QUANTUM INFORMATION PROCESSING WITH NON-CLASSICAL LIGHT a dissertation submitted to the department of electrical engineering and the committee on graduate studies of stanford university in partial fulfillment of the requirements for the degree of doctor of philosophy Edo Waks May 2003
191
Embed
quantum information processing with non-classical light
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
QUANTUM INFORMATION PROCESSING
WITH NON-CLASSICAL LIGHT
a dissertation
submitted to the department of electrical engineering
Quantum mechanics has radically changed our understanding of the physical world
in which we live. The success of this theory in modelling physical reality has been
unparalleled, leaving little doubt about its validity. One of the most profound aspects
of quantum mechanics is that it predicts effects which would not have been expected
by classical theory, and in some sense run counter to our notion of how the world
should behave. Aspects such as quantum uncertainty and non-local statistics have
had profound impact on our conceptual view of the world.
For many years these so-called quantum mechanical effects were regarded as nu-
ances. Although interesting physically, they are only observed under very controlled
physical environments. Recently however, it has been shown that these properties
can be harnessed to perform computationally significant tasks. This observation has
transformed quantum mechanics research from a purely academic endeavor into an
area of promising technological advancement. A new field, known as quantum infor-
mation processing (QIP), has emerged whose focus is on the technological application
of quantum mechanics.
To date, two important application of quantum mechanics have been identified,
quantum cryptography and quantum computation. Quantum cryptography incor-
porates quantum uncertainty, and in some cases non-locality, in order to perform
1
2 CHAPTER 1. INTRODUCTION
unconditionally secure communication. Quantum computation utilizes the proper-
ties of a collection of coupled quantum systems to achieve exponential speedup of
certain computational tasks. Quantum computational algorithms have the potential
to perform fast searches, and factor prime numbers in polynomial time scales. The
search for other applications of quantum technology is currently a very active area of
research.
One of the main obstacles for quantum information processing is the difficulty of
the experimental implementation. Quantum information tasks require unprecedented
isolation and control of complicated systems. Of the two main applications, quantum
cryptography is the easier to implement. This application requires manipulation of
only simple quantum systems. At the time of this work, there are already several im-
plementations of quantum cryptography over long distances [1–3], with commercial
quantum cryptography systems just on the horizon. In contrast, quantum compu-
tation has been an extremely challenging experimental problem. So far, only very
simple quantum computational tasks have been performed [4–6]. A scalable quantum
computer that is capable of solving large problems is beyond reach of the foreseeable
future.
In order to implement a QIP application, one needs a candidate quantum system
which can serve as the building block for more complicated systems. This building
block is typically referred to as the quantum bit, or qubit for short. A good qubit
system should be easily decoupled from its environment in order to exhibit quantum
mechanical effects. At the same time, it is often necessary for the qubit to interact
with other qubits in a controlled way. Quantum cryptography only requires the first
condition, while for quantum computation both conditions must be satisfied. This is
why quantum computation is an inherently more difficult task.
When only isolation is required, the photon is an excellent candidate for a qubit.
Photons exhibit strong quantum mechanical effects, and are very robust to envi-
ronmental noise. For this reason photons are the exclusive information carriers in
quantum cryptography. The main drawback to using photons in QIP is that they do
not readily interact with other photons. This makes it very challenging to implement
1.2. QUANTUM CRYPTOGRAPHY 3
quantum computation. Most proposals for quantum computation with photons re-
quire very high optical non-linearities, orders of magnitude beyond what is currently
attainable. Recently, however, it has been shown that such non-linearities are not re-
quired. Linear optics alone, combined with single photons and detectors, can be used
to implement quantum computation [7]. Although these proposals suffer from other
practical difficulties, such as requiring extremely low losses [8], they have rekindled
interest in the photon based quantum computer.
1.2 Quantum cryptography
This thesis is concerned with photon based quantum information processing. The
emphasis is placed on quantum cryptography. Photon based quantum computation
remains too difficult to address experimentally. Nevertheless, the tools and concepts
developed here may have applications in future quantum computational efforts.
The field of quantum cryptography has been around for nearly twenty years. The
first protocol was proposed by Bennett and Brassard in 1984 [9]. This protocol is
referred to as BB84. Since the discovery of BB84, the field has undergone rapid ad-
vancement. A host of additional protocols have been presented, each with their own
distinct advantages and dis-advantages [10–12]. The security of quantum cryptog-
raphy has been conclusively established for many of these protocols, yet a security
proof for some protocols remains elusive. The investigation of security in quantum
cryptography has transcended beyond the practical importance of secure communi-
cation. This field has solidified our understanding of very fundamental concepts in
quantum measurement and non-locality.
The experimental effort to perform quantum cryptography has also made great
progress. Initial experimental efforts were restricted to proof of principle experiments
over short distances [13]. More recent efforts have achieved distances of tens of kilo-
meters [1–3]. Extensive work is being invested in extending these distances, as well
as performing earth to satellite cryptography.
To date, two main challenges remain in the field of quantum cryptography. The
first is in the area of theoretical security. Although the security of some protocols,
4 CHAPTER 1. INTRODUCTION
such as BB84, have been extensively proven, security proofs for other protocols remain
elusive. In particular, security proofs for entanglement based protocols such as that
of Ekert [14], and that of Bennett, Brassard, and Mermin [15], have been difficult to
formulate. The second difficulty is the engineering of single photon sources. Many
protocols require the generation of a single photon as an information carrier. Yet
experimental implementations to date have relied on highly attenuated lasers or LEDs
for this task. These sources have inherent photon number fluctuations, making it
impossible to generate exactly one photon.
Lasers and LEDs fall into the class of light emitters known as classical sources.
To properly define classical light sources, it is necessary to introduce the coherent P
representation of a light field. Define ρ as the reduced density matrix of a light field
spanning the number state basis. This density matrix can always be expanded in the
coherent state basis in the form
ρ =
∫α
P (α) |α〉 〈α| (1.1)
where α is a complex amplitude and |α〉 is a coherent state defined as
|α〉 = e−|α|2/2
∞∑n=0
α2
√n!|n〉. (1.2)
In the above equation |n〉 is an n photon Fock state. The function P (α) is the distri-
bution function for the emitted field. For many sources, such as lasers and LEDs, this
function is non-negative. It thus satisfies the properties of a valid probability distri-
bution. Any source whose P distribution function is a valid probability distribution is
referred to as a classical source. The reason for this name is that all photon counting
statistics for a classical source do not require quantum mechanical treatment of the
radiation field. Such statistics are perfectly modelled by classical field amplitudes,
and quantized atomic levels for the detectors.
For non-classical sources, the P distribution function becomes negative. Thus,
it no longer can be interpreted as a probability distribution. Non-classical sources
require full quantum treatment of the radiation field. They also lead to experimental
observable effects which are inconsistent with classical electromagnetic theory. Ex-
amples of such effects are photon anti-bunching, negativity of the Wigner function,
1.2. QUANTUM CRYPTOGRAPHY 5
and non-local correlations [16].
Non-classical light sources play an important role in quantum information process-
ing. For quantum computational schemes, these types of sources are required. It is
precisely the quantum mechanical properties of the field which allows the exponential
speedup promised by quantum algorithms [17]. In quantum cryptography, however,
classical sources such as attenuated lasers are often used. Using such sources comes
at the expense of significantly reduced security properties [18].
This work will mainly be concerned with how non-classical sources can improve
the security behavior of a quantum cryptography system. The focus will be on two
important examples of non-classical light, the emission from a single Indium Arsenide
(InAs) quantum dot, and spontaneous parametric down-conversion. The first source
is useful for generating sub-Poisson light, which features improved security properties
for quantum cryptography protocols over classical light sources. The second source
allows generation of photon twins, which in some cases are in an entangled state. Such
states are important for other quantum cryptography protocols based on non-local
statistics.
Chapter 2 will discuss the basics of classical information theory and cryptography.
The concepts developed in this chapter will play an important role in the security
of quantum cryptography. Chapter 3 will introduce the concept of the quantum bit,
and the properties that make it unique and useful. Chapter 4 will deal with the
theoretical security issues of quantum cryptography. First, quantum cryptography
with sub-Poisson light sources will be considered. A quantitative analysis of how
much improvement such sources can provide will be derived. Then, an alternate
protocol for quantum cryptography based on entangled photons will be analyzed. A
proof of security for this protocol will be given, and it will be shown that this protocol
has potential for significantly improved security behavior.
Having established the advantages of sub-Poisson light, Chapter 5 will describe
an experimental demonstration of quantum cryptography using such a light source
based on InAs quantum dots. Comparison with a standard attenuated laser will show
that this source allows communication in a security regime unattainable by a classical
light sources.
6 CHAPTER 1. INTRODUCTION
1.3 Photon number detection
Single photon detection is an important task in virtually all quantum optics ex-
periments. The standard tools for single photon detection are photomultipliers and
avalanche photo-diodes. These detectors absorb a photon and emit a macroscopic cur-
rent which can be discriminated by digital electronics. One of the main limitations
of such detectors is that they cannot distinguish photon number. If two photons
are absorbed by the detector on very short time scales (relative to the electronic
pulse duration), the electronic pulse which is generated will not differ significantly
from that of a single photon absorption. This is due both to detector dead time and
multiplication noise properties.
Recently, a new detector known known as the Visible Light Photon Counter
(VLPC) has been shown to have the ability to distinguish photon number with very
high quantum efficiency [19, 20]. This makes the VLPC a unique tool for quantum
optics experiments. Photon number detection is already known to be important for
many types of experiments. One of the main applications is in linear optics quantum
computation [7]. Many of the basic building blocks for this scheme rely on the ability
to discriminate photon number on very short time scales.
Chapter 6 investigates the ability of the VLPC to do photon number detection.
Limitations imposed by both quantum efficiency and multiplication noise properties
are investigated. Multiplication noise refers to fluctuations in the number of elec-
trons the VLPC emits when detecting a photon. These fluctuations can limit the
photon number state resolution. Fortunately, the VLPC features nearly noise free
multiplication [21], allowing it to do very accurate photon number discrimination.
1.4 Number State Generation
One application of the photon number detection capability of the VLPC is to do
photon number state generation. This is done in conjunction with a non-linear optical
process known as parametric down conversion [22]. Parametric down-conversion is
implemented by pumping a non-linear crystal with a bright ultra-violet pump. Each
1.4. NUMBER STATE GENERATION 7
pump photon has a small probability of splitting into two visible wavelength photons.
The two-photon nature of parametric down-conversion makes it a non-classical
light source. Since photons come two at a time, the photon number distribution
features even-odd oscillations. This causes the P distribution function to become
negative. The non-classicality of this effect is investigated in Chapter 7. A theoreti-
cal threshold for classical light is derived. This inequality is violated by the even-odd
oscillations generated in parametric down-conversion. The VLPC allows one to ex-
perimentally observe this violation. By correcting for the quantum efficiency of the
detector, one can furthermore reconstruct the oscillatory behavior of the photon num-
ber distribution.
Parametric down conversion can be used to perform photon number generation.
Under appropriate conditions, a pump photon can be made to split into two photons
travelling in different directions. Detection of one photon signals that a second photon
exists in the conjugate mode. This applies as well for any higher photon number.
If one can discriminate the number of photons in one arm, then the other arm is
prepared in an appropriate photon number state. To do this, one needs a detector
capable of doing photon number detection, such as the VLPC. Chapter 8 discusses a
demonstration of photon number generation using the VLPC and parametric down
conversion. This scheme allows the preparation of a 1,2,3 and 4 photon number state.
Such number states may find applications in quantum networking and multi-party
quantum cryptography.
Chapter 2
Classical Information and
Communication
2.1 Introduction
The upcoming chapters will often draw upon the basic principles of classical informa-
tion theory. This field, pioneered by Claude Shannon in the 1940s, is predominantly
concerned with the fundamental limitations of communication and compression. In-
formation theory also plays a very important role in cryptography. In fact, much of
Shannon’s original work was intended for the purposes of analyzing the security of
cryptographic protocols [23].
This chapter will present the basics of classical information theory. These concepts
will be important in the upcoming chapters which deal with security of quantum
cryptography. A full treatment of information theory is well beyond the scope of this
work. The reader can refer to [24] for good reference on this vast topic.
2.2 Entropy and Mutual Information
One of the main insights that led to Shannon’s pioneering work is the relationship
between information and entropy. It is this relationship which allows one to treat
information quantitatively. Lets consider an arbitrary random variable X, which can
8
2.2. ENTROPY AND MUTUAL INFORMATION 9
take on one of n different values, denoted as x1 . . . xn, with probabilities p(x1) . . . p(xn)
respectively. The entropy associated with this random variable is defined as
H(X) = −n∑i=1
p(xi) log2 p(xi). (2.1)
Note that the entropy does not depend on the actual value which the random variable
takes, only its probabilities. The choice of base for the log is somewhat arbitrary.
The base defines the units in which information is to be quantified. When using the
natural logarithm, information is quantified in ”knats”. If, instead, one takes the
base 2 logarithm the information is measured in ”bits”. In this work, information
will always be quantified in units of ”bits”. Hence all logarithms will be taken to base
2.
One of the main postulates of information theory is that the entropy, H(X),
quantifies the self information of a random variable. That is, H(X) denotes the
amount of information one gains by learning what value X took. There are many
ways to justify entropy as a measure of the information content of a variable. One of
the main arguments is that entropy has many properties which agree with our intuitive
notion of how information behaves. For example, suppose that X takes on the value
Xi with probability 1. By Equation 2.1, this random variable has zero information
content. This is compatible with what one intuitively expects. Since X always takes
on the same value, no information is learned by actually observing it. In the opposite
limit, if X takes on each one of its values with equal probability, the information
content is log2 n. One can prove that this value maximizes the information content.
One can also define the entropy conditioned on an event. If Y is a second random
variable which can take on the values y1 . . . ym with probabilities p(y1) . . . p(ym), the
conditional entropy H(X|Y = yi) can be calculated by using the conditional probabil-
ity distribution p(xi|yi) in Equation 2.1. The average conditional entropy, H(X|Y ),
is determined by averaging H(X|Y = yi) over all values of Y. That is,
H(X|Y ) = −n,m∑
i=1,j=1
p(xi, yi) log2 p(xi|yu). (2.2)
10 CHAPTER 2. CLASSICAL INFORMATION AND COMMUNICATION
One can also define the joint entropy H(X, Y ) as
H(X, Y ) = −n,m∑
i=1,j=1
p(xi, yi) log2 p(xi, yi). (2.3)
The joint entropy of two random variables satisfy a well known chain rule which can
be easily proven from the definitions. This chain rule is given by
H(X, Y ) = H(X) +H(Y |X). (2.4)
The above equation establishes, first and foremost, that one’s information can only
increase in light of new knowledge. That is, if someone is allowed to observe both
X and Y, the information they learn is at list as much as that of observing just
X. Furthermore, if X and Y are independent, the amount of information gained by
observing the two variables is the sum of the information content of each individual
variable. Again, these properties naturally mesh with our intuitive notion of how
information should behave. Equation 2.4 is one of the main reasons why entropy is
strongly associated with information content.
A final important concept is that of mutual information. Mutual information,
written as I(X;Y ), denotes the amount of information one gains on random variable
X, given that they are allowed to observe Y. Mathematically, one can express this
as
I(X;Y ) = H(X)−H(X|Y ) (2.5)
That is, mutual information is the change in entropy of random variable X from
before one observes Y to after. Note that I(X;X) = H(X), reinforcing our notion
that H(X) represents self information.
Let’s consider a simple example which will play an important role in the upcoming
chapters. Using the definitions of information, one of the simplest communication
scenarios known as the binary symmetric channel will be analyzed. In the binary
symmetric channel the message sender sends N bits, randomly taking on the values
[0, 1], over a noisy channel. The N bit message string will be referred to as X. The
receiver of the message obtains Y, which is a distorted version of the message due to
channel noise. In a binary symmetric channel, noise is characterized by a very simple
2.2. ENTROPY AND MUTUAL INFORMATION 11
0
1 1
0(1-e)
(1-e)
e
e
Figure 2.1: Schematic of binary symmetric channel.
bit flip model shown in Figure 2.1. In this model each bit experiences a bit flip with
probability e, referred to as the bit error rate (BER). It will be assumed that each
bit in the message is independent of the other bits, and that it can take on the value
0 or 1 with equal probability. Although this is a restrictive assumption, it will turn
out to be a valid one for the upcoming analysis of quantum cryptography.
It is easy to show that, under the above conditions, the mutual information is
given by
I(X;Y ) = N [1 + e log2 e+ (1− e) log2(1− e)] . (2.6)
The constant
C = [1 + e log2 e+ (1− e) log2(1− e)] (2.7)
is often referred to as the channel capacity. It defines the maximum communication
rate which one can communicate over the channel without noise. If the communication
rate is below this critical rate, it is possible, at least in principle, to have completely
noise free communication. Once the rate exceeds this threshold by any amount,
noise free communication is not possible. This result, known as the noiseless coding
theorem, is one of the cornerstones of information theory.
