Top Banner
Trabajo de Fin de Grado en F´ ısica Quantum Teleportation and Quantum Cryptography Urtzi Las Heras Director: Prof. Enrique Solano Departamento de Qu´ ımica F´ ısica Facultad de Ciencia y Tecnolog´ ıa Universidad del Pa´ ıs Vasco UPV/EHU Leioa, Junio del 2012
38

Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

Mar 12, 2020

Download

Documents

dariahiddleston
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page 1: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

Trabajo de Fin de Grado en Fısica

Quantum Teleportation

and

Quantum Cryptography

Urtzi Las Heras

Director:

Prof. Enrique Solano

Departamento de Quımica FısicaFacultad de Ciencia y Tecnologıa

Universidad del Paıs Vasco UPV/EHU

Leioa, Junio del 2012

Page 2: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

Pagina en blanco

Page 3: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

Acknowledgments

En el momento en que el Prof. Enrique Solano, mi director de tesis, me dijo que debıa introduciruna seccion de agradecimientos en el trabajo, solo puedo decir que entre en panico. No obstante,las caras de las personas que me han acompanado en esta aventura han ido apareciendo por mimente y no puedo hacer menos que plasmar en papel lo mucho que agradezco su apoyo.

En primer lugar, mi mas sincero agradecimiento al Prof. Enrique Solano por revivir mi cu-riosidad y entusiasmo por la fısica que tanto han mermado a causa de los agotadores examenes.Gracias por el esfuerzo y dedicacion en este trabajo y por haberme dado la oportunidad deunirme a este estupendo grupo de investigacion en el que no he podido sentirme mas integrado.

Al Dr. Lucas Lamata, que sin su inestimable colaboracion este trabajo no serıa ni sombrade lo que es, gracias por su infinita paciencia y por cada una de sus ensenanzas.

Del mismo modo, gracias a todos los companeros; Laura, Unai, Julen, Antonio, Roberto,Simone, Jorge, Daniel y Guillermo por su predisposicion a ayudarme tantas y tantas veces.

A mis companeros de Jiu Jitsu que con tantas ganas han entrenado conmigo haciendomeolvidar las tensiones del dıa a dıa.

A mis amigos Yelco y Eneko, por haberme sacado mas sonrisas que nadie, y en especial aLara por haber sido uno de los pilares en los que apoyarme cada vez que la he necesitado y queme ha brindado mas carino que nadie.

Gracias a mis padres y a mi hermano, que son verdaderamente los que han lidiado con misenfados cada vez que las cuentas no me han salido y aun ası siempre han tenido palabras deanimo para mı.

Finalmente, gracias tambien a mi abuela, que nunca ha dejado de decirme que estudie yque el esfuerzo trae su recompensa.

3

Page 4: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

Pagina en blanco

4

Page 5: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

Contents

Contents 5

1 Introduction 7

2 Theory of quantum teleportation 9

3 Experimental aspects of quantum teleportation 15

3.1 The Innsbruck photon experiment . . . . . . . . . . . . . . . . . . . . . . . . . . 15

3.2 The NIST trapped-ion experiment . . . . . . . . . . . . . . . . . . . . . . . . . . 18

4 Theory of quantum cryptography 23

4.1 BB84 protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

4.2 E91 protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

5 Experimental aspects of quantum cryptography 31

6 Quantum Hacking 33

7 Conclusions 35

References 37

5

Page 6: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

Pagina en blanco

6

Page 7: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

1 Introduction

Quantum mechanics was discovered and formalized during the last century. So far, the pre-dictions of quantum theory have led to a whole range of prospective applications inconceivableuntil last decade that even today have not yet been developed to its full potentially. Combin-ing quantum properties such as linear superposition and entanglement with information theory,would allow one to realize enhanced computation and communication protocols unfeasible withclassical means. In this work, we review two of them, namely, quantum teleportation andquantum cryptography.

Quantum teleportation is based on the transfer of a quantum state from one point to anotherwhile destroying the original state. To accomplish it, one needs a quantum channel, whichconsists of two entangled particles, and a classical one. We review Bennett et al. theoreticalproposal and we include an original calculation considering a non-perfect quantum channel.The experiments made in Innsbruck and at NIST, making use of photons and trapped ionsrespectively, are shown subsequently. For this, we introduce the basic physics of photons andtrapped ions.

Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how the classical cryptography is less secure than thequantum one, and we review two of the best known quantum-cryptography protocols, namely,BB84 and E91. In both protocols we study the case of an attack from an eavesdropper andits consequences. We also add an original calculation in E91 protocol assuming an imperfectcommunication between the legitimate users. Experimental aspects of quantum cryptographyare analyzed reviewing two of the experiments made in Innsbruck and in Los Alamos. In bothcases, they were accomplished using polarization-entangled photons.

Furthermore, we comment on the basic ideas of quantum hacking, that means obtaininginformation from a message encoded with quantum cryptography techniques. The experimentmade in Singapore is reviewed. Here, the eavesdropper obtained the whole information withoutbeing detected.

Finally, we present our conclusions.

7

Page 8: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

Pagina en blanco

8

Page 9: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

2 Theory of quantum teleportation

Quantum teleportation [1] consists in the transfer of a quantum state |�i from one point toanother while destroying the original state [2] . This process takes place in two di↵erentlocations. Alice has the original state which will be teleported with the help of an entangledstate to Bob. Moreover, Alice and Bob need a classical channel for sending classical information.Both features are essential to make quantum teleportation with 100% fidelity.

Alice and Bob share a maximally entangled state, known as an Einstein-Podolsky-Rosen(EPR) [3] pair. Alice keeps one of the EPR particles with her, and Bob makes the same withthe other one. The state of the EPR pair is:

| (�)23 i = 1p

2(| "2i| #3i � | #2i| "3i). (1)

The particles composing the pair can be of any kind, photons, atoms, e.g.. The onlyrequirement is to have two degrees of freedom, able to encode a quantum bit (qubit). Alice’soriginal particle state is unknown,

|�1i = a| "1i + b| #1i. (2)

Alice makes a Bell measurement of the particles 1 and 2. The complete state of threeparticles before Alice’s measurement is:

| 123i = |�1i ⌦ | (�)23 i =

ap2(| "1i| "2i| #3i � | "1i| #2i| "3i) +

bp2(| #1i| "2i| #3i � | #1i| #2i| "3i). (3)

Using the Bell basis [4] of particles 1 and 2,

| (±)12 i = 1p

2(| "1i| #2i ± | #1i| "2i) (4)

|�(±)12 i = 1p

2(| "1i| "2i ± | #1i| #2i) (5)

we obtain

| 123i =1

2[| (�)

12 i(�a| "3i � b| #3i) + | (+)12 i(�a| "3i + b| #3i)

+|�(�)12 i(a| #3i + b| "3i) + |�(+)

12 i(a| #3i � b| "3i)]. (6)

Once the Bell measurement is made by Alice, particle 3 is projected onto a pure state. Asthere are four possible Bell states, particle 3 can be projected in four states. According to the

9

Page 10: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

result of the measurement, these states will be:

�a| "3i � b| #3i ⌘ |�3i,�a| "3i + b| #3i,a| #3i + b| "3i,a| #3i � b| "3i, (7)

where the Bell states measured are | (�)12 i, | (+)

12 i, |�(�)12 i, |�(+)

12 i, respectively. These states canalso be written as follows:

|�3i,�z

|�3i,��

x

|�3i,i�

y

|�3i, (8)

where �x

, �y

and �z

are the Pauli unitary operators.

Hence, Bob only has to apply the corresponding unitary operation to the state of particle3 to obtain the original state. For this, Alice must send through a classical channel the resultof the Bell measurement. The time of sending classical information is higher than the time ittakes light to travel from Alice to Bob, so there is no causality violation.

|��i

quantum channel

classical channel

Alice

|��i

quantum channel

classical channel

Bob

Figure 1: Scheme of teleportation protocol.

It is possible to question whether the state has been teleported despite not having sentinformation about Alice’s measurement, that is, whether there is superluminal informationsending. Although Bob has just four possible states, there is no way to find the original state

10

Page 11: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

in case Alice does not send the result of the Bell measurement. Tracing out the Bell states, thedensity matrix of the particle 3 results

X

|'i

h'| 123ih 123|'i =X

|'i

h'|⇢123|'i

= h (�)12 |⇢123| (�)

12 i + h (+)12 |⇢123| (+)

12 i + h�(�)12 |⇢123|�(�)

12 i + h�(+)12 |⇢123|�(+)

12 i

=1

4

✓|a|2 ab⇤

a⇤b |b|2◆+

✓|a|2 �ab⇤

�a⇤b |b|2◆+

✓|b|2 a⇤bab⇤ |a|2

◆+

✓|b|2 �a⇤b

�ab⇤ |a|2◆�

=

✓1/2 00 1/2

◆. (9)

As can be seen, Bob obtains a density matrix of the third particle completely depolar-ized. This implies that the information sent by Alice classically is essential to e↵ectuate theteleportation of the original state, giving to the experiment a fidelity of 100 %.

It is important to note that in this process the initial state is destroyed, thus fulfilling theno-cloning theorem. This ensures that there is no procedure by which an unknown quantumstate can be copied from one system to another. For this reason, the procedure is called”teleportation” and not ”copy” of quantum states.

Now, we discuss the possibility of teleporting a state through a quantum channel which iscomposed of a partially entangled state, with an original calculation. In this problem, we wantto see how large is the fidelity using a Werner state [5]. So, particles 2 and 3 are in the mixedstate

⇢23 = p| (�)23 ih (�)

23 | + 1 � p

3[| (+)

23 ih (+)23 | + |�(�)

23 ih�(�)23 | + |�(+)

23 ih�(+)23 |], (10)

where p goes from 0 to 1. Using the basis {"1, #1} and {"2"3, "2#3, #2"3, #2#3} respectively, thedensity matrices of particles 1, ⇢1 and particles 2 and 3, ⇢23, result

⇢1 =

✓|a|2 ab⇤

a⇤b |b|2◆, ⇢23 =

1

6

0

BB@

2(1 � p) 0 0 00 1 + 2p 1 � 4p 00 1 � 4p 1 + 2p 00 0 0 2(1 � p)

1

CCA , (11)

performing the tensorial product of these two matrices we obtain the total state that can bewritten

⇢123 =1

6

0

BBBB@

2(1� p)|a|2 0 0 0 2(1� p)ab⇤ 0 0 00 (1 + 2p)|a|2 (1� 4p)|a|2 0 0 (1 + 2p)ab⇤ (1� 4p)ab⇤ 00 (1� 4p)|a|2 (1 + 2p)|a|2 0 0 (1� 4p)ab⇤ (1 + 2p)ab⇤ 00 0 0 2(1� p)|a|2 0 0 0 2(1� p)ab⇤

2(1� p)a⇤b 0 0 0 2(1� p)|b|2 0 0 00 (1 + 2p)a⇤b (1� 4p)a⇤b 0 0 (1 + 2p)|b|2 (1� 4p)|b|2 00 (1� 4p)a⇤b (1 + 2p)a⇤b 0 0 (1� 4p)|b|2 (1 + 2p)|b|2 00 0 0 2(1� p)a⇤b 0 0 0 2(1� p)|b|2

1

CCCCA,(12)

whose basis is {"1"2"3, "1"2#3, "1#2"3, "1#2#3, #1"2"3, #1"2#3, #1#2"3, #1#2#3}.

11

Page 12: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

From this density matrix we can calculate which state results for the particle 3 in case Aliceobtains anyone of the Bell states in her measurement. These matrices are

1

3

✓(1 + 2p)|a|2 + 2(1 � p)|b|2 �(1 � 4p)ab⇤

�(1 � 4p)a⇤b 2(1 � p)|a|2 + (1 + 2p)|b|2

◆⌘ ⇢3,

1

3

✓(1 + 2p)|a|2 + 2(1 � p)|b|2 (1 � 4p)ab⇤

(1 � 4p)a⇤b 2(1 � p)|a|2 + (1 + 2p)|b|2

◆,

1

3

✓2(1 � p)|a|2 + (1 + 2p)|b|2 �(1 � 4p)a⇤b

�(1 � 4p)ab⇤ (1 + 2p)|a|2 + 2(1 � p)|b|2

◆,

1

3

✓2(1 � p)|a|2 + (1 + 2p)|b|2 (1 � 4p)a⇤b

(1 � 4p)ab⇤ (1 + 2p)|a|2 + 2(1 � p)|b|2

◆,

(13)

where the Bell states measured are | (�)12 i, | (+)

12 i, |�(�)12 i, |�(+)

12 i respectively. Note that thesestates can also be written applying the Pauli unitary operator in this way:

⇢3

�†3 ⇢3 �3,

(��1)† ⇢3 (��1),

(i�2)† ⇢3 (i�2).

(14)

To obtain the fidelity of this teleportation protocol as a function of p, we trace onto theproduct of the ideal state and the obtained state:

Tr(⇢1 · ⇢3) = Tr

✓✓|a|2 ab⇤

a⇤b |b|2

◆· 13

✓(1 + 2p)|a|2 + 2(1 � p)|b|2 �(1 � 4p)ab⇤

�(1 � 4p)a⇤b 2(1 � p)|a|2 + (1 + 2p)|b|2

◆◆

=1 + 2p

3. (15)

As can be seen, the fidelity is of 100% when p goes to 1, that is, when the quantum-channelparticles are on the EPR state.

Let us see for which p the mixed state ⇢23 is a classical state or it has a entangled character.For this, we make the partial transposition, that is, transposing only one of the qubits. Thenwe obtain the eigenvalues and we study them. If the eigenvalues are all positive, the state isclassical but if at least one eigenvalue is negative, it means that the state is entangled [6].

(⇢23)pt =

1

6

0

B@

2(1 � p) 0 0 00 1 + 2p 1 � 4p 00 1 � 4p 1 + 2p 00 0 0 2(1 � p)

1

CA

pt

=1

6

0

B@

2(1 � p) 0 0 1 � 4p0 1 + 2p 0 00 0 1 + 2p 0

1 � 4p 0 0 2(1 � p)

1

CA.

(16)

12

Page 13: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

The eigenvalues of this matrix are �1 = �2 =1�p

3 , �3 =1+2p6 and �4 =

1�2p2 . Only the last

can be negative in case p > 12 and it becomes zero when p = 1

2 . As can be seen in figure 2, forthat value of p the fidelity is about 66%, which coincides with the classical limit for the fidelityof the teleportation protocol.

Figure 2: Plot of the fidelity as a function of p.

13

Page 14: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

Pagina en blanco

14

Page 15: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

3 Experimental aspects of quantum teleportation

In this section, we review some of the most relevant experiments in the field of quantumteleportation. Zeilinger [7] and De Martini [8] made their own experiments at the same timeusing polarized photons. De Martini et al. achieved the teleportation but the initial state wastaken from the pair of particles that compose the quantum channel. Although he succeded inteleporting this state in a 100 % of the times, this protocol is not entirely faithful to the originalof Bennett et al., where the initial state was a qubit independent of the quantum channel. Theexperiment of Zeilinger et al. is showed in detail below. We also review experiment of Barrettet al. [9], who made use of trapped ions as did Riebe et al. [10].

In following we will show which techniques are used to reduce a physical system to twodegrees of freedom, generate entangled states, make the Bell measurements and the quantumstate reconstruction with the help of the information sent by Alice.

3.1 The Innsbruck photon experiment

This experiment was made by Zeilinger’s group using the polarization states of the photonsas the degrees of freedom. Using the notation of Section 2, the state | "i corresponds to thevertical polarization and equivalently | #i to the horizontal polarization. Therefore, the originalstate of photon 1 is a linear combination of vertical and horizontal polarization.

The EPR state and the photon 1 are produced by type II parametric down-conversion(PDC).With this technique, inside a nonlinear crystal, an incoming photon decays spontaneously intwo entangled photons that compose the quantum information channel.

In the experiment a UV radiation pulse is pumped through a nonlinear crystal, emittingthe EPR state. The rest of the pulse goes through the crystal and reflects in a mobile mirror tocome into the crystal again emitting photon 1 and a control photon. Photon 1 is polarized asdesired, because this is the state which will be teleported, and then is combined with photon2, one of the entangled photons joined in the first PDC process. In this way, photons 1 and 2are together to make the Bell measurement.

The device which makes the Bell measurement is called beam-splitter. It consists on a semireflective mirror. In ideal conditions the probability that a photon crosses the mirror is of 50%and being reflected is the other 50%.

In case two photons arrive to the beam splitter at the same time, one on each side, theyemerge in both sides only if both are reflected or transmitted. However, this process is onlypossible for certain states of the photons 1 and 2.

The probability amplitude of this process is given by the coherent addition of the amplitudesof reflection or transmission of both particles. It is important to add a minus sign to the wavefunction due to the phase shift gained in reflections. That way, if the photons are in a statesuch as | "1"2i the amplitude of finding the photons on both sides is zero.

On the other hand, the Bell state | (�)12 i, being antisymmetric, has an additional minus sign,

15

Page 16: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

so the interference is constructive and the probability of finding a photon in each side of beamsplitter is di↵erent from zero.

Consequently, to know that the particles 1 and 2 are in the Bell state | (�)12 i, placing two

detectors on both sides of beam splitter, the experiment has to be repeated until there is acoincidence.

Photons 1 and 2 must arrive at the same time to the beam splitter because they mustinterfere. For this, some techniques must be applied to make the arrival times indistinguishable.In this experiment, beam pulses that pass through low bandwidth filters are used. Therefore,coherence time increases until 520 fs, much longer than the length of the pulse, of 200 fs with afrequency of 76 MHz. Furthermore, given that during the creation of photon 1 another photonis also created, it can be used to know whether photon 1 is emitted.

To check that the teleportation happens for any unknown state, the authors used linearlypolarized states at 45� and �45� for photon 1, that form a rotated base with regard to thebase of the states polarized vertically and horizontally, that is, the base of photons 2 and 3.Next, the teleportation of a linear superposition of these states was checked, equivalently forcircularly polarized.

In the first case, the photon 1 was polarized at 45�. When the detectors f1 and f2 ,locatedbehind the beam splitter where photons 1 and 2 interfere, detect a coincidence it means thatthe state of photons 1 and 2 is projected onto the state | (�)

12 i, making the Bell measurementin this way. Consequently, the photon 3 must be in the original state, polarized at 45�.

Figure 3: Graphic scheme of the experiment. Taken from [7].

16

Page 17: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

The polarization of photon 3 is analyzed by a beam splitter that separates the polarizationsof 45� and �45�. These detectors are named d2 and d1 respectively. When the detectors f1and f2 coincide, d2 always detects a photon. Moreover, d1 never coincides with f1 and f2, sothe photon 3 in all the experiments gets the state of polarization of photon 1, at 45�.

To get the highest accuracy in the interference of photons 1 and 2, the delay between thefirst and second down conversion emissions was modified moving the mirror where the beamreflects. In this way, modifying the delay continuously, it can be seen in detail in which timeoverlap does the teleportation happen.

Making the experiment with the optimal delay, it was observed that the coincidences ofdetectors f1f2d1 (�45�) had a dip. Furthermore, there was no dip for the coincidences of f1f2d2(45�), so it confirms the teleportation of the original state. In this analysis the possible spuriousmatches were considered.

The experiment was repeated changing the polarization of photon 1 to linearly polarizedat �45�, 0�and 90� and also circularly polarized, obtaining similar results. Below, the resultsare shown in a list that expresses the visibility of the dip in triple coincidences in detection oforthogonal states to the polarization of photon 1.

Polarization Visibility+45� 0.63 ± 0.02�45� 0.64 ± 0.020� 0.66 ± 0.0290� 0.61 ± 0.02

Circular 0.57 ± 0.02

(17)

Hence, this experiment checks the teleportation in a basis of states vertical and horizontal,being the state to teleport a superposition of states of the base. To make the Bell measurement,the states of photons 1 and 2 have always been projected to the state | (�)

12 i. Oppositely, asthe experiment consists in the search of coincidences of three detectors, there is no possibilityto find a coincidence for another Bell state, because f1 and f2 detectors only coincide when thestate of photons 1 and 2 is antisymmetric. For this reason, the experiment only works in a 25%of times. In case it would be possible to make the Bell measurement for any state, and thecorresponding unitary operation could also be applied onto the state of particle 3, the copy ofthe state with maximum probability would be achieved in a 100% of times.

In 2012, Ma et al. [11] succeeded in teleporting a qubit between two Canary Islands usingphotons. The distance traveled is 143 km and the average fidelity achieved is f = 0.863(38).This procedure opens a window into the long-distance teleportation where the next goal is theteleportation of qubits sending photons between a satellite and ground.

17

Page 18: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

3.2 The NIST trapped-ion experiment

This experiment was made at NIST, in Boulder (Colorado), in collaboration with the Universityof Otago, New Zealand. In contrast with the previous experiment, this was made with massiveparticles. They confined 9Be+ ions in a segmented ion trap [12, 13] where they could use themas qubits with a total control.

The traps used by the authors are Paul traps. They provide 2D confinement using high-frequency electric fields to simulate an electric field minimum, using four axial electrodes. Theseelectrodes are connected ,as shown in the next figure, to a variable potential that repels the ionwhen it is near the center of trap and it becomes attractive when it moves away. For confining inthe axial direction positively charged endcaps are added. In this way, ions are totally confinedin three dimensions.

Figure 10.1: The Penning trap, with cyclotron and magentron motion of theion illustrated below..

J. Appl. Phys., Vol. 83, No. 10, 15 May 1998

a b

Figure 10.2: The Paul trap..

210

Figure 4: Side(a) and axial(b) view of the Paul trap. Taken from [13].

The control electrodes of the trap are segmented into eight sections, providing six trappingzones, centered on electrode segments 2 to 7 as shown in the next figure. Potentials applied tothese electrodes can be varied in time to separate ions and move them to di↵erent segments ofthe trap.

It was necessary to reduce all the possible states of the ions to only two, ground and excitedstates. These states necessarily had to be metastable states because, in other case, the excitedwould decay to ground state spontaneously. This happens for dipole allowed transitions, soa good choice would be two states separated with a quadruple transition, whose lifetimes arearound a second. Other possibility would be two hyperfine ground states.

In this experiment, authors used qubits composed of the ground state hyperfine levels | "i ⌘|F = 1,m = �1i and | #i ⌘ |F = 2,m = �2i which are separated by a frequency !0 ⇡ 2⇡⇥1.25GHz.

To produce entanglement between ions, they are confined in the same segment of trap, that

18

Page 19: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

making appropriate simplifications acts as a quantum harmonic oscillator. In this way, themovement of the particles can be decomposed into normal modes of vibration and it is easy tosee how the movement of one a↵ects the others.

To describe the amount of movement of ions so-called Fock levels are used. Such levels aregiven by the states |ni with an energy E = h!

t

(12 + n) where !t

is the frequency of the trap.Equivalently to what happens with the electromagnetic field in a cavity, Fock states describethe eigenstates of the vibrational Hamiltonian.

Thus, there are two electronic states and n vibrational states, where n goes from 0 to 1.So any state can be described in this way:

| i = A| #i ⌦1X

n=0

Cn

|ni +B| "i ⌦1X

n=0

Dn

|ni (18)

It is necessary to use a laser beam to control the state of particles. Applying the rotatingwave approximation that assumes the laser detuning and Rabi frequency are much smaller thanoptical frequencies, the Hamiltonian of the system becomes:

H = h⌦{�+e�i(�t�') exp(i⌘[ae�i!t + a†ei!t ])} +H.C. (19)

where �+ is the atomic raising operator, a† and a denote the creation and annihilation operatorfor a motional quantum, respectively. ⌦ characterizes the strength of the laser field in termsof the so-called Rabi frequency, ' denotes the phase of the field with respect to the atomicpolarization and � is the laser-atom detuning. !

t

denotes the trap frequency, ⌘ = kz

z0 is theLamb-Dicke parameter with k

z

being the projection of the laser fields wavevector along the zdirection and z0 =

ph/(2m!

t

) is the spatial extension of the ion ground state wave functionin the harmonic oscillator being m the ion mass.

Using then the Lamb-Dicke approximation, ⌘p((a+ a†)2)i ⌧ 1, that is valid for cold ion

strings, the Hamiltonian can be rewritten as follows:

H = h⌦{�+e�i(�t�') + ��e

i(�t�') + i⌘(�+e�i(�t�') � �i(�t�')

e

)(ae�i!tt + a†ei!tt)} (20)

There are three cases of particular interest: � = 0 and � = ±!t

. The first describesthe carrier transition, thus only electronic states | #i and | "iare changed. However, when� = +!

t

simultaneously to exciting the electronic state of ion, a motional quantum, thatis, a phonon is created. This is named blue sideband transition. The Rabi frequency in thetransition of two vibrational levels n and n + 1 is ⌦

n,n+1 =pn+ 1⌘⌦, which describes the

floppy frequency between the states | #, ni and | ", n + 1i. Finally, in case � = �!t

a redsideband transition occurs. As in the previous transition, the motional state changes but nowthe phonon is annihilated. The Rabi frequency is at this time ⌦

n,n�1 =pn⌘⌦. Applying this

to the laser, a state | #, ni becomes | ", n � 1i.Using these transitions the states of ions can be fully manipulated. As in this experiment

the electronic levels are hyperfine ground states such that the so-called Raman transitions are

19

Page 20: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

used. They consist in the excitement to a virtual electronic level, and then the decay to thefirst-wanted level.

By means of two laser beams, single qubit rotations are implemented

R(✓,�) = cos(✓/2)I + i sin(✓/2) cos(�)�x

+ i sin(✓/2)�y

(21)

where I is the identity operator and �x

, �y

and �z

denote the Pauli matrices in the base{| "i, | #i}. ✓ is proportional to the duration of the Raman pulse and � is the relative phasebetween the Raman beams at the position of the ion. Raman beams are also used to generateentanglement between two ions by implementing the phase gate

a| ""i + b| "#i + c| #"i + d| ##i ! a| ""i � ib| "#i � ic| #"i + d| ##i. (22)

Raman beams are also used to generate spin-echo pulses (R(⇡,�SE

)), which are applied inthe sixth trapping zone. These pulses are necessary to prevent dephasing due to variations inthe magnetic field. The duration between spin-echo pulses is lower than the timescale of suchvariations. Accordingly, with an appropriate choice of �

SE

, the dephasing can be compensatedif it is caused by a static magnetic field gradient. As spin-echo pulses do not fundamentallya↵ect the teleportation, their e↵ects are omitted in the next discussion.

To begin the experiment, the initial state | 23i ⌦ | #1i has to be prepared. First, thesystem is initialized to | #1#2#3i by optical pumping, that is cooling the system until it is inthe minimum energy level. Applying the phase gate shown in (22) combined with rotationsto the ions 2 and 3, the state (| #2#3i � i| "2"3i) is achieved. Then applying some individualrotations to this state the singlet state is finally obtained. First, using a ⇡/2 pulse it becomes(| "2#3i+ | #2"3i) and a ⇡ pulse, with a ⇡/2 phase di↵erence yields the state (| "2#3i � | #2"3i).It should be noted that the normalization factors have been removed to simplify the notation.

After obtaining the singlet state, | 23i, given that is invariant under global rotationsR(✓,�)123 upon all three ions, the ion 1 rotates while ions 2 and 3 are not a↵ected. Choosingthe correct ✓ and �, this global rotation allows to produce the state |�1i = a| "1i + b| #1i forany a and b.

When the system is ready to begin the teleportation, the Bell measurement should beperformed. It is needed more than one step to project the state of ions 1 and 2 onto one of thefour possible Bell states. First, three ions come into the trap 6 and then separated, with ions 1and 2 going to trap 5 and ion 3 to trap 7. In trap 5, a phase gate (22) followed by a ⇡/2 pulseR(⇡/2, 0) is applied to ions 1 and 2.

In the separation process, normally it was shown a significant amount of motional-modeheating, and it was achieved with 95% probability. However, the authors of this experimentused a smaller separation electrode in the current trap, separating the ions with no detectablefailure rate. Furthermore, the heating was extremely reduced so far the stretch mode of thetwo ions in trap 5 is in number of about 1. This allows to implement the phase gate (22)between ions 1 and 2 with fidelity greater than 90%, and more importantly, with no necessityof sympathetic recooling. Ideally, and considering the result of spin-echo pulses insignificant,

20

Page 21: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

this leaves the ions in the state

| "1"2i ⌦ R(⇡/2,�⇡/2)�x

|�3i + | "1#2i ⌦ R(⇡/2,�⇡/2)I|�3i+| #1"2i ⌦ R(⇡/2,�⇡/2)�

y

|�3i � | #1#2i ⌦ R(⇡/2,�⇡/2)�z

|�3i (23)

where |�3i = a| "3i + b| #3i.To complete the Bell measurement it is necessary to detect the ions one by one. It is

important to note that in this equation ions are not in the Bell state basis. Given that themeasurement of ions is individual, the basis required is the decoupled one. Therefore, threeions are recombined in the trap 6 and then separated again, moving the ion 2 to trap 5 andthe ions 1 and 3 to trap 7. Detection of the state of ion 2 is achieved through state-dependentresonance fluorescence measurements. The state | #2i fluoresces strongly whereas | "2i doesnot. Once the measure is made, the ion 2 is optically pumped back to the state | #2i.

After this, all three ions are recombined in trap 6 and separated again. In this case, ions 1and 2 are transferred to trap 5 and ion 3 returns to trap 7. As the last spin-echo pulse appliedin trap 6 changes the state of ion 2 to | "2i, a subsequent simultaneous detection of both ionsin trap 5 determines the state of the ion1 with a failure rate less than 1% due to presence ofion 2.

Figure 5: Schematic representation of the teleportation protocol. Taken from [14, 9].

At this point the Bell measurement is made, and classical information has been extracted.To complete the teleportation, one only has to apply the unitary operation that reconstructs

21

Page 22: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

the state of the ion 1 in the ion 3. First, ions 1 and 2 are transported to trap 2 while ion3 goes to trap 5. Here a ⇡/2 pulse (R(⇡/2, ⇡/2)) is applied followed by the correspondingunitary operation �

x

, I, �y

, �z

for the measurement outcomes | "1"2i, | "1#2i, | #1"2i, | #1#2irespectively. Although the spin-echo pulses do not a↵ect the teleportation protocol, one hasto take care of the phase shift introduced. In case �

SE

= ⇡/2, the unitary operations must bereordered after the ⇡/2 pulse to �

y

, �z

, �x

, I respectively.

The teleportation protocol was tested using six di↵erent states for the ion 1. Concretely,they used the eigenstates of Pauli operators �

z

, �x

and �y

. Assuming that the particle is in thestate | #i in z direction by default, it is easy to apply a Raman beam to transform the originalstate. To obtain | "i it is just needed to excite the ion. The fidelity of the experiment was of80 %, 78 ± 3% for | "i and 84 ± 2% for | #i.

Di↵erently, to accomplish the teleportation with the eigenstates of �x

and �y

, | ± Xi and| ± Y i respectively,and to get them from | #i, it is needed a ⇡/2 pulse with a relative phase of0 (R(⇡/2, 0)) for | ± Xi and ⇡/2 (R(⇡/2, ⇡/2)) for | ± Y i. To measure the final state of ion3 once the teleportation protocol has ended, it only has to do the opposite unitary operationto pass from the states | ± Xi and | ± Y i to | #i. This transformation is needed because thefluorescence measurement is made in the basis {| #i, | "i}.

The average fidelity achieved was of 78 ± 2%. The authors studied the causes that limitedthe fidelity and found three significant mechanisms; imperfect preparation of the initial state| 23i ⌦ | #1i, imperfections in the second phase gate due to heating during the separationprocess, and dephasing of the teleported state due to variations of magnetic fields. Studyingthese issues in independent experiments, it is observed a loss of 8 ± 3% in the fidelity of thefinal state which is consistent with the results obtained in the complete experiment of theteleportation. Although the fidelity is not of a 100% it exceeds the 66%, which is essential tobeat in order to ensure the presence of entanglement.

22

Page 23: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

4 Theory of quantum cryptography

Cryptography [15, 16] has been one of the most important aspects of the theory of informationsince 1949. Shannon [17] proved that there exist unbreakable codes or perfectly secret systems.In fact, this field is responsible for the study of algorithms, protocols and systems used toprotect information and providing secure communications between the communicating entities.

There are di↵erent ways of encrypting a message. The most famous protocols are theOne-time pad and the Public-key cryptographic system. In addition, we review the Rivest-Shamir-Adleman system [18], which is used nowadays to protect electronic bank accounts.

The one-time pad consists in ciphering a message, writing it as a series of bits. Then a keyrandomly chosen is combined with the plain text, adding one to one each bit. Given that thesum of a number with a random number is also a random number, the cyphered text can onlybe decrypted by someone who knows the key. If the key is only used once, it is impossible forthe eavesdropper to obtain correlations. However, it is necessary to use a totally random keywith a greater length than the text, because if the key is used cyclically it is possible to extractinformation from the encoded text.

In the public-key cryptographic system two keys are involved. There is a public key whichcan be used by any sender and the person who receives the coded message has a secret privatekey, the inverse of the public one, which decodes the encrypted message. This system is basedon trapdoor one-way functions, that are computationally tractable functions whose inversefunctions can not be solved within a reasonable time. In this way, any sender can encrypt amessage but only the receiver can decode it due to the fact that he already knows the privatekey, that is, the inverse function which decrypts the message.

Rivest, Shamir and Adleman created in 1977 the RSA method implementing the public-keycryptographic system. This method is based on the di�culty of factoring large integer numbers.Using a computer, it is needed one second to factorize a number of order 1012, at least a yearfor a number of order 1020 and it would be needed more than the age of universe to factorize anumber of 60 digits.

The idea of using quantum properties to obtain secure methods for coding was suggestedin 1969 by Stephen Wiesner [20]. He defended that quantum cryptography would rely for thefirst time on laws of physics and not on mathematical conjectures. Since then, quantum keydistribution protocols (QKD) have been gaining importance and nowadays there are companiesfully dedicated to the study and sale of this kind of technology.

QKD methods consist in creating a key which can be known only by Alice and Bob andthen use it to apply the one-time pad protocol. It can be demonstrated that this procedureis much safer than any public-key cryptographic system. For example, in case we could use aquantum computer, applying the Shor’s algorithm [19], any large integer could be factorized ina short enough time. Consequently, the RSA system would not be valid anymore for encodingmessages.

23

Page 24: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

Below, we review the BB84 [21] and E91 [22] protocols, based on the use of quantumproperties of linear superposition and entanglement.

4.1 BB84 protocol

Also known as four-state scheme, this was the first protocol devised in quantum cryptography.By this method, Alice and Bob get a private key which can be used in the one-time pad dueto its high security.

In this procedure, Alice and Bob make use of a quantum channel and another classical onewhich is public too. The quantum one, that is usually an optical fiber, is used for sendingphotons one by one. On the other hand, the public channel can be accessed by anybody.

The protocol can be described in four clear steps:

Step 1. Alice prepares photons linearly polarized at 0�, 90�, 45� and 135�, that are eigen-states of the bases (+,⇥). She does it randomly and she sends them through the quantumchannel recording the sequence of the prepared states. Denoting the states horizontal, 45�, ver-tical and 135� by H,D,V and A respectively, she gives the values 0 for the first two states and 1for the lasts ones. In this way, Alice achieves a sequence of bits totally random. Morever, shewrites down three di↵erent sequences: one for the polarization bases, other for the polarizationstates and the last made of bits. Alice’s sequences are:

tum channel, while keeping a record of the sequence ofthe prepared states and of the associated sequence of 0’sand 1’s obtained representing by 0 the choices of 0 and45 degrees, and by 1 otherwise. This sequence of bits is

clearly random. For instance, denoting by H, V, D, andA the horizontal, vertical, 45°, and 135° polarizations,respectively, and by !, " the polarization basis !H,V",!D,A", Alice’s possible sequences are

Step 2. Bob has two analyzers, one ‘‘rectangular’’ (!type), the other ‘‘diagonal’’ ("type). Upon receiving each ofAlice’s photons, he decides at random what analyzer to use, and writes down the aleatory sequence of analyzers usedas well as the result of each measurement. He also produces a bit sequence associating 0 to the cases in which themeasurement produces a 0° or 45° photon, and 1 in cases of 90° or 135°. With the following analyzers chosen atrandom a possible result of Bob’s action on Alice’s previous sequence is

Step 3. Next they communicate with each other through the public channel the sequences of polarization basis andanalyzers employed, as well as Bob’s failures in detection, but never the specific states prepared by Alice in each basisnor the resulting states obtained by Bob upon measuring.

Step 4. They discard those cases in which Bob detects no photons, and also those cases in which the preparation basisused by Alice and the analyzer type used by Bob differ. After this distillation, both are left with the same randomsubsequence of bits 0, 1, which they will adopt as the shared secret key:

Therefore the distilled key is

1011110000011001001010¯and its length is, on average, and assuming no detectionfailures, one-half of the length of each initial sequence.

b. Eavesdropping effectsAll of this holds in the ideal case in which there are no

eavesdroppers, no noises in the transmission, and no de-fects in the production, reception, or analysis: the dis-tilled keys of Alice and Bob coincide. But let us assume

that Eve ‘‘taps’’ the quantum channel and that, havingthe same equipment as Bob, analyzes the polarizationstate of each photon, forwarding them next to Bob. Eve,much like Bob, ignorant of the state of each photon sentby Alice, will use the wrong analyzer with probability1/2 and will replace Alice’s photon by another one, sothat upon measurement Bob will get Alice’s state withprobability only 3/8, instead of the probability 1/2 in theabsence of eavesdropping. Therefore this intervention ofEve induces on each photon a probability of error 1/4.Returning to the previous example, let us assume thatEve’s measurements on Alice’s photons produce the fol-lowing results:

367A. Galindo and M. A. Martın-Delgado: Classical and quantum information

Rev. Mod. Phys., Vol. 74, No. 2, April 2002

Step 2. Bob can analyze the photons sent by Alice making use of two devices, one in thebase + and the other in ⇥. He chooses randomly which analyzer to use to measure each photon,writing down the sequence of the basis which has been used for the measurement of each photonand the result of this measurements too. Just as Alice, Bob denotes by 0 the states H and 45�,and 1 to V and 135�. In this way, Bob could obtain the next sequences:

tum channel, while keeping a record of the sequence ofthe prepared states and of the associated sequence of 0’sand 1’s obtained representing by 0 the choices of 0 and45 degrees, and by 1 otherwise. This sequence of bits is

clearly random. For instance, denoting by H, V, D, andA the horizontal, vertical, 45°, and 135° polarizations,respectively, and by !, " the polarization basis !H,V",!D,A", Alice’s possible sequences are

Step 2. Bob has two analyzers, one ‘‘rectangular’’ (!type), the other ‘‘diagonal’’ ("type). Upon receiving each ofAlice’s photons, he decides at random what analyzer to use, and writes down the aleatory sequence of analyzers usedas well as the result of each measurement. He also produces a bit sequence associating 0 to the cases in which themeasurement produces a 0° or 45° photon, and 1 in cases of 90° or 135°. With the following analyzers chosen atrandom a possible result of Bob’s action on Alice’s previous sequence is

Step 3. Next they communicate with each other through the public channel the sequences of polarization basis andanalyzers employed, as well as Bob’s failures in detection, but never the specific states prepared by Alice in each basisnor the resulting states obtained by Bob upon measuring.

Step 4. They discard those cases in which Bob detects no photons, and also those cases in which the preparation basisused by Alice and the analyzer type used by Bob differ. After this distillation, both are left with the same randomsubsequence of bits 0, 1, which they will adopt as the shared secret key:

Therefore the distilled key is

1011110000011001001010¯and its length is, on average, and assuming no detectionfailures, one-half of the length of each initial sequence.

b. Eavesdropping effectsAll of this holds in the ideal case in which there are no

eavesdroppers, no noises in the transmission, and no de-fects in the production, reception, or analysis: the dis-tilled keys of Alice and Bob coincide. But let us assume

that Eve ‘‘taps’’ the quantum channel and that, havingthe same equipment as Bob, analyzes the polarizationstate of each photon, forwarding them next to Bob. Eve,much like Bob, ignorant of the state of each photon sentby Alice, will use the wrong analyzer with probability1/2 and will replace Alice’s photon by another one, sothat upon measurement Bob will get Alice’s state withprobability only 3/8, instead of the probability 1/2 in theabsence of eavesdropping. Therefore this intervention ofEve induces on each photon a probability of error 1/4.Returning to the previous example, let us assume thatEve’s measurements on Alice’s photons produce the fol-lowing results:

367A. Galindo and M. A. Martın-Delgado: Classical and quantum information

Rev. Mod. Phys., Vol. 74, No. 2, April 2002

Note that if Alice and Bob use the same basis, the result of the measurement is the samefor both. In other case, they have a probability of 1

2 of obtaining the same result.

24

Page 25: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

Step 3. Using the public information channel, Alice and Bob put in common the sequences ofpolarization bases and analyzers employed. It is important to note that they never communicateeach other which ones are the prepared states nor the resulting states measured by Bob.

tum channel, while keeping a record of the sequence ofthe prepared states and of the associated sequence of 0’sand 1’s obtained representing by 0 the choices of 0 and45 degrees, and by 1 otherwise. This sequence of bits is

clearly random. For instance, denoting by H, V, D, andA the horizontal, vertical, 45°, and 135° polarizations,respectively, and by !, " the polarization basis !H,V",!D,A", Alice’s possible sequences are

Step 2. Bob has two analyzers, one ‘‘rectangular’’ (!type), the other ‘‘diagonal’’ ("type). Upon receiving each ofAlice’s photons, he decides at random what analyzer to use, and writes down the aleatory sequence of analyzers usedas well as the result of each measurement. He also produces a bit sequence associating 0 to the cases in which themeasurement produces a 0° or 45° photon, and 1 in cases of 90° or 135°. With the following analyzers chosen atrandom a possible result of Bob’s action on Alice’s previous sequence is

Step 3. Next they communicate with each other through the public channel the sequences of polarization basis andanalyzers employed, as well as Bob’s failures in detection, but never the specific states prepared by Alice in each basisnor the resulting states obtained by Bob upon measuring.

Step 4. They discard those cases in which Bob detects no photons, and also those cases in which the preparation basisused by Alice and the analyzer type used by Bob differ. After this distillation, both are left with the same randomsubsequence of bits 0, 1, which they will adopt as the shared secret key:

Therefore the distilled key is

1011110000011001001010¯and its length is, on average, and assuming no detectionfailures, one-half of the length of each initial sequence.

b. Eavesdropping effectsAll of this holds in the ideal case in which there are no

eavesdroppers, no noises in the transmission, and no de-fects in the production, reception, or analysis: the dis-tilled keys of Alice and Bob coincide. But let us assume

that Eve ‘‘taps’’ the quantum channel and that, havingthe same equipment as Bob, analyzes the polarizationstate of each photon, forwarding them next to Bob. Eve,much like Bob, ignorant of the state of each photon sentby Alice, will use the wrong analyzer with probability1/2 and will replace Alice’s photon by another one, sothat upon measurement Bob will get Alice’s state withprobability only 3/8, instead of the probability 1/2 in theabsence of eavesdropping. Therefore this intervention ofEve induces on each photon a probability of error 1/4.Returning to the previous example, let us assume thatEve’s measurements on Alice’s photons produce the fol-lowing results:

367A. Galindo and M. A. Martın-Delgado: Classical and quantum information

Rev. Mod. Phys., Vol. 74, No. 2, April 2002

Step 4. They discard those cases in which Bob has had a failure in the detection, orin which the polarization basis used by Alice to prepare the photons and the analyzer basisemployed by Bob in the measurement do not coincide. After the discarding, both obtain thesame subsequence of bits that they take as the secret shared key:

tum channel, while keeping a record of the sequence ofthe prepared states and of the associated sequence of 0’sand 1’s obtained representing by 0 the choices of 0 and45 degrees, and by 1 otherwise. This sequence of bits is

clearly random. For instance, denoting by H, V, D, andA the horizontal, vertical, 45°, and 135° polarizations,respectively, and by !, " the polarization basis !H,V",!D,A", Alice’s possible sequences are

Step 2. Bob has two analyzers, one ‘‘rectangular’’ (!type), the other ‘‘diagonal’’ ("type). Upon receiving each ofAlice’s photons, he decides at random what analyzer to use, and writes down the aleatory sequence of analyzers usedas well as the result of each measurement. He also produces a bit sequence associating 0 to the cases in which themeasurement produces a 0° or 45° photon, and 1 in cases of 90° or 135°. With the following analyzers chosen atrandom a possible result of Bob’s action on Alice’s previous sequence is

Step 3. Next they communicate with each other through the public channel the sequences of polarization basis andanalyzers employed, as well as Bob’s failures in detection, but never the specific states prepared by Alice in each basisnor the resulting states obtained by Bob upon measuring.

Step 4. They discard those cases in which Bob detects no photons, and also those cases in which the preparation basisused by Alice and the analyzer type used by Bob differ. After this distillation, both are left with the same randomsubsequence of bits 0, 1, which they will adopt as the shared secret key:

Therefore the distilled key is

1011110000011001001010¯and its length is, on average, and assuming no detectionfailures, one-half of the length of each initial sequence.

b. Eavesdropping effectsAll of this holds in the ideal case in which there are no

eavesdroppers, no noises in the transmission, and no de-fects in the production, reception, or analysis: the dis-tilled keys of Alice and Bob coincide. But let us assume

that Eve ‘‘taps’’ the quantum channel and that, havingthe same equipment as Bob, analyzes the polarizationstate of each photon, forwarding them next to Bob. Eve,much like Bob, ignorant of the state of each photon sentby Alice, will use the wrong analyzer with probability1/2 and will replace Alice’s photon by another one, sothat upon measurement Bob will get Alice’s state withprobability only 3/8, instead of the probability 1/2 in theabsence of eavesdropping. Therefore this intervention ofEve induces on each photon a probability of error 1/4.Returning to the previous example, let us assume thatEve’s measurements on Alice’s photons produce the fol-lowing results:

367A. Galindo and M. A. Martın-Delgado: Classical and quantum information

Rev. Mod. Phys., Vol. 74, No. 2, April 2002

Therefore the key is

1011110000011001001010...

and supposing that Bob detects all the photons sent by Alice, on average, the length of the keyis one-half of the first sequence’s. This is due to the probability of both Alice and Bob makinguse of the same basis, which is exactly a half.

Now Alice only has to write the message to Bob as a series of bits and then add the sharedsecret key, making the message random. Then she has to communicate it through the classicalchannel and finally Bob can decode the message detracting the key.

All this is written in the ideal case that there are no defects in the transmission of photons,no noises and no eavesdropper. Let’s analyze the case that the communication is perfect butthere is an eavesdropper, Eve, who intercepts the quantum channel and also has the sameequipment as Bob.

Supposing Eve detects Alice’s photons and then she replaces and sends them to Bob, shecan induce an error. If the analyzer’s basis is the same as Alice’s polarization basis, Eve cancreate an equal photon. Even so, if the basis are not the same, whose probability is 1/2,the reproduced photon may have the same polarization as Alice’s photon and also can be 90�

25

Page 26: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

shifted. In this way, Eve can induce an error with a probability of 1/4. Let’s suppose that Eveobtains the next sequence from the photons sent by Alice:

Eve’s states are now those reaching Bob, who with his sequence of analyzers will obtain, for instance,

Proceeding as in Step 4:

We see that the coincidences in the distilled lists getdisrupted: in one out of four cases, the coincidence dis-appears. Sacrificing for verification a piece of the liststaken at random from the final sequences, Alice andBob can publicly compare them, and their differenceswill detect Eve’s intervention. If the length of thatchecked partial sequence is N , the probability that Eve’slistening has not produced discrepancies is (3/4)N and isthus negligible for N large enough. Therefore, shouldthey not find any discordance, they can feel safe aboutthe absence of eavesdroppers. But they must clearly dis-regard the binary string they have made public and notuse it for coding.

In practice, the emitting source, the transmissionchannel, and the receiving equipment all display noise,which will spoil, even without Eve’s intervention, theperfect fit of the bit sequences distilled by Alice andBob. It is necessary then to live with error, so long as thisstays within a tolerable limit. In these circumstances,Eve will try to restrain herself, taking care that the ef-fects of her listening stay below a certain threshold anddo not sound the alarm.

Cryptanalysts like Eve usually are a good deal moresubtle than the previous simple analysis might suggest.Aware as they are of the quantum subtleties, they arenot satisfied with incoherently tapping the quantumchannel qubit to qubit; they know that a coherent attackon strings of qubits, with probes analyzed after the pub-lic exchange of information between Alice and Bob, canbe much more rewarding. To test the safety of a protocolsuch as BB84 under any type of imaginable attack by amalicious and cunning Eve is neither a trivial nor anuninteresting issue, especially bearing in mind that otherprotocols which were considered to be unconditionallysecure have fallen. One such is the bit commitmentquantum protocol: Alice sends something to Bob underthe firm commitment of having chosen a bit b that Bob

does not know, but that Alice can later show to himwhen he claims it. Resorting to entangled EPR statesmakes it possible for either party of the couple to be-have dishonestly (a cheating Alice could change hercommitment at the end without Bob’s being aware, or anuntrustworthy Bob could obtain some information on bwithout asking Alice; Mayers, 1996, 1997; Brassard et al.,1997).

There exists a proof of the unconditional security ofquantum key distribution through noisy channels and upto any distance, by means of a protocol based upon thesharing of EPR pairs and their purification, and underthe hypothesis that both parties (Alice and Bob) havefault-tolerant quantum computers (Lo and Chau, 1999).Likewise, the unconditional security of the BB84 proto-col is also claimed (Mayers, 1998).

c. B92 protocol

Unlike the previous protocol, which uses a system infour pairwise orthogonal states, in the somewhat simplerB92 protocol, only two nonorthogonal states are in-volved. We shall not discuss it here, as it is similar to theprevious one. The interested reader is referred to theoiginal article of Bennett (1992a).

d. Einstein-Podolsky-Rosen protocols

In 1991 Ekert, relying on earlier ideas of Deutsch(1985), proposed an elegant method for secret key dis-tribution, in which the generalized Bell’s inequality safe-guards confidentiality in the transmission of pairs of

368 A. Galindo and M. A. Martın-Delgado: Classical and quantum information

Rev. Mod. Phys., Vol. 74, No. 2, April 2002

Then Eve sends the photons which has measured to Bob, who writes down the next sequenceusing his analyzers:

Eve’s states are now those reaching Bob, who with his sequence of analyzers will obtain, for instance,

Proceeding as in Step 4:

We see that the coincidences in the distilled lists getdisrupted: in one out of four cases, the coincidence dis-appears. Sacrificing for verification a piece of the liststaken at random from the final sequences, Alice andBob can publicly compare them, and their differenceswill detect Eve’s intervention. If the length of thatchecked partial sequence is N , the probability that Eve’slistening has not produced discrepancies is (3/4)N and isthus negligible for N large enough. Therefore, shouldthey not find any discordance, they can feel safe aboutthe absence of eavesdroppers. But they must clearly dis-regard the binary string they have made public and notuse it for coding.

In practice, the emitting source, the transmissionchannel, and the receiving equipment all display noise,which will spoil, even without Eve’s intervention, theperfect fit of the bit sequences distilled by Alice andBob. It is necessary then to live with error, so long as thisstays within a tolerable limit. In these circumstances,Eve will try to restrain herself, taking care that the ef-fects of her listening stay below a certain threshold anddo not sound the alarm.

Cryptanalysts like Eve usually are a good deal moresubtle than the previous simple analysis might suggest.Aware as they are of the quantum subtleties, they arenot satisfied with incoherently tapping the quantumchannel qubit to qubit; they know that a coherent attackon strings of qubits, with probes analyzed after the pub-lic exchange of information between Alice and Bob, canbe much more rewarding. To test the safety of a protocolsuch as BB84 under any type of imaginable attack by amalicious and cunning Eve is neither a trivial nor anuninteresting issue, especially bearing in mind that otherprotocols which were considered to be unconditionallysecure have fallen. One such is the bit commitmentquantum protocol: Alice sends something to Bob underthe firm commitment of having chosen a bit b that Bob

does not know, but that Alice can later show to himwhen he claims it. Resorting to entangled EPR statesmakes it possible for either party of the couple to be-have dishonestly (a cheating Alice could change hercommitment at the end without Bob’s being aware, or anuntrustworthy Bob could obtain some information on bwithout asking Alice; Mayers, 1996, 1997; Brassard et al.,1997).

There exists a proof of the unconditional security ofquantum key distribution through noisy channels and upto any distance, by means of a protocol based upon thesharing of EPR pairs and their purification, and underthe hypothesis that both parties (Alice and Bob) havefault-tolerant quantum computers (Lo and Chau, 1999).Likewise, the unconditional security of the BB84 proto-col is also claimed (Mayers, 1998).

c. B92 protocol

Unlike the previous protocol, which uses a system infour pairwise orthogonal states, in the somewhat simplerB92 protocol, only two nonorthogonal states are in-volved. We shall not discuss it here, as it is similar to theprevious one. The interested reader is referred to theoiginal article of Bennett (1992a).

d. Einstein-Podolsky-Rosen protocols

In 1991 Ekert, relying on earlier ideas of Deutsch(1985), proposed an elegant method for secret key dis-tribution, in which the generalized Bell’s inequality safe-guards confidentiality in the transmission of pairs of

368 A. Galindo and M. A. Martın-Delgado: Classical and quantum information

Rev. Mod. Phys., Vol. 74, No. 2, April 2002

Finally, Alice and Bob communicate their sequences of basis to obtain the key.

Eve’s states are now those reaching Bob, who with his sequence of analyzers will obtain, for instance,

Proceeding as in Step 4:

We see that the coincidences in the distilled lists getdisrupted: in one out of four cases, the coincidence dis-appears. Sacrificing for verification a piece of the liststaken at random from the final sequences, Alice andBob can publicly compare them, and their differenceswill detect Eve’s intervention. If the length of thatchecked partial sequence is N , the probability that Eve’slistening has not produced discrepancies is (3/4)N and isthus negligible for N large enough. Therefore, shouldthey not find any discordance, they can feel safe aboutthe absence of eavesdroppers. But they must clearly dis-regard the binary string they have made public and notuse it for coding.

In practice, the emitting source, the transmissionchannel, and the receiving equipment all display noise,which will spoil, even without Eve’s intervention, theperfect fit of the bit sequences distilled by Alice andBob. It is necessary then to live with error, so long as thisstays within a tolerable limit. In these circumstances,Eve will try to restrain herself, taking care that the ef-fects of her listening stay below a certain threshold anddo not sound the alarm.

Cryptanalysts like Eve usually are a good deal moresubtle than the previous simple analysis might suggest.Aware as they are of the quantum subtleties, they arenot satisfied with incoherently tapping the quantumchannel qubit to qubit; they know that a coherent attackon strings of qubits, with probes analyzed after the pub-lic exchange of information between Alice and Bob, canbe much more rewarding. To test the safety of a protocolsuch as BB84 under any type of imaginable attack by amalicious and cunning Eve is neither a trivial nor anuninteresting issue, especially bearing in mind that otherprotocols which were considered to be unconditionallysecure have fallen. One such is the bit commitmentquantum protocol: Alice sends something to Bob underthe firm commitment of having chosen a bit b that Bob

does not know, but that Alice can later show to himwhen he claims it. Resorting to entangled EPR statesmakes it possible for either party of the couple to be-have dishonestly (a cheating Alice could change hercommitment at the end without Bob’s being aware, or anuntrustworthy Bob could obtain some information on bwithout asking Alice; Mayers, 1996, 1997; Brassard et al.,1997).

There exists a proof of the unconditional security ofquantum key distribution through noisy channels and upto any distance, by means of a protocol based upon thesharing of EPR pairs and their purification, and underthe hypothesis that both parties (Alice and Bob) havefault-tolerant quantum computers (Lo and Chau, 1999).Likewise, the unconditional security of the BB84 proto-col is also claimed (Mayers, 1998).

c. B92 protocol

Unlike the previous protocol, which uses a system infour pairwise orthogonal states, in the somewhat simplerB92 protocol, only two nonorthogonal states are in-volved. We shall not discuss it here, as it is similar to theprevious one. The interested reader is referred to theoiginal article of Bennett (1992a).

d. Einstein-Podolsky-Rosen protocols

In 1991 Ekert, relying on earlier ideas of Deutsch(1985), proposed an elegant method for secret key dis-tribution, in which the generalized Bell’s inequality safe-guards confidentiality in the transmission of pairs of

368 A. Galindo and M. A. Martın-Delgado: Classical and quantum information

Rev. Mod. Phys., Vol. 74, No. 2, April 2002

As can be seen, in one out of four cases Eve’s induced error appears and the key sequencedoes not coincide although Alice and Bob have used the same basis to prepare/measure thephotons. Accordingly, they can verify the presence of an eavesdropper putting in common apiece of the key that they can not use anymore. Sacrificing a piece of the key whose length isN bits, the probability of not detecting eavesdropper’s e↵ects is (3/4)N . Using a piece of thekey long enough, if they not find any discrepancies they can discard the possibility of beingintercepted by an eavesdropper.

This is just an ideal case of the protocol but in practice one has to take care of the noiseof the emitting source, the transmission channel or the receiving equipment. This can creatediscrepancies between the distilled bit sequences by Alice and Bob, but not as much as theeavesdropper introduces.

Sequences have been taken from [15].

26

Page 27: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

4.2 E91 protocol

Ekert’s protocol, just as in the previous one, is based on obtaining a private key and using itin the one-time pad. To obtain the key, Alice and Bob share spin 1/2 particles in a state ofmaximum entanglement. Due to the correlations, they are able not only to get a secure keybut also to detect the presence of an eavesdropper.

The communication between Alice and Bob is provided by a classical channel and a quantumone. We assume that Alice has a source that emits EPR pairs, from which one is measured byAlice and the other travels to Bob’s system where it is also measured.

The detectors of both systems perform measurements on spin components along three di-rections perpendicular to the trajectory of the particles. Choosing the z axis as the trajectorydirection, the measurements are made in the x-y plane. Measurement directions are character-ized by the azimuthal angles as follows: �a

1 = 0�, �a

2 = 45�, �a

3 = 90� and �b

1 = 45�, �b

2 = 90�,�b

3 = 135�, where subscripts ”a” and ”b” refer to Alice and Bob respectively and the anglestarts in the x axis.

Alice chooses randomly one of the three orientations of the detector for each pair of entangledparticles, and Bob does the same. They obtain one bit of information in each measurement, 1in case the result is spin up and 0 if it is spin down.

We define the correlation coe�cient as

E(ai

,bj

) = P++(ai

,bj

) + P��(ai

,bj

) � P+�(ai

,bj

) � P�+(ai

,bj

) (24)

where ai

and bj

are the directions of the Alice and Bob’s analyzers. P±± correspond to theprobability that the result of the measurement has been spin up or spin down along the directionai

and bj

respectively. In agreement with the quantum formalism

E(ai

,bj

) = �ai

· bj

. (25)

Consequently, in case the analyzers of both users have the same direction (a2

,b1

and a3

,b2

) theanticorrelation of the results obtained by Alice and Bob is total, E(a

2

,b1

) = E(a3

,b2

) = �1.

Following the CHSH inequality [23], which is based on Bell’s theorem [24], we define aquantity composed of the correlation coe�cients for which the detector’s orientations, a andb, are di↵erent:

S = E(a1

,b1

) � E(a1

,b3

) + E(a3

,b1

) + E(a3

,b3

). (26)

It can be easily seen that

S = �2p2, (27)

which violates Bell’s inequality, |S| 2, due to the non-locality of the EPR state.

Once the transmission is completed, Alice and Bob communicate the sequence of the orien-tations of the analyzers employed. They discard the cases in which the detections have failed

27

Page 28: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

and then separate in two groups, one for the cases they have used di↵erent orientation in theirdetectors and another where the orientations coincide. They put in common the results ofthe measurements of the first group, so they can calculate the value of S by averaging theprobabilities P±± for each combination of analyzer’s directions. In case the particles were notperturbed, S should remain being �2

p2, so the users can be sure that the quantum channel is

not being intercepted by an eavesdropper.

Given that there is a total anticorrelation if Alice and Bob use the same direction in theiranalyzers, Alice’s second group results are the opposite of Bob’s. Consequently, Bob has tochange his results to obtain Alice’s sequence, which will be used as the key. Note that theresults of the second group has never been shared through the quantum channel, so only theusers have them and the one-time pad can be accomplished.

Besides, if there is an eavesdropper intercepting the quantum channel, he will measure theEPR particles, and he also will try to replace them. However, the correlation coe�cients willbe altered, which changes (26) as follows:

S =R⇢(n

a

,nb

)dna

dnb

[(a1

· na

)(b1

· nb

) � (a1

· na

)(b3

· nb

)

+(a3

· na

)(b1

· nb

) + (a3

· na

)(b3

· nb

)], (28)

where na

and nb

are the directions of the eavesdropper analyzer for the particles that willbe measured by Alice and Bob respectively. ⇢(n

a

,nb

) can be considered as the strategy ofthe eavesdropper, because is the probability of intercepting a spin component along the givendirection for a particular measurement.

In case Alice has the source of particles in the singlet state, the eavesdropper only couldintercept Bob’s particle the directions n

a

and nb

check the relation nb

= �na

. In this way,(26) can be simplified giving

S =

Z⇢(n

a

,nb

)dna

dnb

[p2n

a

· nb

], (29)

so the value S is restricted to

�p2 S

p2. (30)

This result is contrary to (27) for any strategy ⇢(na

,nb

). So then, the eavesdropper has noway to escape from being detected.

Now, we show an original calculation in Ekert’s protocol assuming that the quantum channelis composed of two particles in the Werner state that we introduced in (10). So, the densitymatrix of particles 1 and 2 is

⇢12 =1

6

0

BB@

2(1 � p) 0 0 00 1 + 2p 1 � 4p 00 1 � 4p 1 + 2p 00 0 0 2(1 � p)

1

CCA . (31)

28

Page 29: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

First of all we calculate correlation coe�cients. For this, we should calculate the probabilitiesthat the result of the measurement has been spin up or spin down along the directions a

i

andbj

. This is given by

P±±(ai

,bj

) = Tr[(⇤±(ai

) ⌦ ⇤±(bj

)) · ⇢12], (32)

where ⇤±(v) is the projector of the state linearly polarized along the direction given by v witheigenvalues +1 and -1 respectively. That projector can be constructed from

⇤±(v) =1

2[ ± � · v], (33)

being � = �x

nx

+ �y

ny

+ �z

nz

.

We analyze correlation coe�cients in the cases that Alice and Bob’s detectors have the samepolarization direction

E(a2

,b1

) = P++(a2

,b1

) + P��(a2

,b1

) � P+�(a2

,b1

) � P�+(a2

,b1

)

=1

3(1 � p) +

1

3(1 � p) � 1

6(1 + 2p) � 1

6(1 + 2p) =

1

3(1 � 4p). (34)

It is easy to see that E(a2

,b1

) = E(a3

,b2

) = 13(1 � 4p). So if p = 1, the anticorrelation

becomes maximum, which is in agreement with the case of the singlet state.

Let us calculate S replacing the singlet state by the Werner one. In this case we obtain

S = E(a1

,b1

) � E(a1

,b3

) + E(a3

,b1

) + E(a3

,b3

)

=1 � 4p

3p2

� 4p � 1

3p2

+1 � 4p

3p2

+1 � 4p

3p2

=4(1 � 4p)

3p2

. (35)

As can be seen in Figure 6, S only violates Bell’s theorem if p > 3+p2

4p2, so security can not

be assured in case p is less than this value. Moreover, the less is p the less is the probabilityof establishing a perfect key between Alice and Bob due to the fact that the anticorrelationcoe�cient for the same direction of measurement decreases proportionally to p.

29

Page 30: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

Figure 6: Plot of the S as a function of p.

30

Page 31: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

5 Experimental aspects of quantum cryptography

Although quantum-cryptography (QC) protocols began to be published in 1984, the first ex-periments could not be accomplished until 1999. The high di�culty of changing rapidly thebasis of the analyzers, which was one of the requirements of QC protocols, was insurmountablefor more than a decade.

With the implementation of new technologies, the field of quantum communication madea remarkable progress. In fact, in 2000 the result of three QC experiments from Universityof Innsbruck [25], Los Alamos National Laboratory [26] and University of Geneva [27] werepublished in the journal Physical Review Letters. These ones reproduced E91 protocol makinguse of polarization-entangled photons in the first ones while the last consists in energy-timeentanglement. In the following we review the polarization-entanglement experiments.

Both groups used photon pairs at a wavelength of 700nm because this was the easiest wayto be detected by the single-photon detectors based on silicon avalanche photodiode’s. Togenerate the entangled pair, the source consisted in one or two �-BaB2O4 crystals pumped byan argon-ion laser. This is the same technique that was used in Innsbruck in the teleportationexperiment, which is known as parametric down-conversion.

Entangled photons go to Alice and Bob’s analyzers, which are composed of an active polar-ization rotator, a beam splitter and a an avalanche photodiode. The first element allows to theuser to rote, instead of beamsplitter’s polarization direction, photon’s one obtaining the sameresult.

tion of one photon of a pair reveals the presence of acompanion. In principle, it is thus possible to have aprobability of emitting a nonempty pulse equal to one.43

It is beneficial only because currently available single-photon detectors feature a high dark-count probability.The difficulty of always collecting both photons of a pairsomewhat reduces this advantage. One frequently hearsthat photon pairs have the advantage of avoiding multi-photon pulses, but this is not correct. For a given meanphoton number, the probability that a nonempty pulsecontains more than one photon is essentially the samefor weak pulses as for photon pairs (see Sec. III.A.2).

A second advantage is that using entangled photonspair prevents unintended information leakage in unuseddegrees of freedom (Mayers and Yao, 1998). Observinga QBER lower than approximately 15%, or equivalentlyobserving that Bell’s inequality is violated, indeed guar-antees that the photons are entangled, so that the differ-ent states are not fully distinguishable through other de-grees of freedom. A third advantage was indicatedrecently by new and elaborate eavesdropping analyses.The fact that passive state preparation can be imple-mented prevents multiphoton splitting attacks (see Sec.VI.J).

The coupling between the optical frequency and theproperty used to encode the qubit, i.e., decoherence, israther easy to master when using faint laser pulses.However, this issue is more serious when using photonpairs, because of the larger spectral width. For example,for a spectral width of 5 nm full width at half maximum(FWHM)—a typical value, equivalent to a coherencetime of 1 ps—and a fiber with a typical polarizationmode dispersion of 0.2 ps/!km, transmission over a fewkilometers induces significant depolarization, as dis-cussed in Sec. III.B.2. In the case of polarization-entangled photons, this effect gradually destroys theircorrelation. Although it is in principle possible to com-pensate for this effect, the statistical nature of the polar-ization mode dispersion makes this impractical.44

Although perfectly fine for free-space QC (see Sec.IV.E), polarization entanglement is thus not adequatefor QC over long optical fibers. A similar effect ariseswhen dealing with energy-time-entangled photons.Here, the chromatic dispersion destroys the strong timecorrelations between the photons forming a pair. How-ever, as discussed in Sec. III.B.3, it is possible to com-pensate passively for this effect either using additionalfibers with opposite dispersion, or exploiting the inher-ent energy correlation of photon pairs.

Generally speaking, entanglement-based systems arefar more complex than setups based on faint laserpulses. They will most certainly not be used in the nearfuture for the realization of industrial prototypes. In ad-dition, the current experimental key creation rates ob-tained with these systems are at least two orders of mag-nitude smaller than those obtained with faint laser pulsesetups (net rate on the order of a few tens of bits persecond, in contrast to a few thousand bits per second fora 10-km distance). Nevertheless, they offer interestingpossibilities in the context of cryptographic optical net-works. The photon-pair source can indeed be operatedby a key provider and situated somewhere in betweenpotential QC customers. In this case, the operator of thesource has no way of getting any information about thekey obtained by Alice and Bob.

It is interesting to emphasize the close analogy be-tween one- and two-photon schemes, which was firstnoted by Bennett, Brassard, and Mermin (1992). In atwo-photon scheme, when Alice detects her photon, sheeffectively prepares Bob’s photon in a given state. In theone-photon analog, Alice’s detectors are replaced bysources, while the photon-pair source between Alice andBob is bypassed. The difference between these schemeslies only in practical issues, like the spectral widths ofthe light. Alternatively, one can look at this analogyfrom a different point of view: in two-photon schemes, itis as if Alice’s photon propagates backwards in timefrom Alice to the source and then forward in time fromthe source to Bob.

A. Polarization entanglement

A first class of experiments takes advantage ofpolarization-entangled photon pairs. The setup, depictedin Fig. 21, is similar to the scheme used for polarizationcoding based on faint pulses. A two-photon source emitspairs of entangled photons flying back to back towardsAlice and Bob. Each photon is analyzed with a polariz-ing beamsplitter whose orientation with respect to acommon reference system can be changed rapidly. Theresults of two experiments were reported in the spring of2000 (Jennewein, Simon, et al., 2000; Naik et al., 2000).Both used photon pairs at a wavelength of 700 nm,which were detected with commercial single-photon de-tectors based on silicon APD’s. To create the photonpairs, both groups took advantage of parametric down-conversion in one or two !-BaB2O4 (BBO) crystals

43Photon-pair sources are often, though not always, pumpedcontinuously. In these cases, the time window determined by atrigger detector and electronics defines an effective pulse.

44In the case of weak pulses, we saw that a full round triptogether with the use of Faraday mirrors circumvents the prob-lem (see Sec. IV.C.2). However, since the channel loss on theway from the source to the Faraday mirror inevitably increasesthe fraction of empty pulses, the main advantage of photonpairs vanishes in such a configuration.

FIG. 21. Typical system for quantum cryptography exploitingphoton pairs entangled in polarization: PR, active polarizationrotator; PBS, polarizing beamsplitter; APD, avalanche photo-diode.

176 Gisin et al.: Quantum cryptography

Rev. Mod. Phys., Vol. 74, No. 1, January 2002

Figure 7: Graphic scheme of the experiment. PR, active polarization rotator; PBS, polarizingbeamsplitter; APD, avalanche photo-diode. Taken from [16].

In Innsbruck, the distance between Alice and Bob analyzers had a length of 360m. Conse-quently, they needed to use a special optical fibers designed for guiding only a single mode at700nm. Each analyzer saved the results of the measurements and later on that information was

31

Page 32: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

put in common following the implemented protocols, one based on Wigner’s inequality [28],which is a specific case of Bell’s inequalities, and the other based on BB84.

On the other hand, Los Alamos’ experiment was a table-top realization that spanned nomore than a few meters, so photons travelled a short free-space distance. In this case, theyemployed the six-state protocol and the E91. For the last, they simulated di↵erent eavesdrop-ping strategies and an increase in the discrepancies between Alice and Bob was clearly observedwhen the information obtained by the eavesdropper increased.

32

Page 33: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

6 Quantum Hacking

The best known attack on a cryptographic system may be the one that involves the Enigmamachine [29]. This system could encrypt any message but also decrypt it. The best minds, AlanTuring among others, worked hardly to decode the machine. Their contribution was invaluableto win World War II. This is a clear example of importance of cryptography in the modernworld.

Nowadays is common to hear about events where security of computer systems is brokenup. This is called hacking. As we have shown above, there are mechanisms to decode securitykeys generated classically. Even though the one-time pad is 100% secure, it is not really usefulif the users are not able to create secret keys steadily. The public-key cryptographic systemmay be more useful. However, the users should be aware that an eavesdropper can decryptthe message in case he finds the way to obtain the inverse of the function that encrypts themessage.

Given that quantum cryptography is based on physical properties and not on mathematicalconjectures, the eavesdropper has to interact with the quantum channel to obtain the key. Thisallows legitimate users to detect him, making the quantum key distribution protocols the mostsecure ones to date. In fact, as we have shown above, Alice and Bob have mechanisms to detectthe presence of an eavesdropper although they never issue the key.

Until now, we have restricted to the ideal case that there are no noises in the transmissionand no defects in the production, reception or analysis, where quantum cryptography protocolsare perfect. On the contrary, implementations use imperfect devices available with currenttechnology and thus, the eavesdropper can access the information.

In 2011 a full-field implementation of a perfect eavesdropper on a quantum cryptographysystem was accomplished in the National University of Singapore [30]. The authors succeededin obtaining the entire ”secret” key while Alice and Bob did not detect any secure breach.

In this experiment, the four-state protocol is realized with polarization encoding and passivebasis choice. Eavesdropper’s analyzers are the same as Bob’s, four linear polarizers in frontof avalanche photodiodes. He has to make Bob to measure in the same basis as him to avoidbeing detected. Therefore, he makes use of a laser diode that blinds Bob’s detectors emittingcontinuous-wave circularly polarized light. For each photon from Alice, he adds a linearlypolarized pulse of the same polarization that has measured when he intercepts Alice’s photon.Only the analyzer chosen by the eavesdropper will detect the reproduced photon, achievingthat Bob obtains the same measurement as his own. In this way, the eavesdropper and Bobobtain the same result sequence, and after Alice communicates her sequence of basis, both Boband the eavesdropper get the key.

This experiment confirms that quantum cryptography can be broken although theoreticalprotocols might be perfect. Therefore, the field of cryptography is not already closed and ithas to be improved to become highly secure.

33

Page 34: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

Pagina en blanco

34

Page 35: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

7 Conclusions

This chapter lists the key results obtained during research conducted in this work. The study ofquantum theory in combination with the theory of information has been developed during thelast decades but even today it is still an open field that has not been fully exploited. This workis just a sample of the wealth of this field, not only for its predictions in theoretical protocolsbut also for the huge variety of applications in which it can be implemented.

In the following we show the conclusions of each section:

• A quantum channel and a classical one are necessary to teleport a quantum state fromone point to another. In case one of them is missing the teleportation protocol can not beapplied. The quantum channel has to consist of two entangled particles. As we have seen,the fidelity of the protocol decreases proportionally to the degree of entanglement of thestate until 66% fidelity of teleportation protocol corresponding to the maximum fidelity ofclassical state. We also demonstrate that the classical channel is essential to accomplishthis protocol because Bob does not obtain any information until Alice communicates theresult of the measurement to him, even if she has already made it.

• We have reviewed two of the most relevant experiments in the field of quantum teleporta-tion. Innsbruck group only succeeded in a 25% of times due to the fact that the employeddevices only could detect the state | �i making the Bell measurement. The experimentwas accomplished using photons polarized in several ways to get a high accuracy. On theother hand, in the experiment realized at NIST, authors made use of trapped ions. Theydemonstrated that this system can attain higher fidelities than one composed of photons,achieving an accuracy of 78%.

• We have shown that classical cryptography is secure nowadays with some methods,namely, the one-time pad and the public-key cryptographic system. However, quan-tum cryptography is based on laws of physics and not on mathematical conjectures. Wehave reviewed the BB84 and the E91 protocols, which are based in quantum propertiesof linear superposition and entanglement respectively. In both we have analyzed the casethat an eavesdropper intercepts the quantum communication and in both cases the le-gitimate users detect the presence of the eavesdropper. In addition, we have studied theE91 protocol in case the quantum channel is not perfect, obtaining when the security isassured as a function of the imperfection of the quantum channel.

• We have shortly reviewed two of the implementations of quantum-cryptography protocols.In these experiments, the authors made use of polarization-entangled photons. In both,two systems succeeded establishing the secure key. Furthermore, in the experiment basedon Ekert’s protocol, the authors introduced an eavesdropper and they observed an increaseof discrepancies in the key when the eavesdropper interacted with the quantum channel.

• Experimental quantum cryptography is not secure yet even though it is safe from atheoretical point of view. The experiment made in Singapore shows how an eavesdropper

35

Page 36: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

can obtain the key without being detected due to the imperfections of employed devices,so it is possible to achieve a perfect attack on a current quantum cryptographic system.

Summarizing, quantum teleportation and quantum cryptography are two fundamental prim-itives of quantum communication that very likely will revolutionize future transmission of in-formation. Framed inside the broad field of quantum information, these protocols, togetherwith quantum computation and simulation, are expected to shape the future technologies ofprocessing and transmission of information. This is likely just the beginning of a new era inInformation and Communication Technologies.

36

Page 37: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

References

[1] E. Solano, El Heraldo de Aragon, 21/7/2011, p. 4.

[2] C. H. Bennett, G. Brassard, C. Crepeau, R. Jozsa, A. Peres, and W. K. Wootters, Phys.Rev. Lett. 70, 1895 (1993).

[3] A. Einstein, B. Podolsky, and N. Rosen, Phys. Rev. 70, 1895 (1993).

[4] M. A. Nielsen and I. L. Chuang, Quantum Computation and Quantum Information, Cam-bridge University Press, Cambridge, U.K. (2000).

[5] R. F. Werner, Phys. Rev. A 40, 4277 (1989).

[6] A. Peres, Phys. Rev. Lett. 77, 1413 (1996).

[7] D. Bouwmeester, J.W. Pan, K. Mattle, M. Eibl, H. Weinfurter and A. Zeilinger, Nature390, 575 (1997).

[8] D. Boschi, S. Branca, F. De Martini, L. Hardy, and S. Popescu, Phys. Rev. Lett. 80, 1121(1998).

[9] M. D. Barrett, J. Chiaverini, T. Schaetz, J. Britton, W. M. Itano, J. D. Jost, E. Knill, C.Langer, D. Leibfried, R. Ozeri and D. J. Wineland, Nature 429, 737 (2004).

[10] M. Riebe, H. Ha↵ner, C. F. Roos, W. Hansel, J. Benhelm, G. P. T. Lancaster, T. W.Korber, C. Becher, F. Schmidt-Kaler, D. F. V. James and R. Blatt, Nature 429, 734(2004).

[11] X. Ma, et al, eprint arXiv:1205.3909.

[12] H. Ha↵ner C.F. Roos and R. Blatt, Phys. Rep. 469, 155 (2008)

[13] M. Lukin, Quantum Optics Course, Harvard University, Cambridge, USA.

[14] E. Solano, C. L. Cesar, R. L. de Matos Filho and N. Zagury, Eur. Phys. J. D 13, 121(2001).

[15] A. Galindo and M. A. Martın-Delgado, Rev. Mod. Phys. 74, 347 (2002).

[16] N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Rev. Mod. Phys. 74, 145 (2002).

[17] C. E. Shannon, Bell System Technical Journal, 28, 656 (1949).

[18] R. Rivest, A. Shamir and L. Adleman, Communications of the ACM 21, 120 (1991).

[19] P. W. Shor, 35th Annual Symposium on Foundations of Computer Sciene, IEEE Press,Los Alamitos, CA (1995).

[20] S. Wiesner, SIGACT News, 15, 1 (1983).

37

Page 38: Quantum Teleportation and Quantum Cryptography · Quantum cryptography consists in the study of secure communication making use of quan-tum properties. In this section we show how

[21] C. H. Bennett and G. Brassard, Proceedings of IEEE International Conference on Com-puters, Systems and Signal Processing, IEEE press, 175 (1984).

[22] A. K. Ekert, Phys. Rev. Lett. 67, 661 (1991).

[23] J. F. Clauser, M. H. Horne, A. Shimony and R. A. Holt, Phys. Rev. Lett. 23, 880 (1969).

[24] J. S. Bell, Physics 1, 195 (1965).

[25] T. Jennewein, C. Simon, G. Weihs, H. Weinfurter, and A. Zeilinger, Phys. Rev. Lett. 84,4729 (2000).

[26] D. S. Naik, C. G. Peterson, A. G. White, A. J. Berglund, and P. G. Kwiat, Phys. Rev.Lett. 84, 4733 (2000).

[27] W. Tittel, J. Brendel, H. Zbinden, and N. Gisin, Phys. Rev. Lett. 84, 4737 (2000).

[28] E. P. Wigner, Am. J. Phys. 38, 1005 (1970).

[29] A. Hodges, Alan Turing: The Enigma, Vintage Books, London, U.K. (1983).

[30] I. Gerhardt, Q. Liu, A. Lamas-Linares, J. Skaar, C. Kurtsiefer and V. Makarov, Nat. Com.2, 349 (2011).

38