Quantum Cryptography using entangled photons in energy-time Bell states

W. Tittel, J. Brendel, H. Zbinden, and N. Gisin

Group of Applied Physics, University of Geneva, CH-1211, Geneva 4, Switzerland

broader context of quantum communication. Moreover,

We present a setup for quantum cryptography based on the fact that energy-time entanglement can be preserved
photon pairs in energy-time Bell states and show its feasabil- over long distances renders our source particulary inter-
ity in a laboratory experiment. Our scheme combines the ad-
esting for long-distance applications.
vantages of using photon pairs instead of faint laser pulses and
To understand the principle of our idea, we look at
the possibility to preserve energy-time entanglement over long
Fig. 1. A short light pulse emitted at time t0 enters an
distances. Moreover, using 4-dimensional energy-time states,
interferometer having a path length difference which is
arXiv:quant-ph/9911109v1 25 Nov 1999

no fast random change of bases is required in our setup : Na-

ture itself decides whether to measure in the energy or in the large compared to the duration of the pulse. The pulse
time base. is thus split into two pulses of smaller amplitudes, fol-
PACS Nos. 3.67.Dd, 3.67.Hk lowing each other with a fixed phase relation. The light
is then focussed into a nonlinear crystal where some of
the pump photons are downconverted into photon pairs.
Quantum communication is probably one of the most
Working with pump energies low enough to ensure that
rapidly growing and most exciting fields of physics within
generation of two photon pairs by the same as well as by
the last years [1]. Its most mature application is quantum
two subsequent pulses can be neglected, a created photon
cryptography (also called quantum key distribution), en-
pair is described by
suring the distribution of a secret key between two par-
ties. This key can be used afterwards to encrypt and 1
 
decrypt secret messages using the one time pad [2]. In | ψ i = √ | s iA | s iB + eiφ | l iA | l iB . (1)
2
opposition to the mostly used ”public key” systems [2],
the security of quantum cryptography is not based on | s i and | l i denote a photon created by a pump pho-
mathematical complexity but on an inherent property of ton having traveled via the short or the long arm of the
single quanta. Roughly speaking, since it is not possible interferometer, and the indices A, B label the photons.
to measure an unknown quantum system without mod- The state (1) is composed of only two discrete emission
ifying it, an eavesdropper manifests herself by introduc- times and not of a continuous spectrum. This contrasts
ing errors in the transmitted data. During the last years, with the energy-time entangled states used up to now
several prototypes based on faint laser pulses mimicking [7,15]. Please note that, depending on the phase φ, Eq.
single photons, have been developed, demonstrating that (1) describes two of the four Bell states. Interchanging
quantum cryptography not only works inside the labo- | s i and | l i for one of the two photons leads to gener-
ratory, but in the ”real world” as well [1,3,4]. Besides, ation of the remaining two Bell-states. In general, the
it has been shown that two-photon entanglement can be coefficients describing the amplitudes of the | s i| s i and
preserved over large distances [5], especially when being | l i| l i states can be different, leading to nonmaximally
entangled in energy and time [6]. As pointed out by Ek- entangled states. However, in this article, we will deal
ert in 1991 [7], the nonlocal correlations engendered by only with maximally entangled states. Behind the crys-
such states can also be used to establish sequences of cor- tal, the photons are separated and are sent to Alice and
related bits at distant places, the advantage compared to Bob, respectively (see Fig.1). There, each photon trav-
systems based on faint laser pulses being the smaller vul- els via another interferometer, introducing exactly the
nerability against a certain kind of eavesdropper attack same difference of travel times through one or the other
[8,9]. arm as did the previous interferometer, acting on the
Besides improvements in the domain of quantum key pump pulse. If Alice looks at the arrival times of the
distribution, recent experimental progress in generat- photons with respect to the emission time of the pump
ing, manipulating and measuring the so-called Bell-states pulse t0 – note that she has two detectors to look at–, she
[10], has lead to fascinating applications like quantum will find the photons in one of three time slots. For in-
teleportation [11], dense-coding [12] and entanglement stance, detection of a photon in the first slot corresponds
swapping [13]. In a recent paper, we proposed and tested to ”pump photon having traveled via the short arm and
a novel source for quantum communication generating a downconverted photon via the short arm”. To keep it
new kind of Bell states based on energy-time entangle- short, we refer to this process as | s iP ; | s iA , where P
ment [14]. In this paper, we present a first application, stands for the pump- and A for Alice’s photon. However,
exploiting this new source for quantum cryptography. the characterization of the complete photon pair is still
Our scheme follows Ekert’s initial idea concerning the ambiguous, since, at this point, the path of the photon
use of photon-pair correlations. However, in opposition, having traveled to Bob (short or long in his interferome-
it implements Bell states and can thus be seen in the ter) is unknown to Alice. Fig. 1 illustrates all processes

