Äîêóìåíò âçÿò èç êýøà ïîèñêîâîé ìàøèíû. Àäðåñ îðèãèíàëüíîãî äîêóìåíòà : http://qi.phys.msu.ru/papers/2008-jetpl(e)-88-636.pdf Äàòà èçìåíåíèÿ: Wed May 13 15:27:14 2009 Äàòà èíäåêñèðîâàíèÿ: Mon Oct 1 19:52:45 2012 Êîäèðîâêà:

ISSN 0021-3640, JETP Letters, 2008, Vol. 88, No. 9, pp. 636­640. © Pleiades Publishing, Ltd., 2008. Original Russian Text © A.P. Shurupov, S.P. Kulik, 2008, published in Pis'ma v Zhurnal èksperimental'nooe i Teoreticheskooe Fiziki, 2008, Vol. 88, No. 9, pp. 729­733.

Quantum Key Distribution on Biphotons­Ququarts with Test States
A. P. Shurupov and S. P. Kulik
Faculty of Physics, Moscow State University, Moscow, 119992 Russia
Received August 13, 2008; in final form, September 18, 2008

The operational inclusion of the subclass of entangled states in a quantum key distribution protocol based on biphoton­ququarts is analyzed. Four Bell states are proposed to be used as test states to estimate the error level, leaving the subclass of 12 factorized polarization states of biphotons as information states. The elementary analysis of two strategies for an attack on a quantum communication channel, as well as of the key generation rate, has been performed. PACS numbers: 03.67.-a, 42.50.Dv, 42.65.Lm DOI: 10.1134/S0021364008210194

1. INTRODUCTION An increase in the dimension D of the Hilbert space is considered as one of the physical methods for increasing the security of quantum cryptography. The security is determined by the admissible error level: if errors are larger than this level, the distribution of a bit string used to construct a key (after the procedures of the error correction and security enhancement) is not guaranteed. In a certain sense, an increase in this level is one of the basic aims of quantum cryptography and leads to the stability of protocols against various eavesdropper attacks and/or to the increase in the key distribution distance. Several quite realistic physical systems have already been proposed as prototypes for the real implementation of the quantum key distribution on multilevel states (for which D > 2). Among them are the spatial modes of the light-field beams [1], single-photon states in combined phase­time space [2], biphotons in a multiarm interferometer [3], spatial modes of the biphoton field [4], four-photon polarization states [5], biphotons generated by a sequence of laser pulses [6], and polarization single-beam biphotons­ququarts (D = 4), when two photons belong to the same spatial mode, but have different polarizations and fixed nondegenerate frequencies [7]. In simplicity and implementation efficiency, polarization ququarts constitute a promising class of states for developing protocols of the quantum key distribution in the multidimensional Hilbert space. One of the advantages of such systems is the possibility of the encoding and transmission of information in states of photon pairs (including entangled states) propagating in the same direction. Another advantage is the use of the methods of the frequency selection and polarization modulation of signals, which are well developed in

classical telecommunication. At the same time, the fact that the currently implemented states and schemes for their measurement do not cover the complete set of polarization two-photon states, namely, the subclass of entangled states, was mentioned as a demerit of the use of ququarts­biphotons [8]. Therefore, the use of such systems in quantum key distribution does not open the complete spectrum of their possibilities and reduces only to the manipulation with the factorized states | 1 | 2 , (1)

where the ket vectors stand for the states of photons 1 and 2. Indeed, the generation of two-photon entangled states does not face serious difficulties, whereas its deterministic measurement with only linear optical instruments is fundamentally impossible [9]. This reasoning is decisive for choosing a certain subclass of two-photon states for the demonstration of quantum key distribution on states with dimension D = 4. At the same time, the following question arises: Can a realistic protocol involving entangled states be implemented on biphoton­ququarts? In this work, we propose a quantum key distribution protocol with the use of so-called "substitutional" twophoton entangled states. These states are not information states and are used only for testing an eavesdropping attack on a quantum communication channel. Information states are factorized states (1) previously used to demonstrate the extended BB84 protocol [10] on biphotons­ququarts [11, 12]. Thus, the protocol involves all representatives of the class of two-photon polarization states, both factorized and entangled, whereas a measurement is performed in convenient bases of factorized states.

