QUANTUM INFORMATION PROCESSING WITH NON-CLASSICAL LIGHT

Transcription

1 QUANTUM INFORMATION PROCESSING WITH NON-CLASSICAL LIGHT a dissertation submitted to the department of electrical engineering and the committee on graduate studies of stanford university in partial fulfillment of the requirements for the degree of doctor of philosophy Edo Waks May 2003

2 c Copyright by Edo Waks 2003 All Rights Reserved ii

3 I certify that I have read this dissertation and that, in my opinion, it is fully adequate in scope and quality as a dissertation for the degree of Doctor of Philosophy. Yoshihisa Yamamoto (Principal Adviser) I certify that I have read this dissertation and that, in my opinion, it is fully adequate in scope and quality as a dissertation for the degree of Doctor of Philosophy. Robert L. Byer I certify that I have read this dissertation and that, in my opinion, it is fully adequate in scope and quality as a dissertation for the degree of Doctor of Philosophy. Martin M. Fejer Approved for the University Committee on Graduate Studies: iii

4 Abstract Quantum information processing (QIP) is a field concerned with technological applications of quantum mechanical phenonomena. In many cases, photons are an ideal quantum system for such applications. Photons exhibit superb coherence properties, are robust to environmental noise, and can be transmitted over long distances. One of the main difficulties of photon based quantum information processing is the generation of non-classical light fields. Non-classical light fields exhibit counting statistics which are inconsistent with the classical theory of radiation. These nonclassical statistics are precisely what QIP applications make use of in many cases. This thesis explores the applications of non-classical light fields for quantum information processing applications. There are three main parts to this work. The first part is a theoretical analysis of quantum cryptography based on non-classical light sources. In this part, a theoretical study on sub-poisson light sources is presented, which quantitatively characterizes their advantage over classical sources such attenuated laser. Next, the security of quantum cryptography with entangled photons is investigated. A security proof is presented, and it is shown that such protocols have significantly enhanced security properties, potentially allowing quantum cryptography over 170km with currently available technology. The second part is an experimental demonstration of quantum cryptography using sub-poisson light from an InAs quantum dot. A fully functional system is presented, and an experimental comparison between the quantum dot source and an attenuated laser is made. It is shown that the quantum dot can withstand 5dB of additional channel loss over the attenuated laser. iv

5 In the final part, a method for photon number generation is presented using parametric down-conversion and the Visible Light Photon Counter (VLPC). The VLPC is a photon counter that has the ability to do photon number discrimination with very high quantum efficiency. When combined with a non-linear optical process called parameric down-cnversion, one can generate photon number states. An experimental demonstration of 1,2,3 and 4 photon number states is presented. v

6 Acknowledgements Over the past six years, there are many people who I owe thanks to for their help and support. First and foremost, I owe a great deal to my advisor, Professor Yoshihisa Yamamoto, for his outstanding guidance and support. I have also been extremely fortunate to work with many bright colleagues in the Yamamoto group. Interaction and brain-storming with the group members has been an important part of my graduate career. Over the past years I have had many mentors who have shared their expertise with me. I was extremely fortunate to work for three months with Dr. Paul Kwiat, who taught me virtually all of my optics skills. Later, I worked with Dr. Jungsang Kim, who taught me how to operate the VLPC. Xavier Maitre was extremely helpful in many of the later phases of operating the VLPC detector as well. I also had the pleasure of working with Dr. Chung Ki Hong, who helped with the initial phases of my experiments with parametric down conversion. During the cryptography experiment I worked a lot with Dr. Kyo Inoue from NTT basic research. Finally, Dr. Barry Sanders from Macquarie University was a great resource of new ideas. I would also like to thank the colleagues in the Yamamoti group who I have had the pleasure of working with. Will Oliver provided us with valuable help in the amplifier design for the VLPC. The single photon source for the cryptogtraphy experiment was designed by Charles Santori and David Fattal, who spent long hours in the lab helping us get data. In the final phases of my Ph.D., I was fortunate to work with Eleni Diamanti, who helped with the photon number generation experiment. I would like to thank my defense committee Professor Yamamoto, Professor Byer, Professor Fejer, and Professor Gratta, for attending my defense. I would like to thank vi

7 the first three members for also agreeing to be on my reading committee. I would like to thank all my friends who have supported throughout these year. And finally, I would like to thank my Mom, my Dad, and my brother for their unwavering support and sympathy through all the highes and lows. vii

8 Contents Abstract Acknowledgements iv vi 1 Introduction Quantum information Quantum cryptography Photon number detection Number State Generation Classical Information and Communication Introduction Entropy and Mutual Information Cryptography Encoding quantum information Introduction The qubit Positive Operator Value Measures (POVMs) The photonic qubit Entaglement Teleportation and entanglement swapping viii

9 4 Theory of Quantum Cryptography The BB84 protocol Practical aspects of BB Error Correction Privacy amplification Proof of security by Lütkenhaus Photon source characterization Communication rates for BB84 with sub-poisson light Estimates for sub-poisson light sources Quantum cryptography with entangled photons The BBM92 protocol Proof of security for BBM Ideal entangled photon source Entangled photons from parametric down-conversion Calculations Entanglement Swapping Quantum cryptography with sub-poisson light Sub-Poisson light from InAs quantum dots Quantum cryptography with a quantum dot The Visible Light Photon Counter VLPC operation principle Cryogenic system for operating the VLPC Quantum efficiency and dark counts of the VLPC Noise properties of the VLPC Multi-photon detection with the VLPC Characterizing multi-photon detection capability Non-classical statistics from parametric down-conversion Basics of parametric down-conversion Non-classical photon statistics ix

10 7.3 Observation of non-classical statistics Reconstruction of photon number oscillations Photon number state generation Single photon generation Theory Experiment Multi-photon generation Conclusion 155 A Handling side information from error correction 158 B One photon contribution 161 C Higher order number contributions 166 Bibliography 168 x

11 List of Tables 4.1 Values of f(e) for different error rates Results of fit for panel (c) of Figure xi

12 List of Figures 2.1 Schematic of binary symmetric channel Schematic of system for unconditionally secure cryptography The Bloch sphere Model for generalized, delayed quantum measurements Implementation of a dual rail quantum bit. a, spatial mode implementation. b, polarization mode implementation Time slot based qubit for optical fiber applications Different types of eavesdropping attacks considered in security proofs Basic system for performing the BB84 protocol Two methods of implementing Bob s detection apparatus Hanbury Brown-Twiss intensity interferometer Communication rate as a function of channel loss for different values of g (2), assuming the device efficiency is Communication as a function of channel loss for different device efficiencies Basic system for performing the BB84 protocol Comparison between BB84 protocol and BBM92 using both ideal and realistic sources BBM92 implementation with entanglement swapping. Boxes labelled B represent bell state analyzers, while EPR represents an entangled photon source Comparison of no swap, one swap, and two swap scheme xii

13 5.1 Atomic force microscope image of uncapped quantum dot sample Scanning electron microscope image of micro-post structure. a, image of several micro pillars. b, close up image of micro-post showing DBR mirror structure Experimental setup for characterizing quantum dot photon source a, wavelength spectrum of quantum dot. The dot features a narrow emission line at 920nm. b, the lifetime of the dot is measured by a streak camera to be 0.174ns Energy level diagram of quantum dot showing resonant excitation scheme Saturation curve for quantum dot Autocorrelation measurement for quantum dot single photon source. The area of the τ = 0 peak is suppressed to 0.14 of a far off side peak Experimental setup for implementing BB84 with quantum dot photon source Data correlation between Alice and Bob Comparison between attenuated laser and quantum dot single photon source Demonstration of one time pad encryption. The message is a 140x141 pixel bitmap of Stanford s memorial church, approximately 20kilobyte in length. a, a 20kilobyte key is exchanged over the quantum cryptography system and used to encode the message. The encoded message looks like white noise to anyone who does not possess the key. Decryption allows perfect recovery of the original message. b, a pixel value histogram of the original and encrypted message. The original message shows definite structure, while the distribution for the encrypted message appears flat, reminiscent of white noise Schematic of the structure of the VLPC detector Schematic of cryogenic setup for VLPC Experimental setup to measure quantum efficiency of the VLPC xiii

14 6.4 Quantum efficiency of VLPC vs. bias voltage for different temperatures Quantum efficiency of VLPC vs. dark counts for different temperatures Experimental setup to measure multi-photon detection capability of the VLPC Oscilloscope pulse trace of VLPC output after room temperature RF amplifiers Pulse area spectrum from VLPC. The dotted lines represent the fitted distribution of each photon number peak. The solid line is the total sum of all the peaks. Diamonds denote measured data points Pulse area spectrum fit to Poisson constraint on normalized peak areas Variance as a function of photon number detection. The linear relation is consistent with the independent detection model Experimental setup for observation of non-classical counting statistics from parametric down-conversion Pulse area spectrum using 1µW pump power Measured value of Γ as a funtion of pump power. The black line represents the classical limit Detected photon number distribution from parametric down conversion. (a) Measured distribution with perfect detection efficiency η. (b) Measured distribution with detection efficiency η = Backgrounds vs. pump power Reconstructed even-odd photon number oscillations for several pump powers. (a), 4µW pump. (b) 6µW pump. (c) 8µW pump Single photon generation with parametric down-converiosn Communication rate vs. channel loss for different values of G Experimental setup for generation of single photons Pulse height spectrum emitted from charge sensitive amplifier Pulse height spectrum emitted from charge sensitive amplifier Correlation measurements for different upper thresholds of the SCA Correlation measurements for different bias voltages of the VLPC xiv

15 8.8 Measured value of G as a function of quantum efficiency of the VLPC Experimental setup for generating N photon number state Pulse height histogram for VLPC Pulse area histogram of VLPC 2 without postselection from VLPC Pulse area histogram and reconstructed photon number probabilities for VLPC 2, conditioned on photon number detection from VLPC Pulse area histogram of VLPC 2 for the case of 3 photon generation as a function of pump power Generation efficiency and number state quality as a function of pump power for 2,3, and 4 photon number generation. Data denoted by squares corresponds to P n, the probability the correct photon number was generated. Data denoted by diamonds shows the probability that the VLPC observes the correct photon number on a given laser pulse. The squares reference the left y axis, while the diamonds reference the right y axis xv

16 xvi

17 Chapter 1 Introduction 1.1 Quantum information Quantum mechanics has radically changed our understanding of the physical world in which we live. The success of this theory in modelling physical reality has been unparalleled, leaving little doubt about its validity. One of the most profound aspects of quantum mechanics is that it predicts effects which would not have been expected by classical theory, and in some sense run counter to our notion of how the world should behave. Aspects such as quantum uncertainty and non-local statistics have had profound impact on our conceptual view of the world. For many years these so-called quantum mechanical effects were regarded as nuances. Although interesting physically, they are only observed under very controlled physical environments. Recently however, it has been shown that these properties can be harnessed to perform computationally significant tasks. This observation has transformed quantum mechanics research from a purely academic endeavor into an area of promising technological advancement. A new field, known as quantum information processing (QIP), has emerged whose focus is on the technological application of quantum mechanics. To date, two important application of quantum mechanics have been identified, quantum cryptography and quantum computation. Quantum cryptography incorporates quantum uncertainty, and in some cases non-locality, in order to perform 1

18 2 CHAPTER 1. INTRODUCTION unconditionally secure communication. Quantum computation utilizes the properties of a collection of coupled quantum systems to achieve exponential speedup of certain computational tasks. Quantum computational algorithms have the potential to perform fast searches, and factor prime numbers in polynomial time scales. The search for other applications of quantum technology is currently a very active area of research. One of the main obstacles for quantum information processing is the difficulty of the experimental implementation. Quantum information tasks require unprecedented isolation and control of complicated systems. Of the two main applications, quantum cryptography is the easier to implement. This application requires manipulation of only simple quantum systems. At the time of this work, there are already several implementations of quantum cryptography over long distances [1 3], with commercial quantum cryptography systems just on the horizon. In contrast, quantum computation has been an extremely challenging experimental problem. So far, only very simple quantum computational tasks have been performed [4 6]. A scalable quantum computer that is capable of solving large problems is beyond reach of the foreseeable future. In order to implement a QIP application, one needs a candidate quantum system which can serve as the building block for more complicated systems. This building block is typically referred to as the quantum bit, or qubit for short. A good qubit system should be easily decoupled from its environment in order to exhibit quantum mechanical effects. At the same time, it is often necessary for the qubit to interact with other qubits in a controlled way. Quantum cryptography only requires the first condition, while for quantum computation both conditions must be satisfied. This is why quantum computation is an inherently more difficult task. When only isolation is required, the photon is an excellent candidate for a qubit. Photons exhibit strong quantum mechanical effects, and are very robust to environmental noise. For this reason photons are the exclusive information carriers in quantum cryptography. The main drawback to using photons in QIP is that they do not readily interact with other photons. This makes it very challenging to implement

19 1.2. QUANTUM CRYPTOGRAPHY 3 quantum computation. Most proposals for quantum computation with photons require very high optical non-linearities, orders of magnitude beyond what is currently attainable. Recently, however, it has been shown that such non-linearities are not required. Linear optics alone, combined with single photons and detectors, can be used to implement quantum computation [7]. Although these proposals suffer from other practical difficulties, such as requiring extremely low losses [8], they have rekindled interest in the photon based quantum computer. 1.2 Quantum cryptography This thesis is concerned with photon based quantum information processing. The emphasis is placed on quantum cryptography. Photon based quantum computation remains too difficult to address experimentally. Nevertheless, the tools and concepts developed here may have applications in future quantum computational efforts. The field of quantum cryptography has been around for nearly twenty years. The first protocol was proposed by Bennett and Brassard in 1984 [9]. This protocol is referred to as BB84. Since the discovery of BB84, the field has undergone rapid advancement. A host of additional protocols have been presented, each with their own distinct advantages and dis-advantages [10 12]. The security of quantum cryptography has been conclusively established for many of these protocols, yet a security proof for some protocols remains elusive. The investigation of security in quantum cryptography has transcended beyond the practical importance of secure communication. This field has solidified our understanding of very fundamental concepts in quantum measurement and non-locality. The experimental effort to perform quantum cryptography has also made great progress. Initial experimental efforts were restricted to proof of principle experiments over short distances [13]. More recent efforts have achieved distances of tens of kilometers [1 3]. Extensive work is being invested in extending these distances, as well as performing earth to satellite cryptography. To date, two main challenges remain in the field of quantum cryptography. The first is in the area of theoretical security. Although the security of some protocols,

20 4 CHAPTER 1. INTRODUCTION such as BB84, have been extensively proven, security proofs for other protocols remain elusive. In particular, security proofs for entanglement based protocols such as that of Ekert [14], and that of Bennett, Brassard, and Mermin [15], have been difficult to formulate. The second difficulty is the engineering of single photon sources. Many protocols require the generation of a single photon as an information carrier. Yet experimental implementations to date have relied on highly attenuated lasers or LEDs for this task. These sources have inherent photon number fluctuations, making it impossible to generate exactly one photon. Lasers and LEDs fall into the class of light emitters known as classical sources. To properly define classical light sources, it is necessary to introduce the coherent P representation of a light field. Define ρ as the reduced density matrix of a light field spanning the number state basis. This density matrix can always be expanded in the coherent state basis in the form ρ = P (α) α α (1.1) α where α is a complex amplitude and α is a coherent state defined as α = e α 2 /2 α 2 n. (1.2) n! In the above equation n is an n photon Fock state. The function P (α) is the distribution function for the emitted field. For many sources, such as lasers and LEDs, this function is non-negative. It thus satisfies the properties of a valid probability distribution. Any source whose P distribution function is a valid probability distribution is referred to as a classical source. The reason for this name is that all photon counting statistics for a classical source do not require quantum mechanical treatment of the radiation field. Such statistics are perfectly modelled by classical field amplitudes, n=0 and quantized atomic levels for the detectors. For non-classical sources, the P distribution function becomes negative. Thus, it no longer can be interpreted as a probability distribution. Non-classical sources require full quantum treatment of the radiation field. They also lead to experimental observable effects which are inconsistent with classical electromagnetic theory. Examples of such effects are photon anti-bunching, negativity of the Wigner function,

21 1.2. QUANTUM CRYPTOGRAPHY 5 and non-local correlations [16]. Non-classical light sources play an important role in quantum information processing. For quantum computational schemes, these types of sources are required. It is precisely the quantum mechanical properties of the field which allows the exponential speedup promised by quantum algorithms [17]. In quantum cryptography, however, classical sources such as attenuated lasers are often used. Using such sources comes at the expense of significantly reduced security properties [18]. This work will mainly be concerned with how non-classical sources can improve the security behavior of a quantum cryptography system. The focus will be on two important examples of non-classical light, the emission from a single Indium Arsenide (InAs) quantum dot, and spontaneous parametric down-conversion. The first source is useful for generating sub-poisson light, which features improved security properties for quantum cryptography protocols over classical light sources. The second source allows generation of photon twins, which in some cases are in an entangled state. Such states are important for other quantum cryptography protocols based on non-local statistics. Chapter 2 will discuss the basics of classical information theory and cryptography. The concepts developed in this chapter will play an important role in the security of quantum cryptography. Chapter 3 will introduce the concept of the quantum bit, and the properties that make it unique and useful. Chapter 4 will deal with the theoretical security issues of quantum cryptography. First, quantum cryptography with sub-poisson light sources will be considered. A quantitative analysis of how much improvement such sources can provide will be derived. Then, an alternate protocol for quantum cryptography based on entangled photons will be analyzed. A proof of security for this protocol will be given, and it will be shown that this protocol has potential for significantly improved security behavior. Having established the advantages of sub-poisson light, Chapter 5 will describe an experimental demonstration of quantum cryptography using such a light source based on InAs quantum dots. Comparison with a standard attenuated laser will show that this source allows communication in a security regime unattainable by a classical light sources.

22 6 CHAPTER 1. INTRODUCTION 1.3 Photon number detection Single photon detection is an important task in virtually all quantum optics experiments. The standard tools for single photon detection are photomultipliers and avalanche photo-diodes. These detectors absorb a photon and emit a macroscopic current which can be discriminated by digital electronics. One of the main limitations of such detectors is that they cannot distinguish photon number. If two photons are absorbed by the detector on very short time scales (relative to the electronic pulse duration), the electronic pulse which is generated will not differ significantly from that of a single photon absorption. This is due both to detector dead time and multiplication noise properties. Recently, a new detector known known as the Visible Light Photon Counter (VLPC) has been shown to have the ability to distinguish photon number with very high quantum efficiency [19, 20]. This makes the VLPC a unique tool for quantum optics experiments. Photon number detection is already known to be important for many types of experiments. One of the main applications is in linear optics quantum computation [7]. Many of the basic building blocks for this scheme rely on the ability to discriminate photon number on very short time scales. Chapter 6 investigates the ability of the VLPC to do photon number detection. Limitations imposed by both quantum efficiency and multiplication noise properties are investigated. Multiplication noise refers to fluctuations in the number of electrons the VLPC emits when detecting a photon. These fluctuations can limit the photon number state resolution. Fortunately, the VLPC features nearly noise free multiplication [21], allowing it to do very accurate photon number discrimination. 1.4 Number State Generation One application of the photon number detection capability of the VLPC is to do photon number state generation. This is done in conjunction with a non-linear optical process known as parametric down conversion [22]. Parametric down-conversion is implemented by pumping a non-linear crystal with a bright ultra-violet pump. Each

23 1.4. NUMBER STATE GENERATION 7 pump photon has a small probability of splitting into two visible wavelength photons. The two-photon nature of parametric down-conversion makes it a non-classical light source. Since photons come two at a time, the photon number distribution features even-odd oscillations. This causes the P distribution function to become negative. The non-classicality of this effect is investigated in Chapter 7. A theoretical threshold for classical light is derived. This inequality is violated by the even-odd oscillations generated in parametric down-conversion. The VLPC allows one to experimentally observe this violation. By correcting for the quantum efficiency of the detector, one can furthermore reconstruct the oscillatory behavior of the photon number distribution. Parametric down conversion can be used to perform photon number generation. Under appropriate conditions, a pump photon can be made to split into two photons travelling in different directions. Detection of one photon signals that a second photon exists in the conjugate mode. This applies as well for any higher photon number. If one can discriminate the number of photons in one arm, then the other arm is prepared in an appropriate photon number state. To do this, one needs a detector capable of doing photon number detection, such as the VLPC. Chapter 8 discusses a demonstration of photon number generation using the VLPC and parametric down conversion. This scheme allows the preparation of a 1,2,3 and 4 photon number state. Such number states may find applications in quantum networking and multi-party quantum cryptography.