1
leading to a detection in the different time slots both at Like in the BB84 protocol [16] it is the use of com-
Alice’s and at Bob’s detector. Obviously, this reasoning plementary bases that ensures the detection of an eaves-
holds for any combination of two detectors. In order to dropper [17]. If we consider for instance the most in-
build up the secret key, Alice and Bob now publicly agree tuitive intercept/resend strategy, the eavesdropper inter-
about the events where both detected a photon in one of cepts the photons, measures them in one of the two bases
the satellite peaks – without revealing in which one – or and sends new, accordingly prepared photons instead.
both in the central peak – without revealing the detec- Since she never knows in which basis Bob’s measurement
tor. This additional information enables both of them to will take place, she will in half of the cases eavesdrop
know exactly via which arm the sister photon, detected and resend the photons in the ”wrong basis” and there-
by the other person, has traveled. For instance, to come fore will statistically introduce errors in Bobs results, re-
back to the above given example, if Bob tells Alice that vealing in turn her presence. For a more general treat-
he detected his photon in a satellite peak as well, she ment of quantum key distribution and eavesdropping us-
knows that the process must have been | s ip ; | s iA | s iB . ing energy-time complementarity, we refer the reader to
The same holds for Bob who now knows that Alice pho- [18].
ton traveled via the short arm in her interferometer. If To generate the short pump pulses, we use a pulsed
both find the photons in the right peak, the process was diode laser (PicoQuant PDL 800), emitting 600ps
| l ip ; | l iA | l iB . In either case, Alice and Bob have corre- (FWHM) pulses of 655 nm wavelength at a repetition
lated detection times. The cross terms where one of them frequency of 80 MHz. The average power is of ≈ 10 mW,
detect a photon in the left and the other one in the right equivalent to an energy of 125 pJ per pulse. The light
satellite peak do not occur. Assigning now bitvalues 0 passes a dispersive prism, preventing the small quantity
(1) to the short (long) processes, Alice and Bob finally of also emitted infrared light to enter the subsequent
end up with a sequence of correlated bits. setup, and a polarizing beamsplitter (PBS), serving as
Otherwise, if both find the photon in the central optical isolator. The pump is then focussed into a single-
slot, the process must have been | s ip ; | l iA | l iB or mode fiber and is guided into a fiber optical Michelson
| l ip ; | s iA | s iB . If both possibilities are indistinguish- interferometer made of a 3 dB fiber coupler and chem-
able, we face the situation of interference and the prob- ically deposited silver end mirors. The path length dif-
ability for detection by a given combination of detectors ference corresponds to a difference of travel times of ≈
(e.g. the ”+”-labeled detector at Alice’s and the ”–” la- 1.2 ns, splitting the pump pulse into two, well seperated
beled one at Bob’s) depends on the phases α, β and φ pulses. The arm-length difference of the whole interfer-
in the three interferometers. The quantum mechanical ometer can be controlled using a pizoelectric actuator in
treatment leads to Pi,j = 21 1 + ijcos(α + β − φ) with


order to ensure any desired phase difference. Besides, the
i,j = ±1 denoting the detector labels [14]. Hence, chos- temperature is maintained stable. In order to control the
ing appropriate phase settings, Alice and Bob will always evolution of the polarization in the fibers, we implement
find perfect correlations in the output ports. Either both three fiber-optical polarization controllers, each one con-
detect the photons in detector ”–” (bitvalue ”0”), or both sisting of three inclinable fiber loops – equivalent to three
in detector ”+” (bitvalue ”1”). Since the correlations de- waveplates in the case of bulk optic. The first device
pend on the phases and thus on the energy of the pump, is placed before the interferometer and ensures that all
signal and idler photons, we refer to this base as the en- light, leaving the Michelson interferometer by the input
ergy base (showing wave like behaviour), stressing the port will be reflected by the already mentioned PBS and
complementarity with the other, the time basis (showing thus will not impinge onto the laser diode. The second
particle like behaviour). controller serves to equalize the evolution of the polariza-
tion states within the different arms of the interferome-
ter, and the last one enables to control the polarization
Laser

t0 state of the light that leaves the interferometer by the

|sñp ,|lñB ; |l ñp ,|sñB
|sñp ,|lñA ; |lñp ,|sñA second output port. The horizontally polarized light is
|sñp ,|sñA |lñp ,|lñA |sñp ,|sñB |lñp ,|lñB now focussed into a 4x3x12 mm KN bO3 crystal, cut and
Alice

Bob

oriented to ensure degenerate collinear phasematching,

f hence producing photon pairs at 1310 nm wavelength –
tA - t0 tB - t 0 within the so-called second telecommunication window.
Due to injection losses of the pump into the fiber and
a nonlinear b
crystal losses within the interferometer, the average power be-
+ + fore the crystal drops to ≈ 1 mW, and the energy per
-
pulse – remember that each initial pump pulse is now
-
split into two – to ≈ 6 pJ. The probability for creation of
Alice Bob
more than one photon pair within the same or within two
subsequent pulses is smaller than 1 %, ensuring the as-
FIG. 1. Schematics of quantum key distribution using en- sumption that lead to Eq. 1. Behind the crystal, the red
ergy-time Bell states. pump light is absorbed by a filter (RG 1000). The down-

2
converted photons are then focussed into a fiber coupler, Bell inequalities as well [15,19]. From the mean visibil-
separating them in half of the cases, and are guided to ity of (92.2±0.8)%, we can infer to a violation of Bell
Alice and Bob, respectively. The interferometers (type inequalities by 27 standard deviations.
Michelson) located there have been described in detail in
[6]. They consist of a 3-port optical circulator, providing
600
access to the second output arm of the interferometer,
a 3 dB fiber coupler and Faraday mirrors in order to

triple coincidences per 50 sec

500
compensate any birefringence within the fiber arms. To
400
controll their phases, the temperature can be varied or
can be maintained stable. Overall losses are about 6 dB. 300

The path length differences of both interferometers are 200

equal with respect to the coherence length of the down-
100
converted photons – approximately 20 µm. In addition,
the travel time difference is the same than the one intro- 0
duced by the interferometer acting on the pump pulse. In 0 3 6 9 12 15

this case, ”the same” refers to the coherence time of the phase [a.u.]

pump photons, around 800 fs or 0.23 mm, respectively.

To detect the photons, the output ports are connected FIG. 2. Results of the measurement in the energy basis.
to single-photon counters – passively quenched germa- The different mean values are due to different detector effi-
nium avalanche photodiodes, operated in Geiger-mode ciencies
and cooled to 77 K [6]. We operate them at dark count
rates of 30 kHz, leading to quantum efficiencies of ≈ 5 Like in all experimental quantum key distribution
%. The single photon detection rates are of 4-7 kHz, the schemes, the found QBERs are non-zero, even in the
discrepancy being due to different detection efficiencies absence of any eavesdropping. Nevertheless, they are
and losses in the circulators. The signals from the detec- still small enough to guarantee the detection of an eaves-
tors as well as signals being coincident with the emission dropper attack, allowing thus secure key distribution. in-
of a pump pulse are fed into fast AND-gates. equality The remaining ≈ 4% are due to accidental co-
To demonstrate our scheme, we first measure the corre- incidences from uncorrelated events at the single pho-
lated events in the time base. Conditioning the detection ton detectors, a not perfectly localized pump pulse, non-
at Alice’s and Bob’s detectors both on the left satellite perfect time resolution of the photon detectors, and, in
peaks, (| sp i,| sA i and | sp i,| sB i, respectively) we count the case of the energy basis, non-perfect interference.
the number of coincident detections between both AND- Note that the last mentioned errors decrease at the same
gates, that is the number of triple coincidences between rate as the number of correlated events when increas-
emission of the pump-pulse and detections at Alice’s and ing the distance between Alice and Bob (that is when
Bob’s. In subsequent runs, we measure these rates for the increasing the losses). In contrast to that, the number
right-right (| lp i,| lA i AND | lp i,| lB i) events, as well as of errors due to uncorrelated events (point 1) stays al-
for the right-left cross terms. We find values around 1700 most constant since it is dominated by the detector noise.
coincidences per 100 sec for the correlated, and around Thus, the QBER increases with distance, however, only
80 coincidences for the non-correlated events (table 1). at a small rate since this contribution was found to be
From the four times four rates –remember that we have small. Experimental investigations show that introduc-
four pairs of detectors–, we calculate the different quan- ing 6 dB overall losses – in the best case equivalent to 20
tum bit error rates QBER, which is the ratio of wrong km of optical fiber – leads to an increment of only around
to detected events. We find values inbetween 3.7 and 5.7 1%, hence to a QBER of 5-6%. Besides detector noise,
%, leading to a mean value of QBER for the time base another major problem of all quantum key distribution
of (4.6 ±0.1)%. schemes developed up to now is stability, the only excep-
In order to evaluate the QBER in the energy base, we tion being [3]. In order to really implement our setup
condition the detection at Alice’s and Bob’s on the cen- for quantum cryptography, the interferometers have to
tral peaks. Changing the phases in any of the three inter- be actively stabilized, taking for instance advantage of
ferometers, we observe interference fringes in the triple the free ports. The chosen passive stabilization by con-
coincidence count rates (Fig.2). Fits yield visibilities of trolling the temperature is not sufficient to ensure stable
89.3 to 94.5 % for the different detector pairs (table 2). phases over a long time.
In the case of appropriatly chosen phases, the number To conclude, we presented a new setup for quantum
of correlated events are around 800 in 50 sec, and the cryptography using Bell states based on energy-time en-
number of errors are around 35. From these values, we tanglement, and demonstrated its feasability in a lab-
calculate the QBERs for the four detector pairs. We oratory experiment. We found bit rates of around 33
find values inbetween 2.8 and 5.4 %, leading to a mean Hz and quantum bit error rates of around 4 % which is
QBER for the energy base of (3.9±0.4) %. Note that low enough to ensure secure key distribution. Besides
this experiment can be seen as a Franson-type test of a smaller vulnerability against eavesdropper attacks, the

3
advantage of using discrete energy-time states, up to di- pulses where the detecting electronics has to be activated
mension 4, in our scheme, is the fact that no fast change whenever a weak pulse (containing most of the time no
between non-commuting bases is necessary. Nature itself photon) was emitted.
chooses between the complementary properties energy [9] G. Brassard, N. Lütkenhaus, T. Mor, and B.C. Sanders.
and time. Furthermore, the recent demonstration that quant-ph/9911054.
energy-time entanglement can be preserved over long dis- [10] H. Weinfurter, Europhys. Lett 25, 559 (1994). M. Mich-
tances [6] shows that this scheme is perfectly adapted to ler, K. Mattle, H. Weinfurter, and A. Zeilinger. Phys.
long-distance quantum cryptography. Rev. A 53, R1209 (1996).
We would like to thank J.D. Gautier for technical sup- [11] C.H. Bennett, G. Brassard, C. Crpeau, R. Jozsa, A.
port and PicoQuant for fast delivery of the laser. This Peres, and W.K. Wootters. Phys. Rev. Lett. 70 1895
(1993). D. Bouwmeester, J.-W. Pan, K. Mattle, M. Eibl,
work was supported by the Swiss PPOII and the Euro-
D. Boschi, S. Branca, F. De Martini, L. Hardy, and S.
pean QuCom IST projects.
Popescu. Phys. Rev. Lett. 80, 1121 (1998). A. Furusawa,
J.L. Sorensen, S.L. Braunstein, C.A. Fuchs, H.J. Kimble,
and E.S. Polzik. Science 282, 706 (1998).
[12] K. Mattle, H. Weinfurter, P.G. Kwiat, and A. Zeilinger.
Phys. Rev. Lett. 76, 4656 (1996).
[13] J.-W. Pan, D. Bouwmeester, H. Weinfurter, and A.
Zeilinger. Phys. Rev. Lett. 80, 3891 (1998).
[1] Physics World, March 1998, special issue in quan- [14] J. Brendel, N. Gisin, W. Tittel, and H. Zbinden. Phys.
tum communication including an article by W. Tittel, Rev. Lett. 82, 2594 (1999).
G.Ribordy, and N.Gisin on quantum cryptography. [15] J.D. Franson, Phys. Rev. Lett. 62, 2205 (1989).
[2] See e.g. D. Welsh, Codes and Cryptography, Oxfors Sci- [16] C.H. Bennett and G. Brassard, in Proceedings of IEEE
ence Publication, Clarendon Press, Oxford (1988). International Conference on Computers, Systems and
[3] A. Muller, T. Herzog, B. Huttner, W. Tittel, H. Zbinden, Signal Processing, Bangalore, India (IEEE, New York,
and N. Gisin, Appl. Phys. Lett 70, 793 (1997). G. Ri- 1984), p.175
bordy, J.-D. Gautier, N. Gisin, O. Guinnard, and H. [17] C. Fuchs, N. Gisin, R. B. Griffiths, C. S. Niu and A.
Zbinden. quant-ph/9905056. Peres Phys. Rev. A 56, 1163 (19997). I. Cirac and N.
[4] P.D. Townsend. Opt. Fiber Technology 4, 345 (1998). Gisin, Phys. Lett. A 229, 1 (1997).
R.J. Hughes, G.L. Morgan, and C.G. Peterson. quant- [18] H. Bechmann-Pasquinucci and W. Tittel. quant-
ph/9904038. J.-M. Mérolla, Y. Mazurenko, J.-P. Goedge- ph/9910095.
buer, and W.T. Rhodes. Phys. Rev. Lett. 82, 1656 [19] J.S. Bell, Physics 1, 195 (1964).
(1999).
[5] P.R.Tapster, J.G. Rarity, and P.C.M. Owens. Phys. Rev.
Lett. 73, 1923 (1994). W. Tittel, J. Brendel, N. Gisin, T.
Herzog, and H. Zbinden. Phys. Rev. A 57, 3229 (1998). ++ +– –+ ––
W. Tittel, J. Brendel, H. Zbinden, and N. Gisin. Phys. sP sA &sP sB 278±6 197±5 187±5 147±4
Rev. Lett. 81, 3563 (1998). G. Weihs, T. Jennewein, C. lP lA &lP lB 304±7 201±5 200±5 148±5
Simon, H. Weinfurter, and A. Zeilinger, Phys. Rev. Lett. sP sA &lP lB 11±0.8 10.4±0.8 9.2±0.7 9.4±0.7
81, 5039 (1998). lP lA &sP sB 11.2±0.4 8.6±0.4 9.1±0.4 8.5±0.4
[6] W. Tittel, J. Brendel, N. Gisin, and H. Zbinden. Phys. QBER [%] 3.7±0.2 4.6±0.2 4.5±0.2 5.7±0.3
Rev. A 59, 4150 (1999).
TABLE I. Results of the measurement in the time ba-
[7] A.K. Ekert, Phys. Rev. Lett. 67, 661 (1991).
sis. The different coincidence count rates are due to different
[8] When using coherent states, the eavesdropper can take
quantum efficiencies of the detectors, and the slight asymme-
advantage of the fact that there always is a small proba-
try in the correlated events can be explained by the non-equal
bility of finding more than one photon in the same pulse,
transmission probabilities within the interferometers.
hence in the same state. In these cases, she simply mea-
sures one and lets pass the other one unmeasured. This
strategy can be somewhat circumvented using photon
pairs, where one photon serves as trigger for the sec- ++ +– –+ ––
ond one. However, since the possibility to create more Visibility [%] 92.5±1.8 92.6±1.4 89.3±1.9 94.5±1.6
than one pair at the same time increases with the pump max. 518±13 416±8 359±9 279±7
intensity, we face a similar problem concerning the simul- min. 20±5 16±3 20±4 8±2
taneous presence of more than one photon in the same QBER [%] 3.7±0.9 3.7±0.7 5.3±1 2.8±0.8
state. Note that this probability can be made arbitrarily
small in both cases using weaker pulses or lower pump TABLE II. Results of the measurement in the energy-basis.
energies. Still, there is an important difference, favouring
the implementation of photon pairs: Whenever the trig-
ger photon has been detected, there is one photon left in
the setup. This contrasts with the schemes based on faint