636


QUANTUM KEY DISTRIBUTION ON BIPHOTONS­QUQUARTS

637

2. DESCRIPTION OF THE PROTOCOL The protocol is an extended version of the BB84 protocol with the reduced set of mutually unbiased bases1 [13]. We consider three of five possible bases: I. |H 1 |H 2 , |V 1 |H 2 , II. |D 1 |D 2 , | A 1 |D 2 , III. | R 1 | R 2 , | L 1 | R 2 , |H 1 |V 2 , |V 1 |V 2 , |D 1 | A 2 , | A 1 | A 2 , | R 1 | L 2 , | L 1 | L 2 . (2a)

(2b)

(2c)
Deterministic scheme for measuring the states of biphoton­ ququarts. The input state is split at the dichroic beam splitter DBS into spatial modes with different wavelengths. The polarization converters QP1 and QP2 consisting of quarterwave and half-wave plates are used to select a measurement basis, PBS is a polarization beam splitter, and the coincidence scheme is used to select events.

1 Here, |H = a+|vac, |V = b+|vac, |D(A) = ------ (|H + 2 1 (­)|V), and |R(L) = ------ (|H + (­)i |V) are the polariza2 tion single-photon states with the horizontal, vertical, inclined, and circular polarizations, respectively, where a+ and b+ are the photon creation operators in the horizontal and vertical polarization modes, respectively, and |vac is the vacuum state. Subscripts 1 and 2 in Eqs. (1) and (2) enumerate the central frequencies in the spectrum of each single-photon state constituting a biphoton. Two remaining bases are constructed from entangled states, IV. | R 1, H 2 + | L 1, V 2 ; | L 1, H 2 + | R 1, V 2 ; |H 1, R 2 + |V 1, L 2 ; |H 1, L 2 + |V 1, R 2 ; | R 1, H 2 ­ | L 1, V 2 ; | L 1, H 2 ­ | R 1, V 2 , |H 1, R 2 ­ |V 1, L 2 ; |H 1, L 2 ­ |V 1, R 2 (3a)

V.

(3b)

and are not used in the protocol. Alice randomly chooses states from three bases (12 states in total) and sends them to Bob. Bob measures the states in one of randomly chosen bases (2); there is a simple measurement scheme [11] providing a deterministic result if the chosen basis coincides with that from which the state is sent (see figure). Such a scheme consists of a dichroic beam splitter insensitive to polarization; a polarization beam splitter is placed in each output arm of the splitter. The scheme involves one spatial mode at the input and has four modes at the output,
1

where the photon counters are placed. The pulses from counters are fed to a four-input device detecting pair coincidences of pulses with the identification of inputs; this instrument is used to discriminate events. The change of bases occurs by placing polarization converters, half- and quarter-wave phase plates, behind the dichroic beam splitter. For example, these plates are not used in basis (2a). "Inclined" basis (2b) corresponds to placing half-wave plates oriented at an angle of 22.5°. Circular basis (2c) corresponds to quarter-wave plates placed at an angle of 45°. In particular, the triggering of a pair of detectors D3D2 in basis (2a) certainly corresponds to the detection of state |V1H2, etc. In the general case, if Alice sends the state |Alice, the probability of measuring the state |Bob in this scheme is F =
Alice| Bob

.
2

(4)

Let Alice send to the quantum communication channel not only states (2), but also four Bell states with the probability q: 1 ± | 12 = ------ ( |H 1 |V 2 ± |V 1 |H 2 ) , 2 1 ± | 12 = ------ ( |H 1 |H 2 ± |V 1 |V 2 ) . 2 (5a)

Mutually unbiased bases are bases constructed on orthonormalized states satisfying the conditions: |ei |ej |2 = 1/D if the vectors |ei and |ej belong to different bases and |ei |ej |2 = 0 for i j and |ei |ei |2 = 1 for the vectors belonging to one basis. The maximally possible number of mutually unbiased bases for a system with dimension D is D + 1 and the total number of states is D(D + 1). JETP LETTERS Vol. 88 No. 9 2008

(5b)

After the transmission of the quantum states, using an open authentic communication channel, Bob informs Alice of the bases in which he performed measurements, but does not report the result of the measure-


638

SHURUPOV, KULIK

Result of the projection of test states into the factorized states belonging to three mutually unbiased bases (2) Measurement basis state |H1|H2 I |H1|V2 |V1|H2 |V1|V2 |D1|D2 II |D1|A2 |A1|D2 |A1|A2 |R1|R2 III |R1|L2 |L1|R2 |L1|L2 |+ 1/2 0 0 1/2 1/2 0 0 1/2 0 1/2 1/2 0 Preparation: test states |­ 1/2 0 0 1/2 0 1/2 1/2 0 1/2 0 0 1/2 |+ 0 1/2 1/2 0 1/2 0 0 1/2 1/2 0 0 1/2 |­ 0 1/2 1/2 0 0 1/2 1/2 0 0 1/2 1/2 0

case is caused only by an unauthorized attack on the communication channel (or by a technical error). The absence of coincidences of photocounts in certain projection measurements of maximally entangled states is the manifestation of the two-photon interference effect well known in quantum optics [14]. States (5) are used as test states. This means that the measurement station also randomly projects the received states into one of bases (2). The use of states (5) as information states would significantly complicate the measurement scheme, because a projector onto entangled states is required in this case. This is unrealistic at the current level of development of the experimental equipment. 3. ANALYSIS OF EAVESDROPPING AND KEY GENERATION RATE Since the total number and form of information states do not change as compared to the extended BB84 protocol on ququarts [11], all estimates of the security level obtained in [12] are valid. Measurements concern only the sensitivity of the protocol to external attacks and the key generation rate. 3.1. Reception­Transmission

ments. Alice and Bob retain only outcomes of the events in which the measurement and preparation bases coincide, i.e., events in which the measured and transmitted states should be identical (in the absence of an attack on the quantum communication channel). Then, Alice informs Bob of which Bell states she sent at which time instants. Bob estimates the perturbation level of these states according to the table that is constructed for states (5) by rule (4). Indeed, let us consider the result of projection (4) for the example of the transmission of the singlet, |­, and triplet, |+, states and their subsequent projection into pairs of the states from the third basis: | R 1 | R 2
­ 2

1 = -- | ( H 1| V 2| ­ V 1| H 2| ) 8
2

Let an eavesdropper (Eve) perform a projection measurement of the transmitted state in one of the bases used by the legitimate users. The result of the measurement is retransmitted to Bob. Then, if the bases of Eve and Bob coincide (with the probability P = 1/3), the introduced perturbation is minimal and is zero. If the bases do not coincide, the error on information states (2) and test states (5) is 3/4 and 1/2, respectively. For a protocol on three bases, the probability that Eve chooses an incorrect basis is 2/3; as a result, the average perturbations of information states and test states are Dinf = 2/3 â 3/4 = 50% and Dtest = 2/3 â 1/2 = 33.33%, respectively. Thus, the probability of perturbation in the protocol on the test states is lower than that in the original protocol by a factor of Dinf/Dtest = 1.5. 3.2. Optimal Attack If Eve performs the so-called optimal attack (see, e.g., [12, 15]), she relates the transmitted state |i to her auxiliary system |E by the unitary transformation U ( |i |E ) + 1 ­ D |i |E i, i
i, i + j

(6a)

â ( |H 1 + i |V 1 ) ( |H 2 + i |V 2 ) | = 0, | R 1 | L 2
+

1 = -- | ( H 1| V 2| ­ V 1| H 2| ) 8 1 2 â ( |H 1 + i |V 1 ) ( |H 2 ­ i |V 2 ) | = -- . 2
2

(6b)

According to the table, the result of the measurement of the singlet state |­, being invariant, is independent of the choice of the basis. Another remarkable result following from the table is that some test states in any basis do not provide a count with unit probability! Therefore, the triggering of a pair of detectors in this


j=1

3

D --- |i + j |E 3

,

(7)

where | j (j = 0, ..., 4) are the orthonormalized vectors of one of bases (2). The probability of measuring the
JETP LETTERS Vol. 88 No. 9 2008


QUANTUM KEY DISTRIBUTION ON BIPHOTONS­QUQUARTS

639

state | after the projection measurement by Bob is F = |
(i) (i) B, out

| ,

(8)

where B, out = TrE[U(|i |E)(E| i |U+)] is the reduced density matrix of the state |i sent by Alice and received by Bob after the optimal eavesdropping attack. As a result of the comparison of the bases, the probability of the correct measurement is F = 1 ­ D and the total perturbation is Dinf = D. If Alice sends a test state, Bob detects the average error Dtest = 2/3D, which corresponds to the reception­transmission attack! 3.3. Uniform Depolarization A separate aim is the construction of a universal unitary operator whose action is manifested in the statistical spread of single-photon polarization states from (2) uniformly over the PoincarÈ sphere. Such an operator would correspond to the natural depolarization model and describe the polarization perturbation of the states propagating both in free space and in optic fibers. It is as yet impossible to construct such an universal operator. 3.4. Key Generation Rate Let N states be transmitted in the communication session and perturbation in the communication channel be estimated on a sample of M states. If the test states are not used, the number of information quarts remaining for the legitimate users after the procedure of the comparison of the bases and estimation of perturbation in the original protocol [11, 12] is n = N/3 ­ M. For the protocol with the test states under consideration, the number of available quarts is larger, n' = (N ­ M)/3 > n! If the perturbation in the original protocol is estimated by the fraction q of m = q(N/3) (m' M = qN for the protocol on the test states) quarts remaining after the comparison of the bases, the numbers of available quarts in both protocols coincide, n = (N/3)(1 ­ q). However, the number of events from which perturbation in the communication channel is estimated in this case is larger for the protocol on the test states, m'/m = 3. Thus, loss in the probability of detecting an error (Sections 3.1 and 3.2) is doubly compensated for by an increase in the key generation rate: m'/m = 2Dinf/Dtest. In this case, the parameter q is free and is chosen taking into account a particular level of technical (or other) errors in the bare key. 4. CONCLUSIONS The protocol on the factorized states of biphoton­ ququarts belonging to three bases (2) [11, 12] seems to be preferable for applications. Such states are easily prepared and the quality of their preparation is very high and can reach 99.9%, because all required polarJETP LETTERS Vol. 88 No. 9 2008

ization elements are simple and available. A simple measurement scheme tested in [7, 11] allows the deterministic measurements of all 12 states. The use of the complete set of five mutually unbiased bases including eight entangled states (3) is inexpedient, because a complicated projection scheme is required in this case. The compromise solution discussed in this work, namely, the use of 4 (or less) maximally entangled states as test states in addition to 12 factorized states (2) used as information states, makes it possible to use a simple measurement scheme and only slightly complicates the preparation part of the quantum key distribution system [7, 11]. In this case, the key generation rate increases and the security level remains unchanged; this result is surprising for the schemes involving highdimension states; in these schemes, an increase in the key generation rate is accompanied by a decrease in the security level [13]. We are grateful to S.N. Molotkov for a discussion of the results. This work was supported by the Russian Foundation for Basic Research (project nos. 08-0212091-ofi, 07-02-91581-ASP-a, 06-02-16769-a, and 08-02-00559) and the Council of the President of the Russian Federation for Support of Young Scientists and Leading Scientific Schools (project no. NSh796.2008.2). REFERENCES
1. M. N. Soskin, V. N. Gorshkov, M. V. Vasnetsov, et al., Phys. Rev. A 56, 4065 (1997); A. Vaziri, J.-W. Pan, T. Jennewein, et al., Phys. Rev. Lett. 91, 227902 (2003); A. Vaziri, G. Weihs, and A. Zeilinger, Phys. Rev. Lett. 89, 240401 (2002); D. Collins, N. Gisin, N. Linden, et al., Phys. Rev. Lett. 88, 040404 (2002); N. Langford, R. B. Dalton, M. D. Harvey, and J. L. O'Brien, Phys. Rev. Lett. 93, 053601 (2004). 2. S. P. Kulik, S. N. Molotkov, and A. P. Makkaveev, Pis'ma Zh. èksp. Teor. Fiz. 85, 354 (2007) [JETP Lett. 85, 297 (2007)]. 3. R. T. Thew, S. Tanzilini, A. Acin, et al., Quant. Inf. Comp. 4, 93 (2004); R. T. Thew, A. Acin, H. Zbinden, and N. Gisin, Phys. Rev. Lett. 93, 010503 (2004). 4. M. N. O'Sullivan-Hale, I. A. Khan, R. W. Boyd, and J. C. Howell, Phys. Rev. Lett. 94, 220501 (2005); L. Neves, G. Lima, J. G. Aguirre Gomez, et al., Phys. Rev. Lett. 94, 100501 (2005); G. M. D'Ariano, P. Mataloni, and M. F. Sacchi, Phys. Rev. A 71, 062337 (2005). 5. A. Lamas-Linares, J. C. Howell, and D. Bouwmeester, Nature 412, 887 (2001); J. C. Howell, A. Lamas-Linares, and D. Bouwmeester, Phys. Rev. Lett. 88, 030401 (2002). 6. H. Riedmatten, I. Marcikic, V. Scarani, et al., Phys. Rev. A 69, 050304(R) (2004).


640

SHURUPOV, KULIK 12. S. P. Kulik and A. P. Shurupov, Zh. èksp. Teor. Fiz. 131, 842 (2007) [JETP 104, 736 (2007)]. 13. H. Bechmann-Pasquinucci and W. Tittel, Phys. Rev. A 61, 062308 (2000). 14. Y. H. Shih and C. O. Alley, Phys. Rev. Lett. 61, 2921 (1988); D. N. Klyshko, Zh. èksp. Teor. Fiz. 111, 1955 (1997) [JETP 84, 1065 (1997)]. 15. M. Bourennane, A. Karlsson, and G. Bjork, Phys. Rev. A 64, 012306 (2001); F. Caruso, H. Bechmann-Pasquinucci, and C. Machiavello, Phys. Rev. A 72, 032340 (2005).

7. Yu. I. Bogdanov, R. F. Galeev, S. P. Kulik, et al., Pis'ma Zh. èksp. Teor. Fiz. 82, 180 (2005) [JETP Lett. 82, 164 (2005)]; G. A. Maslennikov, S. P. Kulik, E. V. Moreva, and S. S. Straupe, Phys. Rev. Lett. 97, 023602 (2006); Yu. I. Bogdanov, R. F. Galeyev, G. A. Maslennikov, and E. V. Moreva, Phys. Rev. A 73, 063810 (2006). 8. H. Zbinden and H. Weinfurter, private communication. 9. L. Vaidman and N. Yoran, Phys. Rev. A 59, 116 (1999); N. Lutkenhaus, J. Calsamiglia, and K.-A. Suominen, Phys. Rev. A 59, 3295 (1999). 10. H. Bechmann-Pasquinucci and A. Peres, Phys. Rev. Lett. 85, 3313 (2000). 11. S. P. Kulik, E. V. Moreva, and G. A. Maslennikov, Zh. èksp. Teor. Fiz. 129, 1 (2006) [JETP 102, 712 (2006)].

Translated by R. Tyapaev

JETP LETTERS

Vol. 88

No. 9

2008