It is easiest to understand the noiseless coding theorem in the context of error
correcting codes. Error correcting codes use redundancy to achieve noise free com-
munication over a noisy channel. An N bit message is encoded in a larger R bit string.
Define R = N + M , thus M denotes the number of additional bits of information
12 CHAPTER 2. CLASSICAL INFORMATION AND COMMUNICATION
needed to do error correction. By introducing the proper amount of redundancy into
the message, one can make the overall error rate negligibly small, reproducing the
noiseless communication scenario. The noiseless coding theorem tells us that, in the
limit of large strings,
M
N≥ −e log2 e− (1− e) log2(1− e). (2.8)
If equality holds, the error correction algorithm is working in the Shannon limit.
Note that the noiseless coding theorem is not constructive, it does not explain how
to generate error correction codes at the Shannon limit. It only says that such codes
are in principle possible.
Another way to interpret the noiseless coding theorem is to consider communica-
tion rates, instead of the total message. Let’s consider a communication system which
can send one bit each clock cycle. For a given bit error rate e, the noiseless coding
theorem tells states that, at best, one can use a fraction C of the clock cycles to do
communication, while the remaining (1− C) cycles are needed for error correction.
For practical error correcting codes, it is difficult to approach the Shannon limit.
Although there are known codes which achieve this limit, these codes require the
receiver to perform computationally intractable tasks [25]. The generation of codes
which are both computationally feasible and operate close to the Shannon limit is a
challenging field of research.
2.3 Cryptography
One of the first applications of information theory was in the field of cryptography.
The purpose of cryptography is to transmit a secret message over a channel that
may potentially be wiretapped. The goal is to transmit the message to the intended
receiver, while simultaneously making it difficult for any potential wiretapper to in-
tercept the communication.
In order to discuss security in cryptography, one first has to specify what is meant
by security. There are two general approaches to discussing the security of a cryptog-
raphy system, or cryptosystem for short. These two approaches are computational
2.3. CRYPTOGRAPHY 13
security and unconditional security.
In computational security one is mainly concerned with the computational dif-
ficulty required in breaking the code. One may define a cryptosystem as secure if
the best known algorithm for breaking it requires a very large number of operations.
Often times, this problem is approached from the perspective of complexity theory.
From this point of view a secure cryptosystem requires the wiretapper to perform a
computationally intractable task in order to break the system. An intractable algo-
rithm is one which scales exponentially in execution time as the size of the problem
is increased. The main drawback of computational security is that it is extremely
difficult to prove that a mathematical problem is intractable. One must show that
no algorithm exists, even in principle, which can efficiently find a solution. Such
proofs are nearly impossible to formulate. Often times one considers only the best
currently available algorithms for computational security. If a new algorithm is dis-
covered which can efficiently break the system, all communication over the system,
past or present, is rendered insecure.
In the second approach, no restrictions is placed on the the time or computational
resources of a wiretapper. A cryptosystem is defined as unconditionally secure if there
is no way to break it, even with infinite computational resources. Put simply, the
information available to the wiretapper from the encrypted message is not enough to
reliably reconstruct the original message. It is this type of security which quantum
cryptography is concerned with.
Figure 2.2 shows the basic model for unconditionally secure cryptography. The
sender of the message, referred to as Alice, wants to communicate with the receiver,
Bob, over a public channel that can be potentially wiretapped. To ensure the secrecy
of the communication, Alice will also generate a secret key K, which she uses to
encrypt the message M . This generates the encrypted message R, referred to as the
cryptogram, which is sent over the public channel. Alice must also send a copy of
the secret key to Bob, so that he can properly decrypt the cryptogram. In classical
cryptography this can only be done using a secure channel that cannot be wiretapped.
Let us assume that the message M takes on one of a finite set of P messages
m1, . . . ,mP . In order to account for the encryption, it is easier to treat the key not
14 CHAPTER 2. CLASSICAL INFORMATION AND COMMUNICATION
Message
Generator
Key
Generator
Encrypter
Alice
Decrypter
KK
Public
Channel
Secure
Channel
M RMessage
Receiver
Bob
Figure 2.2: Schematic of system for unconditionally secure cryptography.
as a string of data, but rather as a transformation T which generates the cryptogram
R from the original message. Thus, the key enumerates a set of Q transformations,
T1, . . . , TQ, such that if the i′th key is selected, Alice generates the cryptogram R =
TiM . Perfect secrecy is defined to be the case when
P (M |R) = P (M) (2.9)
That is, observing R does not in any way change the probability that M might take
on any one of its values. Using Bayes’ rule,
P (M |R) =P (R|M)P (M)
P (R)(2.10)
directly leads to the following theorem.
Theorem 1 A necessary and sufficient condition for perfect secrecy is that
P (R|M) = P (R) (2.11)
for all M and E.
One way to interpret the above theorem is that the total probability of all keys which
transform mi into a given encrypted message R must equal the total probability of
all keys which transform mj into that same message, for any i and j.
2.3. CRYPTOGRAPHY 15
First, note that the number of possible cryptograms must be at least equal to
H(M). This is because the cryptogram must be able to encode all of the information
content of M . To do this, it must at the very least have as many possible states as the
information it is encoding. One then note that to have perfect secrecy, there must be
at least one key transforming any M to any value of R. This comes immediately from
the previous theorem. These two results combine to form one of the most important
results in Shannon’s work. In order to have perfect secrecy the length of the key must
be at least as big as H(M), the information content of the message [23].
One algorithm which achieves this limit is known as the Vernam cipher. Consider
the case where the message H(M) = P , the total number of bits in M . This means
that the message is maximally compressed. A random key K is generated which is of
the same length as the message. Define Mi, Ki, and Ri is the i’th bit of the message,
key, and cryptogram respectively. In the Vernam cipher these are related by
Ri = Mi +Ki (Mod 2) (2.12)
In other words, one takes the sum modulo 2, or alternately the bitwise exclusive or
of each bit of the key with each bit of the message to form the cryptogram. It is easy
to prove that the Vernam cipher satisfies the definition of perfect secrecy if the key
is picked randomly [23].
Although the Vernam cipher provides unconditional security in the most efficient
way, it has not attained widespread use to date. This is due mainly to one critical
drawback, the key distribution problem. The previous discussion assumed that Alice
and Bob had a way of exchanging the key securely, for example by trusted courier.
However, the final conclusion showed that, for perfect secrecy, the key must be at
least as long as the actual message. Once the key is used it cannot be recycled, it
must instead be discarded. Recycling will eventually allow Eve to determine the key
through the techniques of code breaking. If the key is learned all the transmissions
are rendered insecure. For this reason the Vernam cipher is sometimes referred to
as one time pad encryption. In the past, the overhead of using trusted courier to
exchange a new key for each transmission proved impractical. For this reason most
cryptosystems settled for computational security instead of unconditional security.
16 CHAPTER 2. CLASSICAL INFORMATION AND COMMUNICATION
Recently, however, the advent of quantum cryptography has given a solution to the
key distribution problem. Quantum cryptography allows the exchange of secret keys
without the use of a trusted courier. Security is instead guaranteed by the laws of
quantum mechanics. Furthermore, quantum cryptography can be performed using
the tools and techniques of the optical telecommunication industry, giving it the
potential to generate keys at high data rates. This development opens up the door
for the use of unconditionally secure communication in practical applications.
Chapter 3
Encoding quantum information
3.1 Introduction
The previous chapter showed that there exist encryption techniques which allow un-
conditional security. This is achieved using a one time pad key to encrypt the message.
After encryption, the cryptogram conveys no information about the message unless
the key is known. This leads to the problem of how Alice and Bob can actually
exchange a secret key without interception.
Using only classical information theory it is impossible to prove that any secret
key exchanged by the two communicating parties is secure. Classical information can
be copied many times over, at least in principle. So if only a classical communication
channel is used, the security of the key must be assumed.
The same is not true when one starts to consider quantum communication. In
quantum communication, information is encoded in quantum bits, which are the
quantum mechanical analog of the classical bit. Quantum bits, or qubits for short,
are two state systems like their classical counterparts. The two states, representing
binary 0 and 1, allow us to encode information in the same way as classical bits. In
fact, exchanging quantum bits allows us to reproduce any classical communication
protocol. But qubits have the additional functionality that they can be put in a
superposition state, and can exhibit quantum mechanical coherence properties. Be-
cause of this, quantum information is a superset of classical information theory. All
17
18 CHAPTER 3. ENCODING QUANTUM INFORMATION
classical information protocols can be implemented with qubits, but there are quan-
tum information protocols which cannot be implemented using classical bits. One
example is quantum cryptography, a method of sharing unconditionally secure secret
keys.
3.2 The qubit
Before beginning a basic discussion of quantum cryptography, it will be useful to
discuss the qubit in more detail. A qubit is a two dimensional quantum system. The
two states of the system are denoted as |0〉 and |1〉. These two orthogonal states form
a complete basis for the Hilbert space of the qubit. This basis is referred to as the
computational basis. All states of the qubit can be expressed in the computational
basis as
|ψqubit〉 = cos θ|0〉+ eiφ sin θ|1〉 (3.1)
The angles θ and φ are two independent degrees of freedom. These angles define
a point on the unit sphere in three dimensional space. Thus one can visualize the
state of the qubit as a vector pointing from the origin to the unit sphere, as shown
in Figure 3.1. This sphere, which we often refer to as the Bloch sphere, is a helpful
tool in understanding the behavior of a qubit.
In order to have a useful qubit, one must be able to perform three fundamental
operations on it. The first is initialization. Initialization means that the qubit is
prepared in a well known state, for example |0〉, with very high probability. This
allows the qubit to be treated as a pure state. There are generally two ways to
initialize a qubit. The first way is by cooling. In many instances, the computational
basis commutes with the Hamiltonian of the system. This means that |0〉 and |1〉 are
energy eigenstates. Typically |0〉 would be represented by the energy ground state of
the system, and |1〉 would be the first excited state. If this is true one can perform
initialization by cooling the system down to its ground state. This can work when
the two states are separated by large energies. If the energy separation is too small,
unreasonably low temperatures will be required to do proper initialization. In cases
were the energy separations are very small, or the computational basis represents
3.2. THE QUBIT 19
01
( )10 1
2+
( )10 1
2-
Figure 3.1: The Bloch sphere.
energy degenerate states, cooling is not an option. Initialization in this case can be
done by measurement and post-selection. That is, one measures the state of each
qubit, and if it is found not to be in the state |0〉 it is discarded. Some techniques
use a combination of cooling and post-selection to achieve initialization [26].
The second required operation is the ability to perform controlled unitary evo-
lution. One must be able to transform the qubit from its initial state to any other
state on the Bloch sphere. This transformation must conserve probability, thus it
must be described by a unitary operators. All unitary operators can be visualized as
rotations, or combinations of rotations on the Bloch sphere. It is convenient in the
discussion of unitary evolution to revert to matrix notation for the state of the qubit.
20 CHAPTER 3. ENCODING QUANTUM INFORMATION
One can associate a matrix notation with the computational basis as follows
|0〉 =
[1
0
]; |1〉 =
[0
1
]. (3.2)
A convenient tool in the discussion of unitary evolution are the three Pauli matrices
σx, σy, and σz. These matrices are defined as
σx =
[0 1
1 0
];σy =
[0 −ii 0
];σx =
[1 0
0 −1
]. (3.3)
Any unitary operation can be expressed by these matrices [27]. Let’s define r as a
unit vector on the Bloch sphere. Define the operator R as
R = e−iθσ·r/2, (3.4)
where
σ · r = rxσx + ryσy + rzσz. (3.5)
R generates a rotation on the Bloch sphere of angle θ around an axis defined by r.
One needs to be able to implement any rotation defined by Eq. 3.4 in order to have
full control of the qubit. It turns out that any rotation operator can be decomposed
as
R = eiασz/2eiβσy/2eiγσz/2 (3.6)
if value for the angles α, β, and γ are chosen correctly [27]. Thus, arbitrary rotations
along the y-axis and z-axis of the Bloch sphere can be combined to generate any
unitary operation. This dramatically reduced the amount of resources needed to
manipulate a qubit.
The final operation that is required on a qubit is the ability to measure it. That is,
one must be able to observe the qubit and determine its current state. The difference
between a qubit and a classical bit become strongly pronounced during measurement.
When a classical bit is observed the result is an unambiguous answer. Either the bit
was 0, or it was 1. In contrast, a quantum bit will not give an unambiguous answer
unless the basis in which it was prepared is known. The behavior of a measurement
system on a quantum state is characterized by several postulates [27]. These postu-
lates are fundamental to the theory of quantum mechanics, and are defined below.
3.2. THE QUBIT 21
Postulate 1 The wavefunction of a quantum particle is represented by a vector in a
normalized hilbert space which is spanned by an orthonormal basis |0〉, |1〉, . . . , |n−1〉,where n is the dimensionality of the hilbert space. Every measurement is represented
by a projection onto a complete orthonormal basis which spans the hilbert space. De-
fine this basis as |P0〉, |P1〉, . . . , |Pn−1〉. The probability of measuring the qubit in the
state |Pi〉 is simply given by | 〈Pi| ψ〉 |2, where |ψ〉 is the wavefuntion of the qubit.
The above postulate states that if the qubit is prepared in one of the states |Pi〉,the measurement result will identify this state with 100% probability . If, however, the
qubit is prepared in a superposition state of the measurement basis, the measurement
result will be ambiguous. A qubit repeatedly prepared in the same state and measured
in the same basis will yield a different measurement result from shot to shot. A second
important postulate of quantum mechanics is known as the projection postulate.
Postulate 2 Projection postulate: Define the wavefunction of a quantum system
before a measurement as |ψ〉. Define the measurement basis as |P0〉, . . . |Pn−1〉. Given
that the system was measured in the state |Pi〉, the wavefunction of the system after
the meaurement is also |Pi〉.
From the projection postulate one ascertains that unless a quantum system is
prepared in one of the eigenstates |Pi〉, the measurement process will destroy the
wavefunction of the system. The above two postulates combine to form one of the
most important aspects of quantum measurement. The wavefunction of a single
quantum system cannot be determined unless the preparation basis is known [28].
If the system is measured in the wrong basis, the first postulate states that one
will obtain an ambiguous answer. Furthermore, due to the projection postulate one
cannot go back and re-measure the state because it has already been destroyed.
The qubit is a two dimensional quantum system, meaning that its Hilbert space
is spanned by two basis states. The computational basis, formed by |0〉 and |1〉,is one basis set. Any other basis can be expressed by linear combinations of the
22 CHAPTER 3. ENCODING QUANTUM INFORMATION
computational basis as
|0θ,φ〉 = cos θ|0〉+ eiφ sin θθ|1〉 (3.7)
|1θ,φ〉 = sin θ|0〉 − eiφ cos θ|1〉 (3.8)
In quantum communication, one has the freedom of choosing any one of these bases to
encode information. However, error free communication can only occur if the sender
and receiver use the same basis to encode and measure the qubit.
3.3 Positive Operator Value Measures (POVMs)
The previous section discussed measurement under the framework of projections in
an orthonormal Hilbert space. It turns out that there is a more general formalism
for quantum measurement, which will prove useful in subsequent discussion. This is
known as the Positive Operator Valued Measure (POVM) formalism [29].
A POVM measurement on an N dimensional Hilbert space has n possible mea-
surement outcomes. Each outcome is associated with an operator on the Hilbert space
of the measured quantum system. Define the operators for the different outcomes as
M1, . . . ,Mn. If a system is in a state |ψ〉, then the probability of the i′th outcome is
Pi = 〈ψ|Mi|ψ〉 (3.9)
The operators must satisfy two properties. First, they must be positive semi-definite,
which means
〈ψ|Mi|ψ〉 ≥ 0 (3.10)
for any |ψ〉. This property ensures that all the calculated probabilities are non-
negative. A necessary and sufficient condition for positive semi-definiteness is that
the operator eigenvalues are all non-negative. The second property of the operators
is that they must satisfy the completeness relationship
n∑k=1
Mi = I. (3.11)
This constraint ensures that all of the probabilities will add up to one.
3.3. POSITIVE OPERATOR VALUE MEASURES (POVMS) 23
Having defined a POVM, it remains to be shown how such a measurement can
be physically implemented. Suppose the measured subsystem occupies the Hilbert
space Ha. A POVM is implemented by augmenting the quantum system with a
second Hilbert space Hb, and making projective measurements on the total space
H = Ha ⊗ Hb. That is, all POVMs are implemented by embedding our quantum
system in a larger Hilbert space and making measurements on the total system. This
result is known as Neumark’s theorem [29]. Thus, POVMs do not represent any new
physic above the projective measurements presented in the previous section. One
can always talk only about projective measurements on a properly defined Hilbert
space. However, the POVM formalism is a useful mathematical tool, which allows us
to generalize the measurement concept to cases were the external environment has
an effect on the system.
The POVM formalism can be extended to describe generalized delayed measure-
ments [30]. Such measurements are performed by using a probe state, contained in
a Hilbert space Hp, to measure the system in the space Hs. Figure 3.3 shows a
schematic of how such measurements are made. Assume that the probe and system
are initially unentangled, such that the initial density matrix is ρs⊗ρp. An interaction
Hamiltonian is then turned on between the two systems for a fixed amount of time.
This interaction will cause a unitary evolution of the collective system, defined by the
unitary operator U. After the interaction, the two systems are in an entangled state.
Measuring the probe will then yield information about the state of the system.
To put this type of measurement into a more general mathematical framework,
lets first write the final density matrix, which is given by
ρf = U†ρs ⊗ ρpU (3.12)
Suppose one is interested in the final state of the system after the measurement. This
can be calculated by tracing out the probe Hilbert space in an orthonormal basis |k〉.The probe density matrix is expressed as
ρp =∑j
ρjj |j〉 〈j| (3.13)
24 CHAPTER 3. ENCODING QUANTUM INFORMATION
Qubit Probe
Interaction
|Yinitialñ = ñ Ä ñ|Y |Yqubit probe
|Y |Yfinal entangledñ = U ñ|Y |Yqubit probeñ Ä ñ=
Figure 3.2: Model for generalized, delayed quantum measurements.
Thus,
ρfs =∑k,j
ρjj〈k|U†|j〉ρs〈j|U|k〉. (3.14)
The complex operator Ak can be defined as
Ak =∑j
√ρjj〈j|U|k〉, (3.15)
and the final density matrix of the system becomes
ρfs =∑k
A†kρsAk (3.16)
The set of operators Ak are referred to as a complete positive map (CP map). They
express the backaction noise on a quantum system from a general measurement. They
also provide a convenient way to express the result of the measurement on the system.
One can verify that the probability of measuring the probe in its k’th state is given
by
Pk = Tr{A†kρsAk
}. (3.17)
Because a trace is invariant under circular permutation, one can define the operator
MK = A†kAk. Thus,
Pk = Tr {ρsMk} . (3.18)
It is easy to verify that the operators Mk satisfy positive semi-definiteness and com-
pleteness. They thus form a valid POVM. In fact, any POVM can be generated by
3.4. THE PHOTONIC QUBIT 25
a generalized measurement. The advantage of using Ak instead of Mk is that this
formalism not only provides the correct probabilities for the measurement results, but
also characterize the backaction noise of the measurement on the quantum system,
given by Eq. 3.16.
Once again, it is important to emphasize that generalized measurements do not
represent new physics above the standard quantum formalism. One could discuss
everything from the perspective of unitary evolution and projective measurements
instead of CP maps. The CP map formalism will serve as a convenient mathematical
tool, which allows the treatment of the most general quantum measurements in a
compact notation.
3.4 The photonic qubit
The previous section focussed on the qubit as a mathematical structure with unique
properties. This section will discuss the practical implementation of qubits in physical
systems.
As mentioned previously, a practical qubit requires a convenient way to perform
initialization, unitary evolution, and measurement. In some applications, another
important property is required, the means to exchange qubits over long distances.
This is especially important in quantum communication and networking.
In applications that require long distance exchange of qubits the photon is the
only practical information carrier. Photons are extremely robust to environmental
noise, and can be transmitted over long distances using free space or optical fibers.
There are many techniques for implementing a qubit using photons. This section will
discuss some of the ways and compare their merits and disadvantages.
Figure 3.3 illustrates one common way for implementing a qubit using a single
photon. This is known as the dual rail method, in which the photon is split into two
different spatially separated modes. Suppose the initial state, denoted |ψ0〉, is a single
photon in mode a. Thus,
|ψ0〉 = a†|v〉, (3.19)
where the state |v〉 is the vaccuum state containing zero photons. After the first
26 CHAPTER 3. ENCODING QUANTUM INFORMATION
F
J
a
b
c
d
e
BSP1t = cos ar = sin a
BSP2t = cos br = sin b
l/2plate
l/4plate
l/2plate
l/4plate
a)
b)
Figure 3.3: Implementation of a dual rail quantum bit. a, spatial mode implementa-tion. b, polarization mode implementation.
3.4. THE PHOTONIC QUBIT 27
beamsplitter and phase delay, the state becomes
|ψqubit〉 = cosαb† + eiθ sinαc†|v〉 (3.20)
Thus, one can encode binary 0 and 1 in the following way
|0〉 = b†|v〉
|1〉 = c†|v〉
Any qubit state can be prepared by properly selecting the splitting ratio and phase
shift. To measure the qubit one inserts a second phase shifter and beamsplitter. It is
easy to verify that, up to an irrelevant global phase shift,
d† = cos βb† + e−iφ sin βc†
e† = sin βb† − e−iφ cos βc†
Measuring a photon in modes d and e corresponds to a projective measurement on the
qubit system. Adjustment of the splitting ratio and phase shift of the measurement
apparatus allows the measurment of the qubit in any desired basis. The measurement
result is indicated by a counting event on the photon counters at each port of the
beamsplitter.
The above implementation is simply a Mach-Zehnder interferometer. A binary 0 is
encoded by a photon in the upper arm, while 1 is a photon in the lower arm. Although
this implementation is conceptually simple, and is often how one visualizes a photonic
qubit, it is impractical for long distance qubit transmission. Long Mach-Zhender
interferometers suffer from many practical difficulties including phase stability and
high sensitivity to polarization distortion. For this reason these types of quantum
channels are rarely implemented. An alternative way for implementing a dual rail
qubit is to use polarization, as shown in Figure 3.3b. This is fundamentally equivalent
to the first method where the two spatial modes are replaced by the two polarization
states of a single spatial mode. Thus, binary information can be encoded as
|0〉 = |H〉
|1〉 = |V 〉
28 CHAPTER 3. ENCODING QUANTUM INFORMATION
Any unitary rotation can be generated on the Bloch sphere by using a half waveplate
and a quarter waveplate, whose optic axes are properly rotated relative to the hor-
izontal reference. Polarization encoding has the advantage of ease of use. It is the
method of choice for most free-space implementations [1,2]. However, it has only lim-
ited utility in fiber based systems. This is because fibers induce a random polarization
transformation on the guided light. This transformation is unitary in principle and
can be corrected for with additional waveplates at the output, but such correction
schemes usually suffer from long term drift which limits their stability.
For long distance fiber applications, neither the spatial dual rail nor polarization
qubit give a practical solution. For such systems there is an alternate implementation
originally proposed by Brendel et. al. [31]. This method utilizes time bin encoding.
Figure 3.4 shows how this is done. A single photon, initially in mode a is sent
into an unbalanced interferometer. Assume that mode a defines a transform limited
wavepacket in both space and time. The unbalanced interferometer has a long arm
and a short arm. The long arm introduces a delay, relative to the short arm, which is
greater than the coherence length of the input photon. The output of the unbalanced
interferometer is thus two pulses separated in time. Assume that this time separation
is sufficiently long so that the two time slots can be treated as orthogonal modes.
Define d1 and d2 as the modes corresponding to time slots t1 and t2 respectively. It
is straightforward to show that, given that a photon was not lost to mode l, the state
after the unbalanced interferometer is given by
|ψqubit〉 = d†1 cosα+ d†
2eiθ sinα|v〉. (3.21)
The angle α is determined by the splitting ratio of the first beamsplitter. The qubit
can be measured by a second unbalanced interferometer. The two time slots will
interfere with each other at time t2 on the second beamsplitter. Given that a photon
was detected at this time slot,
g† = d†1 cos β + d†
2e−iφ sin β
h† = d†1 sin β − d†
2e−iφ cos β
Thus, detection of a photon by one of the counters results in a projective measurement
on the qubit state.
3.5. ENTAGLEMENT 29
F J
a bc d
e
f
h
g
t2t1
t2t1 t3
l 50-50BSP
BSP1t = cos ar = sin a
BSP2t = cos br = sin b
50-50BSP
Figure 3.4: Time slot based qubit for optical fiber applications.
The advantage of time bin encoding is that the two time slots are usually separated
by a very short time, typically on the order of several nanoseconds. Because phase and
polarization drifts occur on slow time scales, each pulse undergoes exactly the same
distortion in the fiber. Since the information is encoded by the relative phase of these
two time slots, this information is undisturbed. The main difficulty in implementing
such a system is that it requires two unbalanced interferometers whose relative phase
shift is stabilized. A second disadvantage is that the scheme is partially inefficient.
Some qubits are lost initially to loss mode l, and in the general case more qubits are
also lost during measurement since they are measured at t1 and t3, not t2. This loss
could be eliminated in principle by using a fast optical switch.
3.5 Entaglement
So far, the emphasis has been on the preparation and transmission of single qubits over
a quantum channel. This section will consider the properties of systems composed
of more than one qubit. The discussion begins by considering a two qubit system.
This seemingly modest extension will bring out some of the most fascinating aspects
30 CHAPTER 3. ENCODING QUANTUM INFORMATION
of quantum mechanics.
The Hilbert space of a two qubit system is described by the product space of
each individual qubit. This product space is spanned by four basis vectors: |0〉|0〉,|0〉|1〉,|1〉|0〉, and |1〉|1〉. These states represent the computational basis of a two qubit
hilbert space. The two qubit system can take on any complex superposition of these
basis states.
Consider the situation where the system takes on the following state
|ψentangled〉 =1√2
(|0〉|0〉+ |1〉|1〉) . (3.22)
The above state cannot be factorized into a product state of the two qubits. Any
quantum state which satisfies this property is referred to as an entangled state. En-
tangled states have the fascinating property that, even if the individual qubits are
separated by great distances, one cannot describe their behaviors independently. The
two qubits must still be treated as single quantum system. This leads to measur-
able effects which run highly counterintuitive to our notion of how a physical system
should behave [32].
On first inspection one might not see anything counterintuitive about Eq. 3.22. It
simply says that both qubits will take on the value 0 with 50% probability, otherwise
they both take on the value 1. An analogy can be made to a system of buckets and
balls. Suppose there are two buckets, each of which can either contain a red ball or
a blue ball. A fair coin is then flipped. If the coin lands heads, a blue ball is placed
in each bucket, otherwise a red ball is placed in the buckets instead. If the buckets
are separated by great distances, there is still a correlation between them. If one
looks inside one of the buckets and sees a blue ball, they instantaneously learn with
certainty that the other bucket also contained a blue ball.
Nevertheless, the state in Eq. 3.22 has strikingly different properties than the
bucket and balls experiment just discussed. These properties only become apparent
when the system is measured in a basis other than the computational basis. Define
the following notation:
|0θ〉 = cos θ|0〉+ sin θ|1〉 (3.23a)
|1θ〉 = sin θ|0〉 − cos θ|1〉. (3.23b)
3.5. ENTAGLEMENT 31
This change of basis is performed by a rotation of 2θ across the horizontal equator of
the Bloch sphere. It is easy to verify that
|ψentangled〉 =1√2
(|0θ〉|0θ〉+ |1θ〉|1θ〉) . (3.24)
The expression in Eq. 3.22 is, in fact, partially misleading because it implies that the
computational basis is the preferred basis for the state. From Eq. 3.24 it becomes
clear that this is not true. There is a perfect correlation between the two qubits
regardless of which value of θ is chosen.
Suppose that two qubits are prepared in an entangled state. One of the qubits
is given to Alice in California, while the other qubit is given to Bob in North Car-
olina. Alice will then pick an angle θ, and measure her qubit in the basis defined by
Eq. 3.23. Eq. 3.24 indicates that if Alice’s qubit is measured in the state |0θ〉, Bob’s
wavefunction instantaneously becomes |0θ〉 as well. This seemingly counterintuitive
action at a distance lies at the heart of entanglement. If two systems are entangled,
then measuring one system will have an instantaneous effect on the wavefunction of
the other system.
One may speculate that the above discussion allows superluminal communication.
Take the following protocol as an example. Alice will encode a binary 0 by measuring
her photon in the computational basis. Doing this will prepare Bob’s qubit in one
of the states |00〉 or |10〉, using the notation from Eq. 3.23. Of course, Alice cannot
control which one of these states is generated. In order to encode binary 1, Alice will
measure her photon in the basis defined by θ = π/2. Thus, Bob’s qubit is prepared in
the |0π/2〉, |1π/2〉, again with equal probability. To decode Alice’s transmission, Bob
simply needs to determine if his qubit is in the state |00〉 or |10〉 for binary 0, and
|0π/2〉 or |1π/2〉 for binary 1.
Unfortunately, the measurement Bob must perform is physically impossible. As
discussed in the previous sections, any measurement Bob performs is described by
a projection onto an orthonormal basis. The state of Bob’s qubit is described by a
Figure 2Figure 4.8: Comparison between BB84 protocol and BBM92 using both ideal andrealistic sources.
82 CHAPTER 4. THEORY OF QUANTUM CRYPTOGRAPHY
BBM92, the source is again placed halfway between Alice and Bob, and the rate is
plotted as a function of the total loss in both arms. The dark counts of the detectors
are set to 5 × 10−8. In the curve for BB84 with a Poisson light source the average
photon number n is a free adjustable parameter. Similarly with parametric down-
conversion, χ is a freely adjustable parameter. In both cases the parameters are
chosen to numerically optimize the communication rate at each distance or channel
loss.
Each curve features a cutoff distance where the communication rate quickly drops
to zero. This cutoff is due to the dark counts, which begin to make a non-negligible
contribution to the signal at some point. However the two curves for BBM92 feature
a much longer cutoff distance than their BB84 counterparts. This is due partially to
the absence of the photon splitting attacks. But even when performing BB84 with
ideal single photon sources, which don’t suffer from photon splitting attacks either,
the cutoff distance for BBM92 is still significantly longer. This is because in BBM92
a dark count alone cannot produce an error. It must be accompanied by a photon or
another dark count, so it is much less likely to contribute to the signal. The difference
in rates between the ideal entangled photon source and the parametric down-converter
can be attributed to the interplay between coefficient A in Eq. 4.93, and coefficient
D in Eq. 4.95. Term A is the probability of a real coincidence, and increases with χ.
Term D on the other hand contributes to false coincidences and increases with χ as
well, but is of higher order. One cannot make A arbitrarily large without getting an
increased contribution from D. This leads to an optimum value for χ which is less
than one.
4.3.6 Entanglement Swapping
This section considers a more complicated scheme based on entanglement swapping.
Figure 4.9 gives a diagram of the proposed configuration. A series of entangled photon
sources, which are assumed to be ideal, are spread out an equal distance apart from
Alice to Bob. The sources are clocked to simultaneously emit a single pair of entangled
photons. Each of the pair is sent to a corresponding Bell State Analyzer, whose
4.3. QUANTUM CRYPTOGRAPHY WITH ENTANGLED PHOTONS 83
B B B B
50/50
H/V H/V
Alice Bob
EPR EPR EPR EPR EPR EPR
Figure 3Figure 4.9: BBM92 implementation with entanglement swapping. Boxes labelled Brepresent bell state analyzers, while EPR represents an entangled photon source.
actions is to perform an entanglement swap. If all the swaps have been successfully
performed, Alice and Bob will share a pair of entangled photons. Experimental
demonstrations of a single entanglement swap can be found in [41]. Entanglement
swapping is a key element for quantum repeaters, which use entanglement purification
protocols to reliably exchange quantum correlated photons between two parties [40].
Here it is shown that even without such protocols, using only linear optical elements,
photon counters, and a clocked source of entangled photons, swapping can enhance
the communication distance.
The key element to the scheme is the Bell Analyzer. Since the implementation is
restricted to passive linear elements and vacuum auxiliary states, one cannot achieve
a complete Bell Measurement. It has recently been shown that Bell Analyzers based
on only these components cannot have better than a 50% efficiency [74]. One scheme
which achieves this maximum is shown on the inset of Figure 4.9. This scheme will
distinguish between the states
|ψ±〉 =1√2(|xy〉 ± |yx〉), (4.96)
84 CHAPTER 4. THEORY OF QUANTUM CRYPTOGRAPHY
but will register an inconclusive result if sent the states
|φ±〉 =1√2(|xx〉 ± |yy〉). (4.97)
The state generated by the entangled photon sources is assumed to be |ψ+〉. Con-
The above expression makes it clear that a Bell measurement on photons 2 and 3
leaves photons 1 and 4 in an entangled state, and the measurement result tells which
one. After N such Bell measurements photon 1 and 2N will be entangled, and the N
Bell measurement results will allow Alice and Bob to know which entangled state they
share. Knowledge of this state allows them to do entangled photon key distribution
and interpret their data correctly. Since the Bell analyzer has an efficiency of only
50%, in the best possible case there will be a price of 2−N in communication rate.
Consider the single swap. Define α to be the detection probability for each photon.
The probability that both photon 2 and 3 reach the Bell analyzer and are successfully
projected is
ptrueswap =1
2α2. (4.99)
If a photon is lost in the fiber or due to detector inefficiency the Bell analyzer may still
indicate that a Bell measurement has been performed due to detector dark counts.
The probability of this happening is
pfalseswap = 6αd+ 12d2. (4.100)
Defining the factor
g =ptrueswap
ptrueswap + pfalseswap
, (4.101)
it is straightforward to show that, given the Bell analyzer registered a successful Bell
measurement, the density matrix of photons 1 and 4 is given by
ρ14 = gρψ± + (1− g)I
4, (4.102)
4.3. QUANTUM CRYPTOGRAPHY WITH ENTANGLED PHOTONS 85
where ρψ± is the pure state |ψ+〉 or |ψ−〉 depending on the measurement result.
For the case of N entanglement swaps the detection probability for each photon
is
α = η10−σL
10(2N+2) , (4.103)
where L is the distance from Alice to Bob. It is again straightforward to show that
after N swaps, the state of photon 1 and 2N is
ρ1,2N = gNρψ± + (1− gN)I
4, (4.104)
and the probability that all N bell measurements registered a successful result is
pBell = (ptrueswap + pfalseswap )N . (4.105)
Thus,
ptrue = pBellgNα2
pfalse = pBell(8αd+ 16d2 + (1− gN)α2).
These can be plugged into Eq. 4.76 and 4.79 to get the final communication rate.
Figure 4.10 compares the BBM92 with an ideal entangled photon source, a one
swap scheme, and a two swap scheme using a fiber optic channel at 1.5µm. The swaps
result in a longer cutoff distance which can lead to longer communication ranges. It
should be noted however that at these distances the natural fiber loss is substantial
and will lead to very slow communication rates. It is unclear whether swapping will
lead to a practical form of quantum key distribution, but a single swap could be useful
for very long distance QKD.
86 CHAPTER 4. THEORY OF QUANTUM CRYPTOGRAPHY
0 100 200 300 400 50010
20
1015
1010
105
100
Distance (km)
Sec
ure
Bits
per
Pul
se
BBM92 1 swap 2 swaps
Figure 4Figure 4.10: Comparison of no swap, one swap, and two swap scheme.
Chapter 5
Quantum cryptography with
sub-Poisson light
The security advantages of sub-Poisson light over attenuated lasers and LEDs have
already been established in the previous chapter. To date, there have been many
experimental implementations of sub-Poisson light sources. Most of these sources are
based on single quantum emitters, such as single molecules or quantum dots [56,60].
When a single emitter is excited by a light pulse whose duration is much shorter
than the radiative lifetime, it can only capture one photon. After the laser pulse it
re-emits this photon which can be collected and used for quantum cryptography. A
second method of generating single photons is to use parametric down-conversion.
This process can create photon pairs propagating in different directions. When a
photon is detected in one arm, the other arm must also contain a photon. This
creates a conditional single photon state. This type of single photon source will be
investigated in chapter 7.
This chapter focusses on generation of sub-Poisson light using InAs quantum dots.
Quantum dots are small confined structures in a semiconductor material which fea-
ture discrete optical resonances. In this sense they behave similarly to single atoms.
Quantum dots achieve superb suppression of g(2), and due to micro-cavity technology,
they can also feature high device efficiencies [57, 75,76].
87
88 CHAPTER 5. QUANTUM CRYPTOGRAPHY WITH SUB-POISSON LIGHT
0.0 0.5
1.0
0.5
0.01.0 mm0.0 0.5
1.0
0.5
0.01.0 mm
Figure 5.1: Atomic force microscope image of uncapped quantum dot sample.
5.1 Sub-Poisson light from InAs quantum dots
A quantum dot is a small spec of lower bandgap semiconductor material embedded in
a higher bandgap semiconductor substrate. In this case, the lower bandgap material
is Indium Arsenide (InAs), which is embedded in a Gallium Arsenide (GaAs) host.
This is done by a process called self assembly. In this process, a thin layer of indium
arsenide (on the order of a few monolayers) is grown on top a of a bulk gallium
arsenide substrate. This thin layer is referred to as the wetting layer. Both the
substrate and the wetting layer are grown by a technique known as Molecular Beam
Epitaxy (MBE). Due to the lattice size mismatch between GaAs and InAs, it becomes
energetically favorable for the InAs to clump into small islands, rather than remain a
smooth layer of material. These islands, which are typically 4-7nm thick and 20-40nm
wide, are called quantum dots (QDs). The size and density of the QDs depends on
many growth parameters such as temperature and material concentrations. Quantum
dot densities can vary from 10µm−2 to 500µm−2.
Figure 5.1 shows an atomic force microscope (AFM) image of a typical quantum
dot sample. The sample is uncapped, meaning that the final layer of GaAs has not
5.1. SUB-POISSON LIGHT FROM INAS QUANTUM DOTS 89
a) b)
QD
Figure 5.2: Scanning electron microscope image of micro-post structure. a, image ofseveral micro pillars. b, close up image of micro-post showing DBR mirror structure.
been grown yet. From the figure it is apparent that there are many quantum dots in
a 1x1µm area. This makes it extremely difficult to isolate a single quantum dot by
optical focussing. To better isolate the dots, the sample is etched into small micro-
post structures, as shown in figure 5.2. The micro-post structures are formed by
laying sapphire dust on the surface of the sample, which is used as an etch mask. The
diameter of the sapphire dust particles ranges from 0.2-2µm in diameter. After the
dust particles are laid out, ion beam etching techniques are used to etch out all of
the material except for the portions which are covered by the sapphire dust particles.
The result are the micro-posts shown in the figure. After this structure is formed one
can search for a post containing a quantum dot.
The emission from a quantum dot embedded in bulk GaAs is difficult to collect
for two primary reasons. The first is that the dot emits a dipole radiation pattern
which emits into a large solid angle of possible directions. The second difficulty is
due to the large mismatch in the index of refraction between air and GaAs. Because
90 CHAPTER 5. QUANTUM CRYPTOGRAPHY WITH SUB-POISSON LIGHT
of this index mismatch, most of the light is lost to total internal reflection off the air
GaAs barrier. Only a 30 degree solid angle of emission succeeds in leaking out the
top and making it to the collection lens.
To overcome this problem, the quantum dots are placed in a high-Q optical cavity.
The two mirrors of the cavity are formed by growing alternating quarter wavelength
stacks of GaAs and AlAs. The cavity spacer layer is a half wavelength thick layer of
GaAs containing quantum dots. Figure 5.2b shows a scanning electron microscope
image of a micro-cavity post. The upper mirror is formed of 12 alternating layers
of GaAs and AlAs, while the lower mirror is formed of 20 alternating layers. The
purpose of the cavity is to redirect the spontaneous emission of the quantum dot
into the cavity mode. If the quantum dot is on resonance with the cavity mode, the
spontaneous emission rate into that made is enhanced over other modes by a factor
proportional to the cavity Q. This is known as the Purcell effect [75]. The figure of
merit for the effectiveness of the cavity in re-directing the spontaneous emission is
known as the Purcell factor, which is the ratio of the lifetime of the cavity quantum
dot normalized by its lifetime in bulk GaAs. The micro-post cavities in this work
have achieved Purcell factors as high as 6, implying 83% coupling efficiency into the
cavity mode [76]. Once the photon couples to the cavity, it leaks out the top in a well
defined transverse mode which is very close to Gaussian. This mode can be efficiently
collected by a large numerical aperture lens and used for quantum cryptography.
To generate single photons, the sample containing the micropost structures with
quantum dots is held at a temperature of 5-10K in a cryostat, as shown in figure 5.3.
A micropost is excited every 13ns by picosecond laser pulses from a mode-locked
Ti-Sapphire laser. The laser is tuned to 905nm, which is resonant with an excited
state of the quantum dot, as shown in Figure 5.5. An electron hole pair is generated
in this excited state, and quickly relaxes to a ground state exciton via non-radiative
decay channels. The ground state exciton then re-emits a photon. A spectrometer
can be used to measure the emission spectrum on the dot. The spectrum is shown
in panel a of Figure 5.4. This spectrum features a sharp resonance for the quantum
dot at 920nm, which is the ground state exciton emission wavelength. The lifetime
of the dot is measured by a streak camera. The streak camera measurement is shown
5.1. SUB-POISSON LIGHT FROM INAS QUANTUM DOTS 91
MonitoringDetector
Start
Stop
TimeIntervalAnalyzer
Delay
HeCryostat
QDTi:Sapphire Laser
SM fiberGrating
SpecSlit
50-50BSP
HBT interferometer
SPCM
SPCM
FlipMirror
Figure 5.3: Experimental setup for characterizing quantum dot photon source.
in panel b of the figure. From this measurement, the lifetime is determined to be
0.174ns.
In order to use the emission from the quantum dot, one needs to be able to
isolate the ground state emission wavelength and separate it from other sources of
background photoluminescence. This wavelength selection is done by a grating spec-
trometer. The emission is first coupled to a single mode fiber which serves as the
input slit to this spectrometer. The light is then reflected off of a grating with effi-
ciency of about 70%, and focussed onto a spectrometer slit. After the spectrometer
slit the light can be sent either to a photon counter, to measure the efficiency of the
dot, or onto a HBT intensity interferometer to measure the autocorrelation.
The results of the efficiency measurement are shown in figure 5.6. This plot shows
the count rate on the monitoring detector as a function of pumping power from the
Ti:Saphire laser. The counting rate initially increases in proportion to the excitation
intensity, but eventually saturates ate 245,000 counts per second. The detector ef-
ficiency at the emission wavelength is 0.3. A time resolved measurement is used to
92 CHAPTER 5. QUANTUM CRYPTOGRAPHY WITH SUB-POISSON LIGHT
0.174ns
a)
b)
Figure 5.4: a, wavelength spectrum of quantum dot. The dot features a narrowemission line at 920nm. b, the lifetime of the dot is measured by a streak camera tobe 0.174ns.
determine that 25% of the emission is background photoluminescence, which has a
long emission time. In order to calculate the device efficiency, the background photo-
luminescence is subtracted and the counts are corrected for the quantum efficiency of
the detector. The corrected count rate is compared to the repetition rate of the excita-
tion laser, which is 76MHz. This gives an average of 0.007 photons per pulse emitted
from the quantum dot. To determine the actual efficiency of the dot, one needs to
correct for losses from fiber coupling, reflection losses from optics, and grating inef-
ficiency. The transmission efficiency from the fiber and subsequent interconnects is
measured to be 0.3. Reflection losses from optics amounts to a transmission efficiency
of 0.7, while the grating has an efficiency of 0.7. This results in an overall transmis-
sion efficiency from the collection lens to the detector of 0.15. After correcting for
this loss it is determined that the output efficiency of the quantum dot is 4.6%.
The second important measurement is the autocorrelation. This is done with
5.1. SUB-POISSON LIGHT FROM INAS QUANTUM DOTS 93
ConductionBand
ValenceBand
n=2
n=2
n=1
n=1
1.04 - 1.45 eV
Figure 5.5: Energy level diagram of quantum dot showing resonant excitation scheme.
0 200 400 600 800 1000 1200
0.00
0.01
0.02
0.03
0.04
0.05
0.06
0.07
Effic
ienc
y
Pump Power (uW)
OperatingPoint
Figure 5.6: Saturation curve for quantum dot.
94 CHAPTER 5. QUANTUM CRYPTOGRAPHY WITH SUB-POISSON LIGHT
-80 -60 -40 -20 0 20 40 60 800
50
100
150
200
1.03 1.041.08
1.18
1.38
1 .92
0.14
1.93
1.37
1.18
1.08 1 .05 1.03
Cou
nts
Time De lay (ns)
Figure 5.7: Autocorrelation measurement for quantum dot single photon source. Thearea of the τ = 0 peak is suppressed to 0.14 of a far off side peak.
an HBT intensity interferometer. The results of the autocorrelation are shown in
Figure 5.7. The correlation features a series of peaks separated by the pulse repetition
rate of the laser. The area of the central τ = 0 peak is proportional to the parameter
g(2), defined in Eq. 4.34. In the low efficiency limit, one can normalize this central peak
by one of the side peaks. However, there is one subtlety that must be considered. As
can be seen from the autocorrelation, the area of the first two side peaks is enhanced
relative to the other peaks. In fact, there is a gradual exponential decay of the side
peaks to a steady state value in the long τ limit. This behavior is indicative of dot
blinking. This means that at times, the dot can oscillate from a bright state, where it
emits photons, to a dark state where it doesn’t emit photons. If a photon is detected
at a certain time, then the dot must be in a bright state at that moment. It is more
likely that for times close to this detection event, the dot will still be in a bright state.
Hence, the probability of detecting a photon a time τ later is enhanced for shorter
times. Because of this blinking effect it is important to normalize the central peak
by a far off side peak, were the blinking effect is averaged out. This results in a g(2)
5.2. QUANTUM CRYPTOGRAPHY WITH A QUANTUM DOT 95
of 0.14, indicating nearly an order of magnitude suppression in multi-photon states
relative to Poisson light.
5.2 Quantum cryptography with a quantum dot
Having characterized the source, it can now be used to exchange a raw quantum key.
The experimental setup for implementing the BB84 protocol is shown in figure 5.8.
The same collection optics and spectrometer are used to isolate the emission resonance
of the quantum dot. An electrooptic modulator is used to prepare the polarization
state of each photon before it enters the channel. A data generator, whose signal
is amplified by a high power amplifier, drives the modulator. The data generator is
synchronized to the Ti-Sapphire laser pulse, and produces a random 4 level signal
corresponding to the four different polarization states in the BB84 protocol. The
quantum channel is a 1m free space propagation. Bob’s detection apparatus is com-
posed of a 50-50 beamsplitter, which partitions each photon randomly to one of two
polarization analyzers. Both Alice and Bob share a common clocking signal from the
data generator. Each of Bob’s detection events is recorded by a time-interval ana-
lyzer (TIA), together with a time stamp of the event relative to the common clock. A
detection is also used to generate a logic pulse (containing no information about the
detection result) which triggers a second TIA in Alice’s apparatus. This TIA records
the polarization state which was prepared, along with a time stamp that can be used
for later comparison with Bob’s data.
To verify that communication is being properly implemented, the data generator
is set to create a random number pattern. A long stream of qubits is then exchanged.
A detection correlation between the state of the data generator and Bob’s detection
events is then performed. The result of this data correlation is shown in Figure 5.9.
When Bob measures in the same basis that Alice sent, the data is well correlated.
However, if Bob measures in an incompatible basis the measurement results are un-
correlated with Alice’s transmission, as expected. The central diagonal of the figure
represents error events, where Alice sent one polarization, and Bob detected the or-
thogonal polarization. These error events are caused by imperfect extinction ratio
96 CHAPTER 5. QUANTUM CRYPTOGRAPHY WITH SUB-POISSON LIGHT
HeCryostat
QD
Ti:Sapphire Laser
SM fiberGrating
SpecSlit
Amp
EOM
Det 2
Det 1
Det 3
Det 4
TIA TIA DataGen
Channel
Var.Atten
Figure 5.8: Experimental setup for implementing BB84 with quantum dot photonsource.
5.2. QUANTUM CRYPTOGRAPHY WITH A QUANTUM DOT 97
Bob
H
Bob
V
Bob
R
Bob
L
Alice
H
Alice
V
Alice
R
Alice
L
0
0.1
0.2
0.3
0.4
0.5
Figure 5.9: Data correlation between Alice and Bob.
of the polarization optics, as well as bias drift in the modulator. From the central
diagonal, the bit error rate is calculated to be 2.5%.
In order to correct the errors in the transmission, the error correction algorithm
described in [25] is implemented. In this algorithm, Alice and Bob’s strings are broken
up into blocks. The parity of each block is compared. In the blocks where the parities
don’t match, a bisective search is performed to find the error and correct it. This
algorithm was able to find all of the errors while operating within 25% of the Shannon
limit.
After error correction, privacy amplification is performed to generate the final
key. The compression function is formed by taking random parity blocks of the
error corrected key. The amount of compression required is given by Eq. 4.43. The
parameters e and κ are experimentally measured. For the measured error rate and
g(2), the key must be compressed by about 60%, yielding a final communication rate
98 CHAPTER 5. QUANTUM CRYPTOGRAPHY WITH SUB-POISSON LIGHT
Figure 5.10: Comparison between attenuated laser and quantum dot single photonsource.
of 25kbits/s. The security parameters s and t are selected to be 250 bits each. This
makes Eve’s mutual information on the final key 10−70.
It is important to compare the performance of our quantum cryptography system
to those based on more conventional sources such as attenuated lasers. To do this, an
attenuated Ti:Sapphire laser is used as a second source of photons for the quantum
cryptography system. The performance of the system using the laser, with measured
g(2) = 1, to the performance using the quantum dot with g(2) = 0.14, can then be
compared. The communication rates with both sources are experimentally measured
as a function of channel loss. The channel loss is adjusted by a variable attenuator
which is inserted into the quantum channel. The results of the comparison are shown
in Figure 5.10. At low loss levels the communication rate of the attenuated laser is
higher because a laser starts out with a macroscopically large number of photons,
which can be attenuated to any desired average. This is in contrast to the quantum
dot which is limited by the device efficiency and losses in subsequent optics. How-
ever, at higher channel losses the laser emits too many multi-photon states causing
a more rapid decrease in communication. At around 16dB the quantum dot begins
5.2. QUANTUM CRYPTOGRAPHY WITH A QUANTUM DOT 99
Alice Key Bob Keyb)
0 50 100 150 200 2500
50
100
150
200
250
300
350
400
Pixe l Va lue
# pi
xels
0 50 100 150 200 2500
500
1000
1500
2000
2500
# pi
xels
P ixe l Value
Original Message Encrypted Message
a)
Figure 5.11: Demonstration of one time pad encryption. The message is a 140x141pixel bitmap of Stanford’s memorial church, approximately 20kilobyte in length. a,a 20kilobyte key is exchanged over the quantum cryptography system and used toencode the message. The encoded message looks like white noise to anyone who doesnot possess the key. Decryption allows perfect recovery of the original message. b,a pixel value histogram of the original and encrypted message. The original messageshows definite structure, while the distribution for the encrypted message appearsflat, reminiscent of white noise.
to outperform an attenuated laser. Above 23dB of loss secure communication is no
longer possible with the laser, while the quantum dot source can withstand channel
losses of about 28dB. This demonstrates the security advantage of this device in the
presence of channel losses.
Finally, it is demonstrated that the system can be used to exchange a real message
by implementing the Vernam cipher described in chapter 2. Figure 5.11 shows how
this is done. A 140x141, 256 color pixel bitmap of Stanford’s Memorial Church serves
as the message. The size of the message is roughly 20 kbytes. The cryptography
system is used to exchange a 20 kilobyte key. Alice uses her copy of the key to
100CHAPTER 5. QUANTUM CRYPTOGRAPHY WITH SUB-POISSON LIGHT
do a bitwise exclusive OR operation with every bit of the message. The resulting
encrypted message looks like white noise to anyone who does not posses a copy of the
key, as shown in the figure. This is further illustrated by the pixel value histograms
shown in panel b of the figure. The pixel value histogram of the message shows
clear structure. The histogram of the encoded message, on the other hand, appears
flat, reminiscent of white noise. Bob decodes the encrypted message by performing
a second bitwise exclusive OR using his copy of the key. This faithfully reproducing
the original message, without any pixel errors.
Chapter 6
The Visible Light Photon Counter
One of the main tools in the upcoming chapters is the Visible Light Photon Counter
(VLPC). The VLPC is a relatively new concept in single photon detection which
features many advantages over more conventional photon counters such as avalanche
photodiodes (APDs) and photomultiplier tubes(PMTs). These advantages include
high quantum efficiency, low pulse height dispersion, and multi-photon counting ca-
pability.
This chapter gives a detailed account of the operation principle and advantages
of the VLPC. Although the VLPC has many advantages, it also has some disadvan-
tages. The main disadvantage is that the VLPC is difficult to use. It requires 6K
operation temperature as well as shielding from room temperature thermal photon.
The cryogenic system for implementing this will be described.
6.1 VLPC operation principle
Figure 6.1 shows the structure of the VLPC detector. Photons are presumed to come
in from the left. The VLPC has two main layers, an intrinsic silicon layer and a
lightly doped arsenic gain layer. The top of the intrinsic silicon layer is covered by
a transparent electrical contact and an anti-reflection coating. The bottom of the
detector is a heavily doped arsenic contact layer, which is used as a second electrical
contact.
101
102 CHAPTER 6. THE VISIBLE LIGHT PHOTON COUNTER
Contact Region and Degenerate Substrate
DriftRegion
GainRegion
IntrinsicRegion
TransparentContact
Anti-reflectionCoating
Visible Photon0.4 mm < l < 1.0 mm
e
e
e h
D+
D+
+V
Contact Region and Degenerate Substrate
DriftRegion
GainRegion
IntrinsicRegion
TransparentContact
Anti-reflectionCoating
Visible Photon0.4 mm < l < 1.0 mm
e
e
e
e
e h
D+
D+
+V
Figure 6.1: Schematic of the structure of the VLPC detector.
A single photon in the visible wavelengths can be absorbed either in the intrinsic
silicon region or in the doped gain region. This absorption event creates a single
electron-hole pair. Due to a small bias voltage (6-7.5V) applied across the device, the
electron is accelerated towards the transparent contact while the hole is accelerated
towards the gain region. The gain region is moderately doped with As impurities,
which are shallow impurities lying only 54meV below the conduction band. Because
the device is cooled to an operation temperature of 6-7K, there is not enough ther-
mal energy to excite donor electrons into the conduction band. These electrons are
effectively frozen out. However, when a hole is accelerated into the conduction band
it easily impact ionizes these impurities, kicking the donor electrons into the conduc-
tion band. These electrons can create subsequent impact ionization events resulting
in avalanche multiplication.
One of the nice properties of the VLPC is that, when an electron is impact ionized
from an As impurity, it leaves behind a hole in the impurity state, rather than in the
valence band as in the case of APDs. The As doping density in the gain region
is carefully selected such that there is partial overlap between the energy states of
adjacent impurities. Thus, a hole trapped in an impurity state can travel through
conduction hopping, a mechanism based on quantum mechanical tunneling. This
conduction hopping mechanism is slow, so the hole never acquires sufficiency kinetic
energy to impact ionize other As sites. The only carrier that can create additional
impact ionization events is the electron kicked into the conduction band. Thus,
6.2. CRYOGENIC SYSTEM FOR OPERATING THE VLPC 103
the VLPC has a natural mechanism for creating single carrier multiplication, which
is known to significantly reduce multiplication noise [77]. The multiplication noise
properties of the VLPC will be discussed in further detail in a later section.
One of the disadvantages of using shallow As impurities for avalanche gain is that
these impurities can easily be excited by room temperature thermal photons. IR
photons with wavelengths of up to 30µm can optically excite an impurity. These
excitations can create extremely high dark count levels. The bi-layer structure of the
VLPC helps to suppress this. A visible photon can be absorbed both in the intrinsic
and doped silicon regions. An IR photon, on the other hand, can only be absorbed
in the doped region, as its energy is smaller than the bandgap of intrinsic silicon.
Thus, the absorption length of IR photons is much smaller than visible photons.
This suppresses the sensitivity of the device to IR photons to about 2%. Despite
this suppression, the background thermal radiation is very bright, requiring orders of
magnitude of additional suppression. In the next section we will discuss how this is
achieved.
6.2 Cryogenic system for operating the VLPC
In order to operate the VLPC, it must be cooled down to cryogenic temperatures
to achieve carrier freezeout of the As impurities. It must also be shielded from the
bright room temperature thermal radiation which it is partially sensitive to. This is
achieved by the cryogenic setup shown in Figure 6.2.
The VLPC is held in a helium bath cryostat. A small helium flow is produced
from the helium bath to the cryostat cold finger by a needle valve. The helium bath is
surrounded by a nitrogen jacket for radiation shielding. This improves the helium hold
time. A thermal shroud, cooled to 77K by direct connection to the nitrogen jacket,
covers the VLPC and low temperature shielding. This shroud is intended to improve
the temperature stability of the detector by reducing the thermal radiation load. A
hole at the front of the shroud allows photons to pass through. The detector itself is
encased in a 6K shield made of copper. The shield is cooled by direct connection to
the cold plate of the cryostat. The front windows of the 6K radiation shield, which
104 CHAPTER 6. THE VISIBLE LIGHT PHOTON COUNTER
AcrylicWindows
RoomTempWindow
77K shield
6K shield
VLPC
Retro-reflector
Room TempVacuum Jacket
Figure 6.2: Schematic of cryogenic setup for VLPC.
are also cooled down to this temperature, are made of acrylic plastic. This material
is highly transparent at optical frequencies, but is almost completely opaque from
2-30µm. The acrylic windows provide the required filtering of room temperature IR
photons for operating the detector. Sufficient extinction of the thermal background
is achieved using 1.5-2 cm of acrylic material. In order to eliminate reflection losses
from the window surfaces, the windows are coated with a broadband anti-reflection
coating at 532nm. Room temperature transmission measurements indicate a 97.5%
transmission efficiency through the acrylic windows.
The surface of the VLPC is anti-reflection coated for 550nm, which is close to
our intended operating wavelength of 532nm. Nevertheless, due to the large index
mismatch between silicon and air, there is still substantial reflection losses on the
order of 10%, even at the correct wavelength. In order to eliminate these reflection
losses, the detector is rotated 45 degrees to the direction of the incoming light. A
spherical refocussing mirror, with reflectance exceeding 99%, is used to redirect any
6.3. QUANTUM EFFICIENCY AND DARK COUNTS OF THE VLPC 105
reflections back onto the detector surface. A photon must reflect twice off of the
surface in order to be lost. This reduces the reflections losses to less than 1%.
The VLPC features high multiplication gains of about 30,000 electrons per photo-
ionization event. Nevertheless, this current must be amplified significantly in order
to achieve sufficiently large signal for subsequent electronics. Two different types
of amplifier configurations have been implemented. The first is a high bandwidth
configuration, consisting of a commercial cryogenic pre-amplifier, with an operating
bandwidth of 30 − 500MHz, followed by additional commercial room temperature
RF amplifiers. Such a configuration creates a 120mV pulse with a 3ns duration
when using 62dB of amplifier gain. This high-bandwidth configuration is used to
characterize the performance of the VLPC. The second amplifier scheme is a charge
integrating configuration. A commercial charge integrating amplifier is used, followed
by a pole-zero canceller and a commercial Ortec amplifier with adjustable gain. The
charge integrating configuration is a low noise technique which allows photon counting
over large time intervals with minimal amplifier input noise. This scheme will be
used in the upcoming chapters describing non-classical statistics and photon number
generation by conditional post-selection.
6.3 Quantum efficiency and dark counts of the VLPC
The quantum efficiency (QE) of the VLPC at 650nm wavelength has been previously
measured to be as high as 88% [19]. The dark counts at this peak QE were 20,000 1/s.
The work shown here uses a different operating wavelength of 532nm, and a different
cryogenic setup. Therefore, another measurements of dark counts and QE at this
wavelength and using the current cryogenic setup is presented.
The setup for measuring the quantum efficiency of the VLPC is shown in Fig-
ure 6.3. A helium neon laser with an output wavelength of 543nm is used as a light
source for the measurement. An intensity stabilizer is used to stabilize the output
of the laser to within about 0.1%. A 50-50 beamsplitter sends part of the laser to
a calibrated PIN diode to measure the power. The power reading from the diode is
accurate to within a 2% calibration error. This power reading is used to calculate the
106 CHAPTER 6. THE VISIBLE LIGHT PHOTON COUNTER
Attenuators250mmlens
VLPC
Amps
Disc/Counter
PINDiode
50-50BSP
Iris
IntensityStabilizer
HeliumNeon Laser543nm
Figure 6.3: Experimental setup to measure quantum efficiency of the VLPC.
photon flux N , in units of photons per second. This is given by the relation
N =λP
hc, (6.1)
where λ is the wavelength of the laser, P is the power measured by the PIN diode, h
is Planke’s constant, and c is the velocity of light in vacuum.
The laser is attenuated by a series of carefully calibrated neutral density (ND)
filters down to a flux of approximately 20,000 cps. The attenuation required for
this is on the order of 10−9. This flux is sufficiently small to ensure linearity of the
VLPC. At count rates exceeding 105 cps, the efficiency of the VLPC will begin to
drop due to dead time effects. The efficiency of the VLPC is measured by recording
the count rates of the detector, which we label Nc, as well as the background Nd. The
backgrounds are measured by blocking out the laser. The counts are compare the
rate calculated from the power reading on the PIN diode and the attenuation from
the ND filters. The measured efficiency η is given by
η =Nc −Nd
αN, (6.2)
where α is the transmission efficiency of the ND filters.
Figure 6.4 shows the measured quantum efficiency of the VLPC as a function
of applied bias voltage across the device. Efficiencies are given for several different
operating temperatures. At 7.4V bias the VLPC attains its highest quantum efficiency
of 85%. As the bias voltage is decreased the quantum efficiency also decreases. The
reason for this is that, at lower bias voltages, electrons created by impact ionization
6.3. QUANTUM EFFICIENCY AND DARK COUNTS OF THE VLPC 107
of the initial hole are less likely to accumulate sufficient kinetic energy in the gain
region to trigger an avalanche. The bias voltage cannot be increased beyond 7.4V.
Beyond this bias the VLPC breaks down, resulting in large current flow through the
device. This breakdown is attributed to direct tunnelling of electrons from impurity
sites into the conduction band.
One will notice that as the temperature is decreased, more bias voltage is required
to achieve the same quantum efficiency. This effect is attributed to a temperature
dependance of the dielectric constant of the device, which results in a change in the
electric field intensity in the gain region of the VLPC. As the temperature is decreased,
the dielectric constant is increasing, requiring higher bias voltage to achieve the same
electric field intensity. This conjecture is supported by the measurements shown in
Figure 6.5. This figure plots the quantum efficiency as a function of dark counts,
instead of bias voltage. Data is shown for the different temperatures. Increased bias
voltage results not only in increased quantum efficiency, but also in increased dark
counts. Increasing the temperature also increases both quantum efficiency and dark
counts. But when the quantum efficiency is plotted as a function of dark counts, as
is done in Figure 6.5, the data for different temperatures all lie along the same curve.
This suggests that the quantum efficiency and dark counts both depend on a single
parameter, the electric field intensity in the gain region. Changing the temperature
and bias voltage effects these two numbers by effecting this parameter. The figure
shows that the maximum quantum efficiency of 85% is achieved at a dark count rate
of roughly 20,000 cps.
In order to infer the efficiency of the VLPC, all other losses in the detection
system must be characterized. The acrylic windows are a big source of loss in the
system. Although at room temperature they were measured to have a transmission
efficiency of 97.5%, the performance of the windows degrades appreciably when they
are cooled to cryogen temperatures. Reflectance measurement of the windows at low
temperature indicate a 7% reflection loss. In addition to this loss, there a reflection
loss of 1% due to the VLPC, despite the retro-reflector. Other effects such as detector
dead time and beam focussing should contribute only negligibly small corrections to
the device efficiency. Thus, the efficiency of the VLPC detector itself is estimated to
108 CHAPTER 6. THE VISIBLE LIGHT PHOTON COUNTER
0.600
0.650
0.700
0.750
0.800
0.850
0.900
6.4 6.6 6.8 7 7.2 7.4
Bias (V)
Qu
an
tum
Eff
icie
nc
y
6.3
6.4
6.5
6.6
6.7
Figure 6.4: Quantum efficiency of VLPC vs. bias voltage for different temperatures.
0.500
0.550
0.600
0.650
0.700
0.750
0.800
0.850
0.900
100 1000 10000 100000
Dark Counts (1/s)
Qu
an
tum
Eff
icie
nc
y
6.3K
6.4K
6.5K
6.6K
6.7K
Figure 6.5: Quantum efficiency of VLPC vs. dark counts for different temperatures.
6.4. NOISE PROPERTIES OF THE VLPC 109
be 93% at 543nm wavelengths.
6.4 Noise properties of the VLPC
When a photon is absorbed in a semi-conductor material, it creates a single electron
hole pair. The current produced by this single pair of carriers is, in almost all cases,
too weak to observe due to thermal noise in subsequent electronic components. Sin-
gle photon counters get around this problem by using an internal gain mechanism to
multiply the initial pair into a much greater number of carriers. Avalanche photodi-
odes achieve this by an avalanche breakdown mechanism in the depletion region of
the diode. Photomultipliers instead rely on successive scattering off of dynodes. The
VLPC achieves this gain by impact ionization of shallow arsenic impurities in silicon.
All of the above gain mechanism have an intrinsic noise process associated with
them. That is, a single ionization event does not produce a deterministic number of
electrons. The number of electrons the device emits fluctuate from pulse to pulse.
This internal noise is referred to as multiplication noise, or gain noise. The amount of
multiplication noise that a device features strongly depends on the avalanche mech-
anism. The noise is typically quantified by a parameter F , called the excess noise
factor (ENF). The ENF is mathematically defined as
F =〈M2〉〈M〉2
, (6.3)
where M is the number of electrons produced by a photo-ionization event, and the
the A2D converter. Because the pulse area is proportional to the number of electrons
in the pulse, the pulse area histogram is proportional to the probability distribution of
the number of electrons emitted by the VLPC. This probability distribution features
a series of peaks. The first peak is a zero photon event, followed by one photon,
two photons, and so on. In the absence of electronic noise and multiplication noise,
these peaks would be perfectly sharp, allowing perfect discrimination of the photon
number. Due to electronic noise however, the peaks become broadened and start
to partially overlap. The broadening of the zero photon peak is due exclusively to
electronic noise. Note that the boxcar integrator adds an arbitrary constant to the
pulse area, which is why the zero photon peak is centered around 450 instead of 0.
The one photon peak is broadened by both electronic noise and multiplication noise.
Thus, it is much broader than the zero photon peak. As the photon number increases,
the width of the pulses also increases due to buildup of multiplication noise. This
eventually causes the smearing out of the probability distribution at around seven
photons.
In order to numerically analyze the results, each peak is fit to a gaussian distri-
bution. Theoretical studies predict that the distribution of the one photon peak is a
bi-sigmoidal distribution, rather than a gaussian [78]. However, when the multiplica-
tion gain is large, as in the case of the VLPC, this distribution is well approximated
by a gaussian. This approximation is used because higher order number states are
sums of several single photon events. A gaussian distribution has the nice property
that a sum of gaussian distributions is also a gaussian distribution. In the limit of
large photon numbers this approximation is expected to improve due to the central
limit theorem.
The most general fit would allow the area, mean, and variance of each peak to
be independently adjustable. This allows too many degrees of freedom, which often
results in the optimization algorithm falling into a local minimum. To help avoid this,
the average of each peak is not independently adjustable. Instead, the averages are
required to be equally spaced, as would be expected from the detection model of the
VLPC. Thus, the average of the i’th peak, denoted xi, is determined by the relation
xi = x0 + i∆− i2α. (6.5)
116 CHAPTER 6. THE VISIBLE LIGHT PHOTON COUNTER
400 600 800 1000 1200 14000
1000
2000
3000
4000
Pulse Area (AU)
Cou
nts
Data pointTotal FitSingle Peak
500 1000 15000
1000
2000
3000
4000
Pulse Area (AU)
Cou
nts
500 1000 15000
1000
2000
3000
4000
Pulse Area (AU)
Cou
nts
500 1000 15000
500
1000
1500
2000
Pulse Area (AU)
Cou
nts
01
2
3
4 5
a)
c)
b)
d)
Student Version of MATLAB
Figure 6.8: Pulse area spectrum from VLPC. The dotted lines represent the fitteddistribution of each photon number peak. The solid line is the total sum of all thepeaks. Diamonds denote measured data points.
The above measurements of variance versus photon number gives a very accurate
measurement of the excess noise factor F of the VLPC [21]. Previous measurements
of F for the VLPC have determined that it is less than 1.03 [21], which is nearly
noise free multiplication. This number was obtained by measuring the variance of
the 1 photon peak, and comparing to the mean. However, it is difficult to separate
the electrical noise contribution from the internal multiplication noise using this tech-
nique. Thus, the measurement ultimately determines only an upper bound of F . By
considering how the variance scales with photon numbers, as was done in Figure 6.10,
the multiplication noise can be accurately differentiated from additive electrical noise.
This determines an exact value for the excess noise factor. From the measurement of
σ2M and 〈M〉, one obtains an excess noise factor of F = 1.015.
Chapter 7
Non-classical statistics from
parametric down-conversion
Parametric down-conversion (PDC) has already been introduced in section 4.3.4. The
process is discussed in more detail in this chapter. First, the non-classical nature of
PDC is theoretically described. Tests of classical theory are discussed which can
be used demonstrate that parametric down-conversion is a non-classical light source.
These tests, which require the photon number detection capability of the VLPC, are
experimentally demonstrated.
7.1 Basics of parametric down-conversion
When a photon propagates inside a material that lacks inversion symmetry, there is
a finite probability that it can spontaneously split into two photons of lower energy.
This is caused by the non-linearity in the dipole moment of the material which, for
most systems, is an extremely weak effect. The process by which this photon splitting
occurs is known as parametric down-conversion.
Parametric down-conversion is often observed when exciting a non-linear crystal
with a bright pump field. A pump photon will spontaneously split into two photons
which, for historical reasons, are referred to as the signal photon and the idler photon.
The energy and momentum of the signal and idler are determined by energy and
122
7.1. BASICS OF PARAMETRIC DOWN-CONVERSION 123
momentum conservation rules. Specifically,
ωp =ωs + ωp (7.1a)
kp =ks + kp (7.1b)
The above equations are referred to as phase matching conditions. In a crystal with
normal dispersion there are generally two ways to satisfy the phase matching con-
ditions. They are known as Type I and Type II phase matching. In Type I, the
polarization of the signal and idler are the same, while in Type II the signal and idler
have orthogonal polarizations.
In most cases the energy and momentum of the signal and idler can be selected
by tuning the optical axis of the non-linear crystal. Spatial and spectral filters are
often employed to select a narrow range of momentums and energies for the down-
converted twins. The operating condition where the signal and idler have the same
energy is referred to as degenerate down-conversion. If they have different energies the
process is referred to as non-degenerate. Similarly, if both signal and idler propagate
in the same direction as the pump, this is referred to as collinear phase matching.
In non-collinear phase matching the signal, idler, and pump all travel in different
directions.
The theory of single mode parametric down-conversion has already been discussed.
The interaction hamiltonian for a two-mode parametric down-converter is
HI = ihχ(2)V ei(ω−ωa−ωb)ta†b† + h.c. (7.2)
where a and b are distinguishable modes for the signal and idler photon respectively.
The amplitude V represents the pump field, which is considered bright enough to
treat classically. The result of this interaction is the number correlated state
|ψ〉 =1
coshχ
∞∑n=0
tanhn χ|n〉a|n〉b. (7.3)
In most cases it is difficult to isolate a single mode for the signal and idler using
spatial and spectral filters. Thus, the actual field is a sum of many modes, each of
which satisfy the phase-matching conditions. In the limit of a large number of modes,
the photon pair distribution approaches a Poisson distribution, instead of the thermal
distribution shown above.
124CHAPTER 7. NON-CLASSICAL STATISTICS FROM PARAMETRIC DOWN-CONVERSION
7.2 Non-classical photon statistics
In parametric down-conversion, the signal and idler photons always come in pairs.
Thus, the total number of photons emitted by this process will always be an even
number over a finite time scale. Such a state is non-classical in the sense that its
photon number distribution cannot be expressed as a mixture of Poisson distributions.
In order to test this experimentally, an inequality must be derived which distinguishes
such a state from all classical states.
The inequality presented here relies only on the photon number distribution.
Therefore it constitutes a very direct and conceptually simple demonstration of non-
classical light statistics. However, the experimental demonstration of this effect is not
trivial. It requires high photon detection efficiency, as well as the ability to discrimi-
nate photon number states. Fortunately, as we have shown, the Visible Light Photon
Counter (VLPC) has the ability to do this.
Consider the output of parametric down-conversion, where the probabilities P1
and P3 are zero. Define Γ as
Γ =P2
P1 + P2 + P3
, (7.4)
For parametric down-conversion, Γ = 1. For a Poisson photon number distribution,
it can be shown that this ratio has a maximum value Γ = 3/(3 + 2√
6) ' 0.379.
The Poisson distribution that saturates this bound has average photon number n =√
6. However, one can show that this optimal value holds not only for a Poisson
distribution, but for any weighted sum of Poisson distributions. Consider a weighted
sum Pn = αPmaxn + (1− α)P ′
n of two Poisson distributions Pmaxn and P ′
n, where Pmaxn
has average photon number n =√
6, and P ′n is any other Poisson distribution. The
ratio Γ for this weighted sum is
Γ =αPmax
2 + (1− α)P ′2
α(Pmax1 + Pmax
2 + Pmax3 ) + (1− α)(P ′
1 + P ′2 + P ′
3). (7.5)
Because Pmaxn maximizes Γ for any single Poisson distribution, the condition
x′
y′<x
y⇒ αx+ (1− α)x′
αy + (1− α)y′<x
y, ∀ α < 1 , (7.6)
7.3. OBSERVATION OF NON-CLASSICAL STATISTICS 125
proves that Γ ≤ 3/(3 + 2√
6). Thus, no sum of Poisson distributions can give rise to
a distribution with Γ > Γclassical
All classical light fields will lead to statistics that can be expressed as weighted
sums of Poisson photon number states. Thus, the classical theory of light predicts
that the inequality
Γ ≤ 3
3 + 3√
6, (7.7)
cannot be violated. In contrast, one expects that light from parametric down-
conversion will lead to a violation of this condition, which can be demonstrated by
simply measuring P1, P2, and P3.
In the presence of imperfect detection efficiency, however, this is not always true.
Consider a parametric down-conversion experiment in which the pump is sufficiently
weak that the probability of generating more than one photon pair is very small. In
this case the ratio in Eq. 7.4 is given by Γ = η/(2 − η), where η is the detection
efficiency. One will not observe a violation of the inequality unless η ≥ 3/(3 +√
6) ≈0.55.
7.3 Observation of non-classical statistics
The experimental setup for observing non-classical statistics from parametric down-
conversion is shown in Figure 7.1. The pump source for the down-conversion process
is the 266nm fourth harmonic of a Q-switched Nd:YAG laser, firing at a 45KHz
repetition rate. The pulses are approximately 30ns in duration. A dispersion prism
is first used to separate the residual second harmonic from the fourth harmonic. The
second harmonic is illuminated onto a high speed photo-diode with a 1ns rise time.
The output of the diode is used as a triggering signal. The fourth harmonic is used
as a pump for the parametric down-conversion. The pump is slightly focussed before
the crystal. The focus is selected so that the beam waste is smallest at the collection
iris in front of the detector. This configuration maximizes the collection efficiency, by
producing a sharp two-photon image at the collection point.
The laser pumps a beta barium borate (BBO) crystal, whose optic axis is set
for Type I collinear degenerate phase-matching. This occurs when the optic axis is
126CHAPTER 7. NON-CLASSICAL STATISTICS FROM PARAMETRIC DOWN-CONVERSION
triggersignal Boxcar integrator
diode
prismNd:YAG4th Harmonic266nm
Atten.PBSl/2plate
2mlensIF
266nm
BBO
VLPC
lens
amplifiers
triggersignal Boxcar integrator
diode
prismNd:YAG4th Harmonic266nm
Atten.PBSl/2plate
2mlensIF
266nm
BBO
VLPC
500mmlens
amplifiers
Figure 7.1: Experimental setup for observation of non-classical counting statisticsfrom parametric down-conversion.
tilted 47.6 degrees from the plane normal to the propagation of the pump. The down-
conversion is separated from the pump by a brewster’s angle dispersion prism. The
down-converted photons are then collected by a 500mm lens and focussed onto the
VLPC detector. The electrical pulse from the VLPC is amplified by a series of room
temperature RF amplifiers. The amplified signal is then integrated by the boxcar
integrator, which is triggered by the signal generated from the photodiode.
Figure 7.2 shows the pulse area histogram when the pump power is set 1µW . At
this weak pump intensity, a single pump pulse will usually generate zero photons,
while a photon pair is generated with a small probability. The probability of gener-
ating more than one photon pair is very small. The figure focusses on the 1,2, and 3
photon detection peaks, which are the important ones for verification of non-classical
statistics. The photon number probability distribution is calculated by fitting each
peak to a gaussian. These areas are normalized by the total area of all the peaks.
The calculated probability distribution is shown in the inset. One can see that the
7.3. OBSERVATION OF NON-CLASSICAL STATISTICS 127
800 1000 1200 1400 1600 1800 2000 22000
1000
2000
3000
4000
5000
6000
7000
Pulse Area (AU)
Co
un
ts
1 2 30
0.05
0.1
Figure 7.2: Pulse area spectrum using 1µW pump power.
probability of 1 and 2 photon detection is nearly equal, but the probability of 3 pho-
ton detection is nearly zero. These probabilities are P1 = 0.0818, P2 = 0.0696, and
P3 = 0.0061, which yields Γ = 0.442, representing a 40 standard deviations violation
of the classical limit. This demonstrates the non-classical nature of parametric down
conversion.
The large 1 photon probability is due to losses from the detector and collection
optics. In the limit of low excitation, the 1 photon and 2 photon probability can be
used to calculate the detection efficiency, given by
η =2P2
P1
1 + 2P2
P1
. (7.8)
From the measurements it is calculated that the detection efficiency is 0.67. Using
the measured VLPC quantum efficiency of 0.85, the photon collection efficiency is
calculated to be 0.79.
Figure 7.3 shows the measured value of Γ as a function of pumping intensity.
The black line represents the classical limit. This limit is violated for a large range
of pumping intensities. At high pumping intensities Γ begins to drop. This is due
to an increase in the two pair creation probability, which, in the presence of losses,
128CHAPTER 7. NON-CLASSICAL STATISTICS FROM PARAMETRIC DOWN-CONVERSION
0.2
0.25
0.3
0.35
0.4
0.45
0.5
0.1 1 10 100
Power (uW)
G
Figure 7.3: Measured value of Γ as a funtion of pump power. The black line representsthe classical limit.
will enhance the 3 photon detection probability. The parameter Γ also drops at low
pumping intensities. This drop is attributed to the dark counts of the VLPC. At low
pumping intensities the relative fraction of detection events originating from dark
counts becomes large. This enhances the 1 photon probability, which reduces the
value of Γ.
7.4 Reconstruction of photon number oscillations
The emitted output of parametric down-conversion features even odd oscillations, due
to the two photon nature of the process. These oscillations result in the non-classical
statistics discussed in the previous section. It would be nice to observe these oscil-
lations directly, using the photon counting capability of the VLPC. Unfortunately,
direct observation of the even-odd oscillations requires extremely high quantum effi-
ciencies.
Figure 7.4 demonstrates the problem. Panel (a) shows a typical distribution from
a multi-mode parametric down-conversion experiment. In such a case the photon
7.4. RECONSTRUCTION OF PHOTON NUMBER OSCILLATIONS 129
0 1 2 3 4 5 6 7 8 9 10 110
0.1
0.2
0.3
0.4
Photon Number
Prob
abilit
y
η = 1
0 1 2 3 4 5 6 7 8 9 10 110
0.1
0.2
0.3
0.4
Photon Number
Prob
abilit
yη = 0.7
a)
b)
Student Version of MATLAB
Figure 7.4: Detected photon number distribution from parametric down conversion.(a) Measured distribution with perfect detection efficiency η. (b) Measured distribu-tion with detection efficiency η = 0.7.
pair distribution is a Poisson distribution, and odd photon number states are com-
pletely absent. Panel (b) shows the detection statistics for the same distribution if
each photon is detected with a probability of 0.7. This is a high detection proba-
bility for down-conversion experiments. One can see that the detection inefficiency
quickly washes out the even-odd oscillation, resulting in a much more uniform looking
distribution.
The requirement of very high quantum efficiency makes direct observation of the
photon number oscillation nearly impossible in practice. However, one can make an
accurate independent measurement of the photon detection efficiency, and correct
for this effect in the photon number distribution. This allows the reconstruction of
the original even-odd oscillations of the field. The detection efficiency of the system
has already been measured in the previous section. This was done by measuring
the photon number distribution at low pumping power, where the probability of
generating two photon pairs is negligibly small. In this regime the detection efficiency
is determined by Eq. 7.8. The detection efficiency was measured to be 0.67.
130CHAPTER 7. NON-CLASSICAL STATISTICS FROM PARAMETRIC DOWN-CONVERSION
The detection efficiency can be corrected for as follows. Define pi as the probability
that the photon field contained i photons, and fi as the probability that i photons
are detected. In the presence of losses, these two distributions are related by
fi =∞∑j=i
(j
i
)ηi (1− η)j−i pi (7.9)
In order to calculate pi from fi, the above transformation must be inverted. Unfor-
tunately, if the expression is kept to all orders in photon number, there is no clear
way to invert the transformation. To get around this problem, one must truncate
the photon number distribution at some photon number n, which is sufficiently large
such that pn+1 ≈ 0 is a good approximation. Two vectors are introduced, p and f ,
which are simply given by
p =
p1
p2
...
pn
; f =
f1
f2
...
fn
. (7.10)
These two vectors are related by a matrix M, whose coefficients are given by Eq. 7.9.
One can calculate p by
p = M−1f . (7.11)
Dark counts and backgrounds can also be corrected for using the same method. In
order to include the dark counts, one must model the dark count probability distri-
bution. An extremely reasonable assumption is that each dark count even occurs
independently of all other dark counts. If this is true, the dark count probability
distribution is a Poisson distribution with average d which can be measured. One ex-
pects that background photons will also be Poisson distributed, so they can be lumped
together with the dark counts in parameter d. In the presence of dark counts, the
initial and final probability distributions are related by
fi =i∑
k=0
e−ddk
k!
∞∑j=i−k
(j
i− k
)ηi−k (1− η)j−i+k pi−k (7.12)
7.4. RECONSTRUCTION OF PHOTON NUMBER OSCILLATIONS 131
0 20 40 60 800
0.1
0.2
0.3
0.4
0.5
Power (uw)
Aver
age
Dar
k C
ount
s
y = 0.01 + 0.0072x
Student Version of MATLAB
Figure 7.5: Backgrounds vs. pump power.
Introducing a maximum photon number n, the above relationship is once again a
linear matrix which relates the actual and measured photon number distribution.
Figure 7.5 shows the average background number per laser pulse as a function of
the pump power. The background rate is measured by rotating the polarization of
the pump so that it is orthogonal to the optic axis of the non-linear crystal. When
this is done, phase matching cannot be satisfied so no parametric down-conversion
is observed. A pulse area distribution is acquired for each pump intensity, which is
used to calculate the photon number distribution per pulse. The average is calculated
from this distribution. The plot shows that the average increases linearly with pump
intensity. This linear increase is caused by background photoluminescence generated
by the BBO crystal when it is illuminated by the high energy UV pump. The intercept
of the line gives us the raw dark count rate.
Figure 7.6 shows the result of the photon number reconstruction. Three different
pumping intensities are shown. For each pump intensity, the left panel shows the pulse
area histogram, and the inset to the panel shows the calculated photon probability
distribution. The right panel shows the reconstructed photon number distribution
132CHAPTER 7. NON-CLASSICAL STATISTICS FROM PARAMETRIC DOWN-CONVERSION
0 1000 2000 30000
2
4x 10
4
Co
un
ts
0 1 2 3 4 5 6 7 8 9 10
0
0.2
0.4
0.6
Pro
ba
bili
ty
0 1000 2000 30000
1
2x 10
4
Co
un
ts
0 1 2 3 4 5 6 7 8 9 10
0
0.2
0.4
0.6
Pro
ba
bili
ty
0 1000 2000 30000
1
2x 10
4
Pulse Area (AU)
Co
un
ts
0 1 2 3 4 5 6 7 8 9 10
0
0.2
0.4
0.6
Photon Number
Pro
ba
bili
ty
Student Version of MATLA
4 Wµ 4 Wµ
6 Wµ 6 Wµ
8 Wµ 8 Wµ
0 1 2 3 4 5 6 7 80
0.2
0.4
0.6
0 1 2 3 4 5 6 7 8 9 100
0.1
0.2
0.3
0.4
0.5
0.6
0 1 2 3 4 5 6 7 8 9 100
0.1
0.2
0.3
0.4
0.5
0.6
a)
b)
c)
Figure 7.6: Reconstructed even-odd photon number oscillations for several pumppowers. (a), 4µW pump. (b) 6µW pump. (c) 8µW pump.
7.4. RECONSTRUCTION OF PHOTON NUMBER OSCILLATIONS 133
using the measured quantum efficiency and backgrounds. The photon number dis-
tribution is truncated at 10 photons. The reconstructed probabilities demonstrate
very clean even-odd oscillations, as one would expect from down-conversion. It is
important to emphasize that there are no fitting parameters in the number recon-
struction. The only two parameters, the quantum efficiency and background rate,
are independently measured. Once they are known there is a one-to-one relationship
between the actual and measured photon number distribution.
At higher photon numbers, it can be seen that the reconstructed distribution
becomes slightly negative. This erroneous effect is caused by truncation error. As
the pumping intensity is increased, the approximation that the photon distribution
can be truncated after 10 photons becomes less accurate. This error manifests itself
in the probabilities becoming slightly negative for the 9 and 7 photon probability.
This error is worst at the largest pumping intensity of 8µW , where the truncation
approximation is least accurate. One could reduce this probability by truncating at a
higher photon number. Unfortunately, because of the limited range of the amplifiers
and A2D converters, it is difficult to measure these higher order photon numbers
in practice. This puts a limit on the pumping power one can use and still get a
good reconstruction. Better numerical algorithms for doing the reconstruction may
improve the result. It is possible that an improved numerical technique over simply
putting a cutoff in the number distribution may overcome some of these practical
difficulties.
Chapter 8
Photon number state generation
In the previous chapter the non-classical nature of parametric down-conversion was
investigated. The two photon nature of the process features counting statistics which
are not consistent with the classical interpretation of electromagnetic theory. This
chapter discusses an application of this special property, the generation of photon
number states.
The use of parametric down-conversion for single photon generation is already a
well known process [18, 48]. This is typically done by setting the non-linear crystal
to degenerate, non-collinear phase-matching. In this condition the signal and idler
have the same energy but propagate in different directions. The non-linear crystal is
pumped by a weak pulsed pump, such that the probability of making more than one
pair in the pulse is extremely low. Under these conditions, if a photon counter detects
a photon in the signal arm, the idler arm must also contain exactly one photon. By
post-selecting only the pulses where a signal photon was detected, one creates a so-
called conditional single photon state. The disadvantage of this scheme is that one
cannot create a single photon on demand. One must wait for the counter on the
signal arm to register a count. But once this happens, a single photon is created in
the other arm with very high probability. For many applications, including quantum
cryptography, this is sufficient. The improvements of using such a single photon
source have already been studied [48].
In applications utilizing this type of single photon source, the pumping intensity
134
135
must be carefully selected. If the pumping intensity is too high, the probability of
generating more than one pair becomes non-negligible. In virtually all experiments
to date, the triggering detector could not distinguish the number of photons in the
pulse with high quantum efficiency. Thus, it cannot distinguish between one and
more than one pair created in a pulse. Both cases will be accepted as valid, creating
undesirable multi-photon states in the idler arm. The only way to suppress these
multi-photon states is to make the pumping intensity very low, and in so doing reduce
the probability of generating more than one pair in a pulse. This comes at a price.
At weak pumping intensities, most pump pulses will fail to generate a single pair of
down-converted photons. One has to wait a long time before the triggering detector
sees a photon, which properly prepares the state of the conjugate arm.
This section considers the advantages of replacing the standard triggering detector,
which cannot distinguish photon number, with a triggering detector that does have
photon number detection capability, such as the VLPC. This capability is very useful
for single photon generation. The VLPC can often distinguish between the case where
one and more than one pair was created in a single pump pulse. It not only rejects the
cases where no pair was created, it can also reject many of the cases when more than
one pair was created. In the presence of perfect detection efficiency, one could set the
average photon pair per pulse to 1, optimizing the probability of generating a single
pair. However, when the detection efficiency is not perfect, the VLPC will sometimes
register a multi-photon event as a single photon event, resulting once again in a finite
multi-photon probability. The first section discusses the theoretical improvements
one can expect under these conditions. The experimental demonstration of single
photon generation using the multi-photon detection capability of the VLPC is then
presented.
A second advantage of using a VLPC is that it allows one to generate higher order
photon number states, which cannot be done with a single avalanche photodiode. By
post-conditioning on the case where the VLPC sees 2,3, or 4 photons in the signal
arm, one can generate 2,3, or 4 photon number states in the other arm. The last
section discusses the implementation of this scheme. A demonstration of efficient
generation of up to a 4 photon number state is presented.
136 CHAPTER 8. PHOTON NUMBER STATE GENERATION
Signal
Idler
TriggerDetector
Pump
NonlinearCrystal
Figure 8.1: Single photon generation with parametric down-converiosn.
8.1 Single photon generation
8.1.1 Theory
Figure 8.1 shows the general setup for single photon generation. A non-linear crystal is
pumped by a pulsed source. The phase matching condition is set such that the signal
and idler photons propagate in different directions. A triggering detector is placed in
the signal arm. When this detector registers a photon count, a single photon state
should be prepared in the idler arm.
Lets consider the effect of two types of triggering detectors, threshold detectors and
photon number detectors. A threshold detector can detect the presence of photons in
a laser pulse, but cannot distinguish between one and more the one photon. Thus, a
threshold detector performs a POVM measurement with two elements, E0 and Eclick.
These two elements are defined by
E0 = |0〉 〈0| (8.1a)
Eclick =∞∑k=1
|k〉 〈k| . (8.1b)
In contrast, a photon number detector has the ability to distinguish the number of
photons in each pulse. The POVM performed by such a detector is given by the
8.1. SINGLE PHOTON GENERATION 137
elements Ei, where
Ei = |i〉 〈i| . (8.2)
To incorporate the effect of detection efficiency, one can place a beamsplitter in front
of the triggering detector, which reflects off a fraction of the photons proportional
to the detection efficiency. The POVMs for the two types of detectors can then be
applied to the field after the beamsplitter.
The statistics of the generated field depends on the statistical distribution of
the down conversion. In parametric down-conversion there are two main regimes
of interest. In the first regime, the pump pulse duration is on the order of the
inverse of the measurement bandwidth, which is typically defined by interference
filters in from of the down-converted arms. This is the single mode regime, where
the Hamiltonian in Eq. 7.3 applies. In such a regime, the photon pair distribution
is thermal. The opposite limit occurs when the pump pulse duration is much longer
than the inverse of the measurement bandwidth. In this regime there are many down-
conversion modes which operate simultaneously. This multi-mode down-conversion
process creates statistics which approach a Poisson distribution. This work considers
only the multi-mode case, which is the appropriate limit for the experiments to be
presented. The single mode case can be derived in a completely analogous way.
Define K as the event that the trigger detector has detected a single photon,
and let M be the event that there is more than one photon in the idler arm. Thus,
P (M |K) and P (1|K) are the probabilities of a multi-photon state and a single photon
state in the idler arm, conditioned on the triggering detector. These probabilities
characterize the quality of the generated states. Another important probability is
P (K), the probability that the triggering detector sees a photon. This gives the
generation efficiency, or the rate at which single photons are prepared.
Consider the case where the triggering detector has the ability to distinguish the
number of photons in each pulse. A logic pulse is produced only of the detector sees
exactly one photon. The detection efficiency of the system for the triggering detector
is denoted as η. The parameter α is defined as the average number of twin photons
generated per pulse. Assuming a Poisson distributed pair generation process, it is
138 CHAPTER 8. PHOTON NUMBER STATE GENERATION
straightforward to show that
Pnum(1|K) =e−α(1−η) (8.3a)
Pnum(M |K) =1− e−α(1−η) (8.3b)
Pnum(K) =αηe−αη (8.3c)
In the limit η → 1, one obtains Pnum(1|K) → 1 and Pnum(M |K) → 0, which is
an ideal single photon state. This occurs regardless of the value of α, which can be
set to 1 to achieve maximum generation efficiency. If the detection efficiency is not
ideal however, there is a tradeoff between the multi-photon probability and generation
efficiency. In the limit of small α, the above expressions simplify to
Pnum(1|K) =1− α(1− η) (8.4a)
Pnum(M |K) =α(1− η) (8.4b)
Pnum(K) =αη (8.4c)
For the scheme being considered, it is desirable to have a figure of merit one can
use to quantify the quality of the generated photon state. It is preferable to use a
figure of merit which does not depend on the pumping intensity, or equivalently on
α, the average number of generated pairs. In chapter 4, the figure of merit used was
g(2). This parameter equals the ratio of the multi-photon probability of the source to
that of a Poisson light source, in the limit of small averages. Unfortunately, if one
adopts the same definition of g(2), conditioned on the triggering detector, then g(2)
will depend on α. In fact, α → 0 implies that g(2) → 0. That is, if the excitation
is extremely small, than whenever the triggering detector sees a photon, there is
exactly one photon in the other arm. Thus, the conventional definition of g(2) is not
an appropriate figure of merit for this experiment.
A better figure of merit is to consider the ratio of the multi-photon probability
for the triggering detector to that of an ideal threshold detector. An ideal thresh-
old detector has a quantum efficiency of 1, but cannot distinguish between one and
more than one photon. This detector represents the idealized limit of an avalanche
photodiode. The only non-ideal behavior which will be considered in the theoretical
8.1. SINGLE PHOTON GENERATION 139
analysis is imperfect quantum efficiency. In a practical system, collected background
photons and detector dark counts may also affect the performance of the single photon
generator. Assuming a detection efficiency η, it is straightforward to show that
Pthresh(1|K) =αe−α
1− e−α(8.5a)
Pthresh(M |K) =1− e−α − αe−α
1− e−α(8.5b)
Pthresh(K) =1− e−α (8.5c)
In the limit of small α the above expressions simplify to
Pthresh(1|K) ≈1− α
2(8.6a)
Pthresh(M |K) ≈α2
(8.6b)
Pthresh(K) ≈α (8.6c)
The figure of merit, denoted G, is then defined as
G = limα→0
Pnum(M |K)
Pthresh(M |K)= 2(1− η) (8.7)
Thus, G is independent of α at low excitation powers. Furthermore, from Eq. 8.3b it
is straightforward to show that
Pnum(M |K) ≤ Gα
2. (8.8)
The above equation has a clear similarity to Eq. 4.36. Knowing G allows us to put
a bound on the multi-photon probability, meaning that it is not only a convenient
figure of merit, it is a also a practically important parameter in exactly the same
way that g(2) was in chapter 4. For quantum cryptography applications, G and α
are sufficient to characterize the security performance of the system in the same way
as g(2) and n were sufficient for sub-Poisson light. From Eq. 8.7 one sees that when
η > 0.5, G drops below 1. In this regime the multi-photon probability is suppressed
to a level that is unattainable without photon number detection.
Using the same definitions above, one can similarly derive the value of G for
a non-ideal threshold detector that has a quantum efficiency η. A straightforward
140 CHAPTER 8. PHOTON NUMBER STATE GENERATION
0 10 20 30 40 5010-15
10-10
10-5
100
Channel Loss (dB)
Bits
Per
Pul
se
G=0G=0.001G = 0.01G =0.1G=1G=1.5
Student Version of MATLAB
Figure 8.2: Communication rate vs. channel loss for different values of G.
calculation shows that, in this case,
Gthresh = 2− η (8.9)
The above expression is always greater than one, achieving its best value in the ideal
limit that η → 1. Thus, all threshold detectors are bounded by G > 1. The only way
to suppress the multi-photon probability using such detectors is to make α small.
Figure 8.2 shows simulations for the communication rate of the BB84 protocol
with G taking on a range of values. For each curve, α is numerically optimized at
each value of the channel loss. One can see that all of the curves achieve a maximum
channel loss of approximately 55dB, independent of G. This is expected, since in the
limit of small α a single photon state is generated when the triggering detector sees a
photon, regardless of whether the detector can do photon number detection. However,
when G ∼ 1 the communication rate near the cutoff is unacceptably low, achieving
rates of only 10−12 bits per pulse at best. Using a conventional Ti:Sapphire laser with
76MHz repetition rate, the communication rate is roughly 1 bit every four hours. In
8.1. SINGLE PHOTON GENERATION 141
AND start
stop
APD
APD
VLPC
IntegratingAmplifier
BBO
2m lens
IF 266nm l/2 PBS l/2
Nd:YAG266nm
Prism
Diode
2.5msDelay
Multi-ChannelScalar
irisiris
irisiris
500mmlens
Signal
Idler
SCA
Figure 8.3: Experimental setup for generation of single photons.
the opposite extreme, when G = 0 the communication rate at the cutoff is roughly
10−5, a seven order of magnitude improvement. But such improvements can only be
observed if the efficiency is extremely close to one. Even the curve for G = 0.001,
corresponding to an efficiency of 0.9995, shows appreciably degraded performance near
the cutoff. Still, the value of G = 0.1 achieves two orders of magnitude improvement
in communication rate over a threshold detector.
8.1.2 Experiment
Figure 8.3 shows the experimental setup for generation of single photons. A Q-
switched Nd:YAG laser is converted to its fourth harmonic at 266nm. The fourth
harmonic is used to pump a BBO crystal, whose optic axis is tilted for non-collinear
degenerate phase matching (∼47.6 degrees). The parametric down conversion is emit-
ted at an angle of 1 degree from the pump. The pump is loosely focussed to achieve
a minimum waist at the second collection iris. This results in a sharper two-photon
image which enhances the collection efficiency. The signal photon is focussed onto
the VLPC. The output of the VLPC is amplified by a charge integrating amplifier.
This amplifier emits a voltage pulse whose height is proportional to the number of
142 CHAPTER 8. PHOTON NUMBER STATE GENERATION
0
200
400
600
800
1000
1200
1400
0 500 1000 1500 2000 2500 3000
pulse height (mV)
co
un
ts
SCA Window
Figure 8.4: Pulse height spectrum emitted from charge sensitive amplifier.
electrons emitted during a laser pulse. A pulse height histogram of the output of
the charge sensitive amplifier is shown in Figure 8.4. This spectrum features a series
of peaks for the one photon, two photon, and three photon events. A single channel
analyzer (SCA) is used to select pulses whose height is consistent with a single photon
event. Every time such a pulse occurs the SCA outputs a TTL pulse, which signifies
a valid trigger detection.
The important parameter one would like to measure is G. In the theoretical
analysis, only imperfect detection efficiency was considered. In this approximation
G depends only η, so a measurement of quantum efficiency can be used to directly
calculate it. In a practical system, however, collected backgrounds and dark counts
can also effect G. Furthermore, internal multiplication noise can cause photon number
detection errors even in the presence of perfect quantum efficiency, as discussed in
the previous chapter. A model which incorporates all of these non-idealities is very
complicated. It is better if one can directly measure G. This is done by inserting
a 50-50 beamsplitter in the idler arm, and using two APDs to detect the photons.
The APDs used in the experiment are conventional SPCM detectors with quantum
efficiencies of about 60% at the operating wavelength. A multi-channel scalar is used
to perform time-resolved coincidence detection between the two counters. This setup
8.1. SINGLE PHOTON GENERATION 143
0 20 40 60 80 100 120 1400
500
1000
1500
2000
2500
Time (µ s)
Cou
nts
0.42
Student Version of MATLAB
Figure 8.5: Pulse height spectrum emitted from charge sensitive amplifier.
strongly resembles the HBT intensity interferometer used in Chapter 4. There is
one critical difference, however. The start signal of the multi-channel scalar is only
accepted if the VLPC saw exactly one photon. This is accomplished by performing
a logical AND operation between the output of the SCA and the output of the start
detector. The AND gate will only put out a pulse if both the start detector and SCA
create a simultaneous pulse.
Figure 8.5 shows a time resolved coincidence spectrum taken with the setup. As
with a standard HBT correlation, the spectrum features a series of peaks separated
by the pulse repetition rate of the laser. The τ = 0 peak shows a clear suppression
relative to the other side peaks. If the VLPC was a perfect number detector, this
central peak would be suppressed to 0. But due to detection efficiency and other
non-idealities, the central peak is suppressed by a factor 0.42 relative to the side
peaks. In the limit that α� 1, the ratio of the central peak to one of the side peaks
gives the parameter G. This can be shown as follows. In the limit of small α we
can assume that only zero, one, or two photon pairs are created. Higher order pair
number states occur with negligibly small probability. The τ = 0 peak is proportional
to the probability that two pairs were created in the same pulse, given that the VLPC
144 CHAPTER 8. PHOTON NUMBER STATE GENERATION
saw one photon. The side peaks are proportional to the probability that there was
one pair created at time 0, and a second pair created at time τ , given the VLPC saw
a photon at time zero. Thus
A0
Aτ=
P (2|K)/2
α/4 +O(α2)=
2P (2|K)
α+O(α2). (8.10)
If α is sufficiently small such that P (2|K) = P (M |K) and one can keep the expression
to first order in α, the above expression is equal to G. The measurement in Figure 8.5
indicates G = 0.42. This implies a quantum efficiency of 0.79.
To verify that the measured suppression is really caused by the number detection
capability of the VLPC, one can sweep the upper level of the SCA to incorporate
more higher order photon number states. In this way, the VLPC is continuously
transformed from a detector that can distinguish between one and more than one
photon to a threshold detection. Figure 8.6 shows a series of correlations taken for
different upper level thresholds of the SCA. As the upper threshold is increased, the
central peak changes from being suppressed to being slightly enhanced. The slight
enhancement is due mainly to the quantum efficiency of the VLPC.
One can also examine the predicted relationship between efficiency and G. The
efficiency of the VLPC can be adjusted by reducing the bias voltage. Figure 8.7 shows
correlations for several bias voltages of the VLPC. As the bias voltage is reduced, the
central peak moves from being suppressed to being enhanced by a factor very close
to 2, as predicted by the theory. In Figure 8.8, the measured value of G is plotted
as a function of quantum efficiency. The line represents the theoretically predicted
value. The measured G follows closely to the theoretical model. However, there is a
slight non-linear feature to the data. This may be caused by changes in dark counts
for different bias voltages, or by drift in the alignment of the system which may alter
the quantum efficiency.
8.2 Multi-photon generation
The previous section discussed how photon number detection is useful for generating
single photons using parametric down-conversion. One nice aspect of this scheme is
8.2. MULTI-PHOTON GENERATION 145
-40 -20 0 20 40 60 80 100 1200
0.5
1
1.5
2
Upper level - 480mV
G
-40 -20 0 20 40 60 80 100 1200
0.5
1
1.5
2
Upper level - 840 mV
G
-40 -20 0 20 40 60 80 100 1200
0.5
1
1.5
2
Upper level - 1320mV
G
-40 -20 0 20 40 60 80 100 1200
0.5
1
1.5
2
Upper level - 1680mV
G
-40 -20 0 20 40 60 80 100 1200
0.5
1
1.5
2
Upper level - 10,000mV
τ (ns)
G
0.44
0.49
0.65
1.01
1.23
Student Version of MATLABFigure 8.6: Correlation measurements for different upper thresholds of the SCA.
146 CHAPTER 8. PHOTON NUMBER STATE GENERATION
-20 0 20 40 60 80 100 120 140 1600
0.5
1
1.5
2
2.5
Bias - 7.3V
G
-20 0 20 40 60 80 100 120 140 1600
0.5
1
1.5
2
2.5
Bias - 6.7V
G
-20 0 20 40 60 80 100 120 140 1600
0.5
1
1.5
2
2.5
Bias - 6.5V
G
-20 0 20 40 60 80 100 120 140 1600
0.5
1
1.5
2
2.5Bias - 6.2V
G
-20 0 20 40 60 80 100 120 140 1600
0.5
1
1.5
2
2.5
Bias - 5.8V
τ (ns)
G
0.53
0.64
0.82
1.66
2.04
Student Version of MATLABFigure 8.7: Correlation measurements for different bias voltages of the VLPC.
8.2. MULTI-PHOTON GENERATION 147
0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.90.2
0.4
0.6
0.8
1
1.2
1.4
1.6
1.8
2
2.2
Quantum Efficiency
G
Student Version of MATLAB
Figure 8.8: Measured value of G as a function of quantum efficiency of the VLPC.
that it can be extended in a straightforward way to generate higher order photon
number states. The principle of operation is exactly the same. If the VLPC saw N
photons in the signal arm, there should also be N photons in the idler arm. Post
selecting these cases allows for the generation of conditional photon number states.
For single photon generation, a modified HBT interferometer was used to verify
the nature of the emission. Unfortunately, for higher order number states this setup is
insufficient. The HBT interferometer does not give enough information to verify that
a 2-photon or 3-photon state was generated. In order to verify higher order number
states, it is better to use a detector that can directly measure the photon number
distribution. Therefore, the HBT setup is replaced with a second VLPC, which now
serves as a monitoring detector to verify that the appropriate number of photons was
created.
The experimental setup for higher order photon number generation is shown in
Figure 8.9. The setup on the signal arm remains unchanged. The signal photons are
collected by a 500mm focal length lens, and focussed onto VLPC 1. The output of
VLPC 1 is integrated by a charge sensitive amplifier. The output is once again sent
to a single channel analyzer which creates the post-selection signal. Figure 8.10 shows
148 CHAPTER 8. PHOTON NUMBER STATE GENERATION
VLPC 1
IntegratingAmplifier
BBO
2m lens
IF 266nm l/2 PBS l/2
Nd:YAG266nm
Prism
Diode
2.5msDelay
irisiris
irisiris
500mmlens
Signal
Idler
SCA
500mmlens
BoxcarIntegrator
trigger
signal
VLPC 2
Figure 8.9: Experimental setup for generating N photon number state.
a pulse height spectrum created by the charge sensitive amplifier. The gray regions
illustrate post-selection widows of the SCA for 1,2,3, and 4-photon generation. The
output of the SCA is used to trigger a boxcar integrator. The trigger pulse of the
SCA is combined with the triggering pulse from the photodiode via an AND gate.
In this way only trigger pulses which fall during a laser pulse are allowed to start
the boxcar integrator. This technique allows us to reject trigger events due to dark
counts and collected background light.
In the signal arm, the HBT setup is replaced by VLPC 2. The output of this
VLPC is amplified by a second charge sensitive amplifier, and sent to the signal
channel of the boxcar integrator. Figure 8.11 shows a sample pulse area spectrum
when no post-selection is done. The spectrum was taken at 15µW pumping power.
The inset to the figure shows the calculated photon number probability distribution,
which is effectively a Poisson distribution.
Figure 8.12 shows what happens when the post selection signal is incorporated.
The figure shows pulse area histograms for VLPC 2, when VLPC 1 post-selects the
1, 2, 3, and 4 photon detection events. The pulse area histogram is used to calculate
the photon number distribution, which is then corrected for the quantum efficiency
and dark counts of VLPC 2. The photon number distribution after the correction
8.2. MULTI-PHOTON GENERATION 149
0
500
1000
1500
2000
2500
0 1000 2000 3000 4000 5000
Pulse Height (mV)
Co
un
ts
1 2 3 4
Figure 8.10: Pulse height histogram for VLPC 1.
600 800 1000 1200 1400 1600 1800 2000 2200 24000
500
1000
1500
2000
2500
3000
Pulse Area (AU)
Cou
nts
Student Version of MATLAB
0 1 2 3 40
0.2
0.4
0.6
0.8
1
Figure 8.11: Pulse area histogram of VLPC 2 without postselection from VLPC 1.
150 CHAPTER 8. PHOTON NUMBER STATE GENERATION
is shown in Figure 8.12. For 1, 2, and 3 photon generation the state generated is
nearly an ideal photon number state. For 4 photon generation, however, there is
contribution from the 3 and 5 photon number states. This contribution is attributed
to the smearing between the four photon peak and its nearest neighbors in the pulse
height spectrum of VLPC 1. This smearing is caused by buildup of the multiplication
noise, which puts a limit on the photon number resolution.
The rate at which one can generate a photon number state is an important figure
of merit for this experiment. If the VLPC were an ideal number state detector with
perfect efficiency, the optimal strategy would be to make the average pairs gener-
ated per pulse equal to the desired photon number state. This would maximize the
probability that the down conversion process generates the correct photon number.
However, in the presence of imperfect efficiency this may not be the best strategy. A
large average photon number will lead to many higher order number states. Imperfect
detection efficiency will result in mistakes, in which a higher order number state was
misinterpreted as the correct photon number. This unavoidably degrades the quality
of the generated state. These mistakes can be suppressed by reducing the average
such that the probability of higher order number states is small. Thus, there is a
natural tradeoff between the quality of the number state and the rate at which it is
generated.
Figure 8.13 illustrates this tradeoff for the three photon case. The figure shows
the photon number distribution for four different pumping powers. At 5µW pump
the state generated is nearly ideal. As the pumping power is increased, one starts
to observe an increased contribution from 4 and 5 photon number states. When
attempting to generate n photons, one can use Pn, the probability that n photons
were generated given the VLPC triggered, as a figure of merit for the quality of the
state. In the ideal case, Pn = 1, which is a perfect number state. When higher order
number states start to contribute Pn will drop, as seen in Figure 8.13. Figure 8.14
plots the Pn as a function of pump power for 2,3, and 4 photon generation. Also
plotted is the probability that the VLPC will trigger a correct detection on a laser
pulse, which is the normalized generation rate of the number states. For all three
cases, increasing the pump power results in higher generation rates and decreased
8.2. MULTI-PHOTON GENERATION 151
500 1000 1500 20000
1000
2000
3000
Cou
nts
1 Photon
0 1 2 3 4 5
0
0.5
1
Prob
abilit
y
1 Photon
1000 1500 20000
1000
2000
3000
Cou
nts
2 Photons
0 1 2 3 4 5
0
0.5
1
Prob
abilit
y
2 Photons
1000 1500 20000
200
400
600
Cou
nts
3 Photons
0 1 2 3 4 5
0
0.5
1
Prob
abilit
y
3 Photons
1000 1500 2000 25000
500
1000
Pulse Area (AU)
Cou
nts
4 Photons
0 1 2 3 4 5
0
0.5
1
Photon Number
Prob
abilit
y
4 Photons
Student Version of MATLABFigure 8.12: Pulse area histogram and reconstructed photon number probabilities forVLPC 2, conditioned on photon number detection from VLPC 1.
152 CHAPTER 8. PHOTON NUMBER STATE GENERATION
1000 1500 20000
200
400
600
Cou
nts
5 µW
0 1 2 3 4 5
0
0.5
1
Prob
abilit
y
5 µW
1000 1500 20000
500
1000
Cou
nts
10 µW
0 1 2 3 4 5
0
0.5
1Pr
obab
ility
10 µW
1000 1500 20000
1000
2000
3000
Cou
nts
20 µW
0 1 2 3 4 5
0
0.5
1
Prob
abilit
y
20 µW
1000 1500 20000
500
1000
1500
Pulse Area (AU)
Cou
nts
40 µW
0 1 2 3 4 5
0
0.5
1
Photon Number
Prob
abilit
y
40 µW
Student Version of MATLABFigure 8.13: Pulse area histogram of VLPC 2 for the case of 3 photon generation asa function of pump power.
8.2. MULTI-PHOTON GENERATION 153
state quality.
154 CHAPTER 8. PHOTON NUMBER STATE GENERATION
0 10 20 30 40 500.4
0.6
0.8
1
P 2
0 10 20 30 40 500
0.152 Photons
Effic
ienc
y
0 10 20 30 40 500.4
0.6
0.8
1
P 3
0 10 20 30 40 500
0.13 Photons
Effic
ienc
y
10 20 30 40 500.2
0.4
0.6
P 4
10 20 30 40 500
0.024 Photons
Power (µ W)
Effic
ienc
y
Student Version of MATLAB
Figure 8.14: Generation efficiency and number state quality as a function of pumppower for 2,3, and 4 photon number generation. Data denoted by squares correspondsto Pn, the probability the correct photon number was generated. Data denoted bydiamonds shows the probability that the VLPC observes the correct photon numberon a given laser pulse. The squares reference the left y axis, while the diamondsreference the right y axis.
Chapter 9
Conclusion
Below I present a list of the main results presented in this work.
1. The security properties of sub-Poisson light sources was investigated. The max-
imum channel loss was determined to be a function of g(2), provided the device
efficiency exceeded a critical value.
2. A proof of security for an entangled photon protocol known as BBM92 was
derived. This is the first proof of security for an entangled photon protocol that
can be applied to realistic systems.
3. A numerical comparison was made between BB84 and BBM92. BBM92 was
shown to have significantly enhanced security properties, potentially allowing
secure communication over 170km distances.
4. An experimental demonstration of quantum cryptography using a single photon
source was presented. This source allowed a 5dB increase in the maximum
channel loss, compared to a Poisson light source such as an attenuated laser.
5. The raw quantum efficiency of the Visible Light Photon Counter (VLPC) was
measured at 543nm wavelength to be 85%. The intrinsic quantum efficiency
was determined to be 93%.
155
156 CHAPTER 9. CONCLUSION
6. The photon number detection capability of the VLPC was investigated. The
effect of multiplication noise on the accuracy of the number detection was mea-
sured.
7. A test for non-classical light statistics was derived using only the photon number
distribution of a field. The output of parametric down-conversion is expected
to demonstrate violations of classical statistics using this test.
8. Using the photon number detection capability of the VLPC, violations of clas-
sical statistics were demonstrated using the proposed test.
9. The predicted oscillation in the photon number distribution of parametric down-
conversion was reconstructed using the number state detection capability of the
VLPC.
10. Single photon generation using the VLPC and parametric down-conversion was
demonstrated. A 58% suppresion in the multi-photon probability over an ideal
threshold detector was shown.
11. Generation of 2,3, and 4 photon number states was demonstrated. This is the
first demonstration of reliable generation of such higher order number states.
In conclusion to this work, I speculate on the potential applications of the above
results.
The most immediate application for much of the work described above is in the
area of long distance quantum cryptography. One of the most important goals in the
area of free space quantum cryptography is the implementation of earth to satellite
communication. It is predicted that a system should be able to withstand 40dB of
channel loss in order to implement satellite keying [13]. However, current systems
based on Poisson light sources can only withstand 23dB of channel losses. The single
photon source demonstrated in this work has extended this limit to 28dB of losses.
More recent sources based on better micro-cavity samples have demonstrated g(2) =
0.01 and higher device efficiencies. These devices are predicted to be able to withstand
the 40dB channel loss required for earth to satellite communication.
157
This work has also elucidated the great potential of entangled photon protocols.
Fiber systems based on entangled protocols could potentially achieve unprecedented
ranges of 170km, using currently available technology. Free space entangled photon
protocols are also very promising. Such protocols could withstand channel losses
exceeding 50dB in each arm. This satisfies the requirements for satellite based key
distribution systems. A satellite with an entangled photon source could provide en-
tangled photons to two communicating parties on the ground, in order to perform
BBM92. This could allow extremely long distance point to point secure communica-
tion.
The combination of single photon sources and the VLPC would represent a first
step towards quantum computation based on linear optics. The requirements for
scalable quantum computation are extremely demanding. Nevertheless, currently
available technology may be useful in implementation of novel tasks in quantum
networking. Of particular interest is the area of quantum networking, where only
limited quantum computational power is required. The VLPC, combined with a
good single photon source, may provide the tools needed to implement a quantum
repeater, an important building block for quantum networks.
Single photon generation using the VLPC and parametric down-conversion also
has important applications in quantum networking. By selecting an appropriate pump
frequency and phase matching condition, one can generate a visible wavelength sig-
nal photon for the VLPC, and a 1.5µm telecommunication wavelength idler photon.
This would be a convenient source of telecommunication wavelength single photons.
Such sources are extremely difficult to implement using quantum dot technology, due
material processing problems.
Applications of number state generation, presented in Chapter 8, remains more
of an open question. An important first step to improving this setup is to introduce
femtosecond pump pulses and wavelength filters. This would allow the generation of
n photons in a single mode, also known as a Fock state. Such states are useful in
defeating the standard quantum limit of interferometry. Other applications of such
states remain an interesting research direction.
Appendix A
Handling side information from
error correction
In this appendix we show how to bound Eve’s expected information IE(K;GUZ) by
the average collision probability
〈pc(x|z)〉z =∑z
p(z)Pc(X|Z = z), (A.1)
where
Pc(X|Z = z) =∑x
p2(x|z). (A.2)
Let U and Z be arbitrary, possibly correlated, random variables over alphabets U and
Z respectively. Let | · | denote the cardinality of a given set. Let t > 0 be a security
parameter chosen by Alice and Bob and define set A as
A =
{(u, z) ∈ (U ,Z) : p(u|z) ≥ 2−t
|U|
}. (A.3)
158
159
Defining Ac as the complement of set A we have
P (Ac) =∑
(u,z)∈Ac
p(u, z)
=∑
(u,z)∈Ac
p(u|z)p(z)
≤ 2−t
|U|∑
u∈U ,z∈Z
p(z)
= 2−t.
Thus with probability of at least 1 − 2−t the combined string (U,Z) take a value in