Документ взят из кэша поисковой машины. Адрес оригинального документа : http://qi.phys.msu.ru/papers/2007-nato-11-123.pdf Дата изменения: Tue Mar 13 12:10:54 2007 Дата индексирования: Mon Oct 1 19:45:55 2012 Кодировка:

Security of Quantum Key Distribution Protocol Based on Ququarts
Alexander P. SHURUPOV 1 , and Sergei P. KULIK Faculty of Physics, Moscow M.V.Lomonosov State University
Abstract. We discuss the security of QKD protocol with four-state system based on single spatial and frequency non-degenerate down converted photons. Simple schemes for biphoton generation and their deterministic measurements are analyzed. Three main incoherent attacks (intercept-resend, intermediate basis and optimal attack) on QKD protocol in Hilbert space with dimension D = 4 using three mutually unbiased bases were analyzed. It has been shown that QKD protocol with four-dimensional states belonging to three mutually unbiased bases provides better security against the noise and eavesdropping than protocols exploiting two bases with qubits and ququarts. Keywords. Biphotons, quantum key distribution, security

Introduction Quantum Key Distribution (Quantum Cryptography) allows one to organize key sharing, security of which is guaranteed by principal laws of physics - quantum mechanics [1,2,3]. Extended BB84 protocols The idea of QKD using 4 states belonging to 2 mutually unbiased bases was proposed in [2]. The first extension of this protocol to higher dimension D > 2 was proposed by Peres and Bechmann-Pasquinucci in [4]. According to [4] quantum states, in which information is encoded, belong to four mutually unbiased bases, each containing three elements. By definition vectors belonging to mutually unbiased basis satisfy the following conditions: 1. | ei |ej |2 = 1/D, when |ei and |ej are members of different bases. 2. | ei |ej |2 = 0 when i = j and | e i |ei |2 = 1 for members of the same basis. It was shown, that for three-level systems, full protocol requires 12 states and fourlevel protocol requires 20 states. In case of D = 4 it was found, that in practice one can relatively easily prepare 12 states based on the polarization states of two-photon field and belonging to three mutually unbiased basis [5,6]. Considering this fact, we analyze the protocol with M = 3 mutually unbiased bases in four-dimensional Hilbert space.
1

E-mail: msu.msk@gmail.com.


1. Eavesdropping analysis To identify the eavesdropping attempt Alice and Bob open small part of their raw key for comparison. Results of such comparison allow one to estimate the error rate. Errors may be caused either by physical noise and/or by presence of eavesdropping. We concentrate our attention on incoherent attacks; namely, we assume that the eavesdropper interacts with a single four-dimensional quantum system at a time. In most cases Eve wants to make her attack symmetric, so the disturbance is not distinguishable from the environmental noise. In our work three incoherent attacks are analyzed: intercept-resend strategy, attack in the intermediate basis [7] and optimal attack [8]. Briefly summarizing our results, we can say that the intercept-resend strategy is the most simple one and can by applied to any QKD protocol, but it does not give very much information, while producing considerable noise. Attack in the intermediate basis gives eavesdropper probabilistic information, it causes less disturbance, but such strategy cannot be applied for protocols, that use more than two mutually unbiased bases. Last examined strategy is the optimal one with respect to the mutual information shared between Alice and Eve, I AE , for some given disturbance D. Finally we will compare the robustness against eavesdropping for the various protocols.

Figure 1. Effectiveness of optimal eavesdropping strategy for various protocols.

Protocol remains secure as far as the mutual information shared between legitimate users IAB is greater than the information accessible to eavesdropper I AE . Figure 1 shows that protocol with 3 mutually unbiased basis is more secure, because Eve introduces more disturbance to gain the same amount of information. Figure 2 presents key distribution rate vs. disturbance, introduced with optimal strategy. Disturbance D c , corresponding to zero rate, is critical for given protocol. When estimated error rate in raw key D e exceeds Dc , the secrecy of key can no longer be guaranteed.


Figure 2. Key distribution rate.

The greater number of bases is used, the larger part of raw key is discarded in initial key clean-up phase. This figure also shows that the higher the dimension and the more mutually unbiased bases are used the greater critical disturbance is [9]. This allows one to use noisy channel for QKD and not to be afraid of being compromised.

2. Discussions 2.1. Two qubits ?= ququart Consider two qubits 1 = a1 |0 + b1 |1 and 2 = a2 |0 + b2 |1 coexisting together. Their wave function is given by superposition of four orthogonal vectors existing in fourdimensional Hilbert space:

= 1 2 = a1 a2 |00 + a1 b2 |01 + b1 a2 |10 + b1 b2 |11 It is obvious that in the general case arbitrary four level system (pure) state is not factorized, i.e. represents an entangled pure state of two qubits: = c1 |00 + c2 |01 + c3 |10 + c4 |11 = 1
2

(1)

Factorizing criterion of Eq. (1) is equality of c 1 c4 and c2 c3 (c1 c4 = c2 c3 ). From a practical point of view, generation of an arbitrary entangled state of two qubits is much more complicated than generation of two independent qubits. That is why in work [5] simple method to generate 12 states of ququarts was proposed.


3. Polarization ququarts for QKD protocol The complete QKD protocol with four-dimensional polarization states exploits five mutually unbiased bases with four states in each. In terms of biphoton states, the first three bases consist of product polarization states of two photons and the last two bases consist of two-photon entangled states: I. |H1 H2 ; II. |D1 D2 ; III. |R1 R2 IV . |R1 H2 |L1 H2 + V. |H1 R2 |H1 L2 + |H1 V2 ; |V1 H2 ; |V1 V2 , |D1 D2 ; |D1 D2 ; |D1 D2 , ; |R1 L2 ; |L1 R2 ; |L1 L2 , + |L1 V2 ; |R1 H2 -|L1 V2 ; |R1 V2 ; |L1 H2 -|R1 V2 , + |V1 L2 ; |H1 R2 -|V1 L2 ; |V1 R2 ; |H1 L2 -|V1 R2 .

(2)

1 1 Here |H |1 , |V |0 , |D 2 (|1 + |0 ), D 2 (|1 - |0 ), 1 1 |R 2 (|1 + i|0 ), |L 2 (|1 - i|0 ) indicate horizontal, vertical, +45 linear, -45 linear, right- and left-circular polarization modes respectively. Lower indices numerate the frequency modes of the two photons. It has been proved [10,11] that it is sufficient to use only first two or three bases for the efficient QKD. Using an incomplete set of bases one sacrifices the security but enhances the key generation rate. Since the fulfilment of Bell measurements for the last two bases requires a big experimental effort on both preparation and measurement stages of a protocol, we will restrict ourselves to first three bases. The states from the first three bases can be prepared with the help of a single non-linear crystal and local unitary transformations so it is quite easy to do in experiment. This is a fundamental difference in comparison with biphotons-qutrits [12], for which SU(2) transformations between states from mutually unbiased bases are prohibited. Another advantage of the ququarts is possibility to distinguish the states belonging to one basis deterministically thus allowing its implementation in QKD protocol with polarization ququarts.

3.1. Experimental procedure. The sketch of the experimental setup for the generation of ququart states that belong to the first three bases (2) is shown in Fig. 3.

Figure 3. Setup for preparation of ququarts which can be used in QKD. Wave plates DP1, DP2 oriented at 45 degrees with respect to the vertical axis serve as the dichroic retardation plate with variable optical thickness which is controlled by tilting angle . Two zero-order plates ZP1, ZP2 allow one to choose the basis.


As an example let us consider , the preparation of state |H 1 V2 from initial state |V1 V2 . This transformation can be done by a so-called dichroic wave plate which acts at different wavelengths. In particular it introduces a phase shift of 2 for a vertically polarized photon, and a phase shift of for the conjugated photon. The wave plate is oriented at 45 to the vertical direction. Since such wave plates are not readily available and the result of transformation is extremely sensitive to small variations of thickness, one can use the following method to achieve the desired thickness. Two quartz plates (DP1) and (DP2) with the orthogonally oriented optical axes are placed consecutively in the biphoton beam. The consecutive action of these two wave plates corresponds to the action of quartz wave plate with an effective thickness. If then one can tilt these wave plates towards each other by a finite angle , then the optical thickness of the effective wave plate, formed by DP1 and DP2 will change, and, at a certain value of , the desired transformation will be achieved. In order to change the basis from I to II (III ), zero order half- (quarter)- wave plates ZP 1 (ZP 2) oriented at 22.5 (45 ) were used. This procedure is repeated for the generation of any of the states. At the same time there is a method which allows one to distinguish unambiguously all biphoton states forming chosen bases. The measurement set-up that solves this problem and that has been already tested in our experiments is shown in Fig. 4.

Figure 4. Measurement part at Bob's station.

It consists of the dichroic mirror, separating the photons with different wavelengths, and a pair of polarization beam-splitters, separating photons with orthogonal polarizations. The four-input double-coincidence scheme linked with the outputs of singlephoton detectors registers the biphotons-ququarts. For example, for the first basis the scheme works as follows, provided that Bob's guess of the basis is correct: if the state |H1 H2 comes, then detectors D4, D2 will fire, if the state |H1 V2 comes, then detectors D4, D1 will fire, if the state |V1 H2 comes, then detectors D3, D2 will fire, if the state |V1 V2 comes, then detectors D3, D1 will fire. The same holds for any of the remaining correctly guessed bases, since the quarter- and half- wave plates transform the polarization into HV basis in which the measurement is performed. The registered coincidence count from a certain pair of detectors contributes to the corresponding diagonal component of the density matrix. So if the basis is guessed correctly, then the reg-


istered coincidence count deterministically identifies the input state. The main obstacle for the practical implementation of free-space QKD protocol based on ququarts is that one needs o perform fast polarization transformation at the selected wavelengths. There are different ways of overcoming this problem and we will discuss them elsewhere. In this section we mention briefly the possible ways. Since it is not practical to tune the tilting wave plates every time one wants to encode a ququart value, we suggest either using a polarization modulator that operates on two wavelengths or splitting the photons with dichroic mirrors and perform these transformations on halves of a biphoton independently in a Mach-Zehnder-like configuration. It is important to note that interferometric accuracy in Mach-Zehnder interferometer is not needed, since it is used only for spatial separation of photons. The practical solution would be to couple the down converted photons in a single mode fiber to ensure a perfect spatial mode overlap and then to split them with wavelength division multiplexer (WDM). Then, the switching between the states can be done with the polarization modulators that introduce a or 2 phase shifts for the selected wavelength. The choice of basis on Alice's side is done by a zero order quarter- and half- wave plates, which be realized within Pockel (Liquid Crystal) cell driven by randomly selected voltage. Free space communication is proposed since it is not practical to distribute a polarization state within an optical fiber. On Bob's side, the random choice of basis (RNG) is performed in the same way as on Alice's side. Then the photons are spatially separated with the help of WDM or a dichroic mirror and each of the photons is sent to Brown-Twiss scheme with a polarizing beam-splitter that projects an arrived photon on H or V state as it is shown in Fig. 4. Moreover, registering coincidences allows one to circumvent the problem of the detection noise that is common for single-photon based protocols. If the coincidence window is quite small, it is possible to assure a lower level of accidental coincidences for the usual dark count rate of single photon detectors. This point is discussed in the next section. The question arises, whether one can use for QKD single photon states obtained independently and propagating in same spacial mode instead? It can be shown, that such method of key generation is similar to utilizing two BB84 protocols. Indeed the scheme presented on Fig. 4is just a combination of two Bob's measurement schemes used typically for polarization version of BB84 protocol. In particular this can be done for increasing key generation rate (as compared to single protocol), but there is no gain in secrecy. Schematic presentation of time scale for two independent photon sources is shown in Fig. 5. Each dot visualizes the presence of photon in appropriate time window.

Figure 5. Two photons packets propagate independently. Mean photon number µ 0.1

For the dimension of Hilbert space to be four, only results when both photons are detected must be kept on measuring stage, and all other results should de discarded. Only that case when the pair of independent photons appears in given time slot and proposed


above biphoton are equivalent. But the main problem is that there are no readily available single photon sources at the moment. In most cases faint laser pulses with small mean photon number (µ 0.1) are used. However when such single photon sources are used the probability to create simultaneously (or in two predefined time windows) two photons from different sources is extremely small (p µ 2 10-2 ). This context makes such photon pairs practically useless for quantum key distribution in four-dimensional case. Schematic presentation of time scale for biphoton source is shown in Fig. 6. Each dot pair visualizes presence of a biphoton in the corresponding time window.

Figure 6. Biphotons packets propagatation. Mean biphoton number µ 0.1

3.2. Coincidence scheme Some remarks about the measurement scheme should be made. The most practical choice for single photon detector is an avalanche photodiode, working in gated mode. In rough approach APD can be characterized only by two parameters: - quantum efficiency and p - dark count probability for one strobe with length . Standard biphoton measuring setup based on the Brown-Twiss scheme is shown in Fig. (7). This setup allows one to split two orthogonal polarization states of biphoton, namely |H1 and |V2 ones. To distinguish completely between other polarization states belonging to the bases introduced above it is sufficient to insert either half- or quarter wave plates in front of the polarization beam-splitter.

Figure 7. Biphoton measuring scheme.

In the simplest case the coincidence scheme can be considered as logical "AND" element. Output signal appears only when both detectors fire in a fixed time window T c . Owing to the fact that the probability distribution of the number of biphotons per pulse is given by Poissonian distribution, the mean biphoton number per pulse should be made rather small, for example, µ = 0.1 like in the standard QKD single-photon sources. Now we can introduce some crucial parameters and make several estimations: · Biphoton registration probability P S = µ 2 .


· Probability to get signal, caused by dark counts coming from both detectors, simultaneously PSN = (1 - µ)p2 . The typical value is about of p 10 -4 , so this probability is negligibly small. · Probability of "half" biphoton registration, when one detector clicks ( ), another misses photon (1 - ) but still the dark count arises (p). Such probability is given by PSN = µ · (1 - ) · p. This event gives us some information about biphoton, but for some purpose we can also consider it as a noise. The same values for simple single photon measuring scheme are given by P S = µ (1) and PS = (1 - µ)p. Now we can calculate signal-to-noise ratio for single-photon measurement and µ biphoton schemes. For single-photon scheme we get (S/N ) 1 = (1-µ)p and for two photon scheme we get (S/N ) 2 = (1-)p . One can notice that the second value increases to very great numbers when detectors quantum efficiency tends to unity. This happens because only coincidence events are counted. Now we can estimate how much signal-tonoise ratio for two-photon scheme exceeds the same value for single-photon scheme: 1 1-µ (S/N )2 · = (S/N )1 µ 1- . Fig. 8 shows the ratio versus detectors quantum efficiency. It is seen clearly that the ratio grows with remaining to be larger than unit even for small values of . For typical values of =0.1 the signal-to-noise ratio for two-photon four-state protocol still exceeds the single-photon ratio as much as one order of magnitude that demonstrates the advantage of high-dimensional systems for QKD purposes.
(1)

Figure 8. Relation of signal-to-noise ratios for two-photon and one-photon schemes when µ = 0.1.

3.3. Mapping onto a two-dimensional key In this section we will follow the logic of the paper [10]. Let's encode four quarts in pairs of bits, for example, = 00, = 01, = 10, and = 11. Like in [10] we give


an example showing that Alice and Bob have to be careful about when they perform the translation from high dimension alphabet into the lower dimensional one and vice versa. Suppose that protocol with three mutually unbiased bases in four-dimensional Hilbert space was used and the eavesdropper has used the intercept-resend algorithm. In this case Eve will get each quart correctly with probability 1/2 . This means that on average Eve will have one half of quarts correctly. At the same time she does not know which ones she got correctly and which ones were wrong. Suppose that Alice has sent the following string of , , , and : ... but that Eve has the string ... One can see that 6 out of 12 are wrong in Eve`s string or that she has 1 , i.e half 2 quarts correct. Let us now assume that Alice and Bob want to map the four-dimensional key onto a binary one. Using the encoding given an above example Alice has s new string: 00 01 10 11 01 10 01 00 01 01 11 00... Performing the same operations with her sequence of quarts, Eve extracts 00 10 10 11 01 11 01 01 01 11 00 10... 8 This string contains 24 bits to be wrong, or two out of three bits correct. It happens because the errors occurring in Eve`s string are no longer independent, but depend on each other in the respective blocks. That is why Alice and Bob have to perform error correction and privacy amplification processes with the higher alphabet. Final decoding into the bits must be done after finishing these processes in order to prevent extracting information by eavesdropper.

Conclusion Utilization of biphotons as quantum information carriers in many-state QKD protocols allows one to increase key generation rate as well as robustness of protocols against possible attacks. To do this one can approach the simplest (from experimental point of view) choice of product biphoton states belonging to three mutually unbiased bases.

Acknowledgments Stimulating discussions with H.Zbinden and H.Weinfurter are gratefully acknowledged. This work was supported in part by Russian Foundation of Basic Research (project 0602-16769a) and Leading Russian Scientific Schools (project 4586.2006.2).

References
[1] [2] [3] [4] S. Wiesner, SIGACT News 15, 78 (1983). C.H. Bennett, G. Brassard, Int. Conf. on Computers, Systems and Signal Processing, Bangalore, India (IEEE, New York, 1984), p. 175. W.K. Wootters, W.H. Zurek, Nature 299, 802 (1982). H. Bechmann-Pasquinucci, A. Peres, Phys. Rev. Lett. 85, 3313 (2000).


Yu.I. Bogdanov, E.V. Moreva, G.A. Maslennikov, R.F. Galeev, S.S. Straupe, S.P. Kulik, Phys. Rev. A 73, 063810 (2006). [6] G.A.Maslennikov, E.V.Moreva, S.S.Straupe, and S.P.Kulik, Phys. Rev. L 97, 023602 (2006). [7] C. Bennett, F. Bessette, G. Brassard, et al., J. Cryptology 5, 3 (1992). [8] F. Caruso, H. Bechmann-Pasquinucci, C. Macchiavello, Phys. Rev. A 72, 032340 (2005). [9] N. Cerf, M. Bourennane, A. Karlsson, N. Gisin, Phys. Rev. Lett. 88, 127902 (2002). [10] H. Bechmann-Pasquinucci, W.Tittel, Phys. Rev. A 61, 062308 (2000). [11] M. Bourennane, A. Karlsson, G.BjЖrk, Phys. Rev. A 64, 012306 (2001); N. Cerf, M. Bourennane, A. Karlsson, N. Gisin, Phys. Rev. Lett. 88, 127902 (2002); F. Caruso, H. Bechmann-Pasquinucci, C. Macchiavello, Phys. Rev. A 72, 032340 (2005). [12] Yu. Bogdanov, M. Chekhova, L. Krivitsky, S.P. Kulik, L.C. Kwek, M.K. Tey, C.Ch.Oh, A.A. Zhukov, Phys. Rev. A 70, 042303 (2004).

[5]