1: \documentclass[]{spie} %>>> use for US letter paper
2:
3: %%\documentclass[a4paper]{spie} %>>> use this instead for A4 paper
4: %%\addtolength{\voffset}{9mm} %>>> moves text field down
5:
6: \usepackage[]{graphicx}
7: \def\titlefont{\LARGE\bf}
8: \title{Quantum key distribution with unconditional security for all optical fiber network}
9:
10: \author{
11: Osamu Hirota\supit{a,b},
12: Kentaro Kato\supit{b},
13: Masaki Shoma\supit{c},
14: and
15: Tsuyoshi Sasaki Usuda\supit{d},
16: \skiplinehalf
17: \supit{a}
18: Tamagawa University,
19: Tamagawa-gakuen 6-1-1, Machida, Tokyo 194-8610, JAPAN\\
20: \supit{b}
21: 21st century COE program, Chuo University, Tokyo, JAPAN\\
22: \supit{c}
23: Matsushita Research Institute Tokyo, Inc., JAPAN\\
24: \supit{d}
25: Aichi Prefectural University, Aichi, JAPAN.
26: }
27:
28: %>>>> Further information about the authors, other than their
29: % institution and addresses, should be included as a footnote,
30: % which is facilitated by the \authorinfo{} command.
31:
32: \authorinfo{
33: Further author information:
34: (Send correspondence to Osamu Hirota)\\
35: Osamu Hirota: address; 6-1-1, tamagawa-gakuen, machida-city, Tokyo, Japan.
36: E-mail, hirota@lab.tamagawa.ac.jp;
37: Telephone, +81-42-739-8674\\
38: Kentaro Kato:
39: E-mail, kkatop@ieee.org\\
40: Masaki Sohma:
41: E-mail, sohma@mrit.mei.co.jp\\
42: Tsuyoshi Sasaki Usuda:
43: E-mail, usuda@ist.aichi-pu.ac.jp
44: }
45: %%>>>> when using amstex, you need to use @@ instead of @
46:
47:
48: %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
49: %>>>> uncomment following for page numbers
50: % \pagestyle{plain}
51: %>>>> uncomment following to start page numbering at 301
52: %\setcounter{page}{301}
53:
54: \begin{document}
55: \maketitle
56:
57: %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
58: \begin{abstract}
59: Previously the present protocol was referred as Yuen-Kim second version in our papers.
60: In this paper, it is called Yuen protocol (Y-00) and we present an efficient implementation method of
61: physical layer of Y-00 which can support a secure
62: communication and a quantum key distribution (more generally key expansion)
63: by IMDD(intensity modulation/direct detection)
64: or FSK(frequency shift keying)optical fiber communication network.
65: Although the general proof of the security is not yet given,
66: a brief sketch of security analysis is shown, which involve an entanglement attack.
67: \end{abstract}
68:
69: %>>>> Include a list of keywords after the abstract
70:
71: \keywords{
72: quantum cryptography, Yuen protocol, fiber network
73: }
74:
75: %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
76: \section{INTRODUCTION}
77: A quantum key distribution for legitimate two users
78: (Alice and Bob) is one of the most
79: interesting subjects
80: in quantum information science, which was pioneered by C.Bennett and
81: G.Brassard in 1984[1]. In the original paper of Bennett,
82: single photon communication was employed for implementation
83: of quantum key distribution for simple explanation.
84: However, despite that it is not essential
85: in the great idea of Bennett, many researchers employed
86: single photon communication scheme to realize BB84, B92[2].
87: There exist limitations of communications by single photon state
88: or other quantum state(squeezed state and et al) with strong
89: quantumness in the practical sense[3]. So
90: it was discussed whether one can realize a secure key distribution
91: guaranteed by quantum nature based on conventional light wave
92: communication or not. One of the answers is that one employs
93: coherent state as transmitter state, which has a semiclassical nature and
94: a robustness for energy loss. Recently, as an example, an implementation of
95: BB-84 by using continuous variable coherent state has been proposed[4],
96: which may communicate more long distance and higher efficiency than
97: single photon scheme.
98:
99: On the other hand, in the history of information theory,
100: there were already several works on protocol with unconditionally secure
101: communication. Let us introduce a short history on this subject.
102: The most important problem is what is unconditional security.
103: The condition of perfect secrecy $I(X;C)=0$ was given by Shannon.
104: It means that the plaintext $X$ and the cipher text $C$ as a function of
105: $X$ and a secret key $K$ should be statistically independent.
106: He assumed in his model that Eve has access to precisely the
107: same information as the legitimate user.
108: As a result, a condition: $H(X)\le H(K)$ is required.
109: It looks like impractical, because it means that perfect secrecy is
110: achieved only when the secret key is at least as long as the plaintext message.
111: However, such a pessimism was solved by introducing the modified
112: Shannon's model such that Eve cannot receive precisely the same information as Bob. There may be certain condition in physical world to realize the perfect secrecy. If we have no conditions for it, then it is called unconditionally secure scheme.
113: In general, we can define a channel model of cipher communication or
114: key distribution by the conventional information theory.
115: That is, we have two channels. One is
116: the channel from Alice to Bob, and the other is the channel from Alice to Eve.
117: Let $X,Y,Z$ be random variables of Alice, Bob, and Eve, respectively.
118: The channel behavior is completely specified by the conditional probability
119: $P(Y, Z | X)$.
120: For broadcast channels described by $P(Y, Z | X)$, Wyner[5] clarified a fact
121: that one can realize a scheme with unconditional security in which Eve is assumed
122: to receive signals from Alice over a channel that is noisier than
123: the legitimate users. Subsequently Csisz$\acute{\rm}$ar-K$\ddot{\rm o}$rner[6]
124: generalized Wyner's result defining the secrecy capacity $C_c(P(Y, Z | X))$
125: which means that the maximum bits that Alice can send to Bob in secrecy.
126: These schemes allow us realization of one way communication with confidential
127: message $X$ without initial key, and also distribution of key $K$.
128: However, the assumption that Eve's channel is worse than the legitimate
129: channel is also unrealistic.
130: When the discussion is devoted to only the problem of key distribution,
131: Maurer[7] pointed out that this assumption is not needed if the legitimate
132: users can communicate over insecure but authenticated public channel like BB-84.
133: Unfortunately the efficiency of communication is not so good,
134: because it requires small SNR. In addition, in such information
135: theoretical results, the problem of finding actual encodable and
136: decodable codes that perform in a particular situation was remained.
137: Yuen and Kim[8] showed that, using a protocol like B-92, a practical
138: system with unconditional security can be realized
139: if there exist some statistically independent noise or quantum shot noise
140: in receivers of Eve and Bob, even the system is conventional fiber communication.
141: It is called YK protocol. A simple experimental demonstration of
142: YK protocol based on classical noise was reported[9].
143: Thus the unconditionally secure key distribution does not require
144: a realization of single photon communications and also even quantum phenomena.