24 Chapter 2 Classical Information and Communication 2.1 Introduction The upcoming chapters will often draw upon the basic principles of classical information theory. This field, pioneered by Claude Shannon in the 1940s, is predominantly concerned with the fundamental limitations of communication and compression. Information theory also plays a very important role in cryptography. In fact, much of Shannon s original work was intended for the purposes of analyzing the security of cryptographic protocols [23]. This chapter will present the basics of classical information theory. These concepts will be important in the upcoming chapters which deal with security of quantum cryptography. A full treatment of information theory is well beyond the scope of this work. The reader can refer to [24] for good reference on this vast topic. 2.2 Entropy and Mutual Information One of the main insights that led to Shannon s pioneering work is the relationship between information and entropy. It is this relationship which allows one to treat information quantitatively. Lets consider an arbitrary random variable X, which can 8

25 2.2. ENTROPY AND MUTUAL INFORMATION 9 take on one of n different values, denoted as x 1... x n, with probabilities p(x 1 )... p(x n ) respectively. The entropy associated with this random variable is defined as H(X) = n p(x i ) log 2 p(x i ). (2.1) i=1 Note that the entropy does not depend on the actual value which the random variable takes, only its probabilities. The choice of base for the log is somewhat arbitrary. The base defines the units in which information is to be quantified. When using the natural logarithm, information is quantified in knats. If, instead, one takes the base 2 logarithm the information is measured in bits. In this work, information will always be quantified in units of bits. Hence all logarithms will be taken to base 2. One of the main postulates of information theory is that the entropy, H(X), quantifies the self information of a random variable. That is, H(X) denotes the amount of information one gains by learning what value X took. There are many ways to justify entropy as a measure of the information content of a variable. One of the main arguments is that entropy has many properties which agree with our intuitive notion of how information behaves. For example, suppose that X takes on the value X i with probability 1. By Equation 2.1, this random variable has zero information content. This is compatible with what one intuitively expects. Since X always takes on the same value, no information is learned by actually observing it. In the opposite limit, if X takes on each one of its values with equal probability, the information content is log 2 n. One can prove that this value maximizes the information content. One can also define the entropy conditioned on an event. If Y is a second random variable which can take on the values y 1... y m with probabilities p(y 1 )... p(y m ), the conditional entropy H(X Y = y i ) can be calculated by using the conditional probability distribution p(x i y i ) in Equation 2.1. The average conditional entropy, H(X Y ), is determined by averaging H(X Y = y i ) over all values of Y. That is, H(X Y ) = n,m i=1,j=1 p(x i, y i ) log 2 p(x i y u ). (2.2)

26 10 CHAPTER 2. CLASSICAL INFORMATION AND COMMUNICATION One can also define the joint entropy H(X, Y ) as H(X, Y ) = n,m i=1,j=1 p(x i, y i ) log 2 p(x i, y i ). (2.3) The joint entropy of two random variables satisfy a well known chain rule which can be easily proven from the definitions. This chain rule is given by H(X, Y ) = H(X) + H(Y X). (2.4) The above equation establishes, first and foremost, that one s information can only increase in light of new knowledge. That is, if someone is allowed to observe both X and Y, the information they learn is at list as much as that of observing just X. Furthermore, if X and Y are independent, the amount of information gained by observing the two variables is the sum of the information content of each individual variable. Again, these properties naturally mesh with our intuitive notion of how information should behave. Equation 2.4 is one of the main reasons why entropy is strongly associated with information content. A final important concept is that of mutual information. Mutual information, written as I(X; Y ), denotes the amount of information one gains on random variable X, given that they are allowed to observe Y. Mathematically, one can express this as I(X; Y ) = H(X) H(X Y ) (2.5) That is, mutual information is the change in entropy of random variable X from before one observes Y to after. Note that I(X; X) = H(X), reinforcing our notion that H(X) represents self information. Let s consider a simple example which will play an important role in the upcoming chapters. Using the definitions of information, one of the simplest communication scenarios known as the binary symmetric channel will be analyzed. In the binary symmetric channel the message sender sends N bits, randomly taking on the values [0, 1], over a noisy channel. The N bit message string will be referred to as X. The receiver of the message obtains Y, which is a distorted version of the message due to channel noise. In a binary symmetric channel, noise is characterized by a very simple

27 2.2. ENTROPY AND MUTUAL INFORMATION 11 0 (1-e) 0 e e 1 1 (1-e) Figure 2.1: Schematic of binary symmetric channel. bit flip model shown in Figure 2.1. In this model each bit experiences a bit flip with probability e, referred to as the bit error rate (BER). It will be assumed that each bit in the message is independent of the other bits, and that it can take on the value 0 or 1 with equal probability. Although this is a restrictive assumption, it will turn out to be a valid one for the upcoming analysis of quantum cryptography. It is easy to show that, under the above conditions, the mutual information is given by I(X; Y ) = N [1 + e log 2 e + (1 e) log 2 (1 e)]. (2.6) The constant C = [1 + e log 2 e + (1 e) log 2 (1 e)] (2.7) is often referred to as the channel capacity. It defines the maximum communication rate which one can communicate over the channel without noise. If the communication rate is below this critical rate, it is possible, at least in principle, to have completely noise free communication. Once the rate exceeds this threshold by any amount, noise free communication is not possible. This result, known as the noiseless coding theorem, is one of the cornerstones of information theory. It is easiest to understand the noiseless coding theorem in the context of error correcting codes. Error correcting codes use redundancy to achieve noise free communication over a noisy channel. An N bit message is encoded in a larger R bit string. Define R = N + M, thus M denotes the number of additional bits of information

28 12 CHAPTER 2. CLASSICAL INFORMATION AND COMMUNICATION needed to do error correction. By introducing the proper amount of redundancy into the message, one can make the overall error rate negligibly small, reproducing the noiseless communication scenario. The noiseless coding theorem tells us that, in the limit of large strings, M N e log 2 e (1 e) log 2 (1 e). (2.8) If equality holds, the error correction algorithm is working in the Shannon limit. Note that the noiseless coding theorem is not constructive, it does not explain how to generate error correction codes at the Shannon limit. It only says that such codes are in principle possible. Another way to interpret the noiseless coding theorem is to consider communication rates, instead of the total message. Let s consider a communication system which can send one bit each clock cycle. For a given bit error rate e, the noiseless coding theorem tells states that, at best, one can use a fraction C of the clock cycles to do communication, while the remaining (1 C) cycles are needed for error correction. For practical error correcting codes, it is difficult to approach the Shannon limit. Although there are known codes which achieve this limit, these codes require the receiver to perform computationally intractable tasks [25]. The generation of codes which are both computationally feasible and operate close to the Shannon limit is a challenging field of research. 2.3 Cryptography One of the first applications of information theory was in the field of cryptography. The purpose of cryptography is to transmit a secret message over a channel that may potentially be wiretapped. The goal is to transmit the message to the intended receiver, while simultaneously making it difficult for any potential wiretapper to intercept the communication. In order to discuss security in cryptography, one first has to specify what is meant by security. There are two general approaches to discussing the security of a cryptography system, or cryptosystem for short. These two approaches are computational

29 2.3. CRYPTOGRAPHY 13 security and unconditional security. In computational security one is mainly concerned with the computational difficulty required in breaking the code. One may define a cryptosystem as secure if the best known algorithm for breaking it requires a very large number of operations. Often times, this problem is approached from the perspective of complexity theory. From this point of view a secure cryptosystem requires the wiretapper to perform a computationally intractable task in order to break the system. An intractable algorithm is one which scales exponentially in execution time as the size of the problem is increased. The main drawback of computational security is that it is extremely difficult to prove that a mathematical problem is intractable. One must show that no algorithm exists, even in principle, which can efficiently find a solution. Such proofs are nearly impossible to formulate. Often times one considers only the best currently available algorithms for computational security. If a new algorithm is discovered which can efficiently break the system, all communication over the system, past or present, is rendered insecure. In the second approach, no restrictions is placed on the the time or computational resources of a wiretapper. A cryptosystem is defined as unconditionally secure if there is no way to break it, even with infinite computational resources. Put simply, the information available to the wiretapper from the encrypted message is not enough to reliably reconstruct the original message. It is this type of security which quantum cryptography is concerned with. Figure 2.2 shows the basic model for unconditionally secure cryptography. The sender of the message, referred to as Alice, wants to communicate with the receiver, Bob, over a public channel that can be potentially wiretapped. To ensure the secrecy of the communication, Alice will also generate a secret key K, which she uses to encrypt the message M. This generates the encrypted message R, referred to as the cryptogram, which is sent over the public channel. Alice must also send a copy of the secret key to Bob, so that he can properly decrypt the cryptogram. In classical cryptography this can only be done using a secure channel that cannot be wiretapped. Let us assume that the message M takes on one of a finite set of P messages m 1,..., m P. In order to account for the encryption, it is easier to treat the key not

30 14 CHAPTER 2. CLASSICAL INFORMATION AND COMMUNICATION Alice Message Generator M Encrypter R Public Channel Decrypter Bob Message Receiver K Key Generator K Secure Channel Figure 2.2: Schematic of system for unconditionally secure cryptography. as a string of data, but rather as a transformation T which generates the cryptogram R from the original message. Thus, the key enumerates a set of Q transformations, T 1,..., T Q, such that if the i th key is selected, Alice generates the cryptogram R = T i M. Perfect secrecy is defined to be the case when P (M R) = P (M) (2.9) That is, observing R does not in any way change the probability that M might take on any one of its values. Using Bayes rule, P (M R) = directly leads to the following theorem. P (R M)P (M) P (R) (2.10) Theorem 1 A necessary and sufficient condition for perfect secrecy is that P (R M) = P (R) (2.11) for all M and E. One way to interpret the above theorem is that the total probability of all keys which transform m i into a given encrypted message R must equal the total probability of all keys which transform m j into that same message, for any i and j.

31 2.3. CRYPTOGRAPHY 15 First, note that the number of possible cryptograms must be at least equal to H(M). This is because the cryptogram must be able to encode all of the information content of M. To do this, it must at the very least have as many possible states as the information it is encoding. One then note that to have perfect secrecy, there must be at least one key transforming any M to any value of R. This comes immediately from the previous theorem. These two results combine to form one of the most important results in Shannon s work. In order to have perfect secrecy the length of the key must be at least as big as H(M), the information content of the message [23]. One algorithm which achieves this limit is known as the Vernam cipher. Consider the case where the message H(M) = P, the total number of bits in M. This means that the message is maximally compressed. A random key K is generated which is of the same length as the message. Define M i, K i, and R i is the i th bit of the message, key, and cryptogram respectively. In the Vernam cipher these are related by R i = M i + K i (Mod 2) (2.12) In other words, one takes the sum modulo 2, or alternately the bitwise exclusive or of each bit of the key with each bit of the message to form the cryptogram. It is easy to prove that the Vernam cipher satisfies the definition of perfect secrecy if the key is picked randomly [23]. Although the Vernam cipher provides unconditional security in the most efficient way, it has not attained widespread use to date. This is due mainly to one critical drawback, the key distribution problem. The previous discussion assumed that Alice and Bob had a way of exchanging the key securely, for example by trusted courier. However, the final conclusion showed that, for perfect secrecy, the key must be at least as long as the actual message. Once the key is used it cannot be recycled, it must instead be discarded. Recycling will eventually allow Eve to determine the key through the techniques of code breaking. If the key is learned all the transmissions are rendered insecure. For this reason the Vernam cipher is sometimes referred to as one time pad encryption. In the past, the overhead of using trusted courier to exchange a new key for each transmission proved impractical. For this reason most cryptosystems settled for computational security instead of unconditional security.

32 16 CHAPTER 2. CLASSICAL INFORMATION AND COMMUNICATION Recently, however, the advent of quantum cryptography has given a solution to the key distribution problem. Quantum cryptography allows the exchange of secret keys without the use of a trusted courier. Security is instead guaranteed by the laws of quantum mechanics. Furthermore, quantum cryptography can be performed using the tools and techniques of the optical telecommunication industry, giving it the potential to generate keys at high data rates. This development opens up the door for the use of unconditionally secure communication in practical applications.

33 Chapter 3 Encoding quantum information 3.1 Introduction The previous chapter showed that there exist encryption techniques which allow unconditional security. This is achieved using a one time pad key to encrypt the message. After encryption, the cryptogram conveys no information about the message unless the key is known. This leads to the problem of how Alice and Bob can actually exchange a secret key without interception. Using only classical information theory it is impossible to prove that any secret key exchanged by the two communicating parties is secure. Classical information can be copied many times over, at least in principle. So if only a classical communication channel is used, the security of the key must be assumed. The same is not true when one starts to consider quantum communication. In quantum communication, information is encoded in quantum bits, which are the quantum mechanical analog of the classical bit. Quantum bits, or qubits for short, are two state systems like their classical counterparts. The two states, representing binary 0 and 1, allow us to encode information in the same way as classical bits. In fact, exchanging quantum bits allows us to reproduce any classical communication protocol. But qubits have the additional functionality that they can be put in a superposition state, and can exhibit quantum mechanical coherence properties. Because of this, quantum information is a superset of classical information theory. All 17

34 18 CHAPTER 3. ENCODING QUANTUM INFORMATION classical information protocols can be implemented with qubits, but there are quantum information protocols which cannot be implemented using classical bits. One example is quantum cryptography, a method of sharing unconditionally secure secret keys. 3.2 The qubit Before beginning a basic discussion of quantum cryptography, it will be useful to discuss the qubit in more detail. A qubit is a two dimensional quantum system. The two states of the system are denoted as 0 and 1. These two orthogonal states form a complete basis for the Hilbert space of the qubit. This basis is referred to as the computational basis. All states of the qubit can be expressed in the computational basis as ψ qubit = cos θ 0 + e iφ sin θ 1 (3.1) The angles θ and φ are two independent degrees of freedom. These angles define a point on the unit sphere in three dimensional space. Thus one can visualize the state of the qubit as a vector pointing from the origin to the unit sphere, as shown in Figure 3.1. This sphere, which we often refer to as the Bloch sphere, is a helpful tool in understanding the behavior of a qubit. In order to have a useful qubit, one must be able to perform three fundamental operations on it. The first is initialization. Initialization means that the qubit is prepared in a well known state, for example 0, with very high probability. This allows the qubit to be treated as a pure state. There are generally two ways to initialize a qubit. The first way is by cooling. In many instances, the computational basis commutes with the Hamiltonian of the system. This means that 0 and 1 are energy eigenstates. Typically 0 would be represented by the energy ground state of the system, and 1 would be the first excited state. If this is true one can perform initialization by cooling the system down to its ground state. This can work when the two states are separated by large energies. If the energy separation is too small, unreasonably low temperatures will be required to do proper initialization. In cases were the energy separations are very small, or the computational basis represents

35 3.2. THE QUBIT ( 0 + 1) ( 0-1) Figure 3.1: The Bloch sphere. energy degenerate states, cooling is not an option. Initialization in this case can be done by measurement and post-selection. That is, one measures the state of each qubit, and if it is found not to be in the state 0 it is discarded. Some techniques use a combination of cooling and post-selection to achieve initialization [26]. The second required operation is the ability to perform controlled unitary evolution. One must be able to transform the qubit from its initial state to any other state on the Bloch sphere. This transformation must conserve probability, thus it must be described by a unitary operators. All unitary operators can be visualized as rotations, or combinations of rotations on the Bloch sphere. It is convenient in the discussion of unitary evolution to revert to matrix notation for the state of the qubit.

36 20 CHAPTER 3. ENCODING QUANTUM INFORMATION One can associate a matrix notation with the computational basis as follows [ ] [ ] = ; 1 =. (3.2) 0 1 A convenient tool in the discussion of unitary evolution are the three Pauli matrices σ x, σ y, and σ z. These matrices are defined as [ ] [ ] [ ] i 1 0 σ x = ; σ y = ; σ x =. (3.3) 1 0 i Any unitary operation can be expressed by these matrices [27]. Let s define r as a unit vector on the Bloch sphere. Define the operator R as R = e iθσ r/2, (3.4) where σ r = r x σ x + r y σ y + r z σ z. (3.5) R generates a rotation on the Bloch sphere of angle θ around an axis defined by r. One needs to be able to implement any rotation defined by Eq. 3.4 in order to have full control of the qubit. It turns out that any rotation operator can be decomposed as R = e iασz/2 e iβσy/2 e iγσz/2 (3.6) if value for the angles α, β, and γ are chosen correctly [27]. Thus, arbitrary rotations along the y-axis and z-axis of the Bloch sphere can be combined to generate any unitary operation. This dramatically reduced the amount of resources needed to manipulate a qubit. The final operation that is required on a qubit is the ability to measure it. That is, one must be able to observe the qubit and determine its current state. The difference between a qubit and a classical bit become strongly pronounced during measurement. When a classical bit is observed the result is an unambiguous answer. Either the bit was 0, or it was 1. In contrast, a quantum bit will not give an unambiguous answer unless the basis in which it was prepared is known. The behavior of a measurement system on a quantum state is characterized by several postulates [27]. These postulates are fundamental to the theory of quantum mechanics, and are defined below.

37 3.2. THE QUBIT 21 Postulate 1 The wavefunction of a quantum particle is represented by a vector in a normalized hilbert space which is spanned by an orthonormal basis 0, 1,..., n 1, where n is the dimensionality of the hilbert space. Every measurement is represented by a projection onto a complete orthonormal basis which spans the hilbert space. Define this basis as P 0, P 1,..., P n 1. The probability of measuring the qubit in the state P i is simply given by P i ψ 2, where ψ is the wavefuntion of the qubit. The above postulate states that if the qubit is prepared in one of the states P i, the measurement result will identify this state with 100% probability. If, however, the qubit is prepared in a superposition state of the measurement basis, the measurement result will be ambiguous. A qubit repeatedly prepared in the same state and measured in the same basis will yield a different measurement result from shot to shot. A second important postulate of quantum mechanics is known as the projection postulate. Postulate 2 Projection postulate: Define the wavefunction of a quantum system before a measurement as ψ. Define the measurement basis as P 0,... P n 1. Given that the system was measured in the state P i, the wavefunction of the system after the meaurement is also P i. From the projection postulate one ascertains that unless a quantum system is prepared in one of the eigenstates P i, the measurement process will destroy the wavefunction of the system. The above two postulates combine to form one of the most important aspects of quantum measurement. The wavefunction of a single quantum system cannot be determined unless the preparation basis is known [28]. If the system is measured in the wrong basis, the first postulate states that one will obtain an ambiguous answer. Furthermore, due to the projection postulate one cannot go back and re-measure the state because it has already been destroyed. The qubit is a two dimensional quantum system, meaning that its Hilbert space is spanned by two basis states. The computational basis, formed by 0 and 1, is one basis set. Any other basis can be expressed by linear combinations of the

38 22 CHAPTER 3. ENCODING QUANTUM INFORMATION computational basis as 0 θ,φ = cos θ 0 + e iφ sin θθ 1 (3.7) 1 θ,φ = sin θ 0 e iφ cos θ 1 (3.8) In quantum communication, one has the freedom of choosing any one of these bases to encode information. However, error free communication can only occur if the sender and receiver use the same basis to encode and measure the qubit. 3.3 Positive Operator Value Measures (POVMs) The previous section discussed measurement under the framework of projections in an orthonormal Hilbert space. It turns out that there is a more general formalism for quantum measurement, which will prove useful in subsequent discussion. This is known as the Positive Operator Valued Measure (POVM) formalism [29]. A POVM measurement on an N dimensional Hilbert space has n possible measurement outcomes. Each outcome is associated with an operator on the Hilbert space of the measured quantum system. Define the operators for the different outcomes as M 1,..., M n. If a system is in a state ψ, then the probability of the i th outcome is P i = ψ M i ψ (3.9) The operators must satisfy two properties. First, they must be positive semi-definite, which means ψ M i ψ 0 (3.10) for any ψ. This property ensures that all the calculated probabilities are nonnegative. A necessary and sufficient condition for positive semi-definiteness is that the operator eigenvalues are all non-negative. The second property of the operators is that they must satisfy the completeness relationship n M i = I. (3.11) This constraint ensures that all of the probabilities will add up to one. k=1

39 3.3. POSITIVE OPERATOR VALUE MEASURES (POVMS) 23 Having defined a POVM, it remains to be shown how such a measurement can be physically implemented. Suppose the measured subsystem occupies the Hilbert space H a. A POVM is implemented by augmenting the quantum system with a second Hilbert space H b, and making projective measurements on the total space H = H a H b. That is, all POVMs are implemented by embedding our quantum system in a larger Hilbert space and making measurements on the total system. This result is known as Neumark s theorem [29]. Thus, POVMs do not represent any new physic above the projective measurements presented in the previous section. One can always talk only about projective measurements on a properly defined Hilbert space. However, the POVM formalism is a useful mathematical tool, which allows us to generalize the measurement concept to cases were the external environment has an effect on the system. The POVM formalism can be extended to describe generalized delayed measurements [30]. Such measurements are performed by using a probe state, contained in a Hilbert space H p, to measure the system in the space H s. Figure 3.3 shows a schematic of how such measurements are made. Assume that the probe and system are initially unentangled, such that the initial density matrix is ρ s ρ p. An interaction Hamiltonian is then turned on between the two systems for a fixed amount of time. This interaction will cause a unitary evolution of the collective system, defined by the unitary operator U. After the interaction, the two systems are in an entangled state. Measuring the probe will then yield information about the state of the system. To put this type of measurement into a more general mathematical framework, lets first write the final density matrix, which is given by ρ f = U ρ s ρ p U (3.12) Suppose one is interested in the final state of the system after the measurement. This can be calculated by tracing out the probe Hilbert space in an orthonormal basis k. The probe density matrix is expressed as ρ p = j ρ jj j j (3.13)

40 24 CHAPTER 3. ENCODING QUANTUM INFORMATION Qubit initial qubit probe Probe Interaction final U qubit probe entangled Figure 3.2: Model for generalized, delayed quantum measurements. Thus, ρ f s = k,j ρ jj k U j ρ s j U k. (3.14) The complex operator A k can be defined as A k = j ρjj j U k, (3.15) and the final density matrix of the system becomes ρ f s = k A k ρ sa k (3.16) The set of operators A k are referred to as a complete positive map (CP map). They express the backaction noise on a quantum system from a general measurement. They also provide a convenient way to express the result of the measurement on the system. One can verify that the probability of measuring the probe in its k th state is given by } P k = Tr {A k ρ sa k. (3.17) Because a trace is invariant under circular permutation, one can define the operator M K = A k A k. Thus, P k = Tr {ρ s M k }. (3.18) It is easy to verify that the operators M k satisfy positive semi-definiteness and completeness. They thus form a valid POVM. In fact, any POVM can be generated by

41 3.4. THE PHOTONIC QUBIT 25 a generalized measurement. The advantage of using A k instead of M k is that this formalism not only provides the correct probabilities for the measurement results, but also characterize the backaction noise of the measurement on the quantum system, given by Eq Once again, it is important to emphasize that generalized measurements do not represent new physics above the standard quantum formalism. One could discuss everything from the perspective of unitary evolution and projective measurements instead of CP maps. The CP map formalism will serve as a convenient mathematical tool, which allows the treatment of the most general quantum measurements in a compact notation. 3.4 The photonic qubit The previous section focussed on the qubit as a mathematical structure with unique properties. This section will discuss the practical implementation of qubits in physical systems. As mentioned previously, a practical qubit requires a convenient way to perform initialization, unitary evolution, and measurement. In some applications, another important property is required, the means to exchange qubits over long distances. This is especially important in quantum communication and networking. In applications that require long distance exchange of qubits the photon is the only practical information carrier. Photons are extremely robust to environmental noise, and can be transmitted over long distances using free space or optical fibers. There are many techniques for implementing a qubit using photons. This section will discuss some of the ways and compare their merits and disadvantages. Figure 3.3 illustrates one common way for implementing a qubit using a single photon. This is known as the dual rail method, in which the photon is split into two different spatially separated modes. Suppose the initial state, denoted ψ 0, is a single photon in mode a. Thus, ψ 0 = â v, (3.19) where the state v is the vaccuum state containing zero photons. After the first

42 26 CHAPTER 3. ENCODING QUANTUM INFORMATION a) a b c d e BSP2 t = cos r = sin BSP1 t = cos r = sin b) /2 plate /4 plate /2 plate /4 plate Figure 3.3: Implementation of a dual rail quantum bit. a, spatial mode implementation. b, polarization mode implementation.

43 3.4. THE PHOTONIC QUBIT 27 beamsplitter and phase delay, the state becomes ψ qubit = cos αˆb + e iθ sin αĉ v (3.20) Thus, one can encode binary 0 and 1 in the following way 0 = ˆb v 1 = ĉ v Any qubit state can be prepared by properly selecting the splitting ratio and phase shift. To measure the qubit one inserts a second phase shifter and beamsplitter. It is easy to verify that, up to an irrelevant global phase shift, ˆd = cos βˆb + e iφ sin βĉ ê = sin βˆb e iφ cos βĉ Measuring a photon in modes ˆd and ê corresponds to a projective measurement on the qubit system. Adjustment of the splitting ratio and phase shift of the measurement apparatus allows the measurment of the qubit in any desired basis. The measurement result is indicated by a counting event on the photon counters at each port of the beamsplitter. The above implementation is simply a Mach-Zehnder interferometer. A binary 0 is encoded by a photon in the upper arm, while 1 is a photon in the lower arm. Although this implementation is conceptually simple, and is often how one visualizes a photonic qubit, it is impractical for long distance qubit transmission. Long Mach-Zhender interferometers suffer from many practical difficulties including phase stability and high sensitivity to polarization distortion. For this reason these types of quantum channels are rarely implemented. An alternative way for implementing a dual rail qubit is to use polarization, as shown in Figure 3.3b. This is fundamentally equivalent to the first method where the two spatial modes are replaced by the two polarization states of a single spatial mode. Thus, binary information can be encoded as 0 = H 1 = V

44 28 CHAPTER 3. ENCODING QUANTUM INFORMATION Any unitary rotation can be generated on the Bloch sphere by using a half waveplate and a quarter waveplate, whose optic axes are properly rotated relative to the horizontal reference. Polarization encoding has the advantage of ease of use. It is the method of choice for most free-space implementations [1,2]. However, it has only limited utility in fiber based systems. This is because fibers induce a random polarization transformation on the guided light. This transformation is unitary in principle and can be corrected for with additional waveplates at the output, but such correction schemes usually suffer from long term drift which limits their stability. For long distance fiber applications, neither the spatial dual rail nor polarization qubit give a practical solution. For such systems there is an alternate implementation originally proposed by Brendel et. al. [31]. This method utilizes time bin encoding. Figure 3.4 shows how this is done. A single photon, initially in mode a is sent into an unbalanced interferometer. Assume that mode a defines a transform limited wavepacket in both space and time. The unbalanced interferometer has a long arm and a short arm. The long arm introduces a delay, relative to the short arm, which is greater than the coherence length of the input photon. The output of the unbalanced interferometer is thus two pulses separated in time. Assume that this time separation is sufficiently long so that the two time slots can be treated as orthogonal modes. Define ˆd 1 and ˆd 2 as the modes corresponding to time slots t 1 and t 2 respectively. It is straightforward to show that, given that a photon was not lost to mode ˆl, the state after the unbalanced interferometer is given by ψ qubit = ˆd 1 cos α + ˆd 2e iθ sin α v. (3.21) The angle α is determined by the splitting ratio of the first beamsplitter. The qubit can be measured by a second unbalanced interferometer. The two time slots will interfere with each other at time t 2 on the second beamsplitter. Given that a photon was detected at this time slot, ĝ = ˆd 1 cos β + ˆd 2e iφ sin β ĥ = ˆd 1 sin β ˆd 2e iφ cos β Thus, detection of a photon by one of the counters results in a projective measurement on the qubit state.

45 3.5. ENTAGLEMENT 29 a b c d BSP1 t = cos r = sin l BSP e f BSP2 t = cos r = sin g h BSP t 1 t 2 t 1 t 2 t 3 Figure 3.4: Time slot based qubit for optical fiber applications. The advantage of time bin encoding is that the two time slots are usually separated by a very short time, typically on the order of several nanoseconds. Because phase and polarization drifts occur on slow time scales, each pulse undergoes exactly the same distortion in the fiber. Since the information is encoded by the relative phase of these two time slots, this information is undisturbed. The main difficulty in implementing such a system is that it requires two unbalanced interferometers whose relative phase shift is stabilized. A second disadvantage is that the scheme is partially inefficient. Some qubits are lost initially to loss mode ˆl, and in the general case more qubits are also lost during measurement since they are measured at t 1 and t 3, not t 2. This loss could be eliminated in principle by using a fast optical switch. 3.5 Entaglement So far, the emphasis has been on the preparation and transmission of single qubits over a quantum channel. This section will consider the properties of systems composed of more than one qubit. The discussion begins by considering a two qubit system. This seemingly modest extension will bring out some of the most fascinating aspects

46 30 CHAPTER 3. ENCODING QUANTUM INFORMATION of quantum mechanics. The Hilbert space of a two qubit system is described by the product space of each individual qubit. This product space is spanned by four basis vectors: 0 0, 0 1, 1 0, and 1 1. These states represent the computational basis of a two qubit hilbert space. The two qubit system can take on any complex superposition of these basis states. Consider the situation where the system takes on the following state ψ entangled = 1 2 ( ). (3.22) The above state cannot be factorized into a product state of the two qubits. Any quantum state which satisfies this property is referred to as an entangled state. Entangled states have the fascinating property that, even if the individual qubits are separated by great distances, one cannot describe their behaviors independently. The two qubits must still be treated as single quantum system. This leads to measurable effects which run highly counterintuitive to our notion of how a physical system should behave [32]. On first inspection one might not see anything counterintuitive about Eq It simply says that both qubits will take on the value 0 with 50% probability, otherwise they both take on the value 1. An analogy can be made to a system of buckets and balls. Suppose there are two buckets, each of which can either contain a red ball or a blue ball. A fair coin is then flipped. If the coin lands heads, a blue ball is placed in each bucket, otherwise a red ball is placed in the buckets instead. If the buckets are separated by great distances, there is still a correlation between them. If one looks inside one of the buckets and sees a blue ball, they instantaneously learn with certainty that the other bucket also contained a blue ball. Nevertheless, the state in Eq has strikingly different properties than the bucket and balls experiment just discussed. These properties only become apparent when the system is measured in a basis other than the computational basis. Define the following notation: 0 θ = cos θ 0 + sin θ 1 (3.23a) 1 θ = sin θ 0 cos θ 1. (3.23b)

47 3.5. ENTAGLEMENT 31 This change of basis is performed by a rotation of 2θ across the horizontal equator of the Bloch sphere. It is easy to verify that ψ entangled = 1 2 ( 0 θ 0 θ + 1 θ 1 θ ). (3.24) The expression in Eq is, in fact, partially misleading because it implies that the computational basis is the preferred basis for the state. From Eq it becomes clear that this is not true. regardless of which value of θ is chosen. There is a perfect correlation between the two qubits Suppose that two qubits are prepared in an entangled state. One of the qubits is given to Alice in California, while the other qubit is given to Bob in North Carolina. Alice will then pick an angle θ, and measure her qubit in the basis defined by Eq Eq indicates that if Alice s qubit is measured in the state 0 θ, Bob s wavefunction instantaneously becomes 0 θ as well. This seemingly counterintuitive action at a distance lies at the heart of entanglement. If two systems are entangled, then measuring one system will have an instantaneous effect on the wavefunction of the other system. One may speculate that the above discussion allows superluminal communication. Take the following protocol as an example. Alice will encode a binary 0 by measuring her photon in the computational basis. Doing this will prepare Bob s qubit in one of the states 0 0 or 1 0, using the notation from Eq Of course, Alice cannot control which one of these states is generated. In order to encode binary 1, Alice will measure her photon in the basis defined by θ = π/2. Thus, Bob s qubit is prepared in the 0 π/2, 1 π/2, again with equal probability. To decode Alice s transmission, Bob simply needs to determine if his qubit is in the state 0 0 or 1 0 for binary 0, and 0 π/2 or 1 π/2 for binary 1. Unfortunately, the measurement Bob must perform is physically impossible. As discussed in the previous sections, any measurement Bob performs is described by a projection onto an orthonormal basis. The state of Bob s qubit is described by a density matrix ρ b which can be calculated as ρ b = Tr a { ψ entangled ψ entangled } Tr { ψ entangled ψ entangled } = I, (3.25)

48 32 CHAPTER 3. ENCODING QUANTUM INFORMATION where the operator Tr a is a trace over Alice s qubit. Thus, Bob s qubit state is an incoherent mixture of 0 and 1. Regardless of which basis he chooses to measure, the measurement is completely unaffected by the basis which Alice measures her qubit in. This means that no communication is possible. Bob s inability to decode Alice s message stems from a very fundamental principle, the wavefunction of a single quantum system cannot be measured unless the preparation basis is known. Although Alice can instantaneously modify the wavefunction of Bob s qubit, a wavefunction is not a physical quantity. Thus, non-locality cannot be used to directly do superluminal communication. However, non-local states can lead to measurement results which deviate from the natural concept of local realism. These effects become apparent when the correlations between Alice and Bob s measurement is considered. Assume that Alice measures her qubit in the θ basis, while Bob measures his qubit in the φ basis. There are four possible measurement results: 00, 11, 01, and 10. These results occur with probabilities P (0, 0) = 1 2 cos2 (θ φ) P (1, 1) = 1 2 cos2 (θ φ) P (1, 0) = 1 2 sin2 (θ φ) P (0, 1) = 1 2 sin2 (θ φ). If θ = φ, Alice and Bob s measurement results have perfect correlation, they will both either measure 0 or 1. If instead, α φ = π/4, there is no correlation between the measurement results. All measurement combinations are equally likely. This behavior is inconsistent with the concept of local reality. The probabilities described in Eq cannot be reproduced by statistical mixtures of qubits whose states are well defined. Theories that restrict the individual qubit states to be well defined are known as local hidden variable theories (LHVTs). All measurement statistics produced by such theories must satisfy a relationship known as Bell s Inequality [33]. The measurement statistics in Eq predicts that this inequality can be violated. Thus, Bell s inequality gives us a measurable test of the validity of local hidden

49 3.6. TELEPORTATION AND ENTANGLEMENT SWAPPING 33 variable theories. The fact that Bell s inequality can be violated has been conclusively demonstrated under many different experimental conditions using numerous types of qubits [34 36]. The utility of entangled states extends beyond fundamental tests of basic physical principles such as Bell s inequality. They are also an extremely useful tool in quantum communication. They play an important role in quantum cryptography, quantum computation, and quantum networking. Of central importance are the four states ψ + = 1 2 ( ) ψ = 1 2 ( ) φ + = 1 2 ( ) φ = 1 2 ( ). (3.27a) (3.27b) (3.27c) (3.27d) In the above equations we use the less cumbersome notation ab to represent the state a b. The states in Eq are often referred to as Bell states, because these states lead to a maximal violation of Bell s inequality. The Bell states form a complete, orthonormal basis of the two qubit Hilbert space, which we refer to as the Bell basis. 3.6 Teleportation and entanglement swapping The concept of entanglement and the Bell basis was introduced in the previous section. One of the most important applications of entangled states is quantum teleportation [37]. Teleportation allows the transmission of an unknown quantum state from one party to another. In some sense, teleportation offers an alternative form of quantum channel. Instead of directly preparing a qubit and transmitting it over optical fibers, one can teleport the state of the qubit. Assume that Alice and Bob have shared a pair of entangled qubits. For definiteness, assume that the qubits are the state ψ defined in Eq Bob s qubit will be referred to as qubit 1, and Alice s as qubit 2. Suppose Alice wants to teleport a

50 34 CHAPTER 3. ENCODING QUANTUM INFORMATION third qubit to bob in the state ψ 3 = α 0 + β 1 (3.28) The three qubit wavefunction can be written as ψ 123 = ψ 12 ψ 3 (3.29) By expanding qubits 2 and 3 in the Bell basis, one can rewrite this wavefunction in the alternate form ψ 123 = 1 2 [( α 0 1 β 1 1 ) ψ 23 (3.30) + ( α β 1 1 ) ψ (β α 1 1 ) φ 23 + (β 0 1 α 1 1 ) φ + 23 ] If Alice performs a Bell measurement on qubits 2 and 3, the measurement result leaves qubit 1 in one of four possible states. Alice can then tell Bob over a public channel which of the Bell states she measured. Depending on the result, Bob will either do nothing, change 1 to 1, flip 0 with 1, or do both. After this, the state of qubit 3 is teleported onto qubit 1. Several experimental demonstrations of this effect have been reported [38, 39]. One extension of the teleportation protocol is called an entanglement swap. In a swap, Alice and Bob have exchanged a pair of entangled qubits, which again are referred to as 1 and 2. Alice also has in her possession a second pair of entangled qubits 3 and 4. Assume that qubits 1 and 2 are in the state ψ, and so are qubits 3 and 4. The product state ψ 12 ψ 34 can be written as ψ 1234 = 1 2 [ ψ + 14 ψ + 23 ψ 14 ψ 23 φ + 14 φ φ + 14 φ + 23 ] (3.31) A Bell measurement on qubits 2 and 3 leave qubits 1 and 4 in an entangled state, even though qubits 1 and 4 never interacted. Swapping is an important operation in quantum repeaters [40], which allow high fidelity exchange of entangled states over arbitrarily long distances. Experimental demonstration of this effect have also been reported [41].

51 Chapter 4 Theory of Quantum Cryptography The previous chapter discussed the quantum bit and its unique properties. There are two striking differences between a qubit and classical bits. The first is that a qubit cannot be measured without knowledge of the basis it was prepared in. The second is that qubits can be in entangled states, which feature non-local correlations that cannot be emulated by classical bits. One important application of these unique properties is quantum cryptography. Quantum cryptography is the process of exchanging unconditionally secure keys using the laws of quantum mechanics. An alternate name for this is quantum key distribution (QKD). The latter name emphasizes the fact that one is not exchanging a real message, only a secret key. If the security of this key can be guaranteed, it can then be use as a one time pad for unconditionally secure cryptography protocols such as the Vernam cipher. There have been many proposed schemes for doing QKD. Most protocols fall into one of two categories, single qubit protocols, and entangled qubit protocols. Single qubit protocols make use of the measurement uncertainty properties discussed in Section 3.2 to ensure secrecy. Some examples of single qubit protocols are BB84, B92, Koashi01, and the six-state protocol [9 12]. Entangled qubit protocols instead use non-local correlations to achieve security. They rely on the fact that if any local variable exists which can predict the state of an entangled qubit pair, then non-local correlations are washed out. Two important examples of entangled photon protocols 35

52 36 CHAPTER 4. THEORY OF QUANTUM CRYPTOGRAPHY are Ekert91 and BBM92 [14, 15]. This work will focus exclusively on two protocols, BB84 and BBM The BB84 protocol Lets suppose that Alice wants to exchange a secret key with Bob. In the BB84 protocol Alice generates a stream of single qubits to encode information. This information can be encoded in one of two bases. The first basis is the computational basis. That is, Alice will use the states 0 and 1 to encode binary 0 and 1 respectively. The second is the α = π/4 basis, which is referred to as the diagonal basis. The eigenstates of this basis are denoted as 0 and 1, and from Eq 3.23 we have 0 = 1 2 ( ) 1 = 1 2 ( 0 1 ). Alice randomly chooses one of the two bases with equal probability for each photon, and then randomly encodes a binary 0 or 1 with equal probability. Thus, Alice can transmit the four possible states 0, 1, 0, and 1 each with probability of Bob receives each qubit and measures it to learn the value of the bit. Because he does not know the preparation basis, Bob must guess whether to measure in the computational or the diagonal basis. It is important that Bob randomly select one of these two with equal probability for each individual qubit. This way a potential eavesdropper cannot know the basis Bob is using and tailor their attack accordingly. Bob s measurement can be described by a Positive Operator Valued Measure (POVM), which corresponds to the following four projectors E 0 = (4.1a) E 1 = (4.1b) E 0 = E 1 = (4.1c) (4.1d)

53 4.1. THE BB84 PROTOCOL 37 When Bob measures in the correct basis he learns the value of the bit with 100% probability, giving him complete information. When he measures in the wrong basis his result is completely uncorrelated with Alice s transmission, giving him no information. Later, after all the qubits have been transmitted Alice and Bob can reveal the basis in which the qubits were encoded and measured, but not the measurement results. They agree to discard all bits which were measured in the wrong basis. The remaining bits form a key to be used for one time pad encryption. The security of the BB84 protocol relies on the fact that an eavesdropper, referred to as Eve, doesn t know which basis the qubit was encoded in. She learns this information only after the qubit has been received by Bob, and at that point its too late to modify her measurement. Let us first consider the simplest possible attack Eve may perform, known as the intercept and re-send attack. The eavesdropper simply intercepts each qubit from the quantum channel, measures its state, and then relays a second qubit to Bob prepared in the same state that was measured. But Eve does not know the measurement basis used to prepare the qubit, so she must guess. She can, for instance, simply use the same POVM that Bob uses to measure the photon, randomly deciding between the computational basis and the mixed basis. Half of the time she will guess wrong, and relay the wrong wavefunction to Bob which causes a 50% error rate. Hence this type of intercept re-send attack will create an overall error rate of 25% in the transmission. This increase in errors can be used to detect the presence of the eavesdropper. Alice and Bob can simply sacrifice a small fraction of their key over the public channel to estimate the error rate. If errors are detected they discard the key. Of course, Eve is not restricted to making measurements only in the computational basis. She could choose any projective basis of the form Eq It is not difficult to prove that any basis she chooses will result in an overall error rate of 25%. Thus, any intercept and re-send strategy will result in Eve being detected. Nevertheless, intercept and re-send in not the most general attack strategy. In the most general case, an eavesdropper can perform a generalized delayed measurement of the form discussed in section 3.3. But no such measurement can yield information about the quantum state of the system without imposing an unavoidable backaction. So there

54 38 CHAPTER 4. THEORY OF QUANTUM CRYPTOGRAPHY should be no way for Eve to learn any information about the transmitted key without causing some amount of error. The above conjecture is not difficult to prove. Assume that Eve performs a generalized delayed measurement, in which she entangles the Hilbert space of her probe with the qubit. Lets define Eve s initial probe state as E i. All unitary operators she implements can be characterized by the following evolution U 0 E i = 0 E E 01 U 1 E i = 0 E E 11. (4.2a) (4.2b) The states E 00, E 01, E 10, and E 11 are not normalized, nor is it assumed that they are orthogonal. Furthermore, the dimensionality or structure of their Hilbert space is also unknown. In order for the error rate to be zero, however, we require E 10 = E 01 = 0. Suppose instead that Alice sends the state 0. Then U 0 E i = 1 2 ( 0 E E 11 ). (4.3) The above comes from expanding 0 in the computational basis, along with the linearity property of quantum mechanics. This state can be rewritten in the diagonal basis as U 0 E i = 1 2 [ 0 ( E 00 > + E 11 ) + 1 ( E 00 > E 11 ) ]. (4.4) 2 In order for there to be no errors, one must have E 00 = E 11. But if this is true, then the final state of the probe, as well as all of Eve s measurements on that probe, are completely independent of which state was sent. Therefore Eve learns no information about the transmission. 4.2 Practical aspects of BB84 In the previous section it was established that an eavesdropper cannot obtain information about the key in the BB84 protocol without also introducing errors into the transmission. Unfortunately, the situation becomes more complicated when dealing

55 4.2. PRACTICAL ASPECTS OF BB84 39 with practical systems. In any communication system errors will naturally occur due to imperfections in the individual components. Errors coming from the system cannot be distinguished from errors due to eavesdropping. In quantum cryptography, one must make the worst case assumption that all errors were potentially caused by eavesdropping. Thus, for practical systems, the statement that any eavesdropping will unavoidably cause errors is not a sufficient security proof. There is always a baseline error rate, so it must be conceded that some information has been leaked about the quantum transmission. One needs to be able to put a bound on the amount of information leakage given the error rate. Practical quantum cryptography systems handle errors by augmenting the raw quantum transmission, described in the previous section, with two additional steps, error correction and privacy amplification. Both of these steps can be done using public discussion, they do not require additional exchange of qubits. In error correction Alice reveals some additional information to Bob about her key that will allow him to find and correct all of the error bits. Because this information is sent over a public channel, error correction unavoidably leaks additional information to an eavesdropper. In order to account for the information leaked in the raw quantum transmission and during error correction, a final step called privacy amplification is performed. In privacy amplification the error corrected key is compressed into a shorter final key that is almost completely secure. The amount of compression required depends on how much information may have been leaked in the previous phases of the transmission. In order for a proof of security to be useful, it must bound the amount of information leaked during the raw quantum transmission and error correction, and relate it to how much compression must be done in privacy amplification. The formulation of a complete security proof of this type is a complex subject with several open questions still remaining. Only recently has a proof of security been presented that considers the most general attacks allowed by the laws of quantum mechanics [42]. The earliest work on this subject considered only intercept and re-send attacks [43,44]. Later work tackled the problem of generalized delayed measurements. In this context, there are three categories of generalized attacks that have been considered; individual attacks, collective attacks, and joint attacks. Figure 4.1 illustrates the three categories. In

56 40 CHAPTER 4. THEORY OF QUANTUM CRYPTOGRAPHY a) Individual attacks Alice Qubit Bob probe probe probe probe probe b) Collective Attacks Alice Qubit Bob probe probe probe probe probe Quantum Computer c) Joint Attacks Alice Qubit Bob Probe Figure 4.1: Different types of eavesdropping attacks considered in security proofs.

57 4.2. PRACTICAL ASPECTS OF BB84 41 an individual attack the eavesdropper is restricted to measuring each quantum transmission independently, but is allowed to use any measurement which is not forbidden by quantum mechanics. Security against these types of attacks has been proven in [45 47], and these proofs were extended to practical photon sources in [48]. Collective attacks allow Eve to interact each qubit with an independent quantum probe. Later, she can use a quantum computer to make collective measurements on her probe system. This allows her to take advantage of correlations introduced during error correction and privacy amplification by exchange of block parities. Such correlations can potentially refine an eavesdropper s quantum measurement. Security against collective attacks has been shown in [49]. The most general type of attack is known as a joint attack where the eavesdropper treats the entire quantum transmission as one system which she entangles with a probe of very large dimensionality. There are currently several proofs of security against this most general scenario [50 52]. However, these proofs do not apply when one uses practical qubit sources which sometimes emit more than one qubit. Recently, a complete proof of security for BB84 against all joint attacks that applies to practical qubit sources has been proposed by Inamori, Lütkenhaus, and Mayers [42]. This work is predominantly interested in the effect of practical sources on the BB84 protocol. For this reason the analysis is restricted to individual attacks and uses the proof of security proposed by Lütkenhaus [48]. This restriction is made for several reasons. First, at the time of this work, this is the only proof of security which could be applied to realistic sources. Second, restriction to individual attacks makes the problem mathematically much simpler, while maintaining all of the relevant effects in the quantum transmission. Finally, the ability to perform collective or joint attacks is well beyond today s technological capabilities, or even those of the foreseeable future. Since the technology of tomorrow cannot be used to eavesdrop on today s transmission, the restriction to individual attacks is very realistic. Before discussing the proof of security by Lütkenhuas, the basic theory behind error correction and privacy amplification needs to be introduced.

58 42 CHAPTER 4. THEORY OF QUANTUM CRYPTOGRAPHY Error Correction In a real communication system errors are bound to occur. In order to achieve noise free communication these errors must be corrected, and this can be done through public discussion. Following the raw quantum transmission Alice and Bob each possess the strings X and Y respectively. In order to correct the errors, Alice and Bob exchange an additional message U such that knowledge of string Y and U leave very little uncertainty about string X. The message U should provide Bob with enough information so that H(X Y U) 0. Since string U is publicly disclosed, Eve may learn additional information as well, but good error correction algorithm will reduce this information leakage to a minimum. Unfortunately, given the error rate e, a lower bound exists on the minimum number of bits in U. This is simply the Shannon limit discussed earlier, which states that κ lim n n h (e), (4.5) where n is the length of the string, κ is the number of bits in message U, and h(e) is the conditional entropy of a single bit over a binary symmetric channel which is given by h (e) = e log e (1 e) log (1 e). (4.6) An error correction algorithm should ideally operate very close to this limit. At the same time the algorithm should be computationally efficient or the execution time may become prohibitively long. Error correction algorithms can usually be divided into two classes, unidirectional and bidirectional. In a unidirectional algorithm information flows only from Alice to Bob. Alice provides Bob with an additional string U which he then uses to try to find his errors. This makes it difficult to design algorithms which are both computationally efficient and operate near the Shannon limit [25,47]. In a bidirectional algorithm information can flow both ways, and Alice can use the feedback from Bob to determine what additional information she should provide him. This makes it easier to approach the Shannon limit. These two classes can be further subdivided into two subclasses, one for algorithms which discard errors and one for those which correct

59 4.2. PRACTICAL ASPECTS OF BB84 43 them. Discarding errors is usually done in order to prevent additional side information from leaking to Eve. By correcting the errors one allows for this additional flow of side information, which can be accounted for during privacy amplification. Since privacy amplification is typically a very efficient process, algorithms which correct the errors tends to perform better. Subsequent sections will deal with estimating the communication rate of QKD systems based on system parameters such as channel loss and detector dark counts. These estimations will strong depend on how well one assumes the error correction algorithms works. The calculations presented will assume the algorithm given in [25], which is bi-directional and corrects the errors. This algorithm works within about 15% 35% of the Shannon limit, even with substantial error rates Privacy amplification After error correction, Alice and Bob share an error free string X. Eve has also potentially obtained at least partial information about this string from attacks on the raw quantum transmission and side information leaked during error correction. In [45] it is shown that even with a measured error rate of 1% 5% a non-negligible amount of information on string X could have been revealed. Thus, X cannot by itself be used as a key. However, through the method of generalized privacy amplification [53], the string X can be compressed to a shorter string K over which any eavesdropper has only a negligible amount of information. The amount of compression needed depends on how much information may have been compromised during the previous phases of the transmission. To do privacy amplification Alice picks a function g out of a universal class of functions G which map all n bit strings to r bit strings where r < n (see [53] for more details). Once g has been picked and publicly announced both parties calculate the string K = g(x), which serves as the final key. This key is considered secure if Eve s mutual information on K, defined as I E (K; GV ) = H(K) H(K GV ), (4.7) is negligibly small, where G is the random variable corresponding to the choice of

60 44 CHAPTER 4. THEORY OF QUANTUM CRYPTOGRAPHY function g and V is all the information available to Eve. Let us define Z as all of the information obtained by Eve from attacks on the raw quantum transmission. An important quantity in the analysis of privacy amplification is the collision probability defined as P c (X) = x p 2 (x). (4.8) One can show that the conditional entropy H(K G) is bounded by [53, Thm. 3] H(K G) r 2r ln 2 P c(x). (4.9) This theorem can be applied to conditional distributions as well, which leads to H(K G, Z = z) r 2r ln 2 P c(x Z = z), (4.10) where P c (X Z = z) is just the collision probability of the distribution p(x Z = z). Averaging both sides of the above equation results in where H(K GZ) r 2r ln 2 P c(x Z = z) z, (4.11) P c (X Z = z) z = z p(z)p c (X Z = z) (4.12) is the average collision probability. This is a quantity of central importance in privacy amplification. In the case of individual attacks, the i th bit in Z depends only on the i th bit in X. Under these circumstances the average collision probability factors into the product of the average collision probability of each bit [54]. Thus, where n is the number of bits in string X and P c (X Z = z) z = (p c ) n, (4.13) p c = k α=0,1 β=1 p 2 (α, β). (4.14) p(β) In the above expression α sums over the possible values of a single bit in Alice s string and β sums over the possible measurement outcomes of the probe, which are

61 4.2. PRACTICAL ASPECTS OF BB84 45 enumerated from 1 to k. Suppose that a bound of the form log 2 P c (X Z = z) z could be proven. If one sets r = c s, where s is a security parameter chosen by Alice and Bob, then Eq leads to c I E (X; Z) 2 s / ln 2. (4.15) Thus, a bound on the average collision probability allows the two parties to make Eve s mutual information exponentially small in s. If the only information available to Eve comes from string Z, which is obtained from attacks on the quantum transmission, then the discussion in the previous section is sufficient. But if Alice and Bob correct their errors Eve will also learn an additional string U which gives her more information about Alice s key. This side information must also be included in the calculation. The bound in Eq. 4.9 can be applied to the conditional distribution p(x U = u, Z = z), which leads to H(K G, U = u, Z = z) r 2r ln 2 P c(x U = u, Z = z). (4.16) Averaging both sides of the above expression introduces additional complications. The random variable U creates correlations between different bits in strings X and Z. Because of this the average collision probability no longer factors into the product of individual bits, as in Eq This makes the problem of finding a bound on the average collision probability significantly more difficult. In the past, the problem of side information from error correction was handled in two ways. The first was to devise error correction algorithms which do not leak side information. The error correction was performed using exchanges of block parities. One bit from each exchanged block parity was discarded, leaving the parity of the remaining block unknown. This approach has two major disadavatages. First, it is difficult to create error correction algorithms of this type that operate near the Shannon limit. Second, the fact that the errors are discarded can be utilized by Eve to improve her overall knowledge on the transmission [47]. The second method for overcoming side information was to assume that the transmission during error correction is encrypted. This method requires the assumption that Alice and Bob already posses a short secure key. Using the quantum channel this secure key can

62 46 CHAPTER 4. THEORY OF QUANTUM CRYPTOGRAPHY be grown into a larger one. This changes the overall protocol from quantum key distribution to quantum key growing [47]. The following discussion presents a method for handling side information directly. Instead of resorting to the two previous method of handling side information, a bound on Eve s mutual information is derived using the number of exchanged bits from error correction. This problem has been previously investigated in [55], where several bounds on the collision probability P c (X Z = z, U = u) were derived as a function of P c (X Z = z). This work is extended to the average collision probability, which involves a few subtleties. The complete proof is given in Appendix A. In this appendix it is shown that if r = nτ κ t s, (4.17) where τ = log 2 p c, (4.18) κ is the number of bits in message U, n is the length of the error corrected key, and both s and t are security parameters chosen by Alice and Bob, then I E 2 t r + 2 s ln 2. (4.19) This bound on Eve s information is still exponentially small in the security parameters, and only involves the collision probability averaged over her measurements on the quantum transmission. Before concluding this section on the main concepts in privacy amplification, a few comments should be made on the notion of security in QKD. As stated previously, the key is considered secure if the mutual information is very small. This definition of security may raise some concern. The mutual information can be interpreted as the average number of bits Eve will obtain on the final key. In any given experiment it is possible that Eve can obtain significantly more bits than the average, but this happens with small probability. Perhaps a more satisfactory notion of security would be a statement of the form, with probability no greater than ε Eve obtains no more than ς bits of information on the final key. The mutual information is an important quantity because it can be used to obtain such a bound. A simple method for doing

63 4.2. PRACTICAL ASPECTS OF BB84 47 this is to use the Markov bound P (I ς) I E(K; GUZ), (4.20) ς where I is the actual number of bits of information Eve has obtained. This may serve as a more convincing statement of security than statements about the average. Plugging (4.15) into the above expression shows that the probability that Eve obtains more than an acceptably small number of bits on the final key is exponentially small in the security parameter s Proof of security by Lütkenhaus The proof of security proposed by Lütkenhaus has signified important progress in the field of quantum cryptography. This proof is very versatile, allowing the analysis the security of BB84 in the presence of many imperfections including channel losses, detector dark counts, and imperfect sources. Lets begin by considering a general system for performing the BB84 protocol. Figure 4.2 shows a schematic of such a system. The subsequent discussion assumes that the qubit is physically implemented in the form of a photon, as this is the only qubit implementation that can be transmitted over long distances. The proof itself does not require this assumption. The assumption is made in order to present a real physical system that can be analyzed. For definiteness it will also be assumed that information is encoded in polarization. Other encoding methods can be treated in a completely analagous way. The initialization of the qubit is performed by a photon source. To start with, an ideal photon source will be considered. This source emits exactly one photon in a known polarization state. The extension to realistic sources will be discussed later. The polarization of the photon is prepared by an electrooptic modulator (EOM), then the photon is sent over the quantum channel to Bob s detection apparatus. This apparatus is responsible for randomly selecting the computational or diagonal basis, and measuring the photon in that basis. Figure 4.3 shows two possible implementations for the detection apparatus. The first implementation is known as an active modulation scheme. This scheme uses an EOM to actively select the measurement

64 48 CHAPTER 4. THEORY OF QUANTUM CRYPTOGRAPHY Alice Source EOM Channel Bob Detection Apparatus Figure 4.2: Basic system for performing the BB84 protocol. Bob performs. The second method is known as a passive modulation scheme. Instead of using an EOM, Bob uses a beamsplitter to partition the photon into two different polarization analyzers. It is easy to verify that detection events at each counter correspond to a measurement of one of the POVM elements in Eq Real systems almost always use a passive modulation scheme because it is easier to implement. It will later be shown that passive modulation can also simplify the proof of security. Hence, from this point it will be assumed that Bob s detection apparatus uses passive modulation. In order to account for optical losses, a beamsplitter is placed in front of the detection apparatus to reflect off a specified fraction of the light into a loss mode. All losses are lumped into this beamsplitter and the subsequent optical components can be regarded as lossless. This model is realistic under two conditions. First, the use of a beamsplitter model is valid if the loss is linear. A linear beamsplitter cannot effectively model loss due to nonlinear effects such as two-photon absorption. To incorporate such effects a more complicated loss model is required. However, in real system multi-photon absorption is typically many orders of magnitude weaker than linear absorption, so a beamsplitter approximation is usually extremely good. Second, placing the beamsplitter in front of the detection apparatus requires that the loss to

65 4.2. PRACTICAL ASPECTS OF BB84 49 a) Active modulation Channel EOM BSP H/V PBS b) Passive modulation H/V PBS Channel BSP BSP 45/-45 PBS Figure 4.3: Two methods of implementing Bob s detection apparatus.

66 50 CHAPTER 4. THEORY OF QUANTUM CRYPTOGRAPHY each detector is equal. This is an important point in passive modulation. A passive modulation scheme must be constructed in such a way that a photon has the same probability of being detected regardless of which path it takes. If, for example, one detector has higher quantum efficiency than the other three, additional loss should be placed in front of it to make sure that the above property is satisfied. Having modelled the loss, the operation of the lossless components can now be defined. For each detection unit, E (0) is defined as the projector onto vaccuum and E n ψ as the projector onto the state which has n photons with polarization ψ, where ψ {x, y, u, v}. The detection apparatus performs a POVM measurement whose elements corresponds to different combinations of detection events from the four photon counters. The elements of this POVM can be broken up into F vac, F ψ, and F D which correspond to no detections, one detection corresponding to polarization ψ, and more than one detection respectively. These operators are given by [47] F vac =E 0, ( 1 F ψ = 2 n=1 { [1 F D = 2 n=2 (4.21a) ) n E n ψ, (4.21b) ( ) n ] 1 Eψ n 2 ψ } n,m=1 E n x E m y + E n ue m v. (4.21c) Multiple detection events, corresponding to the operator F D, are possible if more than one photon is incident on the detection apparatus. These events should not be discarded, because keeping track of them can prevent certain security loopholes. By incorporating the multiple detection events in the proof of security for BB84, one can make it disadvantageous for Eve to add additional photons to Alice s signal [47]. Multiple detection events are included in the proof of security by defining the disturbance parameter ɛ. This parameter is given by ɛ = n err + w D n D n rec (4.22) where n err, n D, and n rec are the number of error bits, dual fire events, and number of bits that entered the error corrected key respectively, and w D is a weighting parameter chosen by Alice and Bob. This weighting parameter should be made sufficiently large

67 4.2. PRACTICAL ASPECTS OF BB84 51 so that it is to Eve s disadvantage to cause dual fire events. If passive modulation is used, then w d = 1/2 is a sufficiently large number for this to be true. Note that in the limit that the dual fire rates are negligibly small the disturbance parameter simplifies to the bit error rate. As mentioned in the previous section, a security proof for BB84 involves finding a bound on the collision probability given in Eq This expression must be optimized over all possible attacks on a qubit, which are always characterized by a CP map. This bound should be a function of the disturbance given in Eq Such a bound has been derived in [47], and is given by the following expression p c ɛ 2ɛ2. (4.23) This expression can be directly plugged into Eq to calculate the length of the final key. From the above expression one can see the when ɛ = 0, the collision probability is 1/2, which means Eve gets no information about the key. In the opposite limit, if ɛ = 1/2, the collision probability is 1 and Eve can learn the entire string. This can be done if Eve intercepts each photon Alice sends and stores it, while relaying an unpolarized photon to Bob. The above proof of security applies when the source is ideal, meaning it generates a single photon in a known polarization state. But no realistic source can do this. All practical sources suffer from optical losses, meaning that they sometimes generate vacuum instead of one photon. Worse yet, such sources can also produce multiphoton states. These states are vulnerable to photon splitting attacks, which can cause a security loophole in the communication [18]. In a photon splitting attack, Eve splits off one of the photons and stores it coherently, allowing the second photon to propagate to Bob undisturbed. Later, when Alice and Bob reveal the measurement basis they used, Eve can measure her photon and learn the value of the bit with 100% probability, while causing no errors. Thus, any source which is to be used for the BB84 protocol must have a very low probability of generating multi-photon states. But even if the probability of a multi-photon state is small, it can still cause a large security hazard in the presence of channel losses. When the channel is lossy, Eve can pick off one of the photons from a multi-photon state at the beginning of the channel. She can

68 52 CHAPTER 4. THEORY OF QUANTUM CRYPTOGRAPHY then replace the lossy channel with a lossless channel to ensure that the second photon reaches Bob. She can subsequently block off a fraction of the single photon states to conserve the overall communication rate. This gives her complete information over a larger fraction of the key. At some sufficiently high channel loss, Eve can only relay the multi-photon states while blocking off all of the single photon states. This renders the entire key completely insecure. Thus, the multi-photon states put an upper limit on the amount of channel loss a system can have for secure communication to be possible. Photon splitting attacks can be accounted for by modifying the compression factor τ, defined in Eq [48]. First, the parameter β is defined to be the fraction of detection events in Bob s apparatus that originated from single photon states. Thus, β = n n m n (4.24) where n is the total number of detections, and n m is the total number of multi-photon states that were injected into the quantum channel. τ is then redefined as τ = β log 2 p c (ɛ/β). (4.25) The above equation shows that photon splitting attacks have two effects on the compression factor. First, each multi-photon state reveals a bit of information to Eve. This is accounted for by the outer factor of β in the expression. Second, because Eve learns a fraction of the key without causing errors, she can create a larger error rate on the remainder of the key while maintaining the same overall bit error rate. This is accounted for by normalizing ɛ by β in the expression Photon source characterization Light emitters abound in our everyday lives. We encounter photons from light bulbs, candles, lasers, light emitting diodes, and sunlight on a daily basis. Could such photons be easily used for doing quantum information processing? This is actually a difficult question to answer. As discussed in the introduction, light sources can be generally categorized into two classes, classical sources and non-classical sources. To rigorously define these two

69 4.2. PRACTICAL ASPECTS OF BB84 53 classes, the coherent state α = e α 2 j=0 α i i! i (4.26) is introduced. The complex number α is the amplitude of the coherent field, and α 2 is the average number of photons in the field. The set of all coherent states form a complete basis. That is α α α = I. (4.27) However the coherent states are not orthogonal to each other. Their inner products are given by Because of this, the coherent state basis is overcomplete. α β = e α β 2 (4.28) The output of a field emitted by a light source can always be expanded in the coherent state basis [16]. The result of this expansion is referred to as the coherent state representation of the field, and takes on the following form ρ field = P (α) α α. (4.29) α The function P (α) is known as the P distribution function. This function is always real, and obeys the normalization α P (α) = 1 (4.30) For many sources this function also obeys the property that it is non-negative for all α. If this is the case, then the P distribution function obeys all of the properties of a probability distribution. We refer to all sources whose P distribution function is non-negative as classical sources. All of the sources mentioned in the beginning of this section satisfy this condition. The reason for the name classical is that all photon counting statistics exhibited by such a source do not require quantization of the electromagnetic field. One could instead work with classical field amplitudes, and use Maxwell s equations to determine their dynamics. The detection statistics can be attributed to the photon counters, which are made of a collection of atoms with quantized energy levels. This type of description, known as the semi-classical theory of photon counting, is adequate in many cases.

70 54 CHAPTER 4. THEORY OF QUANTUM CRYPTOGRAPHY Some sources emit fields whose P distribution function becomes negative. Such sources can exhibit effects which cannot be predicted by semiclassical detection theory. Examples of such effects include photon anti-bunching, negativity of the Wigner function, and non-local effects such as violations of Bell s inequality [16]. Such sources are referred to as non-classical sources, because quantization of the electromagnetic field is required in order to explain the counting statistics they generate. The ideal source for quantum cryptography emits exactly one photon, which is is non-classical field. The engineering of a single photon source is an experimentally challenging task. For this reason, the photon sources used to date to perform BB84 have been classical sources such as attenuated laser light. Using such classical sources comes at a significant price. The security behavior of a system based on such sources is vulnerable to photon splitting attacks [18]. In order to quantitatively analyze the performance differences between classical and non-classical sources one needs a way to characterize the security behavior for different photon sources. From the discussion of the previous section, an important quantity is the number of multi-photon states injected into the quantum channel, denoted n m. This number cannot be measured from the communication. Instead, it is necessary to characterize the source and measure the probability that it creates a multi-photon state. In the limit of large strings, n m = Np m where N is the number of clock pulses in the experiment and p m is the probability that the source creates a multi-photon state per pulse. In principle, p m could be calculated by measuring the photon number distribution in an optical pulse. Unfortunately, conventional photon counters do not have the ability to distinguish an optical pulse containing a single photon from one containing multiple photons if all of the photons arrive within the dead time of the detector. This topic will be re-explored later when the Visible Light Photon Counter is discussed. For the current discussion, assume that the photon counters used are avalanche photodiodes (APDs). When these detector are excited by a pulse which is shorter than the dead time, they will signal if the pulse contained zero or more than zero photons. In order to measure p m, a more indirect approach is required that circumvents the dead time of the APDs. The solution is to do an intensity correlation measurement

71 4.2. PRACTICAL ASPECTS OF BB84 55 APD Time resolved Coincidence Counter Source APD Figure 4.4: Hanbury Brown-Twiss intensity interferometer. using a Hanbury Brown-Twiss intensity interferometer, shown in Figure 4.4. analyze the results of this correlation measurement, assume that the photon source creates a train of light pulses at a fixed repetition rate. Each light pulse is assumed to be contained in an interval [0, ], which is smaller than the duty cycle of the experiment. Under these conditions, the photon number operator can be defined as ˆn = 0 To â (t)â(t)dt. (4.31) In the above equation â (t) is the photon creation operator in the time domain. The average number of photons in a duty cycle is simply given by n = ˆn. The second order correlation, g (2), is given by [22] g (2) 0 0 = â (t)â (t )â(t )â(t) dtdt. (4.32) n 2 It is not difficult to show, using the commutation relation [â(t), â (t ) ] = δ(t t ), (4.33) that the expression for g (2) can be rewritten in the form The parameters n and g (2) g (2) = ˆn (ˆn 1) n 2. (4.34) are important because they place a bound on the probability that the source emits a multi photon state. This bound is obtained by

72 56 CHAPTER 4. THEORY OF QUANTUM CRYPTOGRAPHY first writing g (2) i=2 i(i 1)p(i) =. (4.35) n 2 Using the fact that i(i 1) 2 for all i 2 leads to the bound g (2) i=2 2p(i) n 2 or alternately = 2p m n 2, p m n2 g (2). (4.36) 2 This bound can be used to calculate β. The parameter g (2) is relevant to the previous discussion on classical and nonclassical sources. All classical sources satisfy the property g (2) 1. Equality is achieved for a Poisson distributed photon number distribution. Most experimental demonstrations of quantum cryptography to date have relied on highly attenuated laser light as a source of single photons. An attenuated laser with perfect intensity stability is a Poisson light source. Eq indicates that the only way to reduce the multi-photon states from such a source is to make n small. This can be achieved by adding a lot of attenuation to the laser. But adding attenuation comes at a price. If the average is very small, then most of the time the source emits no photons. This reduces the communication rate. Furthermore, the average cannot be made arbitrarily small. At some point the dark counts of the detectors will start to dominate the transmission, increasing the error rate. In order to eliminate this problem, there has been extensive effort in engineering sources which behave closer to an ideal single photon source [56 66]. Such a source is impossible to generate in practice. All sources will suffer from some form of optical losses, causing an unavoidable vacuum contribution to the emission. Furthermore, practical sources still sometimes emit multi-photon states due to effects such as background light collection, substrate photoluminescence, and device non-idealities. Any source with g (2) < 1 is referred to as a sub-poisson light source. Aside from g (2), these sources are characterized by a second important parameter, the device efficiency n dev. This is the average number of photons emitted from the source in a

73 4.2. PRACTICAL ASPECTS OF BB84 57 clock cycle. The average number of photons injected into the quantum channel, n, can be made smaller than this by introducing attenuation, but it cannot be made larger. For attenuated lasers this parameter is not relevant, because lasers start with a macroscopically large number of photons that can be attenuated to any desired average. Furthermore, any optical losses before the quantum channel can be accounted for by slightly increasing the laser intensity. This is not true for sub-poisson light. For such sources the average photon number cannot be made arbitrarily large and is ultimately limited by g (2). From Eq and the fact that ˆn 2 n 2, one obtains the bound n 1. (4.37) 1 g (2) For small g (2), the bound approaches n 1. The best devices to date feature g (2) 0.05 and n 10 40% Communication rates for BB84 with sub-poisson light The previous section has provided the tools necessary to investigate how the two parameters, g (2) and n dev affect the communication rate of a quantum cryptography system. Define p click as the probability that Bob experiences a detection event on a given clock cycle. Detection events may triggered by photons sent from Alice, or by dark counts in Bob s detectors. These two sources may be assumed to be independent. Thus p click = p signal + p d p d p signal. (4.38) If p d and p click are sufficiently small then the probability of a simultaneous signal and dark count detection in the same clock cycle is negligible. Thus, p click p signal + p d. (4.39) In general, the analysis will assume that the probability of multiple detection events in the same clock pulse is small. Such an assumption is valid if the probability of a multi-photon state is low, and the channel losses are sufficiently large so that even if two photons are injected into the channel, the probability both of them will be transmitted is low. These conditions are satisfied by most practical systems. They

74 58 CHAPTER 4. THEORY OF QUANTUM CRYPTOGRAPHY will simplify the analysis considerably, and give accurate numbers at high channel losses, which is the regime of interest. Eq gives the length of the final string after privacy amplification. In the following calculations, it is more useful to calculate a normalized communication rate, in units of bits per clock cycle. This communication rate R can be defined as r R = lim N N. (4.40) Note that n = Np click, where n was defined previously as the length of the final string. Plugging into Eq. 4.17, one obtains R = lim n p click [ τ κ n s + t ]. (4.41) n The security parameter s is not a function of n, while t grows only logarithmically with n. Thus, in the limit of large n, (s + t)/n = 0. The term κ/n is the fraction of additional information exposed during error correction. If the error correction algorithm works at the Shannon limit, then in the limit of large strings κ/n = h(e), where h(e) is the Shannon entropy function defined previously. However, an algorithm that is computationally feasible and works at this limit does not exist. All practical algorithms are inefficient, to some extent, and this is accounted for by inroducing a function f(e), defined as the ratio of the algorithm performance to that of the Shannon limit. Thus, κ lim = f(e)h(e) (4.42) n n where f(e) 1. This function can be determined by benchmark testing the algorithm under a broad range of strings. Subsequent calculations assume that the algorithm being used is the one proposed by [25]. This algorithm works within 35% of the Shannon limit, even with large error rates. Table 4.1 shows values of f(e) for several different error rates, produced by benchmark tests. These values are linearly interpolated to determine intermediate values of f(e). Putting everything together, the final expression for the communication rate is where τ can be calculated from R = p click [τ f(e)h(e)], (4.43)

75 4.2. PRACTICAL ASPECTS OF BB84 59 Table 4.1: Values of f(e) for different error rates. e f(e) The above equation can be used to determine how a system based on sources with different g (2) and n dev behaves in the presence of practical experimental imperfections such as channel loss and detector dark counts. First, one needs to calculate p signal, p d, e, and β. The signal contribution to the detection events is given by p signal = p(n) [1 (1 T ) n ]. (4.44) n=0 The parameter T in the above equation is the total optical loss from the quantum channel and Bob s detection apparatus. In general, this expression cannot be evaluated because p(n) is unknown. But as mentioned before, all calculations are taken in the limit where multiple detection events are negligible. In this limit, the above expression can be kept only to first order in T. Using the approximation (1 T ) n (1 nt ), one obtains p signal nt. (4.45) The probability p d is given by the dark count rate of the detectors multiplied by the measurement time window. Thus, d = r d τ w. The error rate e will receive a contribution from both the signal and dark count component. Errors from the signal component occur because of imperfect state preparation, channel decoherence, and imperfect polarization optics at Bob s detection unit. The baseline signal error rate, denoted as µ, accounts for all of these effects. For good systems, µ is typically less than 2%. A second error component comes from the dark counts at Bob s detection unit. Each dark count is completely uncorrelated with Alice s signal and thus causes

76 60 CHAPTER 4. THEORY OF QUANTUM CRYPTOGRAPHY a 50% error rate. Using the above definitions, one obtains Finally, the parameter β is simply given by e = µp signal + p d /2 p click. (4.46) β = p click p m p click. (4.47) In the above expressions the parameters p d, T, and µ are fixed parameters which characterize the non-idealities of the system. The parameter g (2) is a also a fixed parameter which characterizes the source. There is one other parameter, n, which is adjustable. By introducing losses one can continuously adjust it from 0 to n dev. On first look, it may seem that the best thing to do is to set it to its maximal value of n dev, and hence maximize the amount of signal injected into the channel. It turns out, however, that this is not always the optimal strategy. To understand why, consider the expressions for p click and p m shown below. p click nt + d (4.48) p m n2 g (2). (4.49) 2 The probability p click reduces linearly with n while p m reduces quadratically. If n is set too high, the communication rate will drop due to an increase in p m. If it is instead set too low the communication rate will once again drop due to a decrease in p click. It turns out that there is a unique optimal n which maximizes the communication rate. Thus, the communication rate must be optimized with respect to n in order to achieve the best possible communication rate. The communication rate as a function of the channel loss T for various sources ranging from Poisson light to ideal single photon devices, is shown in Figure 4.5. The dark count rate r d is assumed to be 20s 1, corresponding to a good commercial avalanche photodiode. The measurement window τ w is ultimately limited by the time jitter of the detector which is assumed to be 500ps. The dark count probability under these conditions is d = , where the factor of four comes from four detectors. The baseline error rate µ is set to 1%. The average photon number n is

77 4.2. PRACTICAL ASPECTS OF BB84 61 n = 1 Figure 4.5: Communication rate as a function of channel loss for different values of g (2), assuming the device efficiency is 1.

78 62 CHAPTER 4. THEORY OF QUANTUM CRYPTOGRAPHY numerically optimized for each value of T. Figure 4.5 shows the calculation results for the case where n dev = 1, which is nearly perfect device efficiency. The normalized communication rate is plotted as a function of channel loss for different values of g (2). Poisson light corresponds to the curve g (2) = 1, while the curve g (2) = 0 is an ideal single photon device. Note that the Poisson light bit rate decreases faster than the ideal single photon device. This is because the single photon device does not suffer from photon splitting attacks. The rate decrease is only due to the increasing channel loss. For Poisson light, as the channel loss increases the effect of the multi-photon states is enhanced, forcing a reduction of the average number of photons. Intermediate devices with 0 < g (2) < 1 feature two types of behaviors. At low channel losses they behave very similar to the ideal device where the bit rate decreases in proportion to the channel transmission. At higher loss levels the multi-photon states start to make a significant contribution and the behavior gradually switches over to that of Poisson light. As can be seen, each curve features a cutoff channel loss, beyond which secure communication is no longer possible. A smaller g (2) implies that more loss can be tolerated. Next, consider the situation when the device efficiency is not ideal. Figure 4.6 shows the communication rate as a function of channel loss for a fixed g (2) and several different values of n dev. At low loss levels the bit rate of the system decreases with decreased efficiency. But at higher loss levels most of the curves meet with the ideal curve, leaving the cutoff loss unaffected. Only the extremely lossy device with n dev of 10 3 fails to rejoin the ideal curve, and features a smaller cutoff loss. Most of the curves rejoin the ideal curve because, at high loss levels, added attenuation is already required in order to reduce the effect of photon splitting attacks. For lossy devices, some of this attenuation is provided by device inefficiency. If this inefficiency does not exceed the attenuation required at the cutoff loss, than at some loss level the curve for the lossy device will rejoin that of a lossless one. This leads us to the conclusion that, given g (2) and the system parameters, a critical efficiency value exists. If the device efficiency exceeds this critical efficiency, than the device can tolerate the same maximum channel losses as a perfectly efficient one. Furthermore, as channel losses increase there will be a crossover point where the communication will no

79 4.2. PRACTICAL ASPECTS OF BB84 63 n n n n Figure 4.6: Communication as a function of channel loss for different device efficiencies.

80 64 CHAPTER 4. THEORY OF QUANTUM CRYPTOGRAPHY longer depend on the device efficiency. Figure 4.6 shows that for the particular value of g (2) = 0.01, which is a realistic value for good single photon devices, the critical efficiency is below Such efficiencies are within the reach of today s technological capabilities. Unfortunately, it is very difficult to get a closed form solution of the critical efficiency and loss cutoff from Eq because of the non-linear nature of the equation. This forces us to resort to numerical methods. In the next section, an approximate method is introduced to get a closed form estimate on these two important quantities. This estimate will provide a better intuitive understanding of the different tradeoffs involved Estimates for sub-poisson light sources In this section closed form approximations will be derived for the cutoff loss and critical efficiency of a sub-poisson light source. Using the arguments presented in [18], one can put an upper bound on the allowable error rate using the condition e = β 4. (4.50) Since β is the fraction of single photon states in the key, the condition above defines the point where Eve can intercept and re-send all single photon states, and perform a photon splitting attack on the multi-photon states. Secure communication is not possible beyond this point. The channel loss where the above condition is satisfied will serve as an estimate for the loss cutoff. The efficiency that optimizes the cutoff loss will give an estimate for the critical efficiency. A device with efficiency exceeding this value can be attenuated down to the critical efficiency if the channel losses are close to the cutoff. Comparison with numerical calculations from Eq will show that the above estimates give a remarkably close approximation to the real value. Note that both the error rate, given in Eq. 4.46, and the parameter β given in Eq are functions of the channel transmission T. Plugging these equations back into Eq. 4.50, one can solve for the channel transmission which is given by ( ) 1 d T = 1 4µ n + ng(2). (4.51) 2

81 4.2. PRACTICAL ASPECTS OF BB84 65 The above equation gives the value of the channel transmission where Eve can intercept and resend all single photons and perform a photon splitting attack on all multi-photon states. Here µ, d, and g (2) are considered to be fixed system parameters. When using Poisson light sources the average photon number n is an adjustable parameter, which can be made arbitrarily large or small. This is because Poisson light sources, such as lasers, start with a macroscopically large number of photons that can be attenuated down to the desired final average. With sub-poisson light the average is only adjustable by introducing loss, as previously discussed, and can never exceed the device efficiency. Equation 4.51 shows more clearly the tradeoffs involved in optimizing T. If n is set too low the first term on the right side of the equation becomes large. If it is set too high the second term becomes large. For an ideal device one can set n = 1 and g (2) = 0, so that T ideal min = d/(1 4µ). (4.52) When the device is not ideal, T can be minimized with respect to n, resulting in the conditions n c = T min = 2d (4.53) g (2) 2dg (2) 1 4µ. (4.54) In the above equations n c is the average photon number which minimizes Eq. 4.51, and T min is the obtained minimum channel transmission. Equation 4.53 gives an estimate for the critical efficiency. If the device efficiency exceeds this value one can always attenuate down to optimal value when the channel transmission is close to its minimum. If the device efficiency is below this value however, there is no way to increase it in order to achieve the optimal efficiency. Note that when µ = 0 and g (2) = 1 the bound derived in [18] for Poisson light is reproduced. The above equations, however, can now be applied to any sources between Poisson light and ideal single photon devices. On initial inspection there is an apparent inconsistency in Eq in the limit g (2) 0. The equation predicts T min = 0 in this limit, but one can never do better

82 66 CHAPTER 4. THEORY OF QUANTUM CRYPTOGRAPHY Figure 4.7: Basic system for performing the BB84 protocol. than an ideal single photon source which is bounded by Eq However, in this limit n c, which is a contradiction. The average photon number cannot be made arbitrarily large and is ultimately limited by Eq When g (2) 0, n 1 with equality holding when the device creates exactly one photon per pulse. Thus, one should only use Eq and 4.54 if n c 1. Typical experiments feature g (2) = 0.01 and d = , giving us n c = , which is well below 1. Figure 4.7 shows a comparison between the estimate for the cutoff loss and critical efficiency, and the actual value calculated numerically from Eq In both cases the estimate predicts the actual value to within a factor of 2 over a 4 order of magnitude range for g (2).

83 4.3. QUANTUM CRYPTOGRAPHY WITH ENTANGLED PHOTONS Quantum cryptography with entangled photons This section considers the security of entangled photon protocols. The security of such protocols have not been studied as thoroughly as BB84. Several proofs of security exist for entanglement based protocols against enemies with unlimited computational power. Some of these proofs require that the receivers process their qubits through some form of quantum computer [67, 68]. Others apply to more standard entangled photon protocols but require that the source generate only one photon for each receiver [69]. Although these proofs represent important progress in the security of entangled photon protocols, they cannot yet be used directly to analyze the security of practical systems. In order to treat practical systems a proof of security must apply to realistic sources. Furthermore, in most of these systems the source can be located in between the two receivers and is not trustable. An eavesdropper can replace it with a different source that may provide more information without changing the error rate. In the worst case one must also consider the detection apparatus to be untrustable, so that an eavesdropper can in some way modify the measurements made by the two communicating parties. The issue of untrustable source and detection apparatus has previously been investigated by Mayers and Yao [70, 71]. Mayers and Yao present a protocol in which two receiving parties measure their respective signals randomly in one of three non-orthogonal bases. It is proven that if the probabilities of the measurement results are consistent with those produced by a Bell state, then the security of the communication channel is ensured. An eavesdropper cannot simulate these probabilities while learning a non-negligible amount of information about the secret key, even if she is allowed to modify or control all aspects of the source and detection apparatus (i.e. number of particles per pulse, measurement bases, losses). This proof has the potential to guarantee security for realistic systems with virtually no assumptions. However, at this point the proof considers only the idealized limit where the probabilities are perfect, so it cannot be applied to practical systems either. The extension of this proof to imperfect probabilities due to effects such as imperfect

84 68 CHAPTER 4. THEORY OF QUANTUM CRYPTOGRAPHY state preparation and channel losses remains an important but difficult question. This section provides a proof of security for an entangled photon protocol which can be applied to practical systems. This is done by extending the proof of Lütkenhaus for BB84 with realistic sources [48] to apply to the entangled photon variant of the BB84 protocol proposed by Bennett, Brassard, and Mermin [15], BBM92 for short. The proof of security relies on two assumptions. The first is that all eavesdropping is restricted to individual attacks. The second assumption is that the the detection apparatus is trustable. This means that the detection apparatus behaves according to a specific model. The eavesdropper cannot modify the measurement apparatus beyond this model. This assumption is required in virtually all proofs of BB84, as well as the entangled photon proofs presented in [67 69]. With these restrictions, a quantitative relationship between the security of the final key and experimentally measurable quantities such as the error rate is obtained. This is achieved by finding an upper bound on the average collision probability. The proof works for realistic sources, and allows the source to be placed outside the labs of the two receivers. Although the proof makes assumptions about the eavesdropper and the detection units, these assumptions are realistic under many experimental conditions. The technology to perform collective and joint measurements does not exist, and may not for quite some time. Thus, the assumption of individual attacks is realistic for current systems. The assumption that the measurement apparatus is reliable may also be argued as reasonable because the measurement systems are located in the labs of the receivers. They can therefore be tested to make sure they are operating according to expectation, and cannot be physically manipulated by the eavesdropper. This is in contrast to the source which is located somewhere between the two receivers and can easily be modified The BBM92 protocol This sections describes the BBM92 protocol, and discusses why it is secure. In BBM92 Alice and Bob share a pair of photons from a source presumed to be somewhere in between both parties. In the ideal case the photon pair is in a quantum mechanically

85 4.3. QUANTUM CRYPTOGRAPHY WITH ENTANGLED PHOTONS 69 entangled state such as ψ = 1 2 ( ), (4.55) The above state implies that if both receivers measure their photon in computational basis, their measurement results will be completely correlated. However, the two receivers don t necessarily need to measure in the computational basis. If they instead measure in the diagonal basis, they will also have a perfectly correlated result. This suggests the following protocol for quantum cryptography. Each receiver measures their respective photon randomly in either the computational or diagonal basis. Later they agree to keep only the instances in which the measurement bases were the same, forming the sifted key. To understand why BBM92 is secure, consider the arguments presented by Bennett, Brassard, and Mermin. Since the source is somewhere between the two parties, assume that Eve can block it and replace it with her source, which will provide her with information about Alice and Bob s measurement results. This source will provide one qubit for Alice, one for Bob, and a third probe system for Eve. Eve will use the probe signal to infer the measurement results. The most general state that the source can create is ψ abe = 00 E E E E 10. (4.56) The states E 00, E 11, E 10 and E 01 are states of the probe, and are not assumed to be normalized or orthogonal. If Eve is not allowed to create any errors, then E 01 = E 10 = 0. Now, re-express the state in the diagonal basis. It is easy to show that in this basis ψ abe = 1 [( ) ( E 00 + E 11 ) + ( ) ( E 00 E 11 ). ] (4.57) 2 If Eve is not allowed to generate errors in the diagonal basis, the E 00 = E 11, and Eve s probe is completely uncorrelated with the transmitted qubits. Thus, she gains no information about the measurement result. The above proof shows that Eve cannot gain any information without inducing at least some errors. However, this proof cannot be used in practical systems because it does not quantify the amount of leaked information in the presence of a finite error

86 70 CHAPTER 4. THEORY OF QUANTUM CRYPTOGRAPHY rate. Worse yet, the above proof assumes that only one qubit has been sent to Alice and Bob. There is nothing which prohibits Eve from sending more than one qubit to either party. In the BB84 protocol, when the source generates more than one qubit, it creates a severe security loophole. If the same is true in BBM92, then Eve can simply replace the source with one which always emits more than one qubit for Alice and Bob, rendering the entire protocol insecure. The proof of security for BBM92 will be explained in the next section. The protocol will be shown to be secure even if Eve is allowed to send more than one photon to each party. The proof will be obtained by finding a bound on the average collision probability. This will allow a quantitative comparison of the BBM92 protocol to the BB84 protocol Proof of security for BBM92 In BBM92 Alice, Bob, and Eve observe orthogonal Hilbert spaces H A, H B, and H E respectively. In the most general case Eve can control which density matrix ρ abe over the space H A H B H E she will share with Alice and Bob. This density matrix can span all the photon number states of the two receivers, and Eve s measurable subspace which can have any number of dimensions. In practice Eve can do this by blocking out the original source and substituting her own source which generates the desired state that maximizes her information on the final key. A bound is derived on the optimal density matrix, which serves as an upper bound, even if Eve is incapable of generating it in practice. As mentioned previously, the proof assumes that Eve is restricted to individual attacks and that Alice and Bob s detection apparatus is trustable. A trustable detection apparatus is one whose components behave according to a known model which cannot be modified by Eve. In order to define this model one first has to specify the physical implementation of the detection apparatus. It is assumed that both Alice and Bob implement the same passive modulation scheme that was discussed in the BB84 protocol. Thus, the POVM which the two receivers implement is described by Eq Optical losses are once again accounted for by placing a beamsplitter in

87 4.3. QUANTUM CRYPTOGRAPHY WITH ENTANGLED PHOTONS 71 front of the detection apparatus which reflects off a specified fraction of the light into a loss mode. All losses are lumped into this beamsplitter and the subsequent optical components can be regarded as lossless. The disturbance parameter is also defined in the same way as was done in BB84, using Eq The values n err, n D, and n rec are once again the number of error bits, dual fire events, and number of bits that entered the error corrected key respectively, and w D is a weighting parameter chosen by Alice and Bob. As part of the proof, it will be shows that w D = 1/2 is a sufficient number to ensure security for BBM92, just as it was for BB84. Eve is allowed to pick any density matrix ρ abe which represents some entangled state of her observable Hilbert space and the signals transmitted to Alice and Bob. She can send any number of photons she wishes, or a coherent superposition of photon numbers. The first step is to show that the most general density matrix ρ abe can be written as ρ abe = i,j=1 ρ (ij) abe, (4.58) where ρ (ij) abe is the density operator over the subspace where Alice received i photons and Bob received j photons. This is due to the fact that the detection units consist of only passive linear optics with vacuum auxiliary modes and single photon counters. As can be seen by (4.21a)-(4.21c), a detection event is represented by a projection operator which is diagonal in the photon number basis. Define E i a as the projector onto Alice s i photon subspace, and E j b as the projector onto Bob s j photon subspace. Suppose that F a and F b are positive operators which represent a measurement corresponding to any combination of detection events for Alice and Bob respectively. Because these operators are diagonal in the photon number basis they can be written equivalently as F a = i F b = j E i af i ae i a (4.59) E j b F j b Ej b. (4.60) Let F e be the positive operator corresponding to Eve s measurement result on her

88 72 CHAPTER 4. THEORY OF QUANTUM CRYPTOGRAPHY own subspace. The joint probability p(a, b, e) can be written as p(a, b, e) = Tr {ρ abe F a F b F e } = Tr { ρ abe EaE i j b F af b EaE i j b F } e ij = ij Tr { E i ae j b ρ abee i ae j b F af b F e }. The last step comes from the fact that the projectors commute with Eve s measurement operator and the invariance of the trace under cyclic permutation. If one defines ρ ij abe = Ei ae j b ρ abeeae i j b, the joint probability does not change if a density matrix of the form given in (4.58) is selected. The main consequence of the above result is that Eve can keep track of the number of photons she is sending to Alice and Bob without changing the measurement results. Thus, her collision probability can be broken up into different photon number contributions as where p c = i,j=1 p (ij) c = m M (ij),ψ p (ij) rec p rec p (ij) c, (4.61) 1 p (ij) rec p 2 (ψ, m). (4.62) p(m) The set M (ij) is defined as the set of all measurement results on Eve s probe if she sent i photons to Alice and j to Bob, and p (ij) rec component ρ (ij) abe p (ij) D is the probability that the signal enters the error corrected key. One can similarly define p(ij) err as the probability that this signal component enters the sifted key as an error or causes a dual fire event respectively. Using (4.22), the disturbance measure ɛ can be broken up into different photon number contributions as and ɛ = ij p (ij) rec p err (ij) + w D p (ij) D p rec p (ij) rec = ij p (ij) rec p rec ɛ (ij). (4.63) The next step is to investigate the term p (11) c which is the component corresponding to Alice and Bob each receiving one photon. Instead of directly finding a bound on Eve s collision probability from this component, it is proven show that any bounds

89 4.3. QUANTUM CRYPTOGRAPHY WITH ENTANGLED PHOTONS 73 derived for BB84 on single photon state can also be applied to BBM92 when Alice and Bob each receive one photon. In BB84 Alice sends a photon in one of four non-orthogonal states to Bob. Eve performs a measurement on the photon and the backaction noise on the state can be described by a complete positive mapping (CP map) ρ b = A k ρ a A k (4.64) k where ρ a is the density matrix prepared by Alice, and ρ b is the density matrix which Bob receives. The only restriction on the operators A k is that they satisfy the condition A k A k = I. (4.65) k In BBM92, Alice does not directly send Bob a density matrix. In the ideal case where both receivers share a pure entangled pair, if Alice s measurement corresponds to the operator F a she prepares Bob s density matrix in the state Fa T /Tr {F a }. If one could show that, given Alice observes F a, any eavesdropping strategy incorporated by Eve could once again be described by a CP map ρ b = k A k F T a Tr {F a } A k (4.66) then this seemingly different situation is equivalent to the BB84 attack. Unfortunately, in BBM92 there are many eavesdropping strategies which cannot be described by such a mathematical formalism. However, Appendix B shows that there is always an optimal attack which can be described by a CP map. Thus, any bounds which have been derived for BB84 using a POVM formalism on single photon states can be directly applied to BBM92 when one photon is sent to each receiver. Specifically, the bound derived by Lütkenhaus [47, Appendix D], which was used in the previous sections for BB84, can be directly used to bound p (11) c as follows p (11) c ɛ(11) 2 ( ɛ (11)) 2. (4.67) In order to account for the components with more than one photon for either receiver, Appendix C shows that if the weighting parameter w D in Eq is set to 1/2, Eve s

90 74 CHAPTER 4. THEORY OF QUANTUM CRYPTOGRAPHY optimal strategy is to only send one photon to Alice and Bob. This argument follows the same line as that given for BB84 in [47]. Given that this is the optimal strategy one is led directly to the result p c ɛ 2ɛ2. (4.68) which is exactly the same as the collision probability for BB84 using a single photon source. The above result highlights two important points for the entangled photon protocol. First, one does not have to confine the source to either Alice or Bob s lab. Allowing Eve to have total control of the source does not effect the form of the collision probability. Second, there is no analog to the photon splitting attack for BBM92 since the collision probability bound was derived without assumptions on the source. The error rate and dual fire rate are sufficient to determine how much privacy amplification is necessary Ideal entangled photon source In this section, the expected communication rate for an ideal entangled photon source will be calculated. This source creates exactly one pair of photons per clock cycle, whose quantum state is given by ψ + = 1 2 ( xx + yy ). (4.69) Although proposals for creating such a source exist [72], no successful implementations of such proposals have been reported to date. Nevertheless, this simplified analysis will set the groundwork for the analysis of practical sources based on parametric down-conversion. When doing two photon experiments one is interested in coincidence events where the two receivers simultaneously detect a photon. As before, the following calculations will assume that the dual fire rate is negligibly small. Thus, the disturbance parameter simplifies to the error rate. The channel is assumed to be an exponentially decaying function of distance. Thus, the channel transmission T F can be written as T F = 10 (σl/10), (4.70)

91 4.3. QUANTUM CRYPTOGRAPHY WITH ENTANGLED PHOTONS 75 where σ is the loss coefficient. All losses to each receiver from the channel, detectors, and optics are combined into one beamsplitter with transmission α L = ηt F (L), (4.71) where η accounts for all distance independent losses in the system. The coincidence probability is separated into two parts, p true is the probability of a true coincidence from a pair of entangled photons, and p false is the probability of a false coincidence which, for an ideal source, can only occur from a photon and dark count or two dark counts. In the limit of negligible dual fire events, p coin = p true + p false. (4.72) The location of the source needs to be determined. If the source is set a distance x from Alice and L x from Bob, then p true = α x α L x = α L, and p false = 4α x d + 4α L x d + 16d 2. (4.73) keeping only terms which are second order in α x and d. It can be seen that the probability of a true coincidence does not change with x, but the false coincidence rate does. A simple optimization shows that the false coincidence rate achieves a minimum halfway between Alice and Bob, which is given by p false = 8α L/2 d + 16d 2. (4.74) Define n tot as the total number of signal pulses sent to the receivers, and n rec as the length of the error corrected key. Thus, The error rate e is n rec = n totp click. (4.75) 2 e = p false/2 + µp true p coin, (4.76)

92 76 CHAPTER 4. THEORY OF QUANTUM CRYPTOGRAPHY where µ is the baseline error rate of the signal. Using Eq. 4.17, one obtains ( r = n rec τ(e) κ ) t s. (4.77) n rec The asymptotic communication rate is once again defined as R = r lim. (4.78) n tot n tot Using the proof of security for BBM92, and accounting for the side information from error correction one obtains R = p coin 2 {τ(e) + f(e) [e log 2 e + (1 e) log 2 (1 e)]}. (4.79) The values of p coin and e can be calculated from Eq and Entangled photons from parametric down-conversion A more practical way of generating entangled photons is to use the spontaneous emission of a non-degenerate parametric amplifier. This technique, known as parametric down-conversion, is extensively used to generate entanglement in polarization as well as other degrees of freedom such as energy and momentum. Parametric amplifiers exploit the second order non-linearities of non-centrosymmetric materials. These nonlinearities couple three different modes of an electromagnetic field via the interaction Hamiltonian [22] H I = i hχ (2) V e i(ω ωa ω b)tâ ˆb + h.c. (4.80) where modes a and b are treated quantum mechanically while the third mode V e iωt is considered sufficiently strong to be treated classically. The state of the field after the nonlinear interaction is given by [ 1 T ] ψ = exp H I (t)dt 0. (4.81) i h 0 Assuming the energy conservation condition, ω = ω a + ω b, leads directly to ψ = e χ(â ˆb âˆb) 0, (4.82)

93 4.3. QUANTUM CRYPTOGRAPHY WITH ENTANGLED PHOTONS 77 where the parameter χ depends on several factors including the non-linear coefficient χ (2), the pump energy, and the interaction time. Using the operator identity [22] where directly leads to the relation e χ(â ˆb âˆb) = e Γâ ˆb e g(â â+ˆb ˆb+1) e Γâˆb, (4.83) ψ = 1 cosh χ Γ = tanh χ g = ln cosh χ, tanh n χ n a n b. (4.84) n=0 The above equation makes it clear that whenever a photon is detected in one mode, the conjugate mode must also contain a photon. In order to generate entanglement in polarization one needs to create a correlation between the polarization of these two modes. This is typically done using non-collinear Type II phase matching [34], which leads to the slightly more complicated interaction H I = i hχ (2) Ae (â iωt xˆb y + â ˆb ) y x + h.c. (4.85) where x and y refer to the polarization of the photon. Since all creation operators in the Hamiltonian commute, one can apply Eq to both mode pairs which directly leads to ψ = χ(âx etanh ˆb y+â y ˆb x) cosh 2 χ 0. (4.86) If χ is sufficiently small that the above expression can be kept only to first order then a parametric down-converter creates a Bell state. But χ cannot be made small without sacrificing the rate of down-conversion. The goal is to calculate the probability p coin and the error rate e as a function of the parameter χ, as well as the optical losses and dark counts of the detectors. First, define the field operator ˆψ = etanh χ(â x ˆb y+â y ˆb x) cosh 2. (4.87) χ

94 78 CHAPTER 4. THEORY OF QUANTUM CRYPTOGRAPHY The beamsplitter model introduced previously to account for the losses becomes very useful here. The beamsplitters perform a unitary operation on the modes which is given by â σ α L/2 â σ + 1 α L/2 ĉ σ ˆb σ α L/2ˆbσ + 1 α L/2ˆdσ, where σ represents polarization and the modes c and d are the reflected modes of the beamsplitters. To determine the state of the photons after the losses this beamsplitter transformation is first applied. To simplify the notation, define another field operator ψ ρφ = ˆρ x ˆφ y + ˆρ y ˆφ x, (4.88) where ρ and φ are any two independent modes. Using this definition, Eq is transformed by the two beamsplitters into [ ( ˆψ = tanh χ α L/2 ψ ab + 1 cosh 2 χ exp α L/2 ( 1 αl/2 ) (ψad + ψ bc ) + ( 1 α L/2 ) ψcd )]. (4.89) This expression can be expanded in terms of â and ˆb as 1 ˆψ = cosh 2 χ exp [ tanh χ ( ) ] { 1 α L/2 ψcd 1 + tanh χ α L/2 (1 α L/2 ) [ψ ad + ψ cb ] + } tanh χψ ab + tanh 2 χα L/2 (1 α L/2 )ψ ab ψ cb + ψ D where ψ D is the wave operator which contains all the terms that create more than one photon in either mode. It is now necessary to operate on the vacuum and trace out over modes c and d to get the final density matrix. As shown in Section 4.3.2, off diagonal terms that couple different photon number states can be ignored because they do not contribute to the signal. The density matrix ρ ψ+ is defined as the two photon density matrix in which the photons are in the entangled state ψ + given in Eq The matrices ρ a 0 and ρ b 0 represent a zero photon vacuum state in mode a and b respectively. Finally the matrices ρ a u and ρ b u are defined as ρ a,b u = I 2, (4.90)

95 4.3. QUANTUM CRYPTOGRAPHY WITH ENTANGLED PHOTONS 79 where I is the identity matrix. The above matrices correspond to an unpolarized photon in mode a or b respectively. After tracing out loss modes c and d and ignoring the coherence between different photon number states, the density matrix becomes ρ AB = Aρ ψ+ +Bρ a 0 ρ b 0+C ( ρ a u ρ b 0 + ρ a 0 ρu) b +Dρ a u ρ b u+(1 A B 2C D) ρ D, (4.91) where ρ D is the matrix which represents all the possible states in which more than one photon is in either mode a or b after the losses. The coefficients A, B, C, and D are 1 2αL/2 2 A = tanh2 χ cosh 4 χ (1 tanh 2 χ ( ) ) 2 4 (4.92) 1 α L/2 B = C = D = 1 1 cosh 4 χ (1 tanh 2 χ ( ) ) α L/2 (4.93) ( ) 1 2α L/2 1 αl/2 tanh 2 χ cosh 4 χ (1 tanh 2 χ ( ) ) α L/2 (4.94) ( ) 1 4α 2 2 L/2 1 αl/2 tanh 4 χ cosh 4 χ (1 tanh 2 χ ( ) ) α L/2 (4.95) In the above expression, A is the probability that Alice and Bob share an entangled pair of photons. This component on the signal will be defined as a true coincidence, because it leads to error free transmission. The coefficient B is then the probability that neither receiver gets a photon, either because the source failed to generate a pair or because all photons where lost. Similarly, C is the probability that one of the two receivers gets a photon but the other does not. In order for these signals to be factored into the key they must be accompanied by dark counts. Coefficient D is the probability that both receivers get a photon, but these photons are unpolarized and uncorrelated. Note that D is at least fourth order in tanh χ, indicating that at least two pairs must be created in order for it to exist. The intuitive explanation for the presence of this unpolarized component is that when higher order number states are created, and some of these photons are lost, the loss mode c and d play a similar role to Eve. The photons in these modes can potentially carry some information about

96 80 CHAPTER 4. THEORY OF QUANTUM CRYPTOGRAPHY the quantum state of the other photons, and will thus result in decoherence. Since this component of the signal causes a 50% error, it can be lumped into the definition of a false coincidence. Hence, p true = A p false = 16d 2 B + 8dC + D. The communication rate can be calculated by simply plugging these expressions into Eq. 4.72, 4.76 and Calculations The previous sections derived the communication rates for the BB84 protocol and the BBM92 protocol in the presence of experimental non-idealities. This section provides a quantitative comparison of the two protocols. Simulations are performed for fiber optical and free space key distribution experiments. For the fiber optical simulation, the 1.5µm telecommunication window is considered. For free space communication the focus is shifted to the visible wavelengths where single photon counters tend to perform best. In free space communication the channel loss is no longer an exponential function of distance. Instead, it is a complicated function which results from atmospheric effects, beam diffraction, and beam steering problems. Thus, for free space one is more interested in the rate as a function of the total loss rather than distance. Figure 4.8 shows the calculation results for both BB84 and BBM92 with ideal and realistic sources. Plot (a) of the figure shows results for fiber optical channels. Using experimental values from [73], the detector quantum efficiency is set to 0.18, d = , and the channel loss σ = 0.2dB/km. The baseline error rate is set to µ = 0.01, and an additional 1dB of loss is added to account for losses in the receiver unit. The curves corresponding to BBM92 plot the distance from Alice to Bob, with the source assumed halfway in between. Plot (b) shows calculations for free space quantum key distribution. The communication rate is plotted as a function of the total loss, including the detector quantum efficiency. In the free space curves for

97 4.3. QUANTUM CRYPTOGRAPHY WITH ENTANGLED PHOTONS 81 a) BB84 - Poisson BB84 - Ideal BBM92 - PDC BBM92 - Ideal Bits per Pulse 1x10-4 1x Distance (km) b) 1x10 0 1x10-2 1x10-4 BB84 - Poisson BB84 - Ideal BBM92 - PDC BBM92 - Ideal Bits per Pulse 1x10-6 1x10-8 1x x x Loss (db) Figure 4.8: Comparison between BB84 protocol and BBM92 using both ideal and realistic sources. Figure 2

98 82 CHAPTER 4. THEORY OF QUANTUM CRYPTOGRAPHY BBM92, the source is again placed halfway between Alice and Bob, and the rate is plotted as a function of the total loss in both arms. The dark counts of the detectors are set to In the curve for BB84 with a Poisson light source the average photon number n is a free adjustable parameter. Similarly with parametric downconversion, χ is a freely adjustable parameter. In both cases the parameters are chosen to numerically optimize the communication rate at each distance or channel loss. Each curve features a cutoff distance where the communication rate quickly drops to zero. This cutoff is due to the dark counts, which begin to make a non-negligible contribution to the signal at some point. However the two curves for BBM92 feature a much longer cutoff distance than their BB84 counterparts. This is due partially to the absence of the photon splitting attacks. But even when performing BB84 with ideal single photon sources, which don t suffer from photon splitting attacks either, the cutoff distance for BBM92 is still significantly longer. This is because in BBM92 a dark count alone cannot produce an error. It must be accompanied by a photon or another dark count, so it is much less likely to contribute to the signal. The difference in rates between the ideal entangled photon source and the parametric down-converter can be attributed to the interplay between coefficient A in Eq. 4.93, and coefficient D in Eq Term A is the probability of a real coincidence, and increases with χ. Term D on the other hand contributes to false coincidences and increases with χ as well, but is of higher order. One cannot make A arbitrarily large without getting an increased contribution from D. This leads to an optimum value for χ which is less than one Entanglement Swapping This section considers a more complicated scheme based on entanglement swapping. Figure 4.9 gives a diagram of the proposed configuration. A series of entangled photon sources, which are assumed to be ideal, are spread out an equal distance apart from Alice to Bob. The sources are clocked to simultaneously emit a single pair of entangled photons. Each of the pair is sent to a corresponding Bell State Analyzer, whose

99 4.3. QUANTUM CRYPTOGRAPHY WITH ENTANGLED PHOTONS 83 H/V H/V 50/50 Alice B B B B Bob EPR EPR EPR EPR EPR EPR Figure 4.9: BBM92 implementation with entanglement swapping. Boxes labelled B represent bell state analyzers, while Figure EPR represents 3 an entangled photon source. actions is to perform an entanglement swap. If all the swaps have been successfully performed, Alice and Bob will share a pair of entangled photons. Experimental demonstrations of a single entanglement swap can be found in [41]. Entanglement swapping is a key element for quantum repeaters, which use entanglement purification protocols to reliably exchange quantum correlated photons between two parties [40]. Here it is shown that even without such protocols, using only linear optical elements, photon counters, and a clocked source of entangled photons, swapping can enhance the communication distance. The key element to the scheme is the Bell Analyzer. Since the implementation is restricted to passive linear elements and vacuum auxiliary states, one cannot achieve a complete Bell Measurement. It has recently been shown that Bell Analyzers based on only these components cannot have better than a 50% efficiency [74]. One scheme which achieves this maximum is shown on the inset of Figure 4.9. This scheme will distinguish between the states ψ ± = 1 2 ( xy ± yx ), (4.96)

100 84 CHAPTER 4. THEORY OF QUANTUM CRYPTOGRAPHY but will register an inconclusive result if sent the states φ ± = 1 2 ( xx ± yy ). (4.97) The state generated by the entangled photon sources is assumed to be ψ +. Considering only a single swap, one can write ψ + 12 ψ + 34 = 1 2 [ ψ + 23 ψ + 14 ψ 23 ψ 14 + φ + 23 ψ + 14 φ 23 φ 14 ] (4.98) The above expression makes it clear that a Bell measurement on photons 2 and 3 leaves photons 1 and 4 in an entangled state, and the measurement result tells which one. After N such Bell measurements photon 1 and 2N will be entangled, and the N Bell measurement results will allow Alice and Bob to know which entangled state they share. Knowledge of this state allows them to do entangled photon key distribution and interpret their data correctly. Since the Bell analyzer has an efficiency of only 50%, in the best possible case there will be a price of 2 N in communication rate. Consider the single swap. Define α to be the detection probability for each photon. The probability that both photon 2 and 3 reach the Bell analyzer and are successfully projected is p true swap = 1 2 α2. (4.99) If a photon is lost in the fiber or due to detector inefficiency the Bell analyzer may still indicate that a Bell measurement has been performed due to detector dark counts. The probability of this happening is Defining the factor p false swap = 6αd + 12d 2. (4.100) g = p true swap p true swap + p false swap, (4.101) it is straightforward to show that, given the Bell analyzer registered a successful Bell measurement, the density matrix of photons 1 and 4 is given by ρ 14 = gρ ψ± + (1 g) I 4, (4.102)

101 4.3. QUANTUM CRYPTOGRAPHY WITH ENTANGLED PHOTONS 85 where ρ ψ± is is the pure state ψ + or ψ depending on the measurement result. For the case of N entanglement swaps the detection probability for each photon σl α = η10 10(2N+2), (4.103) where L is the distance from Alice to Bob. It is again straightforward to show that after N swaps, the state of photon 1 and 2N is ρ 1,2N = g N ρ ψ± + (1 g N ) I 4, (4.104) and the probability that all N bell measurements registered a successful result is Thus, p Bell = (p true swap + p false swap) N. (4.105) p true = p Bell g N α 2 p false = p Bell (8αd + 16d 2 + (1 g N )α 2 ). These can be plugged into Eq and 4.79 to get the final communication rate. Figure 4.10 compares the BBM92 with an ideal entangled photon source, a one swap scheme, and a two swap scheme using a fiber optic channel at 1.5µm. The swaps result in a longer cutoff distance which can lead to longer communication ranges. It should be noted however that at these distances the natural fiber loss is substantial and will lead to very slow communication rates. It is unclear whether swapping will lead to a practical form of quantum key distribution, but a single swap could be useful for very long distance QKD.

102 86 CHAPTER 4. THEORY OF QUANTUM CRYPTOGRAPHY 10 0 BBM92 1 swap 2 swaps Secure Bits per Pulse Distance (km) Figure 4.10: Comparison of no swap, one swap, and two swap scheme. Figure 4

103 Chapter 5 Quantum cryptography with sub-poisson light The security advantages of sub-poisson light over attenuated lasers and LEDs have already been established in the previous chapter. To date, there have been many experimental implementations of sub-poisson light sources. Most of these sources are based on single quantum emitters, such as single molecules or quantum dots [56, 60]. When a single emitter is excited by a light pulse whose duration is much shorter than the radiative lifetime, it can only capture one photon. After the laser pulse it re-emits this photon which can be collected and used for quantum cryptography. A second method of generating single photons is to use parametric down-conversion. This process can create photon pairs propagating in different directions. When a photon is detected in one arm, the other arm must also contain a photon. This creates a conditional single photon state. This type of single photon source will be investigated in chapter 7. This chapter focusses on generation of sub-poisson light using InAs quantum dots. Quantum dots are small confined structures in a semiconductor material which feature discrete optical resonances. In this sense they behave similarly to single atoms. Quantum dots achieve superb suppression of g (2), and due to micro-cavity technology, they can also feature high device efficiencies [57, 75, 76]. 87

104 88 CHAPTER 5. QUANTUM CRYPTOGRAPHY WITH SUB-POISSON LIGHT m Figure 5.1: Atomic force microscope image of uncapped quantum dot sample. 5.1 Sub-Poisson light from InAs quantum dots A quantum dot is a small spec of lower bandgap semiconductor material embedded in a higher bandgap semiconductor substrate. In this case, the lower bandgap material is Indium Arsenide (InAs), which is embedded in a Gallium Arsenide (GaAs) host. This is done by a process called self assembly. In this process, a thin layer of indium arsenide (on the order of a few monolayers) is grown on top a of a bulk gallium arsenide substrate. This thin layer is referred to as the wetting layer. Both the substrate and the wetting layer are grown by a technique known as Molecular Beam Epitaxy (MBE). Due to the lattice size mismatch between GaAs and InAs, it becomes energetically favorable for the InAs to clump into small islands, rather than remain a smooth layer of material. These islands, which are typically 4-7nm thick and 20-40nm wide, are called quantum dots (QDs). The size and density of the QDs depends on many growth parameters such as temperature and material concentrations. Quantum dot densities can vary from 10µm 2 to 500µm 2. Figure 5.1 shows an atomic force microscope (AFM) image of a typical quantum dot sample. The sample is uncapped, meaning that the final layer of GaAs has not

105 5.1. SUB-POISSON LIGHT FROM INAS QUANTUM DOTS 89 a) b) QD Figure 5.2: Scanning electron microscope image of micro-post structure. a, image of several micro pillars. b, close up image of micro-post showing DBR mirror structure. been grown yet. From the figure it is apparent that there are many quantum dots in a 1x1µm area. This makes it extremely difficult to isolate a single quantum dot by optical focussing. To better isolate the dots, the sample is etched into small micropost structures, as shown in figure 5.2. The micro-post structures are formed by laying sapphire dust on the surface of the sample, which is used as an etch mask. The diameter of the sapphire dust particles ranges from 0.2-2µm in diameter. After the dust particles are laid out, ion beam etching techniques are used to etch out all of the material except for the portions which are covered by the sapphire dust particles. The result are the micro-posts shown in the figure. After this structure is formed one can search for a post containing a quantum dot. The emission from a quantum dot embedded in bulk GaAs is difficult to collect for two primary reasons. The first is that the dot emits a dipole radiation pattern which emits into a large solid angle of possible directions. The second difficulty is due to the large mismatch in the index of refraction between air and GaAs. Because

106 90 CHAPTER 5. QUANTUM CRYPTOGRAPHY WITH SUB-POISSON LIGHT of this index mismatch, most of the light is lost to total internal reflection off the air GaAs barrier. Only a 30 degree solid angle of emission succeeds in leaking out the top and making it to the collection lens. To overcome this problem, the quantum dots are placed in a high-q optical cavity. The two mirrors of the cavity are formed by growing alternating quarter wavelength stacks of GaAs and AlAs. The cavity spacer layer is a half wavelength thick layer of GaAs containing quantum dots. Figure 5.2b shows a scanning electron microscope image of a micro-cavity post. The upper mirror is formed of 12 alternating layers of GaAs and AlAs, while the lower mirror is formed of 20 alternating layers. The purpose of the cavity is to redirect the spontaneous emission of the quantum dot into the cavity mode. If the quantum dot is on resonance with the cavity mode, the spontaneous emission rate into that made is enhanced over other modes by a factor proportional to the cavity Q. This is known as the Purcell effect [75]. The figure of merit for the effectiveness of the cavity in re-directing the spontaneous emission is known as the Purcell factor, which is the ratio of the lifetime of the cavity quantum dot normalized by its lifetime in bulk GaAs. The micro-post cavities in this work have achieved Purcell factors as high as 6, implying 83% coupling efficiency into the cavity mode [76]. Once the photon couples to the cavity, it leaks out the top in a well defined transverse mode which is very close to Gaussian. This mode can be efficiently collected by a large numerical aperture lens and used for quantum cryptography. To generate single photons, the sample containing the micropost structures with quantum dots is held at a temperature of 5-10K in a cryostat, as shown in figure 5.3. A micropost is excited every 13ns by picosecond laser pulses from a mode-locked Ti-Sapphire laser. The laser is tuned to 905nm, which is resonant with an excited state of the quantum dot, as shown in Figure 5.5. An electron hole pair is generated in this excited state, and quickly relaxes to a ground state exciton via non-radiative decay channels. The ground state exciton then re-emits a photon. A spectrometer can be used to measure the emission spectrum on the dot. The spectrum is shown in panel a of Figure 5.4. This spectrum features a sharp resonance for the quantum dot at 920nm, which is the ground state exciton emission wavelength. The lifetime of the dot is measured by a streak camera. The streak camera measurement is shown

107 5.1. SUB-POISSON LIGHT FROM INAS QUANTUM DOTS 91 He Cryostat SM fiber Grating QD Time Interval Analyzer Ti:Sapphire Laser SPCM BSP Monitoring Detector Spec Slit Start Flip Mirror Stop Delay SPCM HBT interferometer Figure 5.3: Experimental setup for characterizing quantum dot photon source. in panel b of the figure. From this measurement, the lifetime is determined to be 0.174ns. In order to use the emission from the quantum dot, one needs to be able to isolate the ground state emission wavelength and separate it from other sources of background photoluminescence. This wavelength selection is done by a grating spectrometer. The emission is first coupled to a single mode fiber which serves as the input slit to this spectrometer. The light is then reflected off of a grating with efficiency of about 70%, and focussed onto a spectrometer slit. After the spectrometer slit the light can be sent either to a photon counter, to measure the efficiency of the dot, or onto a HBT intensity interferometer to measure the autocorrelation. The results of the efficiency measurement are shown in figure 5.6. This plot shows the count rate on the monitoring detector as a function of pumping power from the Ti:Saphire laser. The counting rate initially increases in proportion to the excitation intensity, but eventually saturates ate 245,000 counts per second. The detector efficiency at the emission wavelength is 0.3. A time resolved measurement is used to

108 92 CHAPTER 5. QUANTUM CRYPTOGRAPHY WITH SUB-POISSON LIGHT a) b) 0.174ns Figure 5.4: a, wavelength spectrum of quantum dot. The dot features a narrow emission line at 920nm. b, the lifetime of the dot is measured by a streak camera to be 0.174ns. determine that 25% of the emission is background photoluminescence, which has a long emission time. In order to calculate the device efficiency, the background photoluminescence is subtracted and the counts are corrected for the quantum efficiency of the detector. The corrected count rate is compared to the repetition rate of the excitation laser, which is 76MHz. This gives an average of photons per pulse emitted from the quantum dot. To determine the actual efficiency of the dot, one needs to correct for losses from fiber coupling, reflection losses from optics, and grating inefficiency. The transmission efficiency from the fiber and subsequent interconnects is measured to be 0.3. Reflection losses from optics amounts to a transmission efficiency of 0.7, while the grating has an efficiency of 0.7. This results in an overall transmission efficiency from the collection lens to the detector of After correcting for this loss it is determined that the output efficiency of the quantum dot is 4.6%. The second important measurement is the autocorrelation. This is done with

109 5.1. SUB-POISSON LIGHT FROM INAS QUANTUM DOTS 93 Conduction Band n=2 n= ev n=1 n=2 Valence Band Figure 5.5: Energy level diagram of quantum dot showing resonant excitation scheme Efficiency Operating Point Pump Power (uw) Figure 5.6: Saturation curve for quantum dot.

110 94 CHAPTER 5. QUANTUM CRYPTOGRAPHY WITH SUB-POISSON LIGHT Counts Time De lay (ns) Figure 5.7: Autocorrelation measurement for quantum dot single photon source. The area of the τ = 0 peak is suppressed to 0.14 of a far off side peak. an HBT intensity interferometer. The results of the autocorrelation are shown in Figure 5.7. The correlation features a series of peaks separated by the pulse repetition rate of the laser. The area of the central τ = 0 peak is proportional to the parameter g (2), defined in Eq In the low efficiency limit, one can normalize this central peak by one of the side peaks. However, there is one subtlety that must be considered. As can be seen from the autocorrelation, the area of the first two side peaks is enhanced relative to the other peaks. In fact, there is a gradual exponential decay of the side peaks to a steady state value in the long τ limit. This behavior is indicative of dot blinking. This means that at times, the dot can oscillate from a bright state, where it emits photons, to a dark state where it doesn t emit photons. If a photon is detected at a certain time, then the dot must be in a bright state at that moment. It is more likely that for times close to this detection event, the dot will still be in a bright state. Hence, the probability of detecting a photon a time τ later is enhanced for shorter times. Because of this blinking effect it is important to normalize the central peak by a far off side peak, were the blinking effect is averaged out. This results in a g (2)

111 5.2. QUANTUM CRYPTOGRAPHY WITH A QUANTUM DOT 95 of 0.14, indicating nearly an order of magnitude suppression in multi-photon states relative to Poisson light. 5.2 Quantum cryptography with a quantum dot Having characterized the source, it can now be used to exchange a raw quantum key. The experimental setup for implementing the BB84 protocol is shown in figure 5.8. The same collection optics and spectrometer are used to isolate the emission resonance of the quantum dot. An electrooptic modulator is used to prepare the polarization state of each photon before it enters the channel. A data generator, whose signal is amplified by a high power amplifier, drives the modulator. The data generator is synchronized to the Ti-Sapphire laser pulse, and produces a random 4 level signal corresponding to the four different polarization states in the BB84 protocol. The quantum channel is a 1m free space propagation. Bob s detection apparatus is composed of a beamsplitter, which partitions each photon randomly to one of two polarization analyzers. Both Alice and Bob share a common clocking signal from the data generator. Each of Bob s detection events is recorded by a time-interval analyzer (TIA), together with a time stamp of the event relative to the common clock. A detection is also used to generate a logic pulse (containing no information about the detection result) which triggers a second TIA in Alice s apparatus. This TIA records the polarization state which was prepared, along with a time stamp that can be used for later comparison with Bob s data. To verify that communication is being properly implemented, the data generator is set to create a random number pattern. A long stream of qubits is then exchanged. A detection correlation between the state of the data generator and Bob s detection events is then performed. The result of this data correlation is shown in Figure 5.9. When Bob measures in the same basis that Alice sent, the data is well correlated. However, if Bob measures in an incompatible basis the measurement results are uncorrelated with Alice s transmission, as expected. The central diagonal of the figure represents error events, where Alice sent one polarization, and Bob detected the orthogonal polarization. These error events are caused by imperfect extinction ratio

112 96 CHAPTER 5. QUANTUM CRYPTOGRAPHY WITH SUB-POISSON LIGHT He Cryostat QD SM fiber Grating Ti:Sapphire Laser Det 3 Det 4 Channel EOM Spec Slit Det 1 Var. Atten Amp Det 2 TIA TIA Data Gen Figure 5.8: Experimental setup for implementing BB84 with quantum dot photon source.

113 5.2. QUANTUM CRYPTOGRAPHY WITH A QUANTUM DOT Alice L Alice R Alice V Alice H Bob H Bob V Bob R Bob L Figure 5.9: Data correlation between Alice and Bob. of the polarization optics, as well as bias drift in the modulator. From the central diagonal, the bit error rate is calculated to be 2.5%. In order to correct the errors in the transmission, the error correction algorithm described in [25] is implemented. In this algorithm, Alice and Bob s strings are broken up into blocks. The parity of each block is compared. In the blocks where the parities don t match, a bisective search is performed to find the error and correct it. This algorithm was able to find all of the errors while operating within 25% of the Shannon limit. After error correction, privacy amplification is performed to generate the final key. The compression function is formed by taking random parity blocks of the error corrected key. The amount of compression required is given by Eq The parameters e and κ are experimentally measured. For the measured error rate and g (2), the key must be compressed by about 60%, yielding a final communication rate

114 98 CHAPTER 5. QUANTUM CRYPTOGRAPHY WITH SUB-POISSON LIGHT Figure 5.10: Comparison between attenuated laser and quantum dot single photon source. of 25kbits/s. The security parameters s and t are selected to be 250 bits each. This makes Eve s mutual information on the final key It is important to compare the performance of our quantum cryptography system to those based on more conventional sources such as attenuated lasers. To do this, an attenuated Ti:Sapphire laser is used as a second source of photons for the quantum cryptography system. The performance of the system using the laser, with measured g (2) = 1, to the performance using the quantum dot with g (2) = 0.14, can then be compared. The communication rates with both sources are experimentally measured as a function of channel loss. The channel loss is adjusted by a variable attenuator which is inserted into the quantum channel. The results of the comparison are shown in Figure At low loss levels the communication rate of the attenuated laser is higher because a laser starts out with a macroscopically large number of photons, which can be attenuated to any desired average. This is in contrast to the quantum dot which is limited by the device efficiency and losses in subsequent optics. However, at higher channel losses the laser emits too many multi-photon states causing a more rapid decrease in communication. At around 16dB the quantum dot begins

115 5.2. QUANTUM CRYPTOGRAPHY WITH A QUANTUM DOT 99 a) b) Alice Key Original Message Bob Key Encrypted Message # pixels Pixel Value # pixels Pixel Value Figure 5.11: Demonstration of one time pad encryption. The message is a 140x141 pixel bitmap of Stanford s memorial church, approximately 20kilobyte in length. a, a 20kilobyte key is exchanged over the quantum cryptography system and used to encode the message. The encoded message looks like white noise to anyone who does not possess the key. Decryption allows perfect recovery of the original message. b, a pixel value histogram of the original and encrypted message. The original message shows definite structure, while the distribution for the encrypted message appears flat, reminiscent of white noise. to outperform an attenuated laser. Above 23dB of loss secure communication is no longer possible with the laser, while the quantum dot source can withstand channel losses of about 28dB. This demonstrates the security advantage of this device in the presence of channel losses. Finally, it is demonstrated that the system can be used to exchange a real message by implementing the Vernam cipher described in chapter 2. Figure 5.11 shows how this is done. A 140x141, 256 color pixel bitmap of Stanford s Memorial Church serves as the message. The size of the message is roughly 20 kbytes. The cryptography system is used to exchange a 20 kilobyte key. Alice uses her copy of the key to

116 100CHAPTER 5. QUANTUM CRYPTOGRAPHY WITH SUB-POISSON LIGHT do a bitwise exclusive OR operation with every bit of the message. The resulting encrypted message looks like white noise to anyone who does not posses a copy of the key, as shown in the figure. This is further illustrated by the pixel value histograms shown in panel b of the figure. The pixel value histogram of the message shows clear structure. The histogram of the encoded message, on the other hand, appears flat, reminiscent of white noise. Bob decodes the encrypted message by performing a second bitwise exclusive OR using his copy of the key. This faithfully reproducing the original message, without any pixel errors.

117 Chapter 6 The Visible Light Photon Counter One of the main tools in the upcoming chapters is the Visible Light Photon Counter (VLPC). The VLPC is a relatively new concept in single photon detection which features many advantages over more conventional photon counters such as avalanche photodiodes (APDs) and photomultiplier tubes(pmts). These advantages include high quantum efficiency, low pulse height dispersion, and multi-photon counting capability. This chapter gives a detailed account of the operation principle and advantages of the VLPC. Although the VLPC has many advantages, it also has some disadvantages. The main disadvantage is that the VLPC is difficult to use. It requires 6K operation temperature as well as shielding from room temperature thermal photon. The cryogenic system for implementing this will be described. 6.1 VLPC operation principle Figure 6.1 shows the structure of the VLPC detector. Photons are presumed to come in from the left. The VLPC has two main layers, an intrinsic silicon layer and a lightly doped arsenic gain layer. The top of the intrinsic silicon layer is covered by a transparent electrical contact and an anti-reflection coating. The bottom of the detector is a heavily doped arsenic contact layer, which is used as a second electrical contact. 101

118 102 CHAPTER 6. THE VISIBLE LIGHT PHOTON COUNTER Anti-reflection Coating Transparent Contact Intrinsic Region Gain Region Drift Region Contact Region and Degenerate Substrate e h e D+ +V e D+ Visible Photon 0.4 m < < 1.0 m Figure 6.1: Schematic of the structure of the VLPC detector. A single photon in the visible wavelengths can be absorbed either in the intrinsic silicon region or in the doped gain region. This absorption event creates a single electron-hole pair. Due to a small bias voltage (6-7.5V) applied across the device, the electron is accelerated towards the transparent contact while the hole is accelerated towards the gain region. The gain region is moderately doped with As impurities, which are shallow impurities lying only 54meV below the conduction band. Because the device is cooled to an operation temperature of 6-7K, there is not enough thermal energy to excite donor electrons into the conduction band. These electrons are effectively frozen out. However, when a hole is accelerated into the conduction band it easily impact ionizes these impurities, kicking the donor electrons into the conduction band. These electrons can create subsequent impact ionization events resulting in avalanche multiplication. One of the nice properties of the VLPC is that, when an electron is impact ionized from an As impurity, it leaves behind a hole in the impurity state, rather than in the valence band as in the case of APDs. The As doping density in the gain region is carefully selected such that there is partial overlap between the energy states of adjacent impurities. Thus, a hole trapped in an impurity state can travel through conduction hopping, a mechanism based on quantum mechanical tunneling. This conduction hopping mechanism is slow, so the hole never acquires sufficiency kinetic energy to impact ionize other As sites. The only carrier that can create additional impact ionization events is the electron kicked into the conduction band. Thus,

119 6.2. CRYOGENIC SYSTEM FOR OPERATING THE VLPC 103 the VLPC has a natural mechanism for creating single carrier multiplication, which is known to significantly reduce multiplication noise [77]. The multiplication noise properties of the VLPC will be discussed in further detail in a later section. One of the disadvantages of using shallow As impurities for avalanche gain is that these impurities can easily be excited by room temperature thermal photons. IR photons with wavelengths of up to 30µm can optically excite an impurity. These excitations can create extremely high dark count levels. The bi-layer structure of the VLPC helps to suppress this. A visible photon can be absorbed both in the intrinsic and doped silicon regions. An IR photon, on the other hand, can only be absorbed in the doped region, as its energy is smaller than the bandgap of intrinsic silicon. Thus, the absorption length of IR photons is much smaller than visible photons. This suppresses the sensitivity of the device to IR photons to about 2%. Despite this suppression, the background thermal radiation is very bright, requiring orders of magnitude of additional suppression. In the next section we will discuss how this is achieved. 6.2 Cryogenic system for operating the VLPC In order to operate the VLPC, it must be cooled down to cryogenic temperatures to achieve carrier freezeout of the As impurities. It must also be shielded from the bright room temperature thermal radiation which it is partially sensitive to. This is achieved by the cryogenic setup shown in Figure 6.2. The VLPC is held in a helium bath cryostat. A small helium flow is produced from the helium bath to the cryostat cold finger by a needle valve. The helium bath is surrounded by a nitrogen jacket for radiation shielding. This improves the helium hold time. A thermal shroud, cooled to 77K by direct connection to the nitrogen jacket, covers the VLPC and low temperature shielding. This shroud is intended to improve the temperature stability of the detector by reducing the thermal radiation load. A hole at the front of the shroud allows photons to pass through. The detector itself is encased in a 6K shield made of copper. The shield is cooled by direct connection to the cold plate of the cryostat. The front windows of the 6K radiation shield, which

120 104 CHAPTER 6. THE VISIBLE LIGHT PHOTON COUNTER Room Temp Window Acrylic Windows 77K shield Retro-reflector 6K shield VLPC Room Temp Vacuum Jacket Figure 6.2: Schematic of cryogenic setup for VLPC. are also cooled down to this temperature, are made of acrylic plastic. This material is highly transparent at optical frequencies, but is almost completely opaque from 2-30µm. The acrylic windows provide the required filtering of room temperature IR photons for operating the detector. Sufficient extinction of the thermal background is achieved using cm of acrylic material. In order to eliminate reflection losses from the window surfaces, the windows are coated with a broadband anti-reflection coating at 532nm. Room temperature transmission measurements indicate a 97.5% transmission efficiency through the acrylic windows. The surface of the VLPC is anti-reflection coated for 550nm, which is close to our intended operating wavelength of 532nm. Nevertheless, due to the large index mismatch between silicon and air, there is still substantial reflection losses on the order of 10%, even at the correct wavelength. In order to eliminate these reflection losses, the detector is rotated 45 degrees to the direction of the incoming light. A spherical refocussing mirror, with reflectance exceeding 99%, is used to redirect any

121 6.3. QUANTUM EFFICIENCY AND DARK COUNTS OF THE VLPC 105 reflections back onto the detector surface. A photon must reflect twice off of the surface in order to be lost. This reduces the reflections losses to less than 1%. The VLPC features high multiplication gains of about 30,000 electrons per photoionization event. Nevertheless, this current must be amplified significantly in order to achieve sufficiently large signal for subsequent electronics. Two different types of amplifier configurations have been implemented. The first is a high bandwidth configuration, consisting of a commercial cryogenic pre-amplifier, with an operating bandwidth of M Hz, followed by additional commercial room temperature RF amplifiers. Such a configuration creates a 120mV pulse with a 3ns duration when using 62dB of amplifier gain. This high-bandwidth configuration is used to characterize the performance of the VLPC. The second amplifier scheme is a charge integrating configuration. A commercial charge integrating amplifier is used, followed by a pole-zero canceller and a commercial Ortec amplifier with adjustable gain. The charge integrating configuration is a low noise technique which allows photon counting over large time intervals with minimal amplifier input noise. This scheme will be used in the upcoming chapters describing non-classical statistics and photon number generation by conditional post-selection. 6.3 Quantum efficiency and dark counts of the VLPC The quantum efficiency (QE) of the VLPC at 650nm wavelength has been previously measured to be as high as 88% [19]. The dark counts at this peak QE were 20,000 1/s. The work shown here uses a different operating wavelength of 532nm, and a different cryogenic setup. Therefore, another measurements of dark counts and QE at this wavelength and using the current cryogenic setup is presented. The setup for measuring the quantum efficiency of the VLPC is shown in Figure 6.3. A helium neon laser with an output wavelength of 543nm is used as a light source for the measurement. An intensity stabilizer is used to stabilize the output of the laser to within about 0.1%. A beamsplitter sends part of the laser to a calibrated PIN diode to measure the power. The power reading from the diode is accurate to within a 2% calibration error. This power reading is used to calculate the

122 106 CHAPTER 6. THE VISIBLE LIGHT PHOTON COUNTER Amps Disc/ Counter PIN Diode Iris Helium Neon Laser 543nm VLPC 250mm lens Attenuators BSP Intensity Stabilizer Figure 6.3: Experimental setup to measure quantum efficiency of the VLPC. photon flux N, in units of photons per second. This is given by the relation N = λp hc, (6.1) where λ is the wavelength of the laser, P is the power measured by the PIN diode, h is Planke s constant, and c is the velocity of light in vacuum. The laser is attenuated by a series of carefully calibrated neutral density (ND) filters down to a flux of approximately 20,000 cps. The attenuation required for this is on the order of This flux is sufficiently small to ensure linearity of the VLPC. At count rates exceeding 10 5 cps, the efficiency of the VLPC will begin to drop due to dead time effects. The efficiency of the VLPC is measured by recording the count rates of the detector, which we label N c, as well as the background N d. The backgrounds are measured by blocking out the laser. The counts are compare the rate calculated from the power reading on the PIN diode and the attenuation from the ND filters. The measured efficiency η is given by where α is the transmission efficiency of the ND filters. η = N c N d αn, (6.2) Figure 6.4 shows the measured quantum efficiency of the VLPC as a function of applied bias voltage across the device. Efficiencies are given for several different operating temperatures. At 7.4V bias the VLPC attains its highest quantum efficiency of 85%. As the bias voltage is decreased the quantum efficiency also decreases. The reason for this is that, at lower bias voltages, electrons created by impact ionization

123 6.3. QUANTUM EFFICIENCY AND DARK COUNTS OF THE VLPC 107 of the initial hole are less likely to accumulate sufficient kinetic energy in the gain region to trigger an avalanche. The bias voltage cannot be increased beyond 7.4V. Beyond this bias the VLPC breaks down, resulting in large current flow through the device. This breakdown is attributed to direct tunnelling of electrons from impurity sites into the conduction band. One will notice that as the temperature is decreased, more bias voltage is required to achieve the same quantum efficiency. This effect is attributed to a temperature dependance of the dielectric constant of the device, which results in a change in the electric field intensity in the gain region of the VLPC. As the temperature is decreased, the dielectric constant is increasing, requiring higher bias voltage to achieve the same electric field intensity. This conjecture is supported by the measurements shown in Figure 6.5. This figure plots the quantum efficiency as a function of dark counts, instead of bias voltage. Data is shown for the different temperatures. Increased bias voltage results not only in increased quantum efficiency, but also in increased dark counts. Increasing the temperature also increases both quantum efficiency and dark counts. But when the quantum efficiency is plotted as a function of dark counts, as is done in Figure 6.5, the data for different temperatures all lie along the same curve. This suggests that the quantum efficiency and dark counts both depend on a single parameter, the electric field intensity in the gain region. Changing the temperature and bias voltage effects these two numbers by effecting this parameter. The figure shows that the maximum quantum efficiency of 85% is achieved at a dark count rate of roughly 20,000 cps. In order to infer the efficiency of the VLPC, all other losses in the detection system must be characterized. The acrylic windows are a big source of loss in the system. Although at room temperature they were measured to have a transmission efficiency of 97.5%, the performance of the windows degrades appreciably when they are cooled to cryogen temperatures. Reflectance measurement of the windows at low temperature indicate a 7% reflection loss. In addition to this loss, there a reflection loss of 1% due to the VLPC, despite the retro-reflector. Other effects such as detector dead time and beam focussing should contribute only negligibly small corrections to the device efficiency. Thus, the efficiency of the VLPC detector itself is estimated to

124 108 CHAPTER 6. THE VISIBLE LIGHT PHOTON COUNTER Quantum Efficiency Bias (V) Figure 6.4: Quantum efficiency of VLPC vs. bias voltage for different temperatures Quantum Efficiency K 6.4K 6.5K 6.6K 6.7K Dark Counts (1/s) Figure 6.5: Quantum efficiency of VLPC vs. dark counts for different temperatures.

125 6.4. NOISE PROPERTIES OF THE VLPC 109 be 93% at 543nm wavelengths. 6.4 Noise properties of the VLPC When a photon is absorbed in a semi-conductor material, it creates a single electron hole pair. The current produced by this single pair of carriers is, in almost all cases, too weak to observe due to thermal noise in subsequent electronic components. Single photon counters get around this problem by using an internal gain mechanism to multiply the initial pair into a much greater number of carriers. Avalanche photodiodes achieve this by an avalanche breakdown mechanism in the depletion region of the diode. Photomultipliers instead rely on successive scattering off of dynodes. The VLPC achieves this gain by impact ionization of shallow arsenic impurities in silicon. All of the above gain mechanism have an intrinsic noise process associated with them. That is, a single ionization event does not produce a deterministic number of electrons. The number of electrons the device emits fluctuate from pulse to pulse. This internal noise is referred to as multiplication noise, or gain noise. The amount of multiplication noise that a device features strongly depends on the avalanche mechanism. The noise is typically quantified by a parameter F, called the excess noise factor (ENF). The ENF is mathematically defined as F = M 2 M 2, (6.3) where M is the number of electrons produced by a photo-ionization event, and the brackets notation represents statistical ensemble averages. Noise free multiplication is represented by F = 1. deterministic number of additional carriers. result in an ENF exceeding 1. In this limit, a single photo-ionization event creates a Fluctuations in the gain process will The noise properties of an avalanche photo-diode are well characterized. The first theoretical study of such devices was presented by McIntyre in 1966 [77]. McIntyre studied avalanche gain in the Markov limit. In this limit, the impact ionization probability for a carrier in the depletion region is a function of the local electric field intensity at the location of the carrier. In this sense, each impact ionization

126 110 CHAPTER 6. THE VISIBLE LIGHT PHOTON COUNTER event is independent of past history. Under this assumption the ENF of an APD was calculated. The ENF depends on the number of carriers that can participate in the avalanche process. If both electrons and holes are equally likely to impact ionize, then F M. In the large gain limit the ENF is very big. Restricting the impact ionization process to only electrons or holes significantly reduces the multiplication noise. In this ideal limit, one obtains F = 2. This limit represents the best noise performance achievable within the Markov approximation. PMTs are known to have better noise characteristics than APDs. The ENF of a typical PMT is around 1.2. This suppressed noise is because, in a PMT, a carrier is scattered off of a fixed number of dynodes. The only noise in the process is the number of electrons emitted by each dynode per electron. The multiplication noise properties of the VLPC have been previously studied. Theoretical studies of the multiplication noise have predicted that the VLPC features nearly noise free avalanche multiplication [78]. This is due to three dominant effects. First, because only electrons can cause impact ionization, the VLPC features a natural single carrier multiplication process. Second, the VLPC does not require high electric field intensities to operate. This is because impact ionization events occur off of shallow arsenic impurities which are only 54meV from the conduction band. Thus, carriers do not have to acquire a lot of kinetic energy in order to scatter the impurity electrons. Because of the lower electric field intensities, a carrier requires a fixed amount of time before it can generate a second impact ionization. This delay time represents a deviation from the Markov approximation, and is predicted to suppress the multiplication noise [78]. A third factor is that the positive charged impurity holes drift very slowly, relative to the conduction band electrons. This builds up a positive space charge region in the device which helps contain the avalanche. The ENF of the VLPC has been experimentally measured to be less than 1.03 in [21]. Thus, the VLPC features nearly noise free multiplication, as predicted by theory. This low noise property will play an important role in multi-photon detection.

127 6.5. MULTI-PHOTON DETECTION WITH THE VLPC Multi-photon detection with the VLPC The nearly noise-free avalanche gain process of the VLPC opens up the door to perform multi-photon detection. When two photons are detected by the VLPC, the number of electrons emitted is expected to be twice that of a single photon detection. If the photons arrive within a time interval which is much shorter than the electronic time scales of the detection system, one expects to observe a detection pulse which is twice as high. In the limit of noise free multiplication, this would certainly be the case. A single detection event would create M electrons, while a two photon event would create 2M electrons. Higher photon numbers would follow the same pattern. After amplification, the area or height of the detector pulse would allow perfect discrimination of the number of detected photons, even if they arrive on extremely short time scales. In the presence of multiplicatiom noise, the situation becomes more complicated. The pulse height of a one photon pulse will fluctuate, as will that of a two photon pulse. There becomes a finite probability that only one photon is detected, but due to multiplication noise the height of the pulse appears to be more consistent with a two photon event, and vice versa. The ability to discriminate the number of detected photons becomes a question of signal to noise ratio. There are ultimately two effects which will limit multi-photon detection. One is the quantum efficiency of the detector, denoted as η. The probability of detecting n photons is given by η n, assuming detector saturation is negligible. Thus, the detection probability is exponentially small in η. For larger n this may produce extremely low efficiencies. The second limitation is the electrical detection noise, as previously discussed. There are two contributions to the electrical noise. One is the excess noise of the detector, and the other is electrical noise originating from amplifiers and subsequent electronics. The latter can in principle be eliminated by engineering ultralow noise circuitry. The former, however, is a fundamental property of the detector which cannot be circumvented, short of engineering a different detector with better noise properties. In the absence of detection inefficiency and amplifier noise, the multiplication noise

128 112 CHAPTER 6. THE VISIBLE LIGHT PHOTON COUNTER will ultimately put a limit on how many photons can be discriminated. Defining σ m and the standard deviation of the multiplication gain, the fluctuations of an n photon peak will be given by nσ m. This is because the n photon pulse is simply the sum of n independent single photon pulses from different locations of the VLPC active area. Summing the pulses also causes the variance to sum, resulting in the buildup of multiplication noise. The mean pulse height separation between the n photon peak and the n 1 photon peak, however, is constant. It is simply proportional to M, the average multiplication gain. At some sufficiently high photon number, the fluctuations in emitted electrons will be so large that there is little distinction between an n and n 1 photon event. One can arbitrarily establish a cutoff at the point where the fluctuations in emitted electrons is equal to the mean separation between the n and n 1 photon peaks. Using this definition, the maximum photon number that can be discriminated is N max = 1 F 1. (6.4) The above condition indicates that even an ideal APD with F = 2 cannot discriminate between 1 and 2 photon events. A PMT with F = 1.2 could potentially be useful for up to 5 photon detection, but due to their low quantum efficiency ( 0.2), this is typically impractical. The VLPC, with F < 1.03 could potentially detect more that 30 simultaneous photons. Furthermore it could potentially do this with 93% detection efficiency. However, this limit is difficult to approach due to electronic noise contribution from subsequent amplifiers. 6.6 Characterizing multi-photon detection capability The multi-photon detection capability of the VLPC has been previously studied. Early studies used long light pulse excitations, with poor electronic time resolution so that multiple photons appeared as a single electronic pulse [79]. Later studies used twin photons generated from parametric down-conversion, which arrive nearly simultaneous, to investigate multi-photon detection [20]. These studies restricted

129 6.6. CHARACTERIZING MULTI-PHOTON DETECTION CAPABILITY 113 their attention to one and two photon detection. Higher order number states were not considered. The experiment described below measures the photon number detection capability of the VLPC when excited by a large number of simultaneous photons. Figure 6.6 shows the experimental setup. A Ti:Sapphire laser, emitting pulses of about 3ps duration, is used. The duration of the optical pulses are much shorter than the electrical pulse of the VLPC detector, which is 2ns. A pulse pick is used to down-sample the repetition rate of the laser from 76MHz to 15KHz. This is done in order to avoid saturation of the detector. A synchronous countdown module, which generates the pulse picking signal, is also used to trigger a boxcar integrator. The output of the VLPC is amplified by high bandwidth RF amplifiers. The first amplifier is a cryogenic module, cooled to 4K by direct thermalization to the helium bath of the cryostat. This helps to minimize thermal electrical noise, which is important for multi-photon detection. The noise figure of the amplifier is about 0.2. Subsequent room temperature RF amplifiers are used for additional gain. The amplified signal is integrated by a boxcar integrator. The integrated value of a pulse should be proportional to the number of electrons emitted by the detector, as long as amplifier saturation is negligible. The output of the boxcar integrator is digitized by an A2D converted, and stored on a computer. Figure 6.7 shows a sample oscilloscope pulse trace of a VLPC pulse after the room temperature amplifiers. The output features an initial sharp negative peak of about 2ns full width at the half maximum, followed by a positive overshoot. This positive overshoot is the result of the 30MHz high pass of the cryogenic amplifiers. Comparison of the variance of the electrical fluctuations before the pulse to the minimum pulse value indicates a signal to noise ration (SNR) of 27. The figure also illustrates the integration window used by the boxcar integrator, which captures only the negative lobe of the pulse. In order to measure the multi-photon detection capability, the laser is attenuated to about 1-5 detected photons per pulse. For each laser pulse, the output of the VLPC is integrated and digitized. Figure 6.8 shows pulse area histograms for four different excitation powers. The area is expressed in arbitrary units determined by

130 114 CHAPTER 6. THE VISIBLE LIGHT PHOTON COUNTER Pulse Picker Sync Count VLPC Boxcar Int. lense 250 mm Cryo Amp RF Amp Ti:Sapphire Figure 6.6: Experimental setup to measure multi-photon detection capability of the VLPC Voltage (V) SNR= Time (ns) Integration Window Figure 6.7: Oscilloscope pulse trace of VLPC output after room temperature RF amplifiers.

131 6.6. CHARACTERIZING MULTI-PHOