Документ взят из кэша поисковой машины. Адрес оригинального документа : http://qi.phys.msu.su/papers/2006-jetp(e)-102-712.pdf
Дата изменения: Sat Jan 3 14:41:14 2009
Дата индексирования: Mon Oct 1 19:46:31 2012
Кодировка:

ISSN 1063-7761, Journal of Experimental and Theoretical Physics, 2006, Vol. 102, No. 5, pp. 712723. © Pleiades Publishing, Inc., 2006. Original Russian Text © S.P. Kulik, G.A. Maslennikov, E.V. Moreva, 2006, published in Zhurnal иksperimental'nooe i Teoreticheskooe Fiziki, 2006, Vol. 129, No. 5, pp. 814829.

ATOMS, MOLECULES, OPTICS

Practical Implementation of Multilevel Quantum Cryptography
S. P. Kulika,*, G. A. Maslennikovb, and E. V. Morevac
Moscow State University, Moscow, 119992 Russia National University of Singapore, Singapore, 119077 Republic of Singapore c Moscow Engineering Physics Institute (State University), Moscow, 115409 Russia *e-mail: skulik@qopt.phys.msu.su
b a

Received October 14, 2005

Abstract--The physical principles of a quantum key distribution protocol using four-level optical systems are discussed. Quantum information is encoded into polarization states created by frequency-nondegenerate spontaneous parametric down-conversion in collinear geometry. In the scheme under analysis, the required nonorthogonal states are generated in a single nonlinear crystal. All states in the selected basis are measured deterministically. The results of initial experiments on transformation of the basis polarization states of a four-level optical system are discussed. PACS numbers: 03.67.Hk, 42.25.Ja, 42.50.Dv DOI: 10.1134/S1063776106050037

1. INTRODUCTION The basic problems in classical cryptography are authentication and secure key distribution. The former means mutual verification of the identity of the legitimate partners. The latter means that the partners must have identical secret keys to be used for encryption and decryption. By Shannon's coding theorem, an unconditionally secret key can be generated by a one-time pad as a random bit string at least as long as the transmitted message. However, generation of a new key for each message is an expensive procedure. The key distribution problem can be partially solved by using currently known algorithms, including so-called asymmetric cryptosystems. These are computationally secure in the sense that either the cost or complexity of breaking the key is too high (in the latter case, the message becomes worthless before the computations are completed). One example of asymmetric encryption is the DiffieHellman key exchange [1]. An alternative approach to the key distribution problem is quantum cryptography, in which quantum systems are employed as information carriers and quantum states can be used to generate unconditionally secret keys and easily change them. However, quantum key distribution does not solve the authentication problem. Quantum cryptography [2] appears to be the only achievement of quantum communication and quantum information science [3] that has been implemented on the hardware level. The unconditional security of a key distributed between the legitimate partners by using quantum systems is guaranteed by the no-cloning theorem, which states that an unknown quantum state can-

not be copied [4]. In the currently known quantum cryptosystems, information is encoded into nonorthogonal states of two-level systems (qubits). The most widely known protocols of this type make use of two (B92) [5], four [6], and six [7] states. However, a variety of alternative quantum cryptosystems have been discussed in the literature, including protocols using entangled states [8, 9]. However, the security of practical quantum key distribution (QKD) is limited by channel losses, transmission errors, distinction of the prepared states from the desired ones, inaccurate measurement (e.g., due to photodetection of background noise), etc. These factors impose limitations on the communication channel length that guarantees secure QKD. These problems can obviously be dealt with by refining the technologies employed in quantum cryptosystems. However, a physical approach based on the use of states in higher dimensional Hilbert spaces can be applied as an alternative. In this paper, we describe an implementation of the family of quantum states in a four-dimensional space and describe measurements on these states. 2. QUANTUM KEY DISTRIBUTION USING SYSTEMS OF DIMENSION D > 2 The QKD protocol using states of dimension D > 2, originally proposed in [10], was an extension of the well-known BB84 protocol [6] to three-level systems. (Strictly speaking, the concept of D-level system is not applicable to energy states, because the systems in question actually have no "levels." However, it is used here as part of the standard terminology.) According to [10],

712

PRACTICAL IMPLEMENTATION OF MULTILEVEL QUANTUM CRYPTOGRAPHY

713

information is encoded into quantum states belonging to four mutually unbiased bases. Each basis is a set of three orthonormal vectors. By definition, the vectors in a family of mutually unbiased bases satisfy the following conditions: e i|e j
2

1 = --- , D

(1a)

if the vectors |ei and |ej belong to different bases, and e i|e j
2

= 0,

i j,

e i|e i

2

= 1,

(1b)

if the vectors belong to the same basis (D is the dimension of the Hilbert space). It was shown in [11] that a set of M = D + 1 mutually unbiased bases exists only if D = pk, where p and k are prime and integer numbers, respectively. In particular, if D = 3 or 4, then1 M3 = 4, M4 = 5. The total number of states in the employed bases is m = MD; i.e., 12 and 20 states are used in three- and fourlevel systems, respectively. None of the vectors belonging to mutually unbiased bases is distinguished: the projection of a particular vector onto another (nonorthogonal) one has the same value for any pair of vectors. This is a key property used in QKD protocols. Key distribution using high-dimensional quantum states essentially follows the scenarios of standard qubit protocols. A random string of characters called qudits (e.g., 0, 1, 2, and 3 if D = 4) is encoded into a sequence of m nonorthogonal states from M randomly chosen (but known) bases. These states are sent one by one over a quantum channel from one legitimate partner to another. Alice stores the basis in which each input state is measured, but does not disclose it. Bob randomly chooses a basis to measure each output state and stores the measurement statistics. (Alice and Bob are the conventional names of the sender and receiver, respectively; A and B denote their respective locations; and Eve is the conventional name of the eavesdropper.) After the transmission, the partners use a public channel2 to exchange part of information about the bases in which the input and output states were measured. If the bases are identical, then the input state is uniquely recovered from the output measurement statistics. If the bases are different, then the disclosed measurement statistics are discarded. In the ideal case of zero error rate,
1

the raw key is the string of characters shared between the partners after the statistics corresponding to different bases have been discarded. By the no-cloning theorem, any eavesdropping attempt changes the carrier state. The legitimate partners use special protocols to check for changes and correct errors in transmissions (including those caused by eavesdropping attempts). For example, they can use a public channel to compare part of their keys. The published part is discarded; i.e., a shorter key is obtained. The length of the key becomes progressively shorter after each round of public communication required to complete the key distillation. The partners deal with classical strings of bits (or dits), but the key distillation procedure depends on the type of the protocol employed. Note that there exists an upper bound for the error rate compatible with secure key distribution for each QKD protocol (e.g., 11% for the BB84 protocol). The final key is used to encode and decode a message. The QKD procedure is so simple that a new key can be generated for each message. Thus, unconditional security is guaranteed: each key is at least as long as the message and is used only once. The security of QKD protocols using high-dimensional systems was discussed in [1217]. In the simplest eavesdropping strategy called interceptresend attack, Eve uses a randomly chosen basis to perform a direct measurement analogous to Bob's measurement on each carrier state and resends a new state depending on the measurement outcome over the quantum channel. If Eve's measurement is performed in the correct basis, then she extracts the complete information about the input state and resends the unchanged state. However, if Eve uses an incorrectly guessed basis, then the resulting perturbation of the carrier state will be detected as a change in measurement statistics at the receiver end. Of particular interest is the situation when Bob has selected the correct basis, but the output state is changed by Eve's measurement performed in an incorrect basis. For quantum systems, this situation was analyzed in [13]. The interception of at least part of the input string results in nonzero Bob's error rate. In the ideal case, its value is completely determined by the amount of mutual information gained by Eve: 1 1 E B = 1 ---- 1 --- . D M (2)

The corresponding basis states are called qutrits and ququarts, respectively. 2 The information transmitted over a public channel can be extracted, but cannot be changed.

Here, the second factor is the probability of incorrect guess of one of the M bases, the third factor is the probability of incorrect detection of one of the D states, and is the intercepted fraction of the input string. For example, the probability of Eve's choice of an incorrect basis is 80% if D = 4. Since a random state is prepared and sent by Eve after she has performed a measurement in an incorrect basis, the ensuing probability of Bob's error conditioned on Eve's incorrect choice of a basis is
Vol. 102 No. 5 2006

JOURNAL OF EXPERIMENTAL AND THEORETICAL PHYSICS

714 Table 1 Protocol ququarts, 20 states

KULIK et al.

D M EB Q = IB/EB T

2 2 1/4 2 1/2

2 3 1/3 1 1/3

3 4 1/2 1/2 1/4

4 5 3/5 1/3 1/5

4 2 3/8 4/3 1/2

75% even if he has selected the correct basis (whereas it would be 100% without Eve's intervention). The average fraction of private information gained by Eve is IE = 1/5 (when measured in quarts3). Therefore, Bob's error rate is 34 3 -E B = -- в -- = -- . 45 5 In quantum cryptography, each change in the carrier state detected by comparing Alice's and Bob's measurement statistics is attributed to an eavesdropping attempt. The effectiveness of an eavesdropping strategy is quantified by the ratio [10] IE Q = ----- . EB Accordingly, the lower Q, the better the protocol is protected from attacks of a particular type. Table 1 lists the values of EB and Q for several QKD schemes in the case of interceptresend eavesdropping: BB84 [6], six-state [7], qutrit [10], and ququart [12] protocols. It is clear that the robustness of QKD protocols increases with the dimension of the system employed. It is important that the relative amount of discarded measurement statistics increases with the state-space dimension, because the probability of a conclusive outcome is 1/M; i.e., the fraction of the states discarded in the course of raw-key generation is 1 T = 1 ---- . M A shorter length of the final key is the price paid for privacy amplification. The values of T corresponding to the compared protocols are also given in Table 1. In the
3

approach proposed in [12], a tradeoff is achieved by using a higher dimensional system to ensure high security, while the key creation rate is increased by using only some of the mutually unbiased bases. According to [12], the ensuing increase in Q over its value in the case when all of the M bases are employed is offset by a substantially higher key creation rate. Alternative eavesdropping strategies, such as measurement in the intermediate basis and attacks using the universal quantum cloning machine (UQCM), were analyzed in [1217].4 In [14], attacks of two types were analyzed: individual attacks (Eve monitors the qudits separately) and coherent attacks (Eve monitors several qudits jointly). For individual attacks, an optimal eavesdropping strategy using a quantum cloning machine was found. It was also shown that the amount of information gained by Eve decreases with increasing statespace dimension if Bob's error rate is held constant. This trend is independent of whether all of the D + 1 bases or only two are employed. In [13], the maximum effective transmission rate was estimated as a function of D and Bob's error rate when the UQCM is used. 3. PHOTON STATES OF DIMENSION D > 2 IN EXPERIMENT Currently, photon states of dimension D > 2 can be created by using several schemes, which are generally based on spontaneous or stimulated parametric downconversion (SPDC) and have their specific advantages and disadvantages. Overall, the basic operations on quantum states (creation, transmission, and measurement) are relatively difficult to control. 3.1. Spatial Modes of Photons The natural basis for representing the spatial structure of a light beam is the family of Hermite and/or Laguerre Gaussian modes. In this representation, photon states can be described in terms of the topological charge and orbital angular momentum associated with the Laguerre Gaussian modes in cylindrical coordinates [19]. These modes correspond to helical wavefronts and phase singularities. Particular modes can be selected by passing the beam through specially designed holograms to analyze the spatial structure of the beam or the constituent modes. A strongly correlated beam that has passed through a specially designed hologram can be used to prepare entangled states as superpositions of
4

ququarts, 8 states

qutrits, 12 states

qubits (BB84), 4 states

qubits, 6 states

Since the amounts of information measured in bits and dits are related as Idit = IbitlogD2 , coding in quarts is denser than coding in bits by a factor of two.

The UQCM (originally analyzed in [18]) is designed to create two states that are as close to the carrier state as they can be according to the no-cloning theorem. Eve keeps one "copy" and sends the other to Alice. After Alice and Bob have published the bases used in their measurements, Eve performs a measurement on the stored state in a basis identical to Bob's one and therefore gains a similar amount of private information on average. However, since Eve's clones are not exact copies, the resulting perturbation of the output state can be detected by the legitimate partners by analyzing measurement statistics. Vol. 102 No. 5 2006

JOURNAL OF EXPERIMENTAL AND THEORETICAL PHYSICS

PRACTICAL IMPLEMENTATION OF MULTILEVEL QUANTUM CRYPTOGRAPHY

715

several correlated Gaussian modes. In [20, 21], entangled qutrits were prepared in the form 1 = ------ { |0 s, 0 i + |1 s, 1 i + |2 s, 2 i } , 3 (3)

where |ms, ni is the state with a photon s(i) in one of the three output ports of a polarization analyzer. States (3) were used to verify the Bell inequalities for threedimensional systems formulated in [22]. In [23], a set of different hologram segments was used to measure states of this type by selecting modes with specific phase singularities. Currently, technologies of fabrication of adaptive holograms are being actively developed. This method for preparing entangled states of dimension D > 2 is likely to become widespread in the nearest future, because it can be used to prepare and measure a broad variety of states of this type with variable complex amplitudes. 3.2. Biphotons in a Multiple-Arm Interferometer If the signal and idle photons making up a biphoton are separately directed into two unbalanced three-arm interferometers, then coincidence detection of photons in the corresponding outputs of the interferometers will yield a superposition of the form [24, 25] = c s |1 s, 1 s + c m |1 m, 1 m + c l |1 l, 1 l . (4) Here, the entangled qutrits |1s, 1s , |1m, 1m , and |1l, 1l corresponding to the shortshort, mediummedium, and longlong path combinations, respectively, are direct generalizations of those prepared by using the well-known Franson interferometric arrangement for qubits [26]. The absolute values of the probability amplitudes cs, m, l and their relative phases can be varied by adjusting the reflectivities of the input beamsplitters and the corresponding relative path lengths. However, multiple-arm interferometers are difficult to use in experiments on qudits: whereas relative phases can easily be varied by means of appropriate modulators, fiber transmittance is a constant characteristic of a particular interferometer. 3.3. Spatial Modes of the Biphoton Field Created by Spontaneous Parametric Down-Conversion In recent experiments, entangled states of multilevel systems were prepared by creating transverse spatial correlation between pairs of photons. In these experiments, signal and/or idle photons passed through arrays of parallel fibers [27] or slits [28] selecting certain spatial modes to prepare states of the form 1 = ------D

where D is the number of fibers or slits in the array and |ls, i represents a signal or idle photon at the output end of the lth path. We should also mention here the recently introduced hyperentangled states, in which entanglement in more than one variable is created. In particular, the noncollinear scheme of frequency-degenerate SPDC proposed in [29] can be used to prepare ququarts of the form 1 = ------ { c 1 |H a1, H b2 + c 2 |V a1, V b2 2 + c 3 |H a2, H b1 + c 4 |V a2, V b1 } ,

(6)

involving both spatial correlations |a1, b2 ± |b1, a2 of pairs of modes a1, b2 and b1 , a2 , and polarization entanglement. 3.4. Four-Photon Polarization States Quantum states of dimension D = 3 were prepared in [30] by generating photon pairs in two distinct modes via stimulated parametric down-conversion in a second-order nonlinear crystal. A polarization-entangled state was created by passing a laser beam twice through the crystal and adjusting the delay both between the photons in a pair and between the modes: = b 1 |( 2 H ) 1, ( 2 V ) 2 + b 2 |( HV ) 1, ( |VH 2 ) + b 3 |( 2 V ) 1, ( 2 H ) 2 . (7)

Here, the qutrit state |(2H)1, (2V)2 consists of two horizontally polarized photons in spatial mode 1 and two vertically polarized photons in spatial mode 2. This scheme can be used to manipulate entangled three-level systems. For example, generalized Bell inequalities were verified in [31] for entangled states of spin 1 particles [22, 32, 33]. However, the amplitudes b1, 2, 3 are difficult to control. 3.5. Biphotons Generated by Sequences of Pump Pulses An optical system with the highest Hilbert space dimension D = 21 was created by using pulse trains in [34]. A sequence of D coherent pump pulses with a fixed phase relation was used to create frequencydegenerate biphotons in a collinear geometry. The laser intensity was adjusted so that each pulse could generate only one biphoton. As a result, photon pairs created within distinct time bins depending on the time between consecutive pump pulses were combined into the superposition =
Vol. 102

l = l
D

l

D

exp { i l } |l s |l i ,

(5)

j=1

D

c j exp { i j } | j A, j B ,
2006

(8)

JOURNAL OF EXPERIMENTAL AND THEORETICAL PHYSICS

No. 5

716

KULIK et al.

where cj exp{ij}| jA, jB corresponds to the photon pair created by the jth pulse (or time bin), with relative amplitude cj and phase j . This must be the most effective method for preparing entangled states of multilevel systems, because both amplitudes and relative phases of the basis states in (8) can easily be varied by means of amplitude and phase modulators. In other words, an arbitrary qudit can be prepared. However, the resulting state is difficult to measure, since a stable D-arm interferometer must be combined with the corresponding array of photodetectors used in conjunction with coincidence circuits. As an alternative to the methods for preparing D-level systems described above, we consider below a method using the polarization states created by singlemode spontaneous parametric down-conversion. 4. BIPHOTONS AS FOUR-LEVEL SYSTEMS Quantum states of dimension D = 2, 3, and 4 can be prepared by using the biphoton field generated by SPDC in crystals without inversion symmetry [35]. Currently, SPDC is considered as a simple and effective method for creating nonclassical field states. Under steady-state conditions, the signal and idle wave frequencies are related to the pump frequency by the phase matching condition s + i = p , (9)

lation between the frequencies, propagation directions, and the instants at which the photon or biphoton pairs are generated. The frequency-degenerate biphoton generation in collinear geometry was considered in [36, 37]. The polarization states of a single-mode biphoton generated via SPDC are called qutrits because they are described by superpositions of three basis vectors: | 3 = c '1 |H, H + c '2 |H, V + c '3 |V , V . Here, c '1
, 2, 3

(13)

are normalized amplitudes, and
2

(a ) |H, H |H |H = ----------- |vac , 2 |H, V |H |V = a b |vac ,

(b ) |V , V |V |V = ----------- |vac 2 are the Fock states obtained by applying the creation operators (a) and (b) to the vacuum states in the horizontal and vertical polarization modes, respectively. Subsequently, a graphic representation of a biphoton by two points on the PoincarИ sphere was proposed in [38], the operational orthogonality criterion for qutrits formulated in [39] was validated in [40], and procedures were developed for statistical reconstruction [41, 42] and preparation [43] of qutrits. The concept of qutrit as a biphoton field state is based on the degeneracy of all degrees of freedom of a biphoton except for polarization. When degeneracy with respect to a parameter (e.g., frequency or propagation direction) is lifted, we have a superposition of four mutually orthogonal state vectors (i.e., a quantum state of dimension D = 4) instead of expression (13): | 4 = c 1 |H 1, H 2 + c 2 |H 1, V 2 + c 3 |V 1, H 2 + c 4 |V 1, V 2 . (14)

2

and the corresponding propagation directions depend on crystal dispersion and sample geometry. The lateral crystal size may not be taken into account in most SPDC setups. Retaining the first-order terms in the expansion of the biphoton field state vector in the pump amplitude, we obtain 1 = 1 + -2

k s, k

i

F

k s, k

i

a ks a ki |0 ,

(10)

where F ks, ki is the biphoton spectral amplitude. The field intensity in the ks and ki modes is maximized when |D | = 0, and the corresponding angular and frequency bandwidths are given by the formula I
s, i 2 DL sin c --------- , 2

In the general case, state (14) cannot be factorized into the direct product of polarization states of the signal and idle photons making up a biphoton: 4 ( a 1 |H 1 + b 1 |V 1 ) s ( a 2 |H 2 + b 2 |V 2 ) i . (15)

(11) Measurement of an arbitrary ququart prepared by using polarization degrees of freedom of biphotons was considered in [44]. Protocols of statistical reconstruction of ququarts generated by removing the frequency degeneracy of the biphoton field were analyzed in [45]. 5. A QKD PROTOCOL USING QUQUARTS The basic physical operations in a QKD protocol are the preparation, transmission, and measurement of
Vol. 102 No. 5 2006

where L is the crystal length and D = ks + ki k
p

(12)

is the wavevector mismatch. In SPDC, a pump photon decays into a pair of photons whose energies and momenta satisfy relations (9) and (12). These conservation laws entail a strong corre-

JOURNAL OF EXPERIMENTAL AND THEORETICAL PHYSICS

PRACTICAL IMPLEMENTATION OF MULTILEVEL QUANTUM CRYPTOGRAPHY

717

quantum states from a given set. It can readily be shown that the families of ququart states (D = 4) belonging to five mutually unbiased bases (M = 5) are5 M = 1: |H 1, H 2, |H 1, V 2, |V 1, H 2, |V 1, V 2 ; (16a) M = 2 : |+45 °, +45 °, |+45 °, 45 ° , 1 2 1 2 | 45 °, +45 °, | 45 °, 45 ° ; 1 2 1 2 M = 3: | R 1, R 2, | R 1, L 2, | L 1, R 2, | L 1, L 2 ; M = 4: | R 1, H 2 + | L 1, V 2, | R 1, H 2 | L 1, V 2 , | L 1, H 2 + | R 1, V 2, | L 1, H 2 | R 1, V 2 ; M = 5: |H 1, R 2 + |V 1, L 2, |H 1, R 2 |V 1, L 2 , |H 1, L 2 + |V 1, R 2, |H 1, L 2 |V 1, R 2 . In expressions (16), the vectors 1 |± 45 ° ------ { |H j ± |V j } , j 2 1 R j ------ { |H j + i |V j } , 2 1 L j ------ { |H j i |V j } 2 (j = 1, 2) can be called diagonal (|± 45°) and circular (|R, |L ) representations of a polarization qubit. It turns out that the 12 ququart states that constitute the first three bases can easily be prepared in an experiment. 5.1. Preparation One remarkable distinction of ququarts from qutrits lies in the fact that all states making up the first three bases in (16) can be prepared by using biphotons generated in a single crystal. This distinction is due to a fundamental difference between four- and three-state biphoton systems. Indeed, frequency-degenerate single-mode biphoton generation is characterized by the degree of polarization defined in terms of the Stokes parameters, which is invariant under SU(2) transformations (performed by using various polarization-changing devices, such as retarders, rotators, etc.): (16b) (16c) (16d)

For qutrits described by (6) (see [36, 46]),
S 1 2 2 a a b b --------- = --------------------------- = c '1 c '3 , 2 2 S 2 a b + ab --------- = ---------------------------- = 2 2

2 Re ( c '* c '2 + c '* c '2 ) , (18) 1 3 2 Im ( c '* c '2 + c '* c '2 ) , 1 3
2

S 3 i ( a b a b ) --------- = ------------------------------------- = 2 2

P3 =

2 2 c '1 c '3 + 2 c '* c '2 + c '2 c '* . 1 3

(19)

(16e)

Accordingly, the basis states of a qutrit having different degrees of polarization cannot be transformed into one another by means of retarding plates. For example, the state |H, H (with P = 1) cannot be obtained by transforming the state |H, V (with P = 0). Therefore, at least two nonlinear crystals must be employed to prepare the set of qutrit states required for QKD [47]. In the general case, at least three nonlinear crystals must be combined into a complex interferometric arrangement having all disadvantages inherent in such schemes, including temporal walk-off, precision control of the relative phases of states, and stringent requirements for spatiotemporal coincidence of different component states [43]. The concepts of Stokes parameters and degree of polarization must be refined to be applicable to twomode polarization states [48, 49]. Indeed, since these quantities are defined in terms of creation and annihilation operators formally introduced for plane waves, they must vary with time when applied to two-mode states, and the field will exhibit beats unrelated to polarization behavior. Polarization characteristics can be described by invoking the concept of the quasispin operator, whose components are the sums of the corresponding mode-specific components over all spatiotemporal modes [50]. For the two-mode biphoton field discussed here, transformations of basis states that change degree of polarization are not forbidden, because polarization is not well defined for this field. Transformations of this kind can be performed by using dichroic polarizationchanging devices. Consider the biphoton consisting of photons with center wavelengths 1 = 702 nm and 2 = 605.2 nm.6 Transformations between the states in (16a) can be performed by means of standard retarding plates selected by taking into account the plate-material dispersion. The geometric plate thickness l and interfer6

P3 =
5

k=1 1, 2

3

2 1 S . -- k 2

(17)

A representation in terms of Fock states analogous to those in (6). The operators a
1, 2

and b

are defined for modes 1 and 2.

The corresponding linewidths depend on the crystal length and dispersion. Vol. 102 No. 5 2006

JOURNAL OF EXPERIMENTAL AND THEORETICAL PHYSICS

718 States P Dp1 Dp2 Bases Qp1Qp2

KULIK et al.

Laser

BBO

Fig. 1. Setup for preparing 12 basis states in three mutually unbiased bases: BBO = nonlinear crystal; P = achromatic wave plate transforming |V1, V2 into |H1, H2; Dp1 , Dp2 = dichroic retarding plates; Qp1 , Qp2 = basis-changing plates.

ence order are calculated for a particular transformation |V 1, V 2 |V 1, H 2 by using the relations m2 2 ( 2 m1 + 1 ) 1 ---------------------------- = ----------- , n2 2 n1 ( 2 m2 + 1 ) 2 m1 1 ----------- = ---------------------------- . 2 n2 n1 (20) (21)

The calculated phase differences are listed in Table 2. Here, m1 and m2 denote the interference orders corresponding to 1 and 2 , respectively; n 1 ( n o n e ) 1 = 0.00906 , n 2 ( n o n e ) 2 = 0.00896 are the birefringence indices for quartz at these wavelengths; and the phase difference introduced by the plate is
1, 2

plate7 and a quarter wave set at angles of 22.5° and 45° to the vertical, respectively. Note that the states in the fourth and fifth bases, which are superpositions of Bell states, can be prepared only with at least two crystals [51]. Thus, both two- and three-level QKD protocols can be implemented by using a single crystal, a set of achromatic retarding plates, and zeroth-order plates. Figure 1 schematizes the setup for preparing all of the 12 quantum states required to implement the threelevel QKD protocol. Transformations within a basis are performed by using dichroic retarding plates Dp1 and Dp2 and an achromatic (or zeroth-order) plate P, while quarter-wave plate Qp1 and half-wave plate Qp2 can be used to switch between bases. 5.1.1. Experiment on biphoton basis transformations. Consider the experiment on preparation of the state |H1, V2 schematized in Fig. 2. Photon pairs in the initial state |V1, V2 are generated via Type I SPDC implemented in a lithium iodate (LiIO3) crystal of length 1.5 cm cut at an angle of 59° to the optical axis and pumped by a 325 nm He-Cd laser. In this geometry, type I phase matching corresponds to waves with 1 = 702 nm and 2 = 605.2 nm and spectral widths of about 2 nm. The transformation |V 1, V 2 |H 1, V 2

l n 1, 2 = ----------------- . 1, 2

(22)

is performed by means of a retarder set at an angle of 45° to the vertical, which acts as a half-wave plate at 1 and a full-wave plate at 2 . In the actual experiment, quartz plates of thickness 3.716 mm (Dpo1) and 0.315 mm (Dpo2) were used. Initially, the optical axes of Dpo1 and Dpo2 were mutually orthogonal, so that their effective overall thickness was 3.401 mm. By tilting the plates toward one another, the phase difference was varied within the interval 1 1.37 ----- 1.44 m1 for 1 = 702 nm and within 2 2.9 ----- 3.14 m2

The states in bases (16b) and (16c) are prepared in a similar manner. Transformations to the second and third bases are performed by using an achromatic wave
Table 2 Phase Plate difference 1 Orders thickness introduced m1 and m2 l, mm by the plate -2 |V1, V2 |V1, H2 -2 8; 10 14; 17 47; 51 3; 3 26; 30 32; 37 665 1135 3406 234 2037 2505

Transformation

for 2 = 605.2 nm. When the required phase differences were obtained, the transformation results in the desired state |H 1, V 2
7

|V1, V2

|H1, V2

0 1 0 0

0 = G 0 = G |V , V . 1 2 0 1

(23)

Such a plate can be used to change polarization in a wide spectral interval. Vol. 102 No. 5 2006

JOURNAL OF EXPERIMENTAL AND THEORETICAL PHYSICS

PRACTICAL IMPLEMENTATION OF MULTILEVEL QUANTUM CRYPTOGRAPHY 4 = |V1, V2 Dpo 1, 2 Qp Hp V2 1 + 2 D2 Input 2 Output Input 1 BS QpHpH1 IF D1

719

t j = cos j + i sin j cos 2 and reflection coefficients

1

r j = sin j sin 2 , where j = 1 and 2 for photons with frequencies 1 and 2 , respectively, and is the angle between the plate's optical axis and the vertical direction. By virtue of frequency nondegeneracy, the optical thickness j = ( nej noj ) l /
j

of a plate of geometric thickness l is different for signal and idle photons. Since the optical thickness changes as the plates are tilted, the phase difference between the ordinary and extraordinary waves can be fine-tuned by adjusting the plate rotation angle :
2 2 noj nej l j = ---- ---------------------------- ---------------------------- . 2 2 j 2 2 n e j sin n o j sin

Fig. 2. Setup for transforming ququart basis states: Dpo1, Dpo2 = rotated quartz plates; BS = nonpolarizing beamsplitter; Qp = quarter-wave plate; Hp = half-wave plate; H1 , V2 = horizontal and vertical polarizers; IF = interference filter; D1 , D2 = photodetectors.

(25)

The matrix in (23) describes polarization-changing SU(2) transformations of ququarts and has the form [45, 46] t r t r G = 1 1 2 2 r* r* r* r* 1 1 2 2 = r1 r2 * * * * t1 r2 t1 t2 r1 r2 r1 t2 , r* t2 r* r2 t* t2 t* r2 1 1 1 1 ** ** ** ** r1 r2 r1 t2 t1 r2 t1 t2 t1t
2

t1r

2

r1 t

2

(24)

with transmission coefficients
I2 1.2 (a) 1.0 0.8 0.6 0.4 0.2 5 10 15 20 , deg 0 5

The desired state was selected by tuning the measurement scheme to horizontal and vertical polarization in channels 1 and 2, respectively. A biphoton with 1 and 2 was selected by inserting a 3 nm bandwidth interference filter with transmittance peak at 702 nm in channel 1. Even though channel 2 carried both spectral components, the desired biphoton was reliably selected by coincidence counting of photons that had passed through a standard combination of quarter- and halfwave plates with a polarizer. This scheme can be used to reconstruct the input ququart state with the maximum possible fidelity [42, 44]. Figures 3a, 3b, and 3c show, respectively, the normalized channel 1 and 2 single count rates and coincidence rate versus the plate rotation angle . Curves represent calculated dependences; symbols, measured results.

I1 1.0 0.8 0.6 0.4 0.2 0

R (b) 1.0 0.8 0.6 0.4 0.2 10 15 20 , deg 0 5 10 15 20 , deg (c)

Fig. 3. Predicted (curves) and measured (symbols) normalized channel 1 and 2 single count rates and coincidence rate versus the rotation angle of quartz plates Dpo1 and Dpo2; (a) channel 1 photocounts; (b) channel 2 photocounts; (c) coincidences. Errors of single count rates are comparable to symbol size in (a) and (b). JOURNAL OF EXPERIMENTAL AND THEORETICAL PHYSICS Vol. 102 No. 5 2006

720 Qp Hp 4 DBS 1 D1 V1 PBS1 H1 D2 PBS2 2 V2 D3 H
2

KULIK et al. D4

i.e.,

the

fourth-order

moments

a 1 a 1 b 1 b 1 ,

a 1 a 1 b 1 b 2 , and a 1 a 1 b 2 b 1 vanish. On the other hand, since channels 1 and 2 select horizontally and vertically polarized photons, respectively, the single count rates are proportional to the corresponding signal intensities: I 1 a 1 a 1 = t
2 1

sin 1 ,
2 2 2 2

2

(27) cos 2 . (28)

I 2 b 1 b 1 + b 2 b 2 = r

2 1

cos 1 + r

Input 1 ID

Input 2

Input 3 Output RS

Input 4

The concurrence condition for the maximum points of (27) and (28) combined with (25) warrants the transformation |V 1, V 2 |H 1, V 2 .

Fig. 4. Setup for measuring 12 basis states in three mutually unbiased bases: DBS = dichroic beamsplitter; PBS1 and PBS2 = polarizing beamsplitters; Qp = quarter-wave plate; Hp = half-wave plate; D1 , D2 , D3 , D4 = photodetectors; RS = data-processing system.

A necessary, but not sufficient, condition for effectiveness of the polarization transformations is the concurrence of the plate rotation angles corresponding to peak values of the channel 1 single count rate and the coincidence rate. Indeed, since the measurement scheme is tuned to select the state |H1, V2, the highest coincidence rate R c a 1 a 1 b 2 b 2 = sin 1 cos
2 2 2

Comparing the solid curves in Fig. 3, we see that the transformation is effective when performed in the neighborhood of the first maximum. Similar locations of the minima of the coincidence rate and the channel 1 signal intensity as functions of are a necessary condition for transformation into the state orthogonal to the state the scheme is tuned to. To verify that the detected state is |H1, V2 when the plate setting corresponds to the first maximum in Fig. 3, we performed an incomplete tomographic reconstruction of the ququart by measuring the diagonal components of the polarization density matrix for state (14)8 = | 4 4 | . Table 3 lists measured and theoretically predicted values of the moments. For the first basis in (16), the fidelity of the experimentally recovered states to the theoretically reconstructed ones is F =
theor| exp 2

(26)

corresponds to this particular state. Expression (26) is obtained by using the fact that only the parametrically conjugated modes contribute to coincidence counts;
Table 3 Polarization density matrix components c * c1 1 c * c2 2 c * c3 3 c * c4 4 Initial state |V1, V2 theory 0 0 0 1 Transformed state |H1, V2 theory 0 1 0 0 experiment 0.093 0.868 0.019 0.020

= 0.87 .

The value of F less than unity is explained by the strong wavelength dependence of the effectiveness of polarization transformations. For example, as channel 1 is detuned from the correct wavelength setting by 1.5 nm (half the interference-filter bandwidth), the theoretical value of F varies between 1.0 and 0.83. Moreover, the plate thickness cannot be adjusted to ensure the required values of phase shifts. Therefore, the theoretical value of F cannot reach its maximum. Finally, the finite spectral width of the biphoton implies that the phase shift depends on the wavelength of a spectral component. However, the value of F is reduced insig8

Detailed statistical analyses of reconstructed ququart states were presented in [45, 52]. Vol. 102 No. 5 2006

JOURNAL OF EXPERIMENTAL AND THEORETICAL PHYSICS

PRACTICAL IMPLEMENTATION OF MULTILEVEL QUANTUM CRYPTOGRAPHY

721

nificantly by integration over the biphoton spectrum under an optimal choice of the center wavelength. 5.2. Transmission Any QKD scheme using polarization states is disadvantageous in that these states cannot be practically transmitted over fiber-optic links. Due to local stressing and straining, as well as temperature fluctuations, the output polarization state is a complicated time-varying function of the input one. Therefore, the quantum states transmitted over fiber-optic cables are encoded into different degrees of freedom [2]. Polarization encoding can be used in free-space QKD protocols (e.g., see [53]). Analysis of the contribution to the error rate due to depolarization of ququarts by atmospheric turbulence is a separate theoretical and experimental problem that lies outside the scope of this study. 5.3. Measurement Figure 4 shows a scheme designed to perform measurements on the detected states in the first, second, or third basis in (16). A dichroic beamsplitter (DBS) separates modes 1 and 2. The retarding plates placed before the beamsplitter are used to tune the system to a specific basis: the quarter-wave plate Qp rotated to 45° selects the "circular" third basis, and the half-wave plate Hp rotated to 22.5° selects the "diagonal" second basis. The polarizing beamsplitters PBS1 and PBS2 inserted into the corresponding arms transmit horizontally and vertically polarized photons (H and V), respectively. The outputs of both arms are detected by single-photon counters coupled to a four-channel pair coincidence circuit. Whenever a pair of input pulses arrive within the same time window Tcoin , the circuit generates a coincidence pulse and an identification pulse (ID) indicating the input ports where the photon pair arrived. The data-processing system (RS) generates a raw key. To illustrate the operation of the detection scheme, suppose that it is tuned to the first ("measuring") basis. First, the correct identification of the four basis states |H1, H2, |H1, V2, |V1, H2, and |V1, V2 must be verified. As the state |H1, H2 arrives, the distinct modes are separated by DBS, and the detectors D2 and D4 fire. As the state |H1, V2 arrives, the distinct modes are separated by DBS, and the detectors D2 and D3 fire. As the state |V1, H2 arrives, the distinct modes are separated by DBS, and the detectors D1 and D4 fire. As the state |V1, V2 arrives, the distinct modes are separated by DBS, and the detectors D1 and D3 fire. Measurements in the circular and diagonal bases are performed analogously. When the plate Qp is rotated, the state symbols change from H to R and from V to L. When the plate Hp is rotated, the symbols change as follows: H +45°, V 45°.

Note that states from the fourth and fifth bases cannot be correctly detected by this scheme. In essence, detection of these states is equivalent to measurement of Bell states, which cannot be performed by means of linear optical devices [54]. However, complete identification of the first three bases is sufficient for executing two- and three-level QKD protocols. 6. DISCUSSION First of all, we note that the implementation of fourlevel quantum cryptography using frequency-nondegenerate biphotons has a number of essential advantages over previously analyzed ones. The principal advantages are the simplicity of preparation and measurement of the states employed in QKD. As noted above, all states involved in the protocol can be prepared by using a single nonlinear crystal, owing to the removal of the frequency degeneracy of the biphoton field. Our experiments have demonstrated the high fidelity of the linear transformations of these states. Furthermore, the detection scheme is free of the losses inherent in biphoton schemes, in which beamsplitters are employed. For comparison, note that the upper bound for the probability of correct detection in the qutrit QKD protocol discussed in [55] is only 8% (provided that the basis is chosen correctly). The low percentage of correctly detected states is due to the destruction of biphotons by beamsplitters, which do not preserve polarization. The key elements of the measurement scheme for ququarts are the dichroic mirror separating the distinct modes and the polarizing beamsplitters in both arms of the interferometer. These beamsplitters are characterized by low inherent losses (on the order of 103104) and are widely used in polarization optics. Note also that the increase in the number of photodetectors (which is undesirable in quantum cryptosystems because of additive background noise) is insignificant for the present scheme because the detection procedure is based on coincidence counting. Indeed, the contribution of dark-count coincidences obeying Poissonian statistics is proportional to the product of the dark-count coincidence rate with the time window: W
coin

= W 1W 2T

coin

.

Taking a time window on the order of 1 ns and a dark count rate of 100 Hz characteristic of modern singlephoton detectors, we see that the resulting error rate is much lower than the typical value 105 ns1 [2]. As a variant of the implementations of polarization transformations on basis states of frequency-nondegenerate biphoton field discussed here, one may consider a scheme with two identical prisms for separating distinct modes and retarding plates placed in one mode path. However, this scheme does not seem very practical. Indeed, the quartz prisms that separate modes with 1 = 702 nm and 2 = 605.2 nm by 2 mm must be set
Vol. 102 No. 5 2006

JOURNAL OF EXPERIMENTAL AND THEORETICAL PHYSICS

722

KULIK et al. and Signal Processing, Bangalore, India (IEEE, New York, 1984), p. 175. D. Bruss, Phys. Rev. Lett. 81, 3018 (1998); H. Bechmann-Pasquinucci and N. Gisin, Phys. Rev. A 59, 4238 (1999). A. Ekert, Phys. Rev. Lett. 67, 661 (1991). S. N. Molotkov, Pis'ma Zh. иksp. Teor. Fiz. 76, 79 (2002) [JETP Lett. 76, 71 (2002)]; D. V. Sych, B. A. Grishanin, and V. N. Zadkov, Phys. Rev. A 70, 052 331 (2004). H. Bechmann-Pasquinucci and A. Peres, Phys. Rev. Lett. 85, 3313 (2000). W. K. Wootters and B. D. Fields, Ann. Phys. (Leipzig) 191, 363 (1989). H. Bechmann-Pasquinucci and W. Tittel, Phys. Rev. A 61, 062 308 (2000). M. Bourennane, A. Karlsson, and G. BjЖrk, Phys. Rev. A 64, 012 306 (2001). N. Cerf, M. Bourennane, A. Karlsson, and N. Gisin, Phys. Rev. Lett. 88, 127 902 (2002). D. Bruss and C. Macchiavello, Phys. Rev. Lett. 88, 127 901 (2002). D. V. Horoshko and S. Ya. Kilin, Opt. Spektrosk. 94, 750 (2003) [Opt. Spectrosc. 94, 691 (2003)]. F. Caruso, H. Bechmann-Pasquinucci, and C. Macchiavello, quant/ph/0505146. V. Buzek and M. Hillery, Phys. Rev. Lett. 81, 5003 (1998). M. N. Soskin, V. N. Gorshkov, M. V. Vasnetsov, et al., Phys. Rev. A 56, 4064 (1997). A. Vaziri, J.-W. Pan, T. Jennewein, et al., Phys. Rev. Lett. 91, 227 902 (2003). A. Vaziri, G. Weihs, and A. Zeilinger, Phys. Rev. Lett. 89, 240 401 (2002). D. Collins, N. Gisin, N. Linden, et al., Phys. Rev. Lett. 88, 040 404 (2002). N. K. Langford, R. B. Dalton, M. D. Harvey, and J. L. O'Brien, Phys. Rev. Lett. 93, 053 601 (2004). R. T. Thew, S. Tanzilli, A. Acin, et al., Quant. Inf. Comput. 4, 93 (2004). R. T. Thew, A. Acin, H. Zbinden, and N. Gisin, Phys. Rev. Lett. 93, 010 503 (2004). J. D. Franson, Phys. Rev. Lett. 62, 2205 (1989). M. N. O'Sullivan-Hale, I. A. Khan, R. W. Boyd, and J. C. Howell, Phys. Rev. Lett. 94, 220 501 (2005). L. Neves, G. Lima, J. G. Aguirre GСmez, et al., Phys. Rev. Lett. 94, 100 501 (2005). G. M. D'Ariano, P. Mataloni, and M. F. Sacchi, Phys. Rev. A 71, 062 337 (2005). A. Lamas-Linares, J. C. Howell, and D. Bouwmeester, Nature 412, 887 (2001). J. C. Howell, A. Lamas-Linares, and D. Bouwmeester, Phys. Rev. Lett. 88, 030 401 (2002).
^

apart to a distance of about 1 m. Moreover, the resulting beam would have a nonuniform cross-sectional frequency distribution. Additional parameterization of this kind maps the initial biphoton states from the ququart space spanned by two polarization modes and two frequency modes to the eight-dimensional space spanned by two polarization modes, two frequency modes, and two spatial modes. The disadvantages of the scheme using biphotons include the twice as high loss rate (as compared to photon-based schemes): a biphoton is destroyed if either photon in the pair is lost. The key generation rate decreases accordingly. To the best of our knowledge, systematic analysis of the influence of the two-photon nature of the information carriers on the upper limit for QKD error rate has never been performed. In this study, we address only the physical principles of preparation and measurement of ququarts. Even though technical aspects of implementation of the QKD protocol are crucial for any cryptosystem, their discussion is beyond the scope of this paper. We only note that all transformations described here can be implemented by using electro-optic modulators, which simultaneously change the polarization states in a photon pair with given wavelengths. The processes involved in preparation and measurement can easily be synchronized by using a mode-locked laser. Furthermore, the problems of temporal walk-off and spatiotemporal mismatch between quantum states are eliminated in the scheme analyzed here, because it does not involve interferometers, in contrast to most QKD schemes. ACKNOWLEDGMENTS We thank V.P, Karasev and A.V. Masalov for fruitful discussions and S.S. Straupe for assistance in experimental work. This work was done as part of the interdisciplinary project no. 4-2005 and supported under the State Program for Support of Leading Science Schools (grant no. NSh-4586.2006.2) and by the Russian Foundation for Basic Research (project nos. 03-02-16444 and 06-02-16769). REFERENCES
1. W. Diffie and M. Hellman, IEEE Trans. Inf. Theory 22, 644 (1976). 2. N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Rev. Mod. Phys. 74, 145 (2002). 3. Physics of the Quantum Information, Ed. by D. Bouwmeester, A. Ekert, and A. Zeilinger (Springer, Berlin, 2000; Postmarket, Moscow, 2002). 4. W. K. Wootters and W. Zurek, Nature 299, 802 (1982). 5. C. H. Bennett, Phys. Rev. Lett. 68, 3121 (1992). 6. C. H. Bennett and G. Brassard, in Proceedings of the IEEE International Conference on Computers, Systems,

7.

8. 9.

10. 11. 12. 13. 14. 15. 16. 17. 18. 19. 20. 21. 22. 23. 24. 25. 26. 27. 28. 29. 30. 31.

32. D. Kaszlikovski, P. Gnaci nski, M. Z ukowski, et al., Phys. Rev. Lett. 85, 4418 (2000).
Vol. 102 No. 5 2006

JOURNAL OF EXPERIMENTAL AND THEORETICAL PHYSICS

PRACTICAL IMPLEMENTATION OF MULTILEVEL QUANTUM CRYPTOGRAPHY 33. D. Kaszlikovski, L. C. Kwek, J.-L. Chen, et al., Phys. Rev. A 65, 032118 (2002). 34. H. de Riedmatten, I. Marcikic, V. Scarani, et al., Phys. Rev. A 69, 050 304(R) (2004). 35. D. N. Klyshko, Photons and Nonlinear Optics (Nauka, Moscow, 1980) [in Russian]. 36. A. V. Burlakov and D. N. Klyshko, Pis'ma Zh. иksp. Teor. Fiz. 69, 795 (1999) [JETP Lett. 69, 839 (1999)]. 37. A. V. Burlakov, M. V. Chekhova, O. A. Karabutova, et al., Phys. Rev. A 60, R4209 (1999). 38. A. V. Burlakov and M. V. Chekhova, Pis'ma Zh. иksp. Teor. Fiz. 75, 505 (2002) [JETP Lett. 75, 432 (2002)]. 39. A. A. Zhukov, G. A. Maslennikov, and M. V. Chekhova, Pis'ma Zh. иksp. Teor. Fiz. 76, 696 (2002) [JETP Lett. 76, 596 (2002)]. 40. M. V. Chekhova, L. A. Krivitsky, S. P. Kulik, and G. A. Maslennikov, Phys. Rev. A 70, 053 801 (2004). 41. Yu. I. Bogdanov, L. A. Krivitskioe, and S. P. Kulik, Pis'ma Zh. иksp. Teor. Fiz. 78, 804 (2003) [JETP Lett. 78, 352 (2003)]. 42. Yu. Bogdanov, M. Chekhova, L. Krivitsky, et al., Phys. Rev. A 70, 042 303 (2004). 43. Yu. I. Bogdanov, M. V. Chekhova, S. P. Kulik, et al., Phys. Rev. Lett. 93, 230 503 (2004). 44. D. F. V. James, P. G. Kwiat, W. J. Munro, and A. G. White, Phys. Rev. A 64, 052 312 (2001).

723

45. Yu. I. Bogdanov, R. F. Galeev, S. P. Kulik, et al., Pis'ma Zh. иksp. Teor. Fiz. 82, 180 (2005) [JETP Lett. 82, 164 (2005)]. 46. D. N. Klyshko, Zh. иksp. Teor. Fiz. 111, 1955 (1997) [JETP 84, 1065 (1997)]. 47. L. A. Krivitskioe, S. P. Kulik, G. A. Maslennikov, and M. V. Chekhova, Zh. иksp. Teor. Fiz. 127, 589 (2005) [JETP 100, 521 (2005)]. 48. V. P. Karasev and A. V. Masalov, Zh. иksp. Teor. Fiz. 126, 63 (2004) [JETP 99, 51 (2004)]. 49. A. Sehat, J. SЖderholm, G. BjЖrk, et al., Phys. Rev. A 71, 033 818 (2005). 50. V. P. Karassiov, J. Phys. A 26, 4345 (1993). 51. Y. H. Kim, S. P. Kulik, and Y. Shih, Phys. Rev. A 63, 060 301 (2001). 52. Yu. I. Bogdanov, R. F. Galeyev, S. P. Kulik, et al., submitted to Phys. Rev. A. 53. C. Kurtsiefer, M. Halder, P. Zarda, et al., Nature 419, 450 (2002). 54. N. Lutkenhaus, J. Calsamiglia, and K.-A. Suominen, Phys. Rev. A 59, 3295 (1999). 55. G. A. Maslennikov, A. A. Zhukov, M. V. Chekhova, and S. P. Kulik, J. Opt. B: Quantum Semiclassic. Opt. 5, 530 (2003).

Translated by A. Betev

JOURNAL OF EXPERIMENTAL AND THEORETICAL PHYSICS

Vol. 102

No. 5

2006