145: {\it These results verified that the key distribution with unconditional security
146: is not proper matter of quantum theory}. So one can realize unconditionally
147: secure scheme by classical communication systems if there exist unavoidable
148: noise such as "thermal noise in free space" and so on. In addition, $H(X)\le H(K)$
149: is not essential.
150: However, these schemes are still inefficient, because it requires small SNR also.
151: One should investigate protocol with more high rate under high security.
152: The best way may be that one seeks noisy channel governed by unavoidable
153: quantum noise based on quantum mechanics. As a result, an interesting question arises
154: " Is it possible to create a quantum system with current technology that
155: could provide a communication in which always Bob's error probability is
156: superior to that of Eve?"
157: In 2000, Yuen gave a protocol(Y-00) to realize it as a positive answer[10],
158: in which he clarified a new scheme so called $M$-ary level cipher.
159: This provides a theoretical basis for communication with confidential message
160: for more general channel models including Wyner's broadcast channel,
161: but it requires initial shared key between Alice and Bob.
162: Furthermore, his scheme supports also secure key expansion,
163: because the message can be replaced by random number.
164: In proceedings paper of QCM and C 2002, an implementation method was shown by using
165: conventional optical communication system[11].
166: These results urged the problem of Wyner, Csisz$\acute {\rm a}$r,
167: Maurer to return from classical to quantum. It may be expected that
168: it will open a new trend of
169: quantum cryptography as a replacement of single photon scheme.
170:
171: Thus, the theory of quantum key expansion has been developed along two directions.
172: One is to follow BB-84 and to give rigorous proof of security of BB-84 and B-92.
173: The other is to follow a basic idea of Wyner and others for broadcast channels. Y-00
174: is close to the latter, but it is applicable to more general channels.
175:
176: In this paper, we will present an implementation method of physical layer for
177: so called Y-00 protocol which supports a secure communication and
178: a quantum key expansion applicable to IMDD(intensity
179: modulation and direct detection) or FSK(frequency shift keying) fiber
180: communication network with fiber amplifiers
181: as optical repeater, and propose an error correction method to improve
182: the performance of the total system.
183:
184: \section{Yuen protocol:Y-00}
185: \subsection{Basis of protocol}
186: It is well known that the no cloning theorem is not necessary condition
187: for unconditionally secure key expansion in information theoretical
188: cryptography, and it is only specific example of the realization.
189: The general information theoretical condition for unconditional security
190: was discussed in the field of information theory[5,6]. Following this line, a physical cryptography by conventional optical communication was proposed
191: by Yuen and Kim[8] which is called YK protocol.
192: Let us here briefly introduce a development from YK protocol to Y-00 protocol.
193: A fundamental idea of YK protocol
194: comes from the next remark.\\
195: {\bf Remark}: {\it If there are statistically independent noises between Eve
196: and Bob, there exists a secure key expansion protocol based on communication.}\\
197: This is an idea along the concept of {\it advantage distillation} of Maurer[7],
198: and it is regarded as a method
199: to realize
200: a scheme such that a channel of legitimate users is reliable than
201: that of Alice and Eve, even the signal to noise ratio of Bob is less
202: than that of Eve.
203: Yuen and Kim emphasized that the essential point of security of the key distribution
204: comes from detectability of signals.
205: This is quite different from the principle of BB-84, et al which are
206: followed by the no cloning theorem.
207: That is, BB-84 and related protocol employ a principle of unavoidable disturbance
208: to quantum states to guarantee the security,
209: but YK protocol employs a principle of communication theory to do so,
210: and it can be realized as a modification of B-92
211: which has reconciliation protocol through a public channel.
212: Although this can apply to long distance fiber system with optical repeaters,
213: it cannot provide
214: unconditional security when we extend communication distance and in some
215: practical situations.
216: Unfortunately, all of protocols proposed so far including the above scheme is
217: inefficient for applying to commercial use.
218: To cope with this defect, it was proposed [10] to use a fundamental theorem
219: in quantum detection theory as follows[12]:
220: \\
221: {\bf Theorem 1}: \\
222: {\it Signals with non commuting or the same density operators cannot be
223: distinguished without error.}\\
224: This means that if we assign non commuting density operators for bit signals 1 and 0,
225: then one cannot distinguish without error.
226: When the error is 1/2 based on quantum noise, there is no way to distinguish them.
227: So the problem is to create such a situation on
228: the channel between Alice and Eve, but the channel of Alice and Bob is
229: kept as a normal communication channel. To realize it, Yuen employed a combination of a shared short key scheme for the legitimate users and a stream cipher instead
230: of reconciliation protocol. This realizes an advantage distillation.
231: A crucial new ingredient in his protocol is the explicit use of a shared short
232: key for cryptographic objective of secure communication and key expansion.
233: We call it Yuen protocol(Y-00).
234:
235: Let us here give a short survey of original protocol and physical layer of Y-00 as direct encription.
236: {\em
237: \begin{itemize}
238: \item[\rm(a)] The sender(Alice) uses an explicit key(seed key:$K$,
239: expanded into a long random running key:$K^*$
240: by use of pseudo random generator as a stream cipher) to modulate the parameters of a multimode
241: coherent state.
242: \item[\rm(b)] State
243: $|\Psi_0\rangle=|\alpha/\sqrt{2}\rangle_1\otimes|\alpha/\sqrt{2} \rangle_2$
244: is prepared. Bit encoding can be represented as follows:
245: \begin{equation}
246: |\Psi_b\rangle=\exp\{-iJ_z\phi_b\}|\Psi_0\rangle
247: =|e^{-i\phi_b/2}\alpha/\sqrt{2}\rangle_1
248: \otimes|e^{i\phi_b/2}\alpha/\sqrt{2} \rangle_2
249: \end{equation}
250: where $J_z =({a^\dagger}_1{a_1} -{a^\dagger}_2{a_2})/2$.
251: \item[\rm(c)] Alice uses the running key $K^*$ to specify a basis from a set
252: of M uniformly
253: distributed two-mode coherent state.
254: \item[\rm(d)] The message $X$ is encoded as $Y_{K^*}(X)$. This mapping of
255: the stream of bits is the key to be
256: shared by Alice and Bob. Because of his knowledge $K^*$, Bob can demodulate from
257: $Y_{K^*}(X)$ to $X$.
258: \end{itemize}
259: }
260: In order to realize secure communication or to expand the key stream under secure way,
261: we have to guarantee that Eve cannot obtain any information from the legitimate channel.
262: They applied that the ciphering angle $\phi_\nu$ could have $k$ in general
263: as discrete or continuous variable determined by running key generated from
264: pseudo random generator. A ciphered two mode state may be
265: \begin{equation}
266: |\Psi_{bk}\rangle=\exp\{-iJ_z(\phi_b+\phi_k)\}|\Psi_0\rangle
267: \end{equation}
268: The corresponding density operator for all possible choices of $k$ is
269: $\rho_b$, where $b=1$ or $0$, where $\rho_b$ are density operator for Eve,
270: and mixed state consisting of
271: two-mode coherent states.
272: The problem for the security is to find the minimum error probability
273: that Eve can achieve in bit determination. To find the optimum detection process for discrimination
274: between $\rho_1$ and $\rho_0$ is a problem of quantum detection theory.
275: The solution is given by [12]
276: \begin{equation}
277: P_e= \min_{\Pi}(p_1Tr\rho_1\Pi_0 + p_0Tr\rho_0\Pi_1)
278: \end{equation}
279: Here, $\{\rho_i\}$ are pure states for Bob, and are mixed states for Eve who has no initial key.
280: As an example of encoding to create $P_e(E) \rightarrow 1/2$ which is the error probability of Eve,
281: Yuen et al., used a scheme such that closest values of a given $k$ can be
282: associated with distinct bits from
283: the bit at position $k$, and two closest neighboring states represent distinct bits which means a set
284: of basis state. In this scheme, they assumed that one chooses
285: a set of basis state(keying state for 1 and 0) for bits
286: without overlap. As a result, the error probability for density
287: operators $\rho_1$
288: and $\rho_0$ becomes 1/2,
289: when the number $M$ of a set of basis state increases.
290: Asymptotic property of the error probability depends on the amplitude(or energy) of coherent state.
291: So one requires large number of $M$ or modes when one wishes to extend the communication distance.
292: Thus in this scheme Bob has always a better channel than Eve. This means the advantage distillation.
293:
294: \subsection{Security analysis}
295: We clarify an intuitive proof of the security for Y-00 given by Yuen[23].
296: The security analysis of Y-00 is considered separately for
297: secure direct encryption and key expansion.
298: For direct encryption, the seed key:$K$ is fixed and the running key:$K^*$ to modulate the optical modulator is
299: constructed by blocks of bits of pseudo random number generated(PRG) by
300: pseudo random number generator with the seed key.
301: We assume that the PRG has sufficient properties for uniformness and so on. In this scheme, Eve cannot get information bits, because of from Eq(3). But she can try to get directly key information through the partial information of running key based on her observation of quantum states as basis in modulation.
302: This corresponds to known plain-text attack
303: in the conventional theory, because she attacks based on running key information which get from her observation for quantum states.
304: The problem is how much accuracy for the observed data is possible for getting "running key". Since Eve has no a priori information on properties of random sequence as running key, she cannot apply several detection scheme known as correlation detections. So she has to employ optimum single shot detection scheme to get the most accurate data of each bit sequences. Let us consider a detection scheme based on individual quantum measurement and classical collective(or correlation) attack.
305: We can evaluate the security by the quantum detection theory for quantum state signals which was formulated by Holeve and Yuen[12].
306: In our case, the detection limit is formulated by quantum minimax formula of Hirota-Ikehara[24].\\
307: {\bf [Quantum minimax game between Alice and Eve]}\\
308: \begin{equation}
309: {P^*}_e = \min_{\Pi}\max_{p_i} (1 - \sum p_iTr \rho_i\Pi_i)
310: \end{equation}
311: where $\rho_i$ are quantum states which represent the basis state in quantum M-ary cipher, $\{\Pi\}$ is positive operator valued measure(POVM) which correspond to receiver of Eve, $p_i$ is randomization probability of Alice. Finally the accuracy of Eve's data is given by the minimax value of this game.
312: By this ultimate detection limit, Eve has to estimate
313: the running key based on her data which involves error.
314: If Eve can get the perfect information on running key,
315: then the security level of this scheme is the same as the conventional stream cipher.
316: Let $n$ be length of the seed key. The security level of the ideal stream cipher
317: is represented by $2^n-1$.
318: In general, the security level of conventional stream cipher is weaker than it.
319: However, by quantum M-ary cipher, the data of Eve involve inherent
320: error based on quantum noise.
321: Here, if the number $M$ is enough large, the equation (4) becomes ${P^*}_e \cong 1$.
322: That is, the sequences of running key are truly randomized. Hence nobody can get the information on
323: the correlation and others among the running key sequences from the observed data.
324: So the legitimate users have {\it almost secret channel} which is guaranteed by the ultimate quantum detection limit.
325:
326: Thus, the security of classical stream cipher is enhanced
327: by quantum $M-$ary cipher scheme. As a result, Eve cannot apply the conventional correlation attack and others for the structure of the generator. The possibility for Eve's strategy is only pure guess for all kind of key $2^n-1$ which corresponds to Brute force attack, even the security of pseudo random number generator
328: is weak. However, if Eve takes the strategy of Brute force attack, then she needs complete cipher text.
329: A trial to get cipher text is equivalent to the cipher text attack in this case. The problem is
330: how to do such a cipher-text attack.
331: First Eve has to clone the following sequence of quantum states
332: \begin{equation}
333: |\Psi_1 \rangle = (|\alpha_{i} \rangle_1|\alpha_{j} \rangle_2 |\alpha_{k} \rangle_3\dots
334: \end{equation}
335: then this sequence is copied as follows:
336: \begin{eqnarray}
337: \begin{array}{lcl}
338: |\Psi_1 \rangle &=& (|\alpha_{i} \rangle_1|\alpha_{j} \rangle_2 |\alpha_{k} \rangle_3\dots \\
339: |\Psi_2 \rangle &=& (|\alpha_{i} \rangle_1|\alpha_{j} \rangle_2 |\alpha_{k} \rangle_3\dots \\
340: |\Psi_3 \rangle &=& (|\alpha_{i} \rangle_1|\alpha_{j} \rangle_2 |\alpha_{k} \rangle_3\dots \\
341: \vdots
342: \end{array}
343: \end{eqnarray}
344: and all sequences must be storaged in quantum memory during the trial to check all kind of text.
345: However, each quantum bits are non orthogonal $\langle \alpha_{i}|\alpha_{j}\rangle \cong 1$,
346: and also $\langle\Psi_i|\Psi_j \rangle \ne 0$.
347: So the clone has error due to quantum no cloning theorem when $M$ is enough large. As a result, Eve cannot get exact cipher-text.
348: {\it If the error is enough large, it is difficult to apply
349: the cipher-text attack, and also Brute force attack, because
350: they would need a super exponential search.}
351: Thus, this scheme has almost perfect secrecy in the individual quantum measurement.
352: For the case of the quantum collective measurement which will provide the same result, we will show in elsewhere.
353:
354: In the case of key expansion, the physical layer is the same as the case of direct encryption.
355: The information data is replaced into the true random number,
356: and they are divided to the blocks with length $n$.
357: After communication of first blocks with length $n$, the legitimate users keep the block,
358: and the seed key is refreshed by the bit block.
359: Then the next random number with the length $n$ is sent by the same physical process
360: with refreshed seed key.
361: They keep them and repeat the process. The bit strings(key) accumulated by
362: the above communication are used as one time pad cipher.
363: It is difficult to get the information for the block bit, because of
364: the same reason for the case of the direct encryption.
365: Since the seed key for M-ary cipher is always refreshed, this is stronger than the case of direct encription.
366: Even if Eve can get some information in this case, the legitimate user can eliminate it by the privacy amplification.
367: So finally the unconditional security for quantum individual, collective measurements, and classical collective attack will be shown.
368:
369: \section{Entanglement attack}
370: Analysis of security is an essential requirement for the discussion on cryptography.
371: Various eavesdropping strategies have appeared in security analysis for BB-84, B-92[13-15].
372: A recent review is given by Gisin et al[16].
373: However, these are not always effective for other scheme, and depend on protocols.
374: Here we discuss on the security for the present model.
375: There is no way for getting bit information in the scheme,
376: because the error of Eve is always 1/2 for bit sequence.
377: However, in quantum system, Eve can attack by methods
378: as not only passive processing, but also active processing.
379: For free space communication,
380: one does not need to consider opaque attack and others, because the strategy of Eve is
381: only to receive a piece of light wave from Alice. On the other hand,
382: for fiber system, one has to consider various eavesdropping strategies
383: in the same way as BB-84. One of them is entanglement attack.
384: Although there are several variation of entanglement attack,
385: here it is sufficient to consider the most simple one.
386: That is, since the legitimate users do not use public channel in Y-00,
387: we do not consider general attacks as conventional collective and joint attack.
388: The entanglement attack in this case is that Eve entangles a separate probe
389: with coherent states from Alice and detect the probe.
390: After entanglement operation, Eve has to
391: send the mode A which comes from Alice and keep the mode B as probe.
392: When Bob measures them, some effects come from the action. Even if the effects act
393: completely, Eve cannot get information of bit, because the each state has
394: possibility of 0 and 1(see section 4). It helps Eve only for information of quantum states
395: which was sent by Alice. If Eve can know all quantum state used by
396: the legitimate users by such an entanglement attack, it reduces to classical stream cipher system.
397:
398: Here we show that Eve also cannot get information of quantum state used by the legitimate users.
399: To give a simple theory of entanglement for coherent state is worth while,
400: because all information is transmitted by coherent state.
401: Let ${\cal H}_A$, and $ {\cal H}_T$ be the Hilbert spaces of Eve and
402: of the total signal plus probe system, respectively.
403: If $|\alpha_i \rangle, | \phi \rangle, U$ denote the signal,
404: probe's initial states and the unitary interaction, respectively,
405: then the state of the signal received by Bob is given by
406: the density operator obtained by tracing out Eve's probe:
407: \begin{equation}
408: \rho_{B} = Tr_{E}(U |\alpha_i, \phi \rangle \langle \alpha_i, \phi |U^{\dagger})
409: \end{equation}
410: The unitary interaction operated by Eve should make the largest entanglement
411: between the signals and probes. Hence it is reasonable to discuss
412: the general properties of entanglement for coherent states.
413: One of authors and van Enk gave a general analysis for entangled state of
414: non orthogonal state like coherent state[17, 18]. Here we apply them to
415: an evaluation of the security.
416: The following quasi Bell states or unitary equivalence of them have good
417: property for the entanglement.
418: \begin{eqnarray}
419: \left\{
420: \begin{array}{lcl}
421: |\Psi_1 \rangle_{AB} &=&
422: h_{1} (|\alpha \rangle_A|-\alpha \rangle_B
423: +|-\alpha \rangle_A|\alpha \rangle_B ) \\
424: |\Psi_2 \rangle_{AB} &=&
425: h_{2} (|\alpha \rangle_A|-\alpha \rangle_B
426: -|-\alpha \rangle_A|\alpha \rangle_B )\\
427: |\Psi_3 \rangle_{AB} &=&
428: h_{3} (|\alpha \rangle_A|\alpha \rangle_B
429: + |-\alpha \rangle_A|-\alpha \rangle_B )\\
430: |\Psi_4 \rangle_{AB} &=&
431: h_{4} (|\alpha \rangle_A|\alpha \rangle_B
432: -|-\alpha \rangle_A|-\alpha \rangle_B)
433: \end{array}
434: \right.
435: \end{eqnarray}
436: where $h_i$ is normalized constant, $\alpha$ is coherent amplitude of light field.
437: As remarkable property, $|\Psi_2 \rangle_{AB}$
438: and $|\Psi_4 \rangle_{AB}$ have
439: complete entanglement which is independent of $\alpha$.
440: The entangled states of other type have bad entanglement.
441: If the amplitudes of mode A and mode B in the above form are different,
442: the eigenvalues of the reduced density operator become
443: \begin{equation}
444: \lambda_{1} =
445: \frac{(1+\kappa_A)(1-\kappa_B)}{2(1-\kappa_A \kappa_B)},
446: \quad
447: \lambda_{2} =
448: \frac{(1-\kappa_A)(1+\kappa_B)}{2(1-\kappa_A \kappa_B)}
449: \end{equation}
450: where $\kappa_A$ and $\kappa_B$ are inner products of basis states in mode A and B,
451: respectively. As a result, again we can see that degree of entanglement is
452: maximum when $\kappa_A=\kappa_B$, because the von Neumann entropy as the measure
453: of entanglement is maximum when $\lambda_{1}= \lambda_{2} =1/2$.
454: In addition, if the basis states are orthogonal,
455: then it is easy to get complete entanglement.
456: Furthermore, S.van Enk showed [18] that {\it one cannot generate entangled
457: coherent state with complete entanglement from coherent states of independent
458: two modes, and that one cannot generate entangled coherent state with
459: complete entanglement from incomplete entangled coherent state by local
460: operation involving local filtering}.
461:
462: Let us return to the discussion of the attacks. If Eve makes a scheme of
463: the entanglement attack in front of the Bob's receiver, the states come from
464: Alice are non orthogonal, because the signal power is very small.
465: It becomes a problem of the generation of entangled state for non orthogonal states.
466: Eve cannot get complete entanglement by her probe according to the above statement.
467: But she can send a trick state which is generated by Eve herself.
468: The amplitude of Alice's coherent state is one of $M$,
469: so Eve does not know the amplitude of signals. As a result,
470: she has to prepare the entangled coherent states with $M$ amplitudes
471: The probability for getting the appropriate entangled coherent state
472: is order of $1/M^2$, in addition she cannot know which is the complete one.
473: Thus, the information on the quantum states of Eve involves inherent error.
474: In addition, if the channel involves optical amplifier as repeater,
475: then the received states are mixed state.
476: Eve cannot make a good entanglement operation in this case.
477:
478: If Eve makes the scheme at the Alice's side,
479: then almost states are regarded as orthogonal, because the signal power is large.
480: Let us show a property of
481: decoherence due to energy loss on the state
482: $|\Psi_2\rangle_{AB}$ which has complete entanglement.
483: Eve has the source of
484: entangled state, keep one part and transmit the other part
485: to Bob through a lossy channel. Bob will receive
486: the attenuated optical state. This is a model for specific
487: sharing method of entangled state.
