Äîêóìåíò âçÿò èç êýøà ïîèñêîâîé ìàøèíû. Àäðåñ îðèãèíàëüíîãî äîêóìåíòà : http://qi.phys.msu.ru/papers/2007-jetp(e)-104-736.pdf Äàòà èçìåíåíèÿ: Mon Oct 27 15:35:50 2008 Äàòà èíäåêñèðîâàíèÿ: Mon Oct 1 19:52:27 2012 Êîäèðîâêà:

ISSN 1063-7761, Journal of Experimental and Theoretical Physics, 2007, Vol. 104, No. 5, pp. 736­742. © Pleiades Publishing, Inc., 2007. Original Russian Text © S.P. Kulik, A.P. Shurupov, 2007, published in Zhurnal èksperimental'nooe i Teoreticheskooe Fiziki, 2007, Vol. 131, No. 5, pp. 842­850.

ATOMS, MOLECULES, OPTICS

On Quantum Key Distribution Using Ququarts
S. P. Kulik and A. P. Shurupov
Moscow State University, Moscow, 119899 Russia e-mail: Sergei.Kulik@gmail.com
Received December 29, 2006

Abstract--A comparative analysis of quantum key distribution protocols using qubits and ququarts as information carriers is presented. Several schemes of incoherent attacks that can be used by an eavesdropper to obtain secret information are considered. The errors induced by the eavesdropper are analyzed for several key distribution protocols. PACS numbers: 03.67.Hkm, 42.25.Ja, 42.50.Dv DOI: 10.1134/S106377610705007X

In quantum cryptography, secure key distribution is guaranteed by fundamental laws of quantum mechanics [1­3]. 1. GENERALIZED BB84 PROTOCOLS The idea of quantum key distribution (QKD) using states of dimension D > 2 was originally put forward in [4]. The QKD protocol proposed therein extended the well-known BB84 protocol to three-level systems [2]. According to [4], information is encoded into quantum states spanned by four mutually unbiased bases. Each basis is a set of three orthonormal vectors. By definition, the vectors in a family of mutually unbiased bases satisfy the following conditions: 1 |ei |ej |2 = --D if the vectors |ei and |ej belong to different bases (D is the dimension of the Hilbert space); |ei |ej |2 = 0, i j, |ei |ei |2 = 1 if the vectors belong to the same basis. It was shown in [5] that a set of M = D + 1 mutually unbiased bases exists only if D = pk, where p and k are a prime and an integer, respectively. In particular, if D = 3 or 4, then the number of bases is M3 = 4 or M4 = 5, respectively. The corresponding basis states are called qutrits and ququarts, respectively. The total number of states spanned by the mutually unbiased bases is m = MD; i.e., 12 and 20 states are used in three- and fourlevel systems, respectively. None of the vectors spanned by mutually unbiased bases is geometrically distinguished: the projection of a particular vector onto one belonging to a different basis (i.e., nonorthogonal to the former vector) has the same value for any pair of vectors. This is a key property used in QKD protocols.

Key distribution using high-dimensional quantum states essentially follows the scenarios of standard qubit protocols. A random string of characters taken from a D-ary alphabet (e.g., 0, 1, 2, and 3 if D = 4) is encoded into a sequence of m nonorthogonal states from M randomly chosen (but known) bases. Further generalization leads to a protocol using an infinite-dimensional Hilbert space and an infinite set of bases [6]. For D = 4, it was found that 12 states spanned by three mutually unbiased bases are relatively easy to prepare [7, 8]. In this paper, we present a detailed analysis of the ququart-based generalized BB84 protocol using three of five possible mutually unbiased bases (M = 3). 2. ANALYSIS OF EAVESDROPPING STRATEGIES To detect eavesdropping attempts, Alice and Bob disclose and compare a fraction of their respective keys. The results of the comparison are used to estimate the error rate induced by channel noise and/or Eve's intervention.1 In incoherent attacks, Eve measures each transmitted quantum state individually. When the attack is symmetric, the introduced disturbance is statistically similar to channel noise. In what follows, we denote three mutually unbiased bases in a four-dimensional Hilbert space by , , and . 2.1. Intercept/Resend In the simplest strategy (intercept­resend attack), Eve intercepts the state sent by Alice to Bob, performs a direct measurement on it, and sends a new state
1

Alice and Bob are the conventional names of the sender and receiver, respectively; A and B denote their respective locations; and Eve is the conventional name of the eavesdropper.

736


ON QUANTUM KEY DISTRIBUTION USING QUQUARTS

737

depending on the measurement outcome to Bob. This possibility is not forbidden by the no-cloning theorem [3], because Eve knows exactly the state she prepares, but cannot exactly measure the intercepted state. Hereinafter, the bases used in Alice's and Bob's measurements are assumed identical; i.e., we consider the states retained after the key has been sifted. Consider the following protocol using ququarts. Suppose that Alice sends a state |. If Eve performs a measurement in the basis (randomly chosen with probability 1/3), then she prepares an exact copy of | and sends it to Bob. Since Eve's information is correct, so is Bob's measurement outcome. However, if Eve performs her measurement in or , then the outcome is any basis state with equal probability 1/4. Thus, Eve gains no information about the input state. When Bob performs a measurement in on a state prepared by Eve in or , the correct outcome | is obtained only with probability 1/4. Thus, Bob's measurement outcome is incorrect with probability 3/4. In the general case, Shannon's entropy of a D-ary character is I = log 2( D ) + H D ( p 1, ..., p D ) , where HD(p1, ..., pD) is the entropy defined as H D ( p 1, ..., p D ) = p 1 log 2 p 1 + ... + p D log 2 p
D

The basis used in the generalized BB84 protocol satisfies the following conditions: i| i = i| i = i| i = max, i| j = i| j = i| j = min, i j. When only two bases are used in data transmission, the -basis elements are obtained simply as | i = N ( | i + | i ) , (3) where N satisfies normalization conditions. Thus, the element |i lies in the hyperplane spanned by |i and |i . When ququarts are used, we have 3 i| i = i| i = --------- , 23 1 i| j = i| j = --------- . 23 (4a) (4b) (2)

(1)

If Alice sends a state | and Eve's measurements are performed in this basis, then the probabilities of correct outcomes are P ( ) = 3/4,
(4 D)

P ( ) = P ( ) = P ( ) = 1/12.

in terms of the probabilities p1, ..., pD of possible outcomes. If Eve uses the intercept/resend strategy to extract data transmitted under this protocol, then the information leaked to Eve, according to (1), is I
(4 D) 3 ­ basis

Hence, Eve's information is I 3 1 3 1 = 2 + -- log 2-- + 3 ----- log 2----- 0.792 ; 4 12 4 12
(4 D) Bob

i.e., her bit rate is 0.396. The corresponding disturbance is E
(2 D)

= 0.666 ;

= 5/12.
(2 D) Bob

i.e., her bit rate is 1/3. Bob's error rate is the product of the respective probabilities of incorrect outcomes of Eve's and Bob's measurements: 2/3 â 3/4 = 1/2. This can be compared with the result obtained under the two-basis protocol using four-dimensional states, I
(4 D) 2 ­ basis

Analogous estimates under the qubit protocol are I 0.399 , E 1/4 .

= 1;

i.e., Eve's error rate is 1/2. In this case, Bob's error rate is 3/8. In the standard BB84 protocol [2], Bob's error rate is 1/4 while Eve's bit rate is I(2D) = 1/2. Eve can reduce the disturbance caused by her intervention by measuring only a fraction of the transmitted states. Then, her information reduces by the same factor. 2.2. Intermediate Basis Instead of guessing the bases used by Alice and Bob, Eve can perform her measurements in an intermediate basis [9]. Eavesdropping with an intermediate basis is the simplest strategy for gaining probabilistic information.

When information is transmitted by using ququarts in three mutually unbiased bases, the elements of an intermediate basis (if any) can be determined by the following algorithm. The first element of the desired basis must have the form | = a | +

j = , ,



1 ­ a i ------------- e j | j . 3

2

(5)

The remaining vectors are calculated analogously. According to (1), the probabilities of Eve's correct and incorrect guesses are a2 and (1 ­ a2)/3, respectively. However, there exists no basis of this kind that satisfies constraints (5) calculated by using (4). Therefore, an attack of this type is unfeasible under the protocol using ququarts in three mutually unbiased bases. In [10], it was proved that there exists no basis of this kind in the case when all of the possible five mutually unbiased bases are employed.
Vol. 104 No. 5 2007

JOURNAL OF EXPERIMENTAL AND THEORETICAL PHYSICS


738 Alice-Bob mutual information, IAB 1.0 0.8 0.6 0.4 0.2
ir43 ib42 ib22 qubits (2b) ququarts (2b) (3b)

KULIK, SHURUPOV

+ D /3 | 2 |E 32 + D ­ 1 | 3 |E 33 , where D denotes the disturbance introduced by Eve's intervention, F = 1 ­ D is the fidelity of the state received by Bob after an eavesdropping attack, and |E is the initial ancilla state. The entangled ancilla states |E00, |E01, ... are normalized, and their dimension is not fixed. The symmetry and unitarity conditions simplify analysis of the strategy by reducing the number of parameters required to describe the most general eavesdropping attack. This strategy has been analyzed for protocols using ququarts in two [12] and all five [11] mutually unbiased bases. We analyze this strategy for the protocol using three mutually unbiased bases. The amounts of Alice­Eve and Alice­Bob information are equal. Accordingly, the security of the protocol cannot be preserved if the dis(3) turbance exceeds the critical value D c = 0.2658. The analogous values obtained in the papers cited above are (2) (5) D c = 0.25 and D c = 0.2666. As expected, the critical disturbance Dc increases with the number of mutually unbiased bases. However, the increase is insignificant. On the other hand, an increase in the number of mutually unbiased bases reduces the key generation rate, which impedes practical implementation of such protocols. The critical disturbance value determines an upper bound for error rate compatible with security of key distribution. Bob's errors can be caused both by channel noise and by Eve's intervention. Therefore, a higher critical disturbance implies security of a noisier channel. Let us compare these results with those obtained when Eve uses a universal cloning machine [13]. An analytical study of the case of five bases was presented in [14]. Analogous predictions for qutrits were supported by numerical calculations performed for a universal cloning machine [11, 15]. The result obtained is fully consistent with the results for optimal eavesdropping. Figure 1 compares several strategies in terms of eavesdropping efficiency. The protocols considered here are secure if the Alice­Bob mutual information is greater than the mutual information known to Eve. This implies that the bit string shared by Alice and Bob after the key distillation and privacy amplification procedures have been completed is unconditionally secure. When Eve's information exceeds the Alice­Bob mutual information, the security of the final key cannot be guaranteed. The line IAB = IAE represents the critical condition. The QKD protocol used by Alice and Bob is specified by the last digit in the notation of the curves. Eve chooses a strategy depending on her equipment (letters
Vol. 104 No. 5 2007

intercept/resend (ir) intermediate basis (ib) optimal algorithm (o) o42 o22 o4 3 ir42 ir22

0

0.2 0.4 0.6 Alice-Eve mutual information, IAE

Fig. 1. Efficiency of eavesdropping strategies: Alice­Bob mutual information vs. private information known to Eve. A protocol is secure unless the former exceeds the latter.

2.3. Optimal Algorithm The following strategy proposed in [11, 12] maximizes Eve's information and minimizes the disturbance caused by her intervention. After Eve has intercepted the carrier state sent by Alice to Bob, as in the standard strategy, she performs a unitary transformation on an auxiliary system (ancilla) interacting with the intercepted carrier to create entangled states, stores the ancilla state in a quantum memory, and forwards a modified carrier state to Bob. Suppose that Eve keeps all stored ancilla states until Bob has announced the bases used in his measurements. The amount of information gained by Eve after she has measured the stored states is determined by the effect of Eve's intervention on the carrier states and the method used for measuring the ancilla states. A stronger effect implies more information known to Eve, but increases the introduced disturbance. The most general symmetric eavesdropping strategy for ququarts is formulated as follows: U | 0 |E = D ­ 1 | 0 |E 00 + D /3 | 1 |E 01

+ D /3 | 2 |E 02 + D /3 | 3 |E 03 , U | 1 |E = D /3 | 0 |E 10 + D ­ 1 | 1 |E 11 (6)

+ D /3 | 2 |E 12 + D /3 | 3 |E 13 , U | 2 |E = D /3 | 0 |E 20 + D /3 | 1 |E 21

+ D ­ 1 | 2 |E 22 + D /3 | 3 |E 23 , U | 3 |E = D /3 | 0 |E 30 + D /3 | 1 |E 31

JOURNAL OF EXPERIMENTAL AND THEORETICAL PHYSICS


ON QUANTUM KEY DISTRIBUTION USING QUQUARTS

739

in the notation of the curves). Suppose that the protocol is the generalized BB84 using four-dimensional states spanned by two mutually unbiased bases (N42, N = o, ir, ib). For example, suppose that Eve wants to extract 40% of private information. According to Fig. 1, the security of the final key cannot be guaranteed in this case if Eve uses the intercept/resend strategy or an intermediate basis. However, a secret final key can be still be generated by the legitimate users when Eve can extract 40% by implementing the optimal algorithm. As noted above, when Eve uses the optimal strategy in an individual attack, she extracts maximum information while the error rate is reduced to a minimum. Security is lost when Eve's information equals that shared by Alice and Bob (i.e., the key generation rate drops to zero). 2.4. Key Generation Rate The key generation rate is the difference in mutual information between the Alice­Bob and Alice­Eve channels divided by the number M of the bases employed: R
AB

Key generation rate, bits 1.0 0.8 0.6 0.4 0.2

0

10 14.64

20

26.6 30 40 25 Error rate, %

Fig. 2. Key generation rate vs. error rate (bits per transmission). Points of intersection with abscissa axis correspond to upper bounds for disturbance. Curves are as in Fig. 1.

is such that = 1
2

1 = ---- ( I M

AB

­ I AE ) .

(7)

= a 1 a 2 |00 + a 1 b 2 |01 + b 1 a 2 |10 + b 1 b 2 |11 .

(8)

Indeed, the relative number of discarded outcomes increases with the number of bases, while the private information is obviously proportional to (IAB ­ IAE), where IAB depends on the disturbance induced by channel noise and/or Eve's intervention as follows: I
AB

It is obvious that an arbitrary state of a four-level system can be represented as an entangled bipartite state of two qubits: = c 1 |00 + c 2 |01 + c 3 |10 + c 4 |11 1 2 . (9) State (9) is separable if c1 c4 = c2 c3 . (10)

= log 2 N + ( 1 ­ E +E
Bob

Bob

) log 2( 1 ­ E

Bob

)

E Bob log 2------------ . N­1

Figure 2 shows the key generation rate (the number of bits in the final key per transmitted bit) versus disturbance for several eavesdropping strategies. It is clear that the upper bound on the disturbance rate compatible with security increases with the carrier-state dimension, approaching unity in the limit of infinite dimension [6]. Therefore, security can be "physically" enhanced by using quantum systems of higher dimension. However, this approach is impeded by the complexity of manipulation on high-dimensional quantum states. The required preparation and measurement procedures are not sufficiently well developed. One exception is the use of two-photon polarization states generated by spontaneous parametric down-conversion (SPDC) [7]. 3. DISCUSSION A Pair of Qubits or a Ququart? By definition, a separable state of two qubits 1 = a 1 |0 + b 1 |1 , 2 = a 2 |0 + b 2 |1

Indeed, the second photon in the pair is described by the reduced density matrix 2 2 * c + c3 c1 c2 + c3 c 2 = Tr 1 = 1 2 c2 c* + c4 c* c2 + c4 1 3 * 4 , 2

(11)

where || and subscript 1 means that the first qubit is traced out. It follows from (11) that the eigen(2) values of 2 are 1, 2 = 0, 1 only if condition (10) is satisfied. In this case, the component qubit states are pure; i.e., wavefunction (9) can be factored into single-photon ones. In practice, entangled states of two qubits are much more difficult to prepare and measure as compared to two uncorrelated qubits. A relatively simple method for preparing 12 ququart states spanned by three mutually unbiased was proposed in [7, 8]. Each prepared state is a separable pair of photon polarization states generated by SPDC in crystals without inversion symmetry. The
Vol. 104 No. 5 2007

JOURNAL OF EXPERIMENTAL AND THEORETICAL PHYSICS


740

KULIK, SHURUPOV

1

1 |+45° |D = ------ ( |H + |V ) , 2 1 |­45° | A = ------ ( |H ­ |V ) , 2 1 | R = ------ ( |H + i |V ) , 2 1 | L = ------ ( |H ­ i |V ) . 2

(13)

2
Fig. 3. Uncorrelated photon packets with mean photon number µ ~ 0.1.

(14)

12
Fig. 4. Biphoton packets with mean biphoton number µ ~ 0.1.

PBS

IF1

D1

IF2 D2 CC

Fig. 5. Setup for measuring the biphoton basis state |H1V2: PBS is a beamsplitter transmitting horizontal polarization and reflecting vertical polarization; CC is a coincidence circuit; IF1 and IF2 are interference filters with transmittance peaks at 1 and 2, respectively; D1 and D2 are photodetectors.

first basis consists of combinations of horizontally and vertically polarized photons: | = |H 1, H 2 , | = |V 1, H 2 , | = |H 1, V 2 , | = |V 1, V 2 . (12a)

By criterion (10), these basis states can be factored into corresponding products of single-photon states; i.e., they are not entangled. Consider two single-photon states prepared independently in the same spatial mode. Figures 3 and 4 illustrate the distributions of uncorrelated and entangled photons, respectively, in pulse trains. It can be shown that this key distribution scheme is a combination of two independent BB84 protocols. As compared to the standard BB84, it can be used to increase the key generation rate, but has no advantage in terms of security. Polarization states in a Hilbert state with D = 4 can be measured by pair coincidence counting with two photodetectors [7]. In this scheme, a pair of uncorrelated photons is equivalent to a biphoton within the coincidence time window Tc. Since a single photon cannot be reliably prepared within a narrow time interval by current experimental techniques, a two-photon state can be generated only by SPDC. However, a photon pair generated in this manner cannot be used to implement a four-state QKD protocol. A QKD scheme using biphotons as carrier states is characterized by a higher key generation rate and an enhanced protection against eavesdropping attacks. 3.2. Pair Coincidence Scheme When the carrier states are biphoton polarization states (ququarts), gated avalanche photodiodes can be used as single-photon counters: the bias voltage is held below the breakdown threshold and increased only for a short gate window when an input photon is expected to arrive. Basically, a photodetector can be characterized by two parameters: quantum efficiency and probability p of dark count over a time . Figure 5 schematizes a standard setup for measuring the biphoton state |H1V2. Horizontally and vertically polarized light transmitted and reflected, respectively, by a polarizing beamsplitter is directed to detectors operating in single-photon counting mode. Biphoton light is selected by interference filters with transmittance peaks at different wavelengths, the detector outputs are compared by a coincidence circuit (an AND gate), and a count signal is produced only when both detectors fire within the same gate window.
Vol. 104 No. 5 2007

Here, subscripts 1 and 2 refer to the component photons, which may have different frequencies. The remaining two bases, the diagonal one | = |D 1, D 2 , | = | A 1, D 2 , and the circular one | = | R 1, R 2 , | = | L 1, R 2 , | = | R 1, L 2 , | = | L 1, L 2 (12c) | = |D 1, A 2 , | = | A 1, A 2 (12b)

are obtained by SU(2) transformations of photon states, which are easy to implement in polarization optics. The basis states in (12) are linear combinations of |H and |V for the first and second photons in a pair:

JOURNAL OF EXPERIMENTAL AND THEORETICAL PHYSICS


ON QUANTUM KEY DISTRIBUTION USING QUQUARTS

741

Since biphoton arrival times follow the Poisson distribution µ ­µ P ( n, µ ) = ---- e , n!
n

(S/N) 2 /(S/N)1 100 80 60 40 20 0 10 20 30 40 50 60 70 80 90 100 Photodetector quantum efficiency , %

the mean photon number µ per gate should be reduced to minimize the probability that two biphotons arrive within the same window (see Figs. 3 and 4). In practical quantum cryptography, weak laser pulses with µ = 0.1 are used to prepare single-photon states [16]. In summary, we give several estimates. 1. The probability of detecting a biphoton is PS = µ2. 2. The probability of dark counts in both photodiodes within the same gate is P
­5,
NN

Fig. 6. Two-photon to one-photon SNR ratio for µ ~ 0.1.

= (1 ­ µ) p .
2

For low-noise detectors with p on the order of 10­4­ 10 a correction PNN proportional to p squared can be neglected. 3. The probability of coincidence of a photon count with probability in one detector and a dark count with probability p (conditioned on the probability 1 ­ that no photon arrives) in the other is P
SN

= µ ( 1 ­ ) p ( 1 ­ p ) µ ( 1 ­ ) p .

However, the example given below demonstrates that they should change to this representation with care to maximize their advantage. Suppose that two mutually unbiased bases are used by Alice and Bob, and an intermediate basis is used in Eve's attack. Then, she can guess three out of four quarts correctly. For example, if Alice's sends the string ..., then Eve may have the string cba.... Here, three out of 12 quarts are incorrect. However, comparing the corresponding bit-string representations Alice 00 11 01 00 10 11 11 01 10 00 01 10 Eve 00 11 10 00 10 0 1 11 01 10 00 0 0 10 we see that Eve's error rate reduces to 1/6 (only four out of 24 bits are incorrect). The explanation is that the errors in Eve's bit string are blockwise independent, whereas her errors in the original quart string are oneto-one independent. Thus, a D-ary string must not be mapped onto a binary one before error correction and privacy amplification procedures have been completed. Moreover, Alice and Bob must not disclose mapping (15), because otherwise Eve can optimize her strategy, for example, by assigning different weights to input states. The security of QKD protocols using qubits and qudits (quantum systems with D > 2) was discussed in [18]. Finally, we emphasize that the use of high-dimensional quantum states is a "physical" approach to resolving the issues arising in quantum cryptography. Our analysis shows that protocols using such carrier states are better protected against eavesdropping attacks and/or corruption by noise. Lower key generation rate associated with higher space dimension (due to a larger fraction of discarded outcomes) can be comVol. 104 No. 5 2007

This outcome is not a strictly dark count, because one of the photons making up a biphoton is still detected. However, we interpret it as a dark count. For the two-photon detection scheme considered here, the signal-to-noise ratio (SNR) is estimated as PS S --- -------- = -------------------- . 2 P SN (1 ­ ) p N µ S --- -------------------- . 1 (1 ­ µ) p N

For a single-photon scheme, the SNR is

Thus, the two-photon SNR exceeds the single-photon one by a factor of 1­µ 1 ----------- ----------- . µ 1­ Figure 6 shows the dependence of this factor on calculated for the typical mean photon number µ = 0.1. For InGaAs photodiodes ( = 1.5 µm, = 0.1), the difference in SNR amounts to an order of magnitude. 3.3. Mapping onto a Two-Dimensional Key As pointed out in [17], Alice and Bob can use binary codewords to represent the characters in a D-ary alphabet. For example, if D = 4, then = 00 , = 01 , = 10 , = 11 . (15)

JOURNAL OF EXPERIMENTAL AND THEORETICAL PHYSICS


742

KULIK, SHURUPOV 6. D. V. Sych, B. A. Grishanin, and V. N. Zadkov, Laser Phys. 14, 1314 (2004). 7. S. P. Kulik, G. A. Maslennikov, and E. V. Moreva, Zh. èksp. Teor. Fiz. 129, 814 (2006) [JETP 102, 712 (2006)]. 8. Yu. I. Bogdanov, E. V. Moreva, G. A. Maslennikov, et al., Phys. Rev. A 73, 063810 (2006). 9. C. Bennett, F. Bessette, G. Brassard, et al., J. Cryptology 5, 3 (1992). 10. R. Asplund, G. Bjork, and M. Bourenanne, J. Opt. B: Quantum Semiclassic. Opt. 3, 163 (2001). 11. D. Bruss and C. Macchiavello, Phys. Rev. Lett. 88, 127901 (2002). 12. F. Caruso, H. Bechmann-Pasquinucci, and C. Macchiavello, Phys. Rev. A 72, 032340 (2005). 13. V. Buz ek and M. Hillery, Phys. Rev. Lett. 81, 5003 (1998). 14. N. J. Cerf, M. Bourennane, A. Karlsson, and N. Gisin, Phys. Rev. Lett. 88, 127902 (2002). 15. T. Durt, N. J. Cerf, N. Gisin, and M. Zukowski, Phys. Rev. A 67, 012311 (2003). 16. N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Rev. Mod. Phys. 74, 145 (2002). 17. H. Bechmann-Pasquinucci and W. Tittel, Phys. Rev. A 61, 062308 (2000). 18. D. V. Horoshko and S. Ya. Kilin, Opt. Spektrosk. 94, 750 (2003) [Opt. Spectrosc. 94, 691 (2003)].
^

pensated for by using fewer mutually unbiased bases. The current availability of well-developed methods for preparing, converting, and measuring two-photon polarization states suggests that this class of states is a promising candidate for use in future quantum cryptosystems. ACKNOWLEDGMENTS We thank H. Zbinden, H. Weinfurter, S.N. Molotkov, and D. Horoshko for helpful discussions of the results of this study. This work was supported by the Russian Foundation (project nos. 06-02-16769 and 07-02-01041-a) and under the State Program for Support of Leading Science Schools (grant no. NSh-4586.2006.2). REFERENCES
1. S. Wiesner, SIGACT News 15, 78 (1983). 2. C. H. Bennett and G. Brassard, in Proceedings of the IEEE International Conference on Computers, Systems, and Signal Processing, Bangalore, India (IEEE, New York, 1984), p. 175. 3. W. K. Wootters and W. H. Zurek, Nature 299, 802 (1982). 4. H. Bechmann-Pasquinucci and A. Peres, Phys. Rev. Lett. 85, 3313 (2000). 5. W. K. Wooters and B. D. Fields, Ann. Phys. (N.Y.) 191, 363 (1989).

Translated by A. Betev

JOURNAL OF EXPERIMENTAL AND THEORETICAL PHYSICS

Vol. 104

No. 5

2007