Äîêóìåíò âçÿò èç êýøà ïîèñêîâîé ìàøèíû. Àäðåñ îðèãèíàëüíîãî äîêóìåíòà : http://qi.phys.msu.ru/papers/2010-jetp(e)-110-561.pdf Äàòà èçìåíåíèÿ: Wed Oct 27 13:54:58 2010 Äàòà èíäåêñèðîâàíèÿ: Mon Oct 1 19:53:01 2012 Êîäèðîâêà:

ISSN 1063 7761, Journal of Experimental and Theoretical Physics, 2010, Vol. 110, No. 4, pp. 561­567. © Pleiades Publishing, Inc., 2010. Original Russian Text © A.V. Korol'kov, K.G. Katamadze, S.P. Kulik, S.N. Molotkov, 2010, published in Zhurnal èksperimental'no i Teoretichesko Fiziki, 2010, Vol. 137, No. 4, pp. 637­645.

ATOMS, MOLECULES, OPTICS

On the Passive Probing of Fiber Optic Quantum Communication Channels
A. V. Korol'kova, K. G. Katamadzeb, S. P. Kulikb, and S. N. Molotkova,c,d
Academy of Cryptography of the Russian Federation, Moscow, 121552 Russia e mail: sergei.kulik@gmail.com b Faculty of Physics, Moscow State University, Moscow, 119899 Russia Institute of Solid State Physics, Russian Academy of Sciences, Chernogolovka, Moscow oblast, 142432 Russia d Faculty of Computational Mathematics and Cybernetics, Moscow State University, Moscow, 119899 Russia
Received September 4, 2009
a

c

Abstract--Avalanche photodetectors based on InGaAs:P are the most sensitive and only detectors operating in the telecommunication wavelength range 1.30­1.55 µm in the fiber optic quantum cryptography systems that can operate in the single photon count mode. In contrast to the widely used silicon photodetectors for wavelengths up to 1 µm operating in a waiting mode, these detectors always operate in a gated mode. The pro duction of an electron­hole pair in the process of the absorption of a photon and the subsequent appearance of an avalanche of carriers can be accompanied by the inverse processes of the recombination and emission of photons. Such a backward emission can present a potential serious problem for the stability of fiber optic quantum cryptography systems against passive probing. The results of analyzing the detection of backscat tered radiation are reported. The probability of such an emission has been estimated. DOI: 10.1134/S1063776110040023

1. INTRODUCTION Within the last decade, the transmission of confi dence information using quantum states has been developed from theoretical ideas to real engineering solutions and sometimes to technologies [1­3]. The security of keys in quantum cryptography is based on fundamental quantum mechanical exclusions rather than on engineering or computational restrictions. Quantum cryptography implies that only transmitter and receiver communication sides are controlled, whereas a quantum communication channel through which quantum states are transmitted is not controlled and is available for any active manipulations and mod ifications by an eavesdropper up to a change of the channel to another, more perfect communication channel. In addition, it is assumed that actions of the eavesdropper are not limited by engineering capabili ties, but are restricted by the fundamental quantum mechanical laws associated with the constraints on the
1

1

2

distinguishability of nonorthogonal quantum states. Any attack on the communication channel in order to obtain information of a transmitted quantum state results in its perturbation and appearance of errors on the receiver side. In real imperfect systems, errors on the receiver side appear even in the absence of the eavesdropper. For each quantum key distribution pro tocol, there is a critical error up to which the key can be distributed with guaranteed security. Since errors induced by own noise and errors induced by the eaves dropper are fundamentally indistinguishable, all the errors should be attributed to the action of the eaves dropper. In fiber optic quantum cryptography systems, a source of quantum states is not strictly single pho ton, the communication channel is imperfect and has losses, and avalanche photodetectors have own dark noise and a finite quantum efficiency (<100%). Long term and detailed investigation [1­3] indicate that even when the eavesdropper has access only to the communication channel, quantum cryptography
3

3

4

More precisely, quantum cryptography makes it possible to dis tribute secure keys by means of which confidence information can then be transmitted. 2 A real quantum communication channel is a usual single mode fiber through which single photon (or quasi single photon) states are transmitted. If a classical optic signal (e.g., synchroni zation pulses) is transmitted, this communication channel oper ates as a classical communication channel.

The security in quantum cryptography is formally based on a simple mathematical fact that a pair of noncommuting observ ables, Hermitian operators, cannot have a common system of eigenvectors; this statement is a reformulation of the Heisenberg uncertainty relations. 4 Strongly weakened laser radiation, which is a coherent state with a Poisson distribution of the number of photons, is used as such a source.

561


562 Transmitter side MZ1 L

KOROL'KOV et al. QC Receiver side MZ2
D1 D2

PM1

PM2

L D
E

E

D

E

Passive probing

Active probing
Fig. 1. Typical fiber optic quantum cryptography scheme: MZ1 and MZ2 are the unbalanced Mach­Zehnder interferometers, PM1 and PM2 are the phase modulators, L is the laser, D1 and D2 are the avalanche photodetectors, QC is the quantum com munication channel, and LE and DE are the laser and photodetectors of the eavesdropper.

ensures security of distributed keys if the length of the communication channel does not exceed a certain critical value. It is assumed that the capabilities of the equipment of legal users are limited by the current technological level, whereas the eavesdropper has no engineering restrictions. For example, the eavesdrop per can have a long term quantum memory yet unim plemented, perfect photodetectors with dark noise and 100% quantum efficiency, can change the existing imperfect quantum communication channel to an ideal communication channel and perform noninva sive measurements of the number of photons in the communication channel. Even under such condi tions nonequivalent in technical level, when the eaves dropper does not have access to the receiver and trans mitter sides and has access only to the communication channel, quantum cryptography ensures the security of distributed keys. 2. TYPES OF ATTACKS ON THE DISTRIBUTED KEY Two types of attacks, active and passive, are possi ble. In active attacks, the eavesdropper either modifies transmitted quantum states or actively probes the states of the receiver and transmitter sides by his signal. In passive attacks, the eavesdropper does not use his probe signals. Direct access to the communication channel. If the eavesdropper has access only to the quantum commu nication channel through which quantum state are transmitted, for each quantum key distribution proto col, there is an attack that is optimal for the eavesdrop per and involves the modification of quantum states.
5

5

Noninvasive and nondemolition measurements of the number of photons (rather than their state) with 100% efficiency are not forbidden in quantum mechanics. However, such measurements have not yet been implemented.

This attack is optimal, because it provides the maxi mum information for the eavesdropper at an error observed at the receiver side. To implement such an optimal attack, the eavesdropper should have a quan tum memory and perform collective measurements of an entire sequence of quantum states. Such an attack has not yet been implemented entirely; only partial results were reported [4]. Such an attack is an active attack on the distributed key and the modification and perturbation of transmitted quantum states inevitably occur and are detected on the receiver side. Indirect access to the receiver and transmitter sides. In reality, the transmitter and receiver sides are not completely isolated from the environment. They are inaccessible to the eavesdropper directly, but can be accessible indirectly through the quantum communi cation channel (optic fiber). Both active and passive attacks are possible. Such attacks do not involve the modification and measurement of transmitted quan tum states and, consequently, do not provide errors in the information sequence. One of the types of active attacks involves the active probing of the transmitting equipment. The prepara tion of quantum states on the transmitter side, e.g., for quantum cryptography systems with the most often applied phase encoding method [2] uses an active fiber optic element, phase modulator (see Fig. 1). For this reason, if the state of the phase modulator in each package is known, the transmitted quantum state and corresponding key bit are known. The phase modula tion is implemented by applying a voltage to the phase modulator, which changes the optical length, leading to the appearance of an addition phase difference in the superposition of quantum states localized in differ ent time windows (see Fig. 1). This change in the opti cal length of the phase modulator can be detected by measuring the reflected external probe radiation (see Fig. 1) as this is made in the optical reflectometry method with time or phase resolution. Such an active probing of the state of the transmitter side does not
Vol. 110 No. 4 2010

JOURNAL OF EXPERIMENTAL AND THEORETICAL PHYSICS


ON THE PASSIVE PROBING OF FIBER OPTIC QUANTUM COMMUNICATION

563

provide the perturbation of transmitted quantum states and errors on the receiver side. However, this attack is detected by an additional control detector on the transmitter side. Such an active attack can also be blocked by other methods. A similar active probing of the state of the phase modulator on the receiver side is possible. It is easy to understand that such a probing at any intensity of a probe pulse (from single to multiphoton) provides errors on the receiver side at any level of the probe sig nal, because the probe signal of any intensity can with a certain probability be detected in the avalanche detectors. Since the probe signal is not coupled with transmitted states, errors inevitably appear in the information sequence. One of the types of active probing is the technique of blinding of avalanche photodetectors [5]. However, such a probing is also easily detected by means of a control classical detector on the receiver side. In addition to active attacks, where an external optical probe signal is used, passive probing is possible. Such a passive probing, which involves the detection of radiation from active optical elements on the receiver side, is discussed below. Avalanche detectors, which are mesa heterostruc tures based on InGaAs:P, are used as single photon detectors in the optical wavelength range 1.30­ 1.55 m in all of the operating fiber optic quantum cryptography systems. We emphasize that this type of detectors is an only type of the detectors acceptable for fiber optic quan tum cryptography systems. For this reason, the analy sis of passive probing--backward emission accompa nying the detection of photons--is very important for the cryptographic resistance of fiber optic quantum cryptography systems. It is necessary to estimate the upper bound for the probability of backward emission. The security of keys is ensured in any case if the prob ability of backward emission is smaller than unity (a backward emission event does not necessarily accompany each photon detection event). The upper bound of the probability of backward emission pro vides a value of the additional compression of keys as compared to the case where such emission is absent. We again emphasize that security is ensured in any case at any probability of backward emission smaller than unity. The absorption of a photon gives rise to the cre ation of an electron­hole pair; then, this pair is accel erated inside a structure owing to the applied voltage and generates an avalanche of carriers providing a cur rent pulse at the output, which is detected. We empha size that detectors in the telecommunication wave length range 1.30­1.55 m, which are used in quan
6

6

tum cryptography systems, operate in the gated mode in order to reduce dark noise. The inverse reemission process owing to the recombination of carriers from the avalanche is also possible. This radiation can be detected beyond the receiver side through the fiber optic quantum commu nication channel. Since a pair of avalanche photode tectors is used in real quantum cryptography systems (see Fig. 1), radiation from them can be slightly differ ent (e.g., in the spectral content) and the detection of such a radiation provides a certain information on the distributed key. Such an attack is passive; thus, it does not provide errors on the receiver side and cannot be detected by any instruments. For this reason, it is very dangerous. A single photon avalanche detector in the tele communication wavelength range 1.30­1.55 m is a complex unique device. Such an investigation of the passive probing of the quantum communication chan nel is a complex fine problem and, as far as we know, has not yet been performed. Only the experiments on the detection of backscat tered luminescence on Si photodetectors near 0.8 m are known. Such a luminescence was detected with the use of a special optical scheme in an air (not fiber optic) variant for collection of backscattered radiation [8]. 3. PASSIVE PROBING OF AVALANCHE DETECTORS Single photon avalanche photodetectors devel oped by our team were used in the experiments [9] (see Figs. 2, 3). Figure 2 shows the scheme of the experi ment, where one detector is a master detector and the second detector is a driven detector. The detectors were synchronized from a common external generator with a frequency of 1 MHz (a gate pulse can also be triggered from an internal generator). The gate pulse duration was 5 ns (the range of possible gate pulse durations is 1.8­12.0 ns) with an amplitude of up to 7 V. The typical breakdown voltage for these 547NT chips (JDS Uniphase Corporation) was 62 V. To cut off parasitic electron noise, the discrimination of the output signal from the avalanche detector was used; the voltage range of the discriminator is 0­400 mV. The range of the delays of the gate pulse with respect to the synchronization pulse was 0­12 ns. The optical inputs of the detectors were directly coupled with a standard patch cord of a SMF 28 fiber with a length of 1.14 cm. To avoid parasitic flashes for the driven pho
7

7

Finer situations are possible when the form of probe radiation is associated with partial information obtained on the transmitted quantum state. We do not consider such attacks here.

Superconducting NbN detectors are actively developed [6]. They have a number of potential advantages such as the absence of afterpulsing and higher operation frequencies (up to 40 GHz). However, it is worth noting that, using new circuit technology [7], the signal detection frequency of avalanche pho todiodes is increased to 10 GHz (with the active suppression of afterpulsing); thus, the advantage in frequency is reduced, whereas avalanche photodetectors that do not require low tem peratures remain usable. Vol. 110 No. 4 2010

JOURNAL OF EXPERIMENTAL AND THEORETICAL PHYSICS


564 Illumination

KOROL'KOV et al.

Optic fiber Master detector Driven detector Computer

Synchronized generator

Fig. 2. Scheme of the experiment.

pulse. Moreover, the driven detector was additionally shaded in order to exclude parasitic illumination. The optical isolation of the driven detector against illumi nation from the master detector was tested at switched on and switched off illumination of the master detector, which was switched out in this case. Several series of the experiments were performed in order to determine the mutual effect of all the possible factors. 4. PASSIVE PROBING 4.1. Scanning of Delay The bias voltage on the master detector was chosen such that illumination ensures a sufficiently large number of photocounts, but does not result in blinding of the detector. Table 1 presents the operating param eters of the detectors. Scanning of the delay of the driven detector was performed. The averaging time was 1 s. The total time of the measurement was 17 min. Three delay values on the driven detector were speci fied once per 13 s. A value of 6.5 ns corresponds to the condition of the total matching of the gate time of the driven detector and the arrival time of emitted photons from the master detector. The condition of the com plete coincidence of the times of the imposition of the gate pulse and time of the possible arrival of a photon is called below the synchronism condition. Two other
8

8

Fig. 3. Experimental equipment for investigating passive probing.

todetector, the avalanche photodiode of the master detector was illuminated directly through the shield of the optic fiber pigtailed to the detector. The delay of the generation of the gate pulse on the driven detector with respect to the gate pulse on the master detector was chosen such that a photon emitted in the gate win dow on the master detector arrives at the driven detec tor exactly at the time of the generation of the gate
Table 1 Parameter Gate duration, ns Discrimination threshold, mV Bias voltage, V Count number, s­1 Photodiode temperature, K Master detector 5 258 55 530 000 (10) 228 Driven detector 5 257 53.9 200 228

In contrast to the experiments [8] on silicon photodetectors operating in a wait mode rather than in the gated mode, the coincidence circuit is not required, because all the counts of both photodetectors are matched with the synchronization pulses. For this reason, to detect an additional signal associated with the detection of radiation from the master detector, it is sufficient to detect a change in the average number of counts in the presence and absence of illumination of the driven detector. The coincidence scheme is required for the reliable matching of emission­detection events by two detectors in the experiments [8] with silicon photodetectors operating in a waiting mode. Vol. 110 No. 4 2010

JOURNAL OF EXPERIMENTAL AND THEORETICAL PHYSICS


ON THE PASSIVE PROBING OF FIBER OPTIC QUANTUM COMMUNICATION Table 2 Delay of the master detector Average count number, s­1 Standard deviation No synchronism, 2 ns 206.0059 0.96426 Synchronism, 6.5 ns 207.0296 0.94652

565

No synchronism, 13 ns 206.2870 0.95905

delay values of 2 and 13 ns corresponded to the with drawal from the synchronism regime. The number of counts in the absence of illumina tion is presented in the parentheses in the tables. The number of dark counts of the master detector was 2 â 10­4 counts per gate at the 20­25% quantum effi ciency of the detector. The results are presented in Table 2. According to this table, the maximum number of counts is observed under the synchronism condi tions, but excess is within the statistical error. In the next series of the experiments, scanning of the delay of the master detector was also performed. The parameters are given in Table 3. The dark count rate of the master detector was reduced to 3 â 10­5 counts per gate owing to a decrease in the bias voltage. Scanning was performed for two delay values-- 6.5 ns (synchronism condition) and 11 ns (absence of synchronism, mismatch in delays)--each for 500 s; the total measurement time was 59 min. The measure ment results are presented in Table 4, where it is seen that the maximum count number is observed under the synchronism conditions, but excess is within the statistical error. 4.2. Scanning of the Bias Voltage of the Master Detector We present also two series of the experiments with scanning of the bias voltage of the master detector. The master detector can be switched off (dark counts and counts in the presence of illumination are absent; i.e., the detector is passive) by reducing the bias voltage. The cutoff voltage was taken to be 49 V; in this case, when the detector is gated, counts are absent, the absorption of a photon is not accompanied by the pro duction of the avalanche of carriers, and, correspond ingly, backscattered luminescence should be absent. The delay on the driven detector was 6.5 ns; i.e., the detectors were under the synchronism conditions. The dark count rate on the driven detector was 10­4 counts per gate. Figure 4 shows the typical time dependence of the number of counts. The measurements were performed with the alternation of bias voltages of 55 V (the master detector is active) and 49 V (the detector is passive) with a time step of 500 s. The total measurement time is 33 min. According to Table 5, excess is within the error. Finally, we present the results of the last series of the measurements. The bias voltage on the driven detector was increased in order to increase the quan tum efficiency. The dark count rate was 2 â 10­4 counts

per gate. The other parameters remained unchanged. The master detector was alternately switched on and switched off by applying bias voltages of 55 V (active) and 49 V (passive) with a time step 500 s. The average values in 50 s interval are shown in Fig. 5. The final data averaged over the entire series are given in Table 6. From the resulting data, the probability of photon emission Pemis in the process of the detection by the master detector within the gate can be estimated. This probability obviously includes not only the emission probability, but also the probability of entering the optic fiber and the probability of the passage of the photon through the optic fiber to the driven detector, Pemis f = N
light count

­N

no light count

.

(1)

Here, f is the frequency of the gate pulses (1 MHz), is the quantum efficiency of the driven detector, and light no light N count and N count are the count numbers of the driven detector in the presence and absence of the illumina tion of the master detector, respectively. With the typ light no light ical difference N count ­ N count 1 (see Tables 2, 4, 6) and 25%, the probability of backward emission is Pemis 1 = 4 â 10 6 0.25 â 10
­6

1 . gate

(2)

This value is comparable with the rate of own dark counts of the detector at a gate duration of 5 ns.
Table 3 Parameter Master detector Driven detector 5 257 53 30 228

Gate duration, ns 5 Discrimination threshold, mV 258 Bias voltage, V 55 Count number, s­1 530 000 (10) Photodiode temperature, K 228

Table 4 Delay of the master detector Average count number, s­1 Standard deviation
Vol. 110 No. 4

Synchro nism, 6.5 ns 31.71657 2.09737
2010

No synchro nism, 11 ns 30.1171 1.57523

JOURNAL OF EXPERIMENTAL AND THEORETICAL PHYSICS


566 Count number 160 Active
detector

KOROL'KOV et al. Count number 250

passive

active

passive

140 240 120 230 100 80 60

220 No exposition Exposition 0 500 1000 1500 2000 Time, s 210

Fig. 4.

200

1

5. DISCUSSION OF THE RESULTS Thus, an attack with passive probing involving the detection of backscattered radiation by the eavesdrop per is the only attack that cannot be detected by the legal users. Nevertheless, it is important to emphasize again that such a passive probing does not give rise to the loss of the security of the distributed keys. Backscattered radiation can potentially provide additional information on the distributed key by the eavesdropper. Obtaining this additional information does not provide errors on the receiver side and is not detected. However, this information can be "with drawn" from the eavesdropper by an additional com pression of the key at the privacy amplification stage [10] using the universal second order hash functions [11]. For example, for the BB84 quantum key distribu tion protocol [1], the length of the secure key that can be obtained from a sequence with the length n when
Table 5 Bias voltage of the master detector Average count number, s­1 Standard deviation Active, 54.5 V 132.5269 0.5930 Passive, 49 V 127.1517 0.5930

2 3 4 5 6 7 8 9 10 Interval no.

Fig. 5. Average count number in 50 s intervals in the ( ) passive and ( ) active detector.

the error observed on the receiver side is Q is given by the expression r = 1 ­ 2h(Q) ­ P n where h ( Q ) = ­ Q log 2Q ­ ( 1 ­ Q ) log 2( 1 ­ Q ) is the binary entropy function. Even in the absence of the eavesdropper, errors owing to the own imperfec tions of the system (imbalance of the interferometer, dark noise) provide the total error Q of several percent. For this reason, the additional compression of the key by the value Pemisn is negligibly small. In particular, at a sequence length of 106 bits, an additional effective compression by several bits is required even if the eavesdropper detects backscattered radiation by per fect detectors with 100% quantum efficiency without own dark noise. To summarize, the effect of backward emission on the security of keys has been experimentally analyzed for fiber optic quantum cryptography systems. An upper bound has been found for the probability of backward emission, which determines the degree of the additional compression of keys in order to ensure its security. ACKNOWLEDGMENTS This work was supported by the Academy of Cryp tography of the Russian Federation and, in part, by the
Vol. 110 No. 4 2010
emis

,

(3)

Table 6 Bias voltage of the master detector Average count number, s­1 Standard deviation Active, 55 V 231.483 4.4658 Passive, 49 V 227.683 4.4256

JOURNAL OF EXPERIMENTAL AND THEORETICAL PHYSICS


ON THE PASSIVE PROBING OF FIBER OPTIC QUANTUM COMMUNICATION

567

Russian Foundation for Basic Research (project no. 08 02 00559). REFERENCES
1. C. H. Bennett and G. Brassard, Proceedings of the IEEE International Conference on Computers, Systems, and Signal Processing, Bangalore, India, 1984 (Bangalore, 1984), p. 175. 2. N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, arXiv:quant ph/0101098; Rev. Mod. Phys. 74, 145 (2002); D. Stucki, N. Walenta, F. Vannel, R. T. Thew, N. Gisin, H. Zbinden, S. Gray, C. R. Towery, and S. Ten, arXiv:quant ph/0903.3907. 3. R. Alleaume, J. Bouda, C. Branciard, T. Debuisschert, M. Dianati, N. Gisin, M. Godfrey, P. Grangier, T. Langer, A. Leverrier, N. Lutkenhaus, P. Painchault, M. Peev, A. Poppe, T. Pornin, J. Rarity, R. Renner, G. Ribordy, M. Riguidel, L. Salvail, A. Shields, H. Weinfurter, and A. Zeilinger, arXiv:quant ph/0701168; R. Ursin, T. Jennewein, J. Kofler, J. M. Perdigues, L. Cacciapuoti, C. J. de Matos, M. Aspelmeyer, A. Valencia, T. Scheidl, A. Fedrizzi, A. Acin, C. Barbieri, G. Bianco, C. Brukner, J. Cap many, S. Cova, D. Giggenbach, W. Leeb, R. H. Had field, R. Laflamme, N. Lutkenhaus, G. Milburn, M. Peev, T. Ralph, J. Rarity, R. Renner, E. Samain, N. Solomos, W. Tittel, J. P. Torres, M. Toyoshima, 4. 5. 6.

7. 8. 9. 10. 11.

A. Ortigosa Blanch, V. Pruneri, P. Villoresi, I. Walms ley, G. Weihs, H. Weinfurter, M. Zukowski, and A. Zeilinger, arXiv:quant ph/0806.0945; W. Mauerer, W. Helwig, and C. Silberhorn, arXiv:quant ph/0712.0517; V. Scarani, H. Bechmann Pasquinucci, N. J. Cerf, M. Dusek, N. Lutkenhaus, and M. Peev, arXiv:quant ph/0802.4155. T. Kim, I. Stork genannt Wersborg, F. N. C. Wong, and J. H. Shapiro, arXiv:quant ph/0611235. V. Makarov, arXiv:quant ph/0707.3987. Book of Abstracts of Papers of the Single Photon Work shop 2007: Source, Detectors, Applications and Measure ments Methods, INRIM, Torino, Italy, 2007 (Torino, 2007). Z. L. Yuan, A. R. Dixon, J. F. Dynes, A. W. Sharpe, and A. J. Shields, New J. Phys. 11, 045 019 (2009). C. Kurtsifier, P. Zarda, S. Mayer, and H. WeinfÝrter, J. Mod. Opt. 48, 2039 (2001). S. N. Molotkov, S. P. Kulik, and A. I. Klimov, RF Patent No. 2 339 919 (June 15, 2007). C. H. Bennett, G. Brassard, C. CrÈpeau, and U. Mau rer, IEEE Trans. Inf. Theory 41, 1915 (1995). J. L. Carter and M. N. Wegman, J. Comput. Syst. Sci. 18, 143 (1979).

Translated by R. Tyapaev

JOURNAL OF EXPERIMENTAL AND THEORETICAL PHYSICS

Vol. 110

No. 4

2010