488: In such a situation, Eve can prepare the following
489: entangled state
490: \begin{equation}
491: |\Psi^*_2(0)\rangle_{AB}
492: =h^*_2( |\alpha\rangle_A |-\frac{\alpha}{\sqrt{\eta}}\rangle_B
493: -|-\alpha\rangle_A |\frac{\alpha}{\sqrt{\eta}}\rangle_B )
494: \end{equation}
495: where $h^*_2=1/\sqrt{2(1-\kappa_A \kappa_B)}$,
496: $\kappa_A = \langle \alpha | -\alpha \rangle$, and
497: $\kappa_B = \langle \frac{\alpha}{\sqrt{\eta}}
498: | -\frac{\alpha}{\sqrt{\eta}} \rangle$,
499: and where $\eta$ is transparency of the channel.
500: When we employ a half mirror model for energy loss channel,
501: the effect of energy loss is described by a linear coupling
502: with an external vacuum field as follows:
503: \begin{equation}
504: U_{BL}|\alpha\rangle_B|0\rangle_L =
505: |\sqrt{\eta}\alpha\rangle_B|\sqrt{1-\eta}\alpha\rangle_L.
506: \end{equation}
507: where the mode $L$ is an external mode corresponding to
508: energy loss, and $\alpha$ is taken as real.
509: If we use $|\Psi^*_2(0)\rangle_{AB} $ as the initial state,
510: Alice will finally couple with the environment in
511: \begin{eqnarray}
512: &\hat I_A\otimes U_{BL}|\Psi^*_2(0)\rangle_{AB}
513: \otimes |0\rangle_L& \nonumber\\
514: &=h_2(|\alpha\rangle_A
515: |-\alpha\rangle_B
516: |-\sqrt{\frac{1-\eta}{\eta}}\alpha\rangle_L
517: -|-\alpha\rangle_A
518: |\alpha\rangle_B
519: |\sqrt{\frac{1-\eta}{\eta}}\alpha\rangle_L ).&
520: \end{eqnarray}
521: Then the state shared by Eve and Bob is given by
522: a super operator calculation as follows:
523: \begin{eqnarray}
524: &\rho_{AB}= \tilde{h_2}^2
525: \{\frac{1}{h^2_2}|\Psi_2\rangle_{AB} \langle\Psi_2|&
526: \nonumber\\
527: &+(1-L)
528: (|\alpha,-\alpha\rangle_{AB}\langle-\alpha,\alpha|
529: +|-\alpha,\alpha\rangle_{AB}\langle\alpha,-\alpha|)\}&
530: \label{coherent_entangle}
531: \end{eqnarray}
532: where
533: \begin{equation}
534: |\Psi_2\rangle_{AB}={1\over\sqrt{2(1-\kappa_A^2)}}
535: ( |\alpha\rangle_A |-\alpha\rangle_B
536: -|-\alpha\rangle_A |\alpha\rangle_B ),
537: \end{equation}
538: and where
539: $L = \exp\{-4(1-\eta)|\alpha|^2\}$,
540: $|\alpha,-\alpha\rangle_{AB}=|\alpha\rangle_A |-\alpha\rangle_{B}$,
541: and
542: $\tilde{h_2}^2=1/\{2(1-L\kappa_A^2)\}$.
543: As a result, we have the following form:
544: \begin{eqnarray}
545: &\rho_{AB}= \frac{(1-\kappa_A^2)}{(1-L\kappa_A^2)}
546: |\Psi_2\rangle_{AB} \langle\Psi_2|& \nonumber\\
547: &+\frac{(1-L)}{(1-L\kappa_A^2)}
548: (|\alpha,-\alpha\rangle_{AB}\langle-\alpha,\alpha|
549: +|-\alpha,\alpha\rangle_{AB}\langle\alpha,-\alpha|)\}
550: \end{eqnarray}
551:
552: Here let us discuss properties of entanglment of the above density
553: operator. We can use the entangled
554: fraction to measure the entanglement of mixed state.
555: The fully entangled fraction of this density operator is given by
556: \begin{equation}
557: f(\rho_{AB}) = _{AB} \langle \Psi_2 |\rho_{AB}|\Psi_2 \rangle_{AB}
558: \end{equation}
559: because $|\Psi_2 \rangle_{AB}$ has complete entanglement
560: which is independent of $\alpha$.
561: As a result, we have
562: \begin{equation}
563: f(\rho_{AB})=\frac{(1-\kappa_A^2)}{(1-L\kappa_A^2)}+
564: \frac{(1-L)(1-\kappa_A^2)^2}{(1-L\kappa_A^2)}
565: \end{equation}
566: In the special cases, the fraction of entanglement is that
567: $f(\rho_{AB})=1$ for $\eta=1$, and
568: $f(\rho_{AB})\ge \kappa_A^2(1-\kappa_A^2)$ for $\eta \cong 0$.
569: Although this is robust for energy loss compared
570: with bi-photon entangled state, the entanglement
571: is destroyed when $\eta \cong 0$. So it is useless in the sense
572: for getting any information.
573:
574: \section{Quantum M-ary cipher for fiber network}
575: An implementation of Y-00 in the above was discussed based on phase
576: (or polarization)modulation which provides the same energy for bit[11].
577: To apply them to fiber communication system, it is better to realize
578: them by intensity modulation/direct detection or frequency shift keying.
579: But to keep the security, it will require some additional idea for
580: implementation of Y-00.
581: The essential role of modulation scheme in Y-00 is
582: to assign non-commuting or same density operators to 0 and 1 for Eve.
583: In the original implementation[11], they assumed that the selection
584: of a set of the basis states to transmit 0 and 1 is as follows
585: \begin{equation}
586: \{1, 0 \}\rightarrow \{ |\Psi_1(1)\rangle, |\Psi_0(1)\rangle \},
587: \{ |\Psi_1(2)\rangle, |\Psi_0(2)\rangle \},
588: \dots
589: \end{equation}
590: where $\{ |\Psi_1(j)\rangle, |\Psi_0(j)\rangle \}, j\in \cal{M}$
591: is a set of basis states. The bit or key information (1 and 0 ) is transmitted
592: by one of $M$ sets of basis states, controlling by initial shared key and running key.
593: This idea comes from
594: a fundamental principle in quantum detection theory such that we can construct
595: non-commuting density operators only by set of non-orthogonal states
596: when one does not allow overlap of the selection of a set of basis state for 1 and 0.
597: The non commutative nature of density operators depend
598: on strongly on amplitude or energy of coherent state.
599: In order to improve this effect, huge number of set of basis states must be prepared.
600:
601: On the other hand, when one allows overlap for selection of a set of basis state,
602: it is easy to construct the same density operators for 1 and 0.
603: That is, $\rho_1=\rho_0$.
604: {\it This scheme is called overlap selection keying}(OSK).
605: As an advantage of the overlap selection keying, we can say that it provides a very simple system
606: and Eve completely cannot estimate the bits at that time
607: even if the set of the basis states is only one.
608: Each set of basis state is
609: used for $\{1, 0\}$, and $\{0, 1\}$, depending on running key.
610: \begin{eqnarray}
611: Set\quad A_1 : 0 &\rightarrow& |\alpha_{(1)}\rangle,
612: \quad 1 \rightarrow |\alpha_{(M+1)}\rangle\\
613: Set\quad A_2 : 0 &\rightarrow& |\alpha_{(M+1)}\rangle,
614: \quad 1 \rightarrow|\alpha_{(1)}\rangle
615: \end{eqnarray}
616: So the density operators of 1 and 0 for Eve are
617: \begin{equation}
618: \rho_1=\rho_0 = \frac{1}{2}(|\alpha_{(1)}\rangle\langle \alpha_{(1)}|
619: +|\alpha_{(M+1)}\rangle\langle \alpha_{(M+1)}|)
620: \end{equation}
621: However, if the signal energy is large, the coherent states become of orthogonal.
622: So bit strings that Eve observed are
623: perfectly the same as those of Bob, though Eve cannot know information bit.
624: This gives still insecure situation.
625: In order to cope with the above problem,we employ
626: a combination of $M$-ary scheme and overlap selection keying.
627: As a result, the energy dependency of the security may be alleviated,
628: and it is enough to take into account only the
629: average error probability for discrimination of
630: 2$M$ pure states for the security.
631:
632: Here we show an example of design for IMDD system.
633: Let us assume that the maximum amplitude is fixed as $\alpha_{max}$.
634: We divide it into 2$M$. So we have $M$ sets of basis state
635: $\{(A_1,A_2),(B_1,B_2), \dots \}$.
636: Total set of basis state is given
637: as shown in Fig.1.
638: %%%%%%%%%%%%%%%%
639: \begin{figure}
640: \begin{center}
641: \begin{tabular}{c}
642: \includegraphics{Fig1.eps}
643: \end{tabular}
644: \end{center}
645: \caption{Scheme of selection of quantum state parameters}
646: \label{figure1}
647: \end{figure}
648: %%%%%%%%%%%%%%%%
649: Here, let us assign 0 and 1 by the same way as Eqs(19),(20) for the sets of $\{B_1,B_2\}$,
650: $\{C_1,C_2\}$,$\dots $.
651: In this case, Eve completely cannot get bit information, while the knowledge of Eve
652: depends on $\alpha_{max}$ and $M$ in the original scheme[11].
653: This fact gives a great advantage when we apply the Y-00 protocol
654: to the practical system.
655: Then she can try to know
656: the information of quantum states used for bit transmission.
657: This problem is of discrimination for 2$M$ pure states.
658: The error probability is given by Eq(4).
659: Although we have many results for calculation of quantum optimum detection
660: problems, to give the analytical solution of this problem
661: is still difficult at present time,
662: because the set of states does not have complete symmetric structure.
663: However, the tight upper bound is given by applying square root measurement(SRM) to
664: 2$M$ pure states.
665: It is well known that SRM provides the optimum or suboptimum detection
666: for many kinds of pure state signals[19, 20]. The SRM is defined as follows:
667: \begin{equation}
668: |\mu_i \rangle=\hat{G}^{- \frac{1}{2}} |\psi_i \rangle , \quad \quad
669: \hat{G}= \sum\nolimits\limits_{\mit i\rm \in \cal{M}}^{}
670: |\psi_i \rangle \langle \psi_i |
671: \end{equation}
672: where $|\psi_i \rangle $ is signal state,
673: $\hat{G}$ is the Gram operator, and the detection operator is formed as
674: \begin{equation}
675: \Pi_i=|\mu_i \rangle\langle \mu_i |, \quad i \in \cal{M}
676: \end{equation}
677: It is very easy to calculate the average error probability when
678: we apply this detection operator,
679: and these are very tight which can be proven by Helstrom's Bayes cost
680: reduction algorithm[21] to check the tightness(see Fig.2).
681: Thus if $M$ increases, then her error for information on quantum states increases.
682: In this case, pure guessing corresponds to $\frac{2M-1}{2M}$.
683: The lower bound is given by the minimum error probability:$P^*_e(2)$
684: for signal set $\{|\alpha_{(1)}\rangle,|\alpha_{(2)}\rangle \}$
685: which are neighboring states. It reads
686: \begin{equation}
687: P_{e(2)}=\frac{1}{2}(1-\sqrt{1-\exp[-|\alpha_2-\alpha_1|^2]})
688: \end{equation}
689: For the error probability of Bob, if we can allow Bob
690: to use the quantum optimum receiver,
691: then the error probability of Bob is independent of the number of
692: set of basis state, and it is given as follows:
693: \begin{equation}
694: P_e(B)= \frac{1}{2}(1 - \sqrt{1-|\langle \alpha_1|\alpha_{M+1}\rangle|^2})
695: \end{equation}
696: We emphasize that Eve cannot get bit information in this stage,
697: because the information for 1 and 0 are modulated by the method of Eqs(19),(20).
698: We will show the detectability for the case of conventional
699: receiver in the next section.
700: Thus, it is achieved
701: that the error of Bob is less than that of Eve even the SNR of Eve
702: is greater than that of Bob, which corresponds to the advantage distillation.
703: \begin{figure}
704: \begin{center}
705: \begin{tabular}{c}
706: \includegraphics{Fig2.eps}
707: \end{tabular}
708: \end{center}
709: \caption{
710: Error probability of Eve for discrimination of M pure states.
711: Horizontal line: upper is of the number of state, under is the number of basis state}
712: \label{figure2}
713: \end{figure}
714: \begin{figure}
715: \begin{center}
716: \begin{tabular}{c}
717: \includegraphics{Fig3.eps}
718: \end{tabular}
719: \end{center}
720: \caption{Error probability of bit information for non overlap selection keying}
721: \label{figure3}
722: \end{figure}
723: Let us compare with non-overlap and overlap selection keying.
724: In the former case, Eve will try to get bit information,
725: so the density operators for Eve
726: become mixed states $\rho_1$, and $\rho_0$ consisting of set
727: of quantum states which send 1 and 0,
728: respectively. The error probability of Eve for bit information
729: ($\rho_1$ or $\rho_0$) depends on
730: strongly power of laser light(see Fig 3).
731: In the latter case, the error of Eve is always 1/2,
732: and it dose not depend on power of laser light.
733: On the information for set of basis states, the error probability of Eve
734: becomes the same one given by the formulae Eq(4) in both cases.
735: Thus in the latter case, it is enough to take the information on
736: the set of basis states into account.
737: Since, in the intensity modulation, we cannot keep the enough signal distance
738: under the power constraint in comparison with phase modulation, the overlap selection keying
739: has great advantage.
740: In addition, it can send 2$M$ bits by $M$ sets of basis state.
741: The above example was described as ASK(amplitude shift keying), but
742: it is the same as the intensity modulation scheme.
743: As simple modification, we can use frequency shift keying(FSK)
744: and also combination of ASK and FSK.
745: If one wishes more efficient scheme, then one can apply many modulation scheme,
746: for instance Manchester scheme and so on.
747:
748: \section{Design for practical fiber network}
749: A special feature of YK and Y-00 protocol is that one can design the secure
750: system based on only
751: the abilities of Eve and Bob for detectability.
752: That is, it is not important
753: how many repeaters are used in communication channel from Alice to Bob.
754: In general, the present fiber network consists of optical repeaters
755: like fiber amplifier,
756: and direct detection scheme(intensity detection for on and off).
757: Although one can make the ability of Eve the level of pure guessing
758: by increasing $M$(the number of basis set), it is difficult to improve
759: the detectability of Bob when the communication distance is
760: very long under the high bit rate, for example 1000 km and 1 Gbps.
761: Here we show how we can solve it.
762:
763: A practical fiber system consist of transmitter(laser diode),
764: fiber cable, repeater(fiber amplifier), pre-amplifier, and photo-detector.
765: The noise in receiver of the above scheme of
766: IMDD is given as follows:
767: \begin{equation}
768: \langle {I_{on}}^2 \rangle = \langle {I_{th}}^2 \rangle
769: +\langle {I_{sig}}^2 \rangle +2\langle {I_{sp}}^2 \rangle
770: +\langle {I_{sig-sp}}^2 \rangle +2\langle {I_{sp-sp}}^2 \rangle
771: \end{equation}
772: where
773: $\langle {I_{th}}^2 \rangle,\langle {I_{sig}}^2 \rangle,\langle {I_{sp}}^2 \rangle ,
774: \langle {I_{sig-sp}}^2 \rangle, \langle {I_{sp-sp}}^2 \rangle $ are
775: thermal noise in detector, quantum shot noise, noise by spontaneous
776: emission from amplifier, beat noise between signal and spontaneous emission,
777: beat noise between spontaneous emission itself, respectively.
778: They are given as follows:
779: \begin{eqnarray}
780: \langle {I_{sig}}^2 \rangle&=&2e^2G_p\kappa_r\langle n \rangle B\\
781: \langle {I_{sp}}^2 \rangle &=&2e^2[\kappa_rG_pN(G-1)+(G_p-1)]n_{sp}B\delta f\\
782: \langle {I_{sig-sp}}^2 \rangle&=&4e^2G_p[\kappa_rG_pN(G-1)+(G_p-1)]
783: \kappa_r\langle n \rangle n_{sp}B\\
784: \langle {I_{sp-sp}}^2 \rangle&=&2e^2[\kappa_rG_pN(G-1)+(G_p-1)]^2
785: {n_{sp}}^2 B\delta f
786: \end{eqnarray}
787: where $e$ is the electron charge, $G_p$ is the gain of pre-amplifier,
788: $G = \frac{1}{\kappa_r}$ is the gain of the repeater, $\kappa_r$ is the transparency
789: of the fiber, $N$ is the number of repeater, $\langle n \rangle$ is
790: the photon number per second at transmitter,
791: $n_{sp}$ is the spontaneous emission factor, $B$ is the bandwidth,
792: and $\delta f$ is the bandwidth of optical filter, respectively.
793: As a result, the bit sequence of Bob involves many error bits.
794: That is, the error probability of Bob $P^*_e(B)$ in a real fiber system
795: is not so good in comparison with quantum optimum receiver.
796: \begin{equation}
797: P^*_e(B) \gg \frac{1}{2}(1 - \sqrt{1-|\langle \alpha_1|\alpha_{M+1}\rangle|^2})
798: \end{equation}
799: Here we give
800: a method for the improvement of this unavoidable error in the direct detection.
801: Since we can use high bit rate(Gbps), it does not give a degradation
802: of the performance even if we use redundant codewords
803: for sending bit information(0 and 1). In the following we show how it works.
804: Let us assign codeword:$u_i$ from the set $W:\{ u_i\in W\}$
805: of the sequence of quantum states.
806: For example, as error correction code, we assign one codeword from the following
807: set of codewords:
808: \begin{eqnarray}
809: & & Code_1:\{0\rightarrow u_1=|\alpha_{(1)}\rangle|\alpha_{(1)}\rangle
810: |\alpha_{(M+1)}\rangle, \quad
811: 1\rightarrow u_4=|\alpha_{(M+1)}\rangle|\alpha_{(M+1)}\rangle|\alpha_{(1)}\rangle \}\nonumber\\
812: & &Code_2:\{0\rightarrow u_2=|\alpha_{(1)}\rangle|\alpha_{(M+1)}\rangle
813: |\alpha_{(1)}\rangle, \quad
814: 1\rightarrow u_5=|\alpha_{(M+1)}\rangle|\alpha_{(1)}\rangle|\alpha_{(M+1)}\rangle \}\nonumber\\
815: & &Code_3:\{ 0\rightarrow u_3=|\alpha_{(M+1)}\rangle|\alpha_{(1)}\rangle
816: |\alpha_{(1)}\rangle \}, \quad
817: 1\rightarrow u_6=|\alpha_{(1)}\rangle|\alpha_{(M+1)}\rangle|\alpha_{(M+1)}\rangle \}\nonumber\\
818: & &\vdots
819: \end{eqnarray}
820: If the set $A_2$ is chosen, then only bit 0 and 1 are changed, and
821: the codeword is the same one.
822: The structure of this codeword may be open for public,
823: but the selection depends on initial key and running key.
824:
825: Let us recall that the decision of legitimate user is binary.
826: For simplifying the evaluation, we assume that the probability distribution
827: of noise in the detector for bit is symmetric.
828: That is, the conditional probabilities for 0 and 1 as the decision process
829: are $P(1|0)=P(0|1)$.
830: Since the Hamming distance of this code is 3, it has a function of one bit
831: error correction. So the average error probability is given as follows:
832: \begin{equation}
833: P_e = 3P(0|1)^2 - 2P(0|1)^3
834: \end{equation}
835: If the bit error:$P(0|1)=10^{-4}$ in the practical receiver of direct detection,
836: then it turns the value of average error into about $10^{-8}$
837: which is enough for practical use.
838: This is effective rather than only to increase the transmitter
839: energy of each light pulse for improving the error probability of Bob.
840:
841: The security for bit information is kept in the case of overlap selection keying,
842: because it is independent of signal power.
843: For information on the set of basis states which are used for sending bit sequence,
844: Eve has to design
845: the quantum optimum receiver applying to total number of pure quantum states
846: as all kind of codewords $u_i\in W$, because Eve cannot know them.
847: In this case, the number of codeword is 3$M$.
848: This corresponds to increasing the set of basis state.
849: According to quantum detection theory and
850: the numerical example of the error probability for $M$-ary pure states,
851: the average error probability increases rapidly when the number $M$ increases.
852:
853: In this section, we showed that if we insert key for the selection of
854: codeword into Y-00 protocol,
855: then we can improve the detectability of Bob without
856: the degradation of the security.
857: More general discussion for design of error correcting code will be
858: given in the subsequent paper.
859:
860: \section{Conclusions}
861: We repeat our motivation here. Basically, one wants to realize
862: one way secure communication.
863: However, the situation of the eavesdropper is in general better
864: than the legitimate user. To cope with such a situation, many proposals were
865: devoted to discuss only a key distribution which allow two way
866: communication or feedback to establish the advantage distillation.
867: BB-84 and other quantum key expansion
868: protocols provided a solution for such problems, introducing to
869: detect the existence of eavesdropper and privacy amplification.
870:
871: However,these may be unenterprising strategy in the practical system.
872: Following such well known results, Yuen verified that more simple
873: information theoretical secure communication and unconditionally secure key
874: expansion exist.
875: In this paper,
876: we have shown an efficient physical layer of Y-00 protocol applicable to
877: secure communication and quantum key expansion for fiber system.
878: It was clarified that the overlap selection keying of set of basis states gives
879: the very efficient way to establish the secure condition in Y-00 protocol.
880: This work is an extension of reference 22.
881:
882: \section*{Acknowledgment}
883: We are grateful to H.P.Yuen, S.J.van Enk
884: for helpful suggestions.
885:
886: %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
887: %%%%% References %%%%%
888: \begin{thebibliography}{1}
889: \bibitem{BB84}
890: C.H.Bennett and G.Brassard,in
891: {\it Proc. IEEE Int. Conf. on
892: Computers, Systems, and Signal processing,
893: Bangalore, India}, pp. 175-179, 1984.
894: %##########################
895: \bibitem{Bennett92}
896: C.H.Bennett,
897: {\it Phys. Rev. Lett.},
898: vol. 68, no. 21, pp. 3121-3124, May 1992.
899: %##########################
900: \bibitem{BL00}
901: G.Brassard, N.Lutkenhaus, T.Mor, and B.Sanders,
902: {\it Phys. Rev. Lett.},
903: vol. 85, no. 6, pp. 1330-1333, August 2000.
904: %##########################
905: \bibitem{G}
906: F.Grosshans, G.van Assche, J.Wenger, R.Brouri, N.J.Cerf, and P.Grangier,
907: {\it Nature.},
908: vol. 421, pp. 238-241, 16 January 2003.
909:
910: %##########################
911: \bibitem{Wyner}
912: A.D.Wyner,
913: {\it Bell System Technical Journal},
914: vol. 54, no. 8, pp. 1355-1387, 1975.
915:
916: %##########################
917: \bibitem{CK}
918: I.Csisz$\acute {\rm a}$r, and J.K$\ddot {\rm o}$rner,
919: {\it IEEE Trans. Inform. Theory},
920: vol. 24, pp. 339-348, 1978.
921: %##########################
922: \bibitem{Maurer93}
923: U.M.Maurer,
924: {\it IEEE Trans. Inform. Theory},
925: vol. 39, no. 3, pp. 733-742, May 1993.
926:
927: %##########################
928: \bibitem{YK98}
929: H.P.Yuen and A.M.Kim,
930: {\it Phys. Lett. A}, vol. 241, pp. 135-138, Apr. 1998.
931: %##########################
932: \bibitem{ToH00}
933: A.Tomita and O.Hirota,
934: {\it J. Opt. B: Quantum Semiclass. Opt.},
935: vol. 2, pp. 705-710, 2000.
936: %##########################
937: \bibitem{Yuen00}
938: H.P.Yuen,
939: Report in Northwestern University, 2000.
940: %##########################
941: \bibitem{BCKYDPP02}
942: G.A.Barbosa, E.Corndorf, P.Kumar, H.P.Yuen, G.D'Ariano, G.Paris, P.Perinotti,
943: {\it Proc. of the Sixth Int. Conf. on Quantum Communication, Measurement
944: and Computing (QCMC'02), July 2002,}
945: ed. by J.H.Shapiro and O.Hirota, Rinton Press, 2003.
946: And also, Phys. Rev. Lett. to be published in 2003.
947: %##########################
948: \bibitem{hels1}
949: C.W.Helstrom,
950: {\it Quantum detection and estimation theory
951: }, Academic press,1976.
952:
953: %##########################
954:
955: \bibitem{mayers}
956: D.Mayers,
957: {\it J. Assoc. Comp. Mach..},
958: vol. 48, p.351, 2001,
959: arXiv e-print {\it quant-ph/9802025}, LANL, 1998.
960:
961: %##########################
962: \bibitem{Lo}
963: H.K.Lo, and H.F.Chau,
964: {\it Science},
965: vol. 283, pp. 2050-2056, 1999.
966: %##########################
967: \bibitem{P.Shor}
968: P.Shor, and J.Preskill,
969: {\it Phys. Rev. Lett.},
970: vol. 85, pp441-444, 2000.
971:
972: %##########################
973: \bibitem{Gisin}
974: N.Gisin, G.Ribordy, W.Tittel, and H.Zbinden,
975: arXiv e-print {\it quant-ph/0101098}, LANL, 2001.
976: %##########################
977:
978: \bibitem{HS}
979: O.Hirota, and M.Sasaki,
980: arXiv e-print {\it quant-ph/0101018}, LANL, 2000,
981: {\it Proc. of the 5th Int. Conf. on Quantum Communication, Measurement
982: and Computing (QCMC'00)}, ed by P.Tombesi and O.Hirota,
983: Kluwer/Plenum, 2001.
984: %##########################
985: \bibitem{EH}
986: S. van Enk, and O.Hirota,
987: {\it Phys. Rev. A},
988: vol. 64, no. 6, 022313, 2001.
989:
990: %##########################
991: \bibitem{BKMH97}
992: M.Ban, K.Kurokawa, R.Momose and O.Hirota,
993: {\it Int. J. Theor. Phys.},
994: vol. 36, pp. 1269-1288, 1997.
995: %##########################
996: \bibitem{KOSH99}
997: K.Kato, M.Osaki, M.Sasaki and O.Hirota,
998: {\it IEEE Trans. Commun.},
999: vol. 47, pp.248-254, Feb. 1999.
1000: %##########################
1001: \bibitem{Helstrom82}
1002: C.W.Helstrom,
1003: {\it IEEE Trans. Inform. Theory}, vol. IT-28,
1004: pp. 359-366, Mar. 1982.
1005:
1006: %##########################
1007: \bibitem{HKS}
1008: O.Hirota, K.Kato, M.Sohma,
1009: arXiv e-print {\it quant-ph/0212050}, LANL, 2002.
1010: %##########################
1011: \bibitem{Yu}
1012: H.P.Yuen,
1013: private communication.
1014: %##########################
1015: \bibitem{HI}
1016: O.Hirota, and S.Ikehara,
1017: {\it Trans. IECE of Japan}, vol. E-65,
1018: p627, 1982. See also M.Osaki, M.Ban, and O.Hirota,
1019: {\it Phys. Rev. A},
1020: vol. 54, no-2, p1691, 1996.
1021:
1022:
1023: \end{thebibliography}
1024:
1025:
1026:
1027: \end{document}
1028: