1:
2: \documentclass[aps,pra,onecolumn,groupedaddress,showpacs]{revtex4}
3: %\documentclass[12pt]{iopart}
4: %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
5: %\usepackage{iopams}
6: \usepackage{amsfonts}
7: \usepackage{amssymb}
8: \usepackage{graphicx}
9: \usepackage{mathcomp}
10: \usepackage{amsfonts}
11: \usepackage{amssymb}
12: \usepackage{epsfig}
13: %\usepackage[active]{srcltx}
14:
15: %\newcommand{\gguide}{{\it Preparing graphics for IOP journals}}
16:
17: \begin{document}
18:
19: \title{Deterministic Rendering of BB84 for Practical Quantum
20: Cryptography\\}
21:
22:
23:
24: \author{\vspace{0.5cm} M. Lucamarini} \email{marco.lucamarini@unicam.it}
25: \affiliation{Dipartimento di Fisica, Universit\`a di Camerino, via
26: Madonna delle Carceri, 9\\ 62032 Camerino, Italy\\}
27:
28: \author{J. S. Shaari}
29: %\email{marco.lucamarini@unicam.it}
30: \affiliation{Faculty of Science, International Islamic University
31: of Malaysia (IIUM), P.O Box 141, 25710 Kuantan, Pahang Darul
32: Makmur, Malaysia\\}
33:
34: \author{M. R. B. Wahiddin}
35: %\email{marco.lucamarini@unicam.it}
36: \affiliation{Faculty of Science, International Islamic University
37: of Malaysia (IIUM), P.O Box 141, 25710 Kuantan, Pahang Darul
38: Makmur, Malaysia\\} \affiliation{Information Security Cluster,
39: MIMOS Berhad, Technology Park Malaysia, 57000 Kuala Lumpur,
40: Malaysia}
41:
42:
43:
44:
45: \begin{abstract}
46: \vspace{0.5cm} We describe how to modify the BB84 protocol for
47: quantum cryptography in order to make it deterministic. We study
48: both theoretical and experimental aspects of this issue, showing
49: that the new scheme is as secure as the old one, more efficient on
50: small-scale distances, and within the range of current technology.
51: \end{abstract}
52:
53: \pacs{03.67.Dd, 03.67.Hk}
54:
55: \maketitle
56:
57: \section*{Introduction}
58:
59: Classically it is possible to convey information from one user
60: (Alice) to another distant user (Bob) with perfect fidelity. This
61: reliable transmission of information is usually obtained by means
62: of redundancy, i.e. by repeating the main signal as many times as
63: necessary for compensating the noise and the losses of the channel
64: connecting the users. However things turn difficult if Alice and
65: Bob wish to communicate privately, i.e. keeping any third party
66: (usually called ``Eve'') ignorant about the information exchanged
67: over the channel. In this situation redundancy plays against
68: privacy and is not at all simple to guarantee the confidentiality
69: of the communication.
70:
71: Quantum mechanics provide a solution to this issue: by using
72: quantum signals a secret random key can be distributed at distant
73: places and eventually used for a private communication. Several
74: protocols for quantum key distribution (QKD) have been suggested
75: so far
76: \cite{BB84,B92,Ekert91,BBM92,Bruss98,BPG99,DPS02,Pho00,SARG04,Bruss03}.
77: Among these the BB84~\cite{BB84} is arguably the most popular, and
78: has been implemented both in free-space and in optical fiber
79: setups even beyond the limit of 100
80: km~\cite{Ursin2007,Gob04,His06}. Its easiness of implementation
81: also triggered the commercialization of prototypes by a number of
82: brands~\cite{QKDcommercial}.
83:
84: The BB84, as the vast majority of the QKD schemes, is a
85: \textit{non-deterministic} protocol. A protocol is defined
86: ``deterministic'' when Alice can \textit{in-principle} transmit a
87: predetermined sequence of bits to Bob in a reliable way. The
88: ``in-principle'' conditions basically mean ``under ideal working
89: conditions'', e.g. with a noiseless and lossless channel
90: connecting Alice and Bob, or with a Bob endowed with perfect
91: detectors. The simplest example of a deterministic protocol is any
92: protocol working with classical signals (which is reliable but not
93: secure, as explained above), like a standard fax transmission. On
94: the contrary it is easy to see why the standard BB84 is
95: non-deterministic. In the BB84 Alice (Bob) prepares (measures) the
96: quantum signals using one out of two non-commuting observables, or
97: bases. Only when the bases chosen by Alice and Bob coincide the
98: two users get correlated results. In all the other instances they
99: must discard their bits. This happens with probability $1/2$, and
100: leads to the waste of half of the acquired bits, on the average.
101: Then Alice can not, even in principle, transmit a predetermined
102: sequence of bits to Bob, because the final sequence will depend
103: also on Bob's choice of the basis, about which Alice has no
104: control.
105:
106: Quite recently several deterministic protocols have been
107: proposed~\cite{Beige02,Goldenberg1995,Reid2000,Long2002,Bostrom02,Yuen2003,Cai2004,Luc05,Deng2003,Deng2004,Shaari06}.
108: All of them satisfy the requisite of an in-principle reliable
109: communication, but none of them comes with a rigorous proof of its
110: unconditional security. The reason is that the newly proposed
111: deterministic schemes are usually quite different from the
112: existing ones, thus preventing a straightforward application of
113: the mathematical tools developed for the standard protocols in the
114: last two decades. The lack of a security proof in turn prevents a
115: direct comparison between a deterministic and a non-deterministic
116: protocol.
117:
118: The deterministic rendering of BB84 (Det-BB84 hereafter) fills
119: this gap, and lets a first precise quantification of the
120: advantages coming from determinism. The point is that the security
121: of Det-BB84 does not need to be demonstrated \textit{ab initio},
122: because it follows from the standard BB84's one. This allows us to
123: directly compare the two protocols, and establish that determinism
124: increases the rate of secure transmission when Alice and Bob are
125: separated by a small-scale distance.
126:
127: The paper is organized as follows. In Section~\ref{sec:BB84} we
128: review what is known on the possibility of a deterministic
129: rendering of BB84. In Section~\ref{sec:detBB84} we give our
130: protocol and discuss its security. Finally in
131: Section~\ref{sec:practice} we propose a practical implementation
132: of our protocol and contrast it with the traditional BB84.
133:
134:
135: \section{Deterministic BB84} \label{sec:BB84}
136:
137: The possibility of a Det-BB84 is a common
138: knowledge~\cite{note1_DetBB84}. The very first formulation of BB84
139: foresees that Bob is endowed with a quantum memory to store the
140: quantum systems (qubits) received by Alice until Alice's public
141: disclosure of the bases. After knowing the bases of all the qubits
142: Bob can measure them in a deterministic way, i.e. without risk of
143: choosing a wrong basis that makes his measure's outcome random.
144:
145: However a simple-minded Det-BB84 appears to be totally unfeasible
146: because of the presence of a quantum memory and of the demanding
147: security requirements pertaining to QKD. For this reason it has
148: been used so far only as a mathematical tool apt to simplify the
149: analysis of the security. Even recently it has been adopted
150: in~\cite{Bih05} to provide a stronger security for a QKD performed
151: with BB84.
152:
153: To better explain the current impracticality of the deterministic
154: scheme we start our discussion with a basic version of Det-BB84,
155: reported below, which exploits a quantum memory for the storage of
156: the qubits. This version of Det-BB84 follows the steps of the BB84
157: described in~\cite{Bih05}, to which we refer for a detailed
158: description, and of that reported in~\cite{NC00}. We also refer
159: to~\cite{Gisin02} and~\cite{Dusek06} for QKD-related technical
160: details.
161:
162: \medskip
163:
164: \noindent \textbf{DET-BB84 (basic version)}
165:
166: \smallskip
167:
168: \noindent (1)~\textit{Data-bit choice}. Alice chooses a random
169: $W$-bit string $d$ (data string), where $W=(4+\eta_c+\eta_m)N$.
170: The factor $\eta_c$ accounts for the losses of the channel while
171: $\eta_m$ accounts for the losses of Bob's imperfect quantum
172: memory.
173:
174: \noindent (2)~\textit{Basis-bit choice and encoding}. Alice
175: chooses a random $W$-bit string $b$ (basis string). She encodes
176: each bit of $d$ on the qubits as $\left\{ \left\vert
177: 0\right\rangle ,\left\vert 1\right\rangle \right\} $ if the
178: corresponding bit of $b$ is $0$ ($Z$ basis) or $\left\{ \left\vert
179: +\right\rangle ,\left\vert -\right\rangle \right\} $ if the
180: corresponding bit of $b$ is $1$ ($X$ basis). Alice sends the
181: resulting states to Bob.
182:
183: \noindent (3)~\textit{Storage}. Bob receives on average
184: $(4+\eta_m)N$ qubits and stores them in a (imperfect) quantum
185: memory.
186:
187: \noindent (4)~\textit{Receipt}. He announces the completion of
188: step \underline{3} on the (authenticated or unjammable) classical
189: channel.
190:
191: \noindent (5)~\textit{Basis revelation}. Alice announces $b$.
192:
193: \noindent (6)~\textit{Deterministic measurement}. Bob retrieves on
194: average $4N$ qubits from the memory and measures each of them in
195: the $X$ or $Z$ basis according to the disclosed value of $b$. In
196: this way the outcome of his measure is deterministic and Alice and
197: Bob do not discard any bits. After the public announcement by Bob
198: of the addresses of the lost qubits, Alice and Bob will get on the
199: average $4N$ pairs of correlated bit, a fraction of which contains
200: errors due to the possible noise on the channel.
201:
202: \noindent (7)~Alice selects a subset of $2N$ bits that will serve
203: as a check on Eve's interference, and tells Bob which bits she
204: selected.
205:
206: \noindent (8)~Alice and Bob announce and compare the values of the
207: $2N$ check bits. If more than an acceptable number disagree, they
208: abort the transmission.
209:
210: \noindent (9)~Alice and Bob perform error correction and privacy
211: amplification on the remaining $2N$ bits to obtain $2M$ private
212: key bits ($M \leq N$).
213:
214: \medskip
215:
216: Points \underline{3}, \underline{5} and \underline{6} of the above
217: protocol makes it deterministic, because they let Bob always
218: measure in the right basis. In case of a noiseless and lossless
219: channel between the users, the newly acquired determinism would
220: enable the possibility of a \textit{direct
221: communication}~\cite{Beige02,Bostrom02} via BB84. However, even
222: for an imperfect channel and quantum memory, one can notice that
223: the coefficient in front of $M$, the final number of distilled
224: bits, is 2. This should be compared with the coefficient 1
225: pertaining to BB84~\cite{NC00}. It is apparent that this
226: corresponds to a doubling of the theoretical final secure
227: bit-rate.
228:
229: A crucial point that makes Det-BB84 as secure as the original
230: BB84~\cite{Bih05} is the \underline{4}, which represents the
231: receipt by Bob of the qubits sent by Alice. Without it there's a
232: risk that Eve delays the qubits until the public disclosure of the
233: basis, thus gaining for herself the possibility of a deterministic
234: measurement. In such a case Eve would go entirely undetected.
235:
236: This security issue apart, point \underline{4} represents the main
237: obstacle toward a practical implementation of Det-BB84. In fact,
238: to send a receipt, Bob must acknowledge that a given number of
239: signals (for example photons) entered his station. The only way to
240: do that without altering the information carried by the photons is
241: represented by an ideal quantum nondemolition measurement (QND),
242: which is still a demanding technology~(\cite{QND}, and references
243: therein).
244:
245: %
246: %we move from a single-transmission protocol (all the
247: %$W$ qubits transmitted, stored and to $W$ ``qubit-by-qubit''
248: %transmissions. After each qubit transfer Bob gives one receipt,
249: %and Alice reveals the basis for that qubit. This step does not
250: %change the overall amount of the used resources, and maintains the
251: %equivalence with BB84.
252: %
253: %The second step concerns the storage of the photons. T
254: %
255: Point \underline{4} also implies that Bob must store the qubit
256: until Alice's basis revelation (point \underline{3}). If we follow
257: the qubit in its travel we see that the minimum storage time for a
258: Det-BB84 with a receipt's transmission is $ 2 \tau$, where $\tau$
259: is the time for a signal to cover the distance between Alice and
260: Bob: one $\tau$ is to let Bob's receipt reach Alice, and one
261: $\tau$ is to let Alice transmit the basis to Bob (we assume for
262: simplicity that Alice and Bob use the same channel, hence the two
263: times are equal in both directions).
264:
265: The simplest example of a quantum memory is an optical fiber loop
266: of length $L$ that allows to store a photon for a time $nL/c$,
267: with $n$ the refractive index of the fiber, $c$ the velocity of
268: light in vacuum. At least in this simple case it is plain that the
269: longer the photons are stored, the lower the probability to
270: recover. Then, it would be necessary to keep the storage time as
271: lower as possible.
272:
273:
274: \section{Practicality and Security of Det-BB84} \label{sec:detBB84}
275:
276: The considerations of Section~\ref{sec:BB84} suggest that the
277: impracticality of Det-BB84 is mainly related to its point
278: \underline{4} (receipt of the qubits). In the following we show
279: how to remove this point from the protocol without affecting its
280: security. Despite some steps might result unusual (clock
281: synchronization, initial measurement of the time delay), they have
282: already been considered elsewhere and belong to the standard
283: implicit structure of any QKD.
284:
285: \medskip
286:
287: \noindent \textbf{DET-BB84 (practical version)}
288:
289: \smallskip
290:
291: \noindent (1)~\textit{Preliminaries}. Alice and Bob measure the
292: time $\tau$ that a classical pulse (e.g. an intense laser pulse)
293: employs to cover the distance between them. Then they use the
294: (authenticated or unjammable) classical channel to (i) publicly
295: declare the measured time $\tau$ (ii) establish the value of a
296: positive security parameter, $\Delta$, used later for the security
297: analysis.
298:
299: \noindent (2)~\textit{Data-bit choice}. Alice chooses a random
300: $W$-bit string $d$ (data string), with $W=(4+\eta_c+\eta_m)N$. We
301: indicate with $d_{i}$ ($i=1,...,W$) the $i$-th bit of the string
302: $d$.
303:
304: \noindent (3)~\textit{Basis-bit choice}. Alice chooses a random
305: $W$-bit string $b$ (basis string). We indicate with $ b_{i}$
306: ($i=1,...,W$) the $i$-th bit of the string $b$.
307:
308: \noindent (4)~\textit{Encoding and transmission of quantum
309: information}. Beginning with $i=1$ Alice encodes the data $d_{i}$
310: into the qubit $q_i$. She encodes each bit of $d$ as $\left\{
311: \left\vert 0\right\rangle ,\left\vert 1\right\rangle \right\} $ if
312: the corresponding bit of $b$ is $0$ ($Z$ basis) or $\left\{
313: \left\vert +\right\rangle ,\left\vert -\right\rangle \right\} $ if
314: the corresponding bit of $b$ is $1$ ($X$ basis). At time $t^{q}_1$
315: Alice starts the transmission of the qubits to Bob. At the generic
316: time $t^{q}_i$ Alice will send out the qubit $q_i$. We note that
317: the times $t^{q}_i$ (included the initial time $t^{q}_1$) need not
318: to follow any particular prescription, and are simply related to
319: Alice's source's repetition rate.
320:
321: \noindent (5)~\textit{Transmission of classical information}. At
322: time $t^{b}_1 = (t^{q}_1+\tau+\Delta)$, \underline{without waiting
323: for Bob's receipt}, Alice starts the transmission of the basis
324: bits $b_{i}$ using the classical channel. At the generic time
325: $t^{b}_{i}=t^{q}_i+\tau+\Delta$ she will send out the bit $b_{i}$.
326: We note that $\tau$ and $\Delta$ have been declared on the
327: authenticated channel during step \underline{1}. We also note that
328: the classical channel can be thought for simplicity and without
329: loss of generality as the same channel used for the qubits, for
330: example an optical fiber, but with an intense signal traveling in
331: it. This entails that the bit $b_i$ employs an additional time
332: $\tau$ to reach Bob. In any case the traveling time on the
333: classical channel is measured and declared during
334: step~\underline{1}.
335:
336: \noindent (6)~\textit{Acquisition of classical information}. At
337: certain times $T_{i}$ Bob acquires the $W$ basis bits $b_{i}$, and
338: labels them as $B_{i}$. This step is very similar to Bob receiving
339: a normal telephone call: he records both the values of the
340: $B_{i}$'s and their times of arrival $T_{i}$. For what said at
341: point \underline{5}, the expected times of arrival are $T_{i} =
342: (t^{q}_{i}+2\tau+\Delta+\delta)$, where $\delta>0$ is a certain
343: unavoidable temporal delay due to the electronics of Bob's
344: apparatus.
345:
346: \noindent (7)~\textit{Deterministic measurement}. As soon as the
347: values $B_{i}$ are available to Bob, he uses them to perform a
348: deterministic measure of the qubits. The timing of this new
349: measure is given by $(T_{i}+\delta^{\prime})\pm\varepsilon$, where
350: $\delta^{\prime}\geq\delta$ is another temporal delay, known to
351: Bob, due to the imperfectness of his apparatus and
352: $\varepsilon\ll\Delta$ is the temporal acquisition window of his
353: detectors. Bob labels the outcomes of this measure as $D_{i}$ and
354: builds up the data string $D$.
355:
356: \noindent (8)~After Bob's public announcement of the losses the
357: users should share on average $4N$ pairs of correlated bits (if it
358: is not so they abort the transmission). Alice selects a subset of
359: $2N$ bits of $d$ and $2N$ bits of $b$ that will serve as a check
360: of Eve's interference, and tells Bob the addresses of the selected
361: bits. Bob selects the same addresses from the strings $B$ and $D$.
362:
363: \noindent (9)~Alice and Bob announce on the classical channel (i)
364: the values of the selected $2N$ basis bits $b_i$ and $B_i$. If any
365: of them does not coincide they abort the whole transmission. (ii)
366: The times of arrival $t^{b}_{i}$ and $T_{i}$ corresponding to the
367: selected $2N$ pairs of bits from $b$ and $B$. If any of them does
368: not fulfill the relation $T_{i} = t^{q}_{i}+2\tau+\Delta+\delta$
369: within the experimental error they abort the transmission (note
370: that for this step the clocks of the users are assumed to be
371: synchronized). (iii) The values of the selected $2N$ pairs of
372: check bits from $d$ and $D$. If more than an acceptable number of
373: these values disagree, they abort the transmission.
374:
375: \noindent (10)~Alice and Bob perform error correction and privacy
376: amplification on the remaining $2N$ bits to obtain $2M$ private
377: key bits ($M \leq N$).
378:
379: \medskip
380:
381: This version of Det-BB84, with the crucial point \underline{5},
382: removes the problem of Bob's receipt, relying more on the
383: classical communication. The main ingredient is a kind of
384: ``postselected'' receipt by Bob: Alice transmits the information
385: about the basis without waiting for Bob's receipt, and Bob does
386: not send the receipt in the very moment he receives the photon.
387: Yet his final measurement will reveal whether the photon was there
388: at the expected time or not. Thus the main problem of a QND
389: measurement is removed at the roots. Another advantage of the
390: above protocol is that the storage time at Bob's site is reduced
391: from $2\tau$ (as discussed in Section~\ref{sec:BB84}) to $\tau +
392: \Delta$. This reduces considerably the losses due to the storage
393: in Bob's quantum memory.
394:
395:
396: \subsection*{Security of the scheme} \label{sec:security}
397:
398: Apart from the removal of Bob's receipt of the qubits, Det-BB84 is
399: entirely equivalent to the protocol we described in
400: Section~\ref{sec:BB84}, which, in turn, has been shown to be
401: secure and equivalent to the original BB84 in~\cite{Bih05}. Hence,
402: our security analysis aims at showing the security of Det-BB84
403: against attacks based on the potential weakness created by the
404: Bob's receipt removal. It can also be seen as a new security
405: argument in the frame of ``sequential'' protocols for
406: QKD~\cite{Mor96},~\cite{Cabello00}.
407:
408: For the moment we consider Bob's measuring apparatus as ideal, and
409: we do not include in the proof the experimental parameters
410: $\delta$, $\delta^{\prime}$ and $\varepsilon$ introduced above.
411: The attackable point of our protocol is the lack of a qubit
412: receipt from Bob to Alice. The risk is that Eve uses the disclosed
413: bases to measure the qubits without perturbing them. Any other
414: kind of eavesdropping is tantamount to Eve attacking a qubit just
415: as she would do against a normal BB84 system. In order to exploit
416: the basis information Eve must delay the qubit until the basis is
417: disclosed. But any variation of the basis time of arrival respect
418: to what declared in point \underline{1} is detected during the
419: check performed at point (ii) of \underline{9}; and any variation
420: of the values of the bases decided by Alice, e.g. through an
421: impersonation attack~\cite{Dusek99}, is detected during the check
422: of point (i) of \underline{9}.
423:
424: Then assume that Eve controls opportunely the length of the
425: channel between Alice and Bob in order to intercept the qubit
426: $q_i$, wait for the basis information $b_i$, measure the qubit
427: without perturbing it, and forward it to Bob without being
428: detected. Let us examine the timing of the protocol: Alice
429: transmits the qubit $q_i$ at time $t^{q}_i$, and the basis
430: information at time
431: \begin{equation}\label{basistime}
432: t^{b}_{i}=t^{q}_i+\tau+\Delta.
433: \end{equation}
434: Bob waits for the basis and deterministically measures the qubit
435: at $T_i = t^{q}_{i}+2\tau+\Delta$ (if this last relation is not
436: \textit{a posteriori} satisfied the protocol is aborted, according
437: to point (ii) of \underline{9}). It is easy to see that Eve would
438: go undetected only if she is able to do her attack without
439: changing the time signature represented by $T_i$. Therefore, since
440: the storage time of Bob's quantum memory is $\tau + \Delta$, Eve
441: must let the qubit enter Bob's station at time
442: \begin{equation} \label{t'}
443: T_i - (\tau + \Delta) =t^{q}_{i}+2\tau+\Delta - (\tau + \Delta) =
444: t^{q}_{i}+ \tau
445: \end{equation}
446: to go undetected. But this time is always less than that at which
447: the basis is revealed (Eq.\ref{basistime}), as long as $\Delta
448: > 0$. In other words when Eve knows the basis from Alice she does not
449: get the qubit anymore.
450:
451: Now let us discuss the experimental delays $\delta$,
452: $\delta^{\prime}$ and $\varepsilon$ of Bob's apparatus in relation
453: to the security issue. The crucial quantity is the parameter
454: $\Delta$: how big should it be to maintain the security of the
455: protocol? The quantity $\varepsilon$ represents a kind of
456: experimental error in determining the exact time of arrival of the
457: photons at Bob's site. For example when the BB84 is implemented
458: using weak pulses as a photon source $\varepsilon$ is the time
459: window of Bob's ``gated mode'' detectors (i.e. detectors which are
460: open only when a photon is expected to be there); otherwise, when
461: the photons are generated through the spontaneous parametric down
462: conversion, $\varepsilon$ is the time window of the coincidence
463: counts. In both cases typical values of $\varepsilon$ are less
464: than 10 ns. In order to maintain the security of our protocol, at
465: point \underline{7} of Det-BB84 we required that
466: $\varepsilon\ll\Delta$. But it descends from our security argument
467: that actually the condition $\varepsilon<\Delta$ is sufficient to
468: guarantee the security of the protocol. Hence, for all practical
469: purposes, we can set $\Delta = 10 \varepsilon \approx 100$~ns.
470: %,i.e. the time light employs to cover about 30 m of free-space.
471:
472: \section{Experimental issues} \label{sec:practice}
473:
474: In this section we discuss the feasibility of Det-BB84. We
475: consider a fiber-based configuration with weak pulses as a photon
476: source. For the only purpose of comparison we make our proposal
477: very similar to the one-way scheme recently reported on
478: in~\cite{Gob04}. However it is straightforward to work out a
479: different setup, for example using the two-way plug-and-play
480: configuration~\cite{Muller1996,Muller1997}.
481:
482: The experimental Det-BB84 requires a fast and precise
483: synchronization: fast enough to reduce Bob's storage time, and
484: precise enough to fulfill the security criteria. Specifically
485: points \underline{4}-\underline{7} require a precise
486: synchronization between the line carrying the quantum information
487: (the qubit) and the line carrying the classical information (the
488: basis).
489:
490: All the QKD realizations known so far use three lines for
491: communication: the quantum channel, the timing channel, or
492: trigger, and the classical channel. In~\cite{Gob04} the quantum
493: channel is a pulsed attenuated laser at the wavelength of
494: $1550$~nm, the trigger is a pulsed bright laser at the wavelength
495: of $1300$~nm, which is used to synchronize the whole apparatus,
496: and the classical channel is the Internet, which is employed to
497: transfer the information about the bases and about error
498: correction and privacy amplification. Now it is plain that to
499: obtain the synchronization between the qubit and the basis
500: mentioned above one can not rely on the Internet, because it can
501: be unpredictably slow and random in the delivery of the TCP/IP
502: packets. The solution is to use the trigger pulse, already
503: synchronized with the quantum line, to convey also the basis
504: information. To do that one can for example modulate the intensity
505: of the trigger pulse: `low-pulse' can represent a `0', while
506: `high-pulse' can represent a `1'. Or it is possible to adequately
507: digitalize the signal.
508:
509: Our scheme is sketched in Figure\ref{FIG:setup}.
510: %
511: \begin{figure}[tbp]
512: \includegraphics[width=14cm]{FIG_setup.eps}
513: \caption{Possible implementation of Det-BB84, obtained through
514: simple changes to the setup of Ref.\protect\cite{Gob04}. L1 and
515: L2: laser diodes; WDM: wavelength division multiplexer; PBS:
516: polarization beam combiner/splitter; APD: avalanche photo diode
517: detector. $L=\tau c/n$, $\Lambda=\Delta c/n$ (see text).}
518: \label{FIG:setup}
519: \end{figure}
520: %
521: The \textit{start} pulse from the computer drives the two laser
522: sources (L1 @1550 nm, the quantum signal, and L2 @1300 nm, the
523: trigger) and the phase modulator which encodes the information in
524: the relative phase of the two pulses generated by L1 and Alice's
525: interferometer. We drew the random number generator (RNG) as
526: detached from the computer for simplicity. The phase encoded on
527: the pulses is determined by the sum of the values of the basis
528: ($0$ or $\pi/2$) and those of the state ($0$ or $\pi$). The
529: important feature is that the basis is also written on the bright
530: pulse @1300 nm, which now has a twofold role: time reference for
531: Bob and carrier of the basis information. Along the bright pulse
532: path there is a delay line, represented by a number of fiber
533: loops, of length $L+\Lambda$. To use the parameters given in
534: Det-BB84 we set $L=\tau c/n$, and $\Lambda=\Delta c/n$, with $n$
535: the refractive index of the fiber and $c$ the speed of light in
536: vacuum.
537:
538: At Bob's site the WDM selects the bright pulse, which is directed
539: at a PIN photodiode detector. This acts as a trigger for the gate
540: of the avalanche photodiode detectors APD1 and APD2. Moreover the
541: value read by the detector (i.e. the basis used by Alice) acts as
542: an input to the phase modulator represented by $\varphi_B$ in the
543: figure, thus allowing the deterministic measurement by Bob. On the
544: other hand, the path followed by the quantum carrier (photon from
545: laser L1) is the same as in~\cite{Gob04}. The only difference is
546: the delay on Bob's site, which is equal to the one at Alice's.
547: This delay represents the simplest quantum memory and allows Bob
548: to wait for the information about the basis before his final,
549: deterministic measurement. So in the whole, with respect to the
550: usual BB84, no additional material other than some software and
551: electronics is required for the implementation of Det-BB84.
552:
553:
554: \subsection*{Comparison with the BB84} \label{sec:comparison}
555:
556: In this section we compare our proposal for a practical Det-BB84
557: with the BB84 of~\cite{Gob04} in terms of the rate of secure bits,
558: $R_{sec}$, introduced by N. Lutkenhaus in~\cite{Lutkenhaus2000}.
559: $R_{sec}$ is a pure number and represents the fraction of
560: distilled secure bits after the procedures of error
561: correction~\cite{Bennett1992,Brassard1994,But03} and privacy
562: amplification~\cite{Bennett1995}. It must be multiplied by the
563: effective repetition rate in order to obtain the total secure rate
564: of the considered setup. The $R_{sec}$ for a BB84 implemented with
565: weak pulses is defined as~\cite{Lutkenhaus2000}:
566: \begin{equation} \label{R_BB84}
567: R_{sec}^{BB84}=\frac{1}{2} p_{exp} \{
568: \beta\left[1-\tau\left(e/\beta\right)\right]-
569: f_{casc}h\left(e\right) \}.
570: \end{equation}
571: The coefficient $1/2$ comes from the basis reconciliation
572: procedure, in which the users' bases coincide with an average
573: probability of $1/2$~\cite{note3_DetBB84}. $p_{exp}$ is the signal
574: of the experiment, which is given by the formula:
575: \begin{equation}\label{pexp}
576: p_{exp}=p_{exp}^{signal}+p_{exp}^{dark}-p_{exp}^{signal}p_{exp}^{dark};
577: \end{equation}
578: $p_{exp}^{dark}$ is the probability Bob gets a dark count in his
579: detectors, while $p_{exp}^{signal}$ is the probability that Bob's
580: detector fires because of a photon emitted by Alice's source. This
581: probability decreases with the distance between the users
582: according to the expression:
583: \begin{equation}\label{pexpsignal}
584: p_{exp}^{signal}=1-exp\left( -\eta_{B}\eta_{T}\mu \right),
585: \end{equation}
586: where $\eta_{B}$ is the quantum efficiency of Bob's detectors,
587: $\mu$ is the average number of photons per pulse, and $\eta_{T}$
588: is the transmission probability of the channel, given by:
589: \begin{equation}\label{etaT}
590: \eta_{T}=10^{-\left(\alpha L + L_{c} \right)/10}.
591: \end{equation}
592: $\alpha$ is the absorption coefficient of the fiber, $L_{c}$ is
593: the loss rate at receiver's station and $L$ is the distance
594: between the users, as reported in Figure~\ref{FIG:setup}.
595: Furthermore in Eq.~(\ref{R_BB84}) $\beta$ is defined as:
596: \begin{equation}\label{beta}
597: \frac{p_{exp}-S_{m}}{p_{exp}},
598: \end{equation}
599: with $S_{m}$ the probability that Alice photon source emits more
600: than a single photon per pulse. $\beta$ is a sort of security
601: parameter: until it is positive the protocol is secure against the
602: so-called PNS attacks~\cite{Hut95,Lutkenhaus2000,Bra00}.
603: $f_{casc}$ is a function defined in~\cite{Brassard1994} that takes
604: into account the imperfect (although efficient) error correction
605: procedure performed with the Cascade protocol. For simplicity we
606: set it equal to $1$ in our simulations. $h\left( e\right) $ is the
607: Shannon entropy pertaining to a given QBER $e$. Finally $\tau$ is
608: the fraction of the error-corrected key which has to be discarded
609: during privacy amplification when only single-photon pulses are
610: taken into account~\cite{Lutkenhaus1999}; it is a function of the
611: QBER and amounts to: $\tau(e) =\log_{2}(1+4e-4e^{2})$ for $0\leq
612: e\leq1/2$ and $\tau(e) =1$ for $1/2<e\leq1$.
613:
614: \smallskip
615:
616: Analogously we define the secure rate for Det-BB84 as:
617: \begin{equation} \label{R_DetBB84}
618: R_{sec}^{Det-BB84}=p_{exp} \{
619: \beta\left[1-\tau\left(e/\beta\right)\right]-
620: f_{casc}h\left(e\right) \}.
621: \end{equation}
622: Notice that the coefficient $1/2$ is replaced by $1$ in the above
623: equation, due to Bob's deterministic measurement. Furthermore the
624: transmission probability $\eta_{T}$ is different from the one in
625: Eq.~(\ref{etaT}). In fact in our scheme the photon is stored in
626: the fiber loops at Bob's site, whose length is $L + \Lambda$. Then
627: the transmission probability becomes:
628: \begin{equation}\label{etaT_DetBB84}
629: \eta_{T}^{\prime}=10^{-\left[\alpha \left(2L + \Lambda \right) + L_{c} \right]/10}.
630: \end{equation}
631: This entails that Det-BB84 is more affected by losses than BB84.
632: However when the distance between Alice and Bob is small enough,
633: the loss-rate is low, and the determinism still provides a
634: nontrivial increase of the secure bit-rate.
635:
636: For every fixed distance $L$ between the users the secure rate has
637: a different maximum in the average photon number
638: $\mu$~\cite{Lutkenhaus2000}. In our numerical simulation we chose
639: the value of $\mu$ as such as to independently maximize the secure
640: rate of BB84 and Det-BB84 at given lengths $L$. These values are
641: reported in Table~\ref{tableI}.
642: %All the experimental parameters have been extrapolated by the BB84
643: %implementation described in~\cite{Gob04}.
644: \begin{table}[h!]
645: \centering
646: \begin{tabular}{|c|c|c|c|c|c|}
647: \hline
648: % after \\: \hline or \cline{col1-col2} \cline{col3-col4} ...
649: distance (km) & $\mu_{optimal}^{Det-BB84}$ & $\mu_{optimal}^{BB84}$ & $R_{\text{sec}}^{Det-BB84}$ & $R_{\text{sec}}^{BB84}$ & $R_{\text{sec}}^{Det-BB84}/R_{\text{sec}}^{BB84}$ \\
650: \hline
651: 2 & 0.03820 & 0.04200 & 6.9145$\times10^{-4}$ & 4.1686$\times10^{-4}$ & 1.6587 \\
652: 4 & 0.03155 & 0.03818 & 4.7567$\times10^{-4}$ & 3.4572$\times10^{-4}$ & 1.3759 \\
653: 8 & 0.02162 & 0.03156 & 2.2498$\times10^{-4}$ & 2.3783$\times10^{-4}$ & 0.9460 \\
654: 16 & 0.01025 & 0.02165 & 4.9456$\times10^{-5}$ & 1.1249$\times10^{-4}$ & 0.4396 \\
655: \hline
656: \end{tabular}
657: \caption{Values used for the numerical calculation of the secure key rates of
658: BB84 and Det-BB84 protocols. For each distance and for each protocol the average
659: photon number $\mu$ has been optimized to maximize the rate. Experimental
660: parameters taken from~\cite{Gob04}.}\label{tableI}
661: \end{table}
662:
663: In Figure~\ref{FIG1} the secure rate is plotted for BB84
664: (Eq.~\ref{R_BB84}) and Det-BB84 (Eq.~\ref{R_DetBB84}) as a
665: function of $L$. Only the average photon number $\mu$ is
666: different, according to what just explained. The diagrams
667: (\textit{a}), (\textit{b}), (\textit{c}) and (\textit{d}) have
668: been obtained by fixing four values of $L$ and finding the values
669: $\mu_{i}$ that maximize $R_{sec}\left(\mu_{i}|L_{j}\right)$
670: separately for BB84 and Det-BB84. Vertical lines have been drawn
671: at the crucial distances $L_{j}$.
672: \begin{center}
673: \begin{figure}[h!]
674: \includegraphics[width=14cm,height=10cm]{FIG_results.eps}\newline
675: \caption{Secure rate of Det-BB84 and BB84 optimized for distances
676: between Alice and Bob of 2, 4, 8 and 16 km. Experimental
677: parameters taken from~\cite{Gob04}.} \label{FIG1}
678: \end{figure}
679: \end{center}
680:
681: It can be seen that in the plots (\textit{a}) and (\textit{b}) the
682: secure rate provided by the Det-BB84 is higher than that
683: pertaining to BB84. After that, in plot (\textit{c}), the rates
684: provided by the two protocols are almost the same. Finally in plot
685: (\textit{d}), the standard BB84 provides a higher rate. In other
686: words, for distances up to about 8 km the Det-BB84 provides a
687: better rate than the non-deterministic BB84. For distances of less
688: than 2 km the improvement factor is more than 1.65, nearing the
689: final value of 2 for very short distances and for a lossless
690: setup. We remember that the maximum secure distance achievable
691: with the BB84 setup described in~\cite{Gob04} is about 60 km.
692:
693: \medskip
694:
695: It should be noted that the secure rate is a figure of merit of a
696: QKD setup, and is not a trivial task to increase it. The rate of
697: transmission in any fiber-based setup is currently limited by
698: detectors' minimum dead times, which are of the order of
699: microseconds for a standard InGaAs Avalanche Photodiode Detector
700: (APD). This is a technological limitation that can be surpassed
701: only by improving the detection mechanism. All the same, in the
702: setups exploiting the spontaneous parametric down-conversion as a
703: single-photon source is not possible to increase the signal on
704: demand. The improvement brought about by Det-BB84 works in both
705: the situations as it concerns the protocol itself, not the way it
706: is implemented. In this respect the plots in Figure~\ref{FIG1} are
707: ``universal'', i.e. independent of the particular technology
708: employed in the experiments. For example it is possible to simply
709: change the scaling factor of the plots drawn above to know the
710: performances of a Det-BB84 realized in free space at the
711: wavelength of 800 nm. It is worthwhile to mention that a low-loss
712: high-rate QKD on very short distances has attracted recently
713: renewed interest because of its closeness to the credit-card
714: security issue~\cite{Dul06}. The rate of this kind of
715: transmissions can be almost doubled using Det-BB84.
716:
717: We also remark that the performances of the practical Det-BB84
718: studied here are not the best possible. For instance we assumed a
719: poor quantum memory for the storage of the photons at Bob's site,
720: i.e. an optical-fiber loop with the same transmission as the one
721: used to connect the users. The maximum distance over which the
722: Det-BB84 outperform the BB84 directly depends on this storage
723: mechanism: the better it is the longer the distance. Technological
724: progresses concerning quantum memories are continuously reported,
725: and values of storage time up to microseconds have been recently
726: achieved~\cite{storage}.
727:
728:
729: \section{Conclusion}
730:
731: In this paper we have provided a first evidence that a
732: deterministic rendering of the BB84 protocol is not only
733: conceivable in theory, but also realizable in practice with
734: current technology. We have introduced the new protocol Det-BB84
735: which is as secure as the standard BB84 and does not need a Bob's
736: receipt for the qubits, thus paving the way to a feasible setup.
737: In fact we have proposed an implementation of Det-BB84 and
738: compared it with the BB84 reported in~\cite{Gob04} in terms of the
739: secure rate of distilled bits, finding a nontrivial increase of
740: the bit-rate at small distances between Alice and Bob. This
741: increase can become even more relevant as long as technology
742: provides better memories for the storage of the qubits.
743:
744: \section{Acknowledgements}
745:
746: The core of this work has been prepared in the labs of MIMOS
747: Berhad, Kuala Lumpur. For its completion one of the authors (M.
748: L.) acknowledges the European Commission through the Integrated
749: Project ‘‘Qubit APplications’’ (QAP), Contract No. 015848, funded
750: by the IST directorate.
751:
752: \newpage
753:
754: \bibliography{total}
755:
756:
757:
758: \end{document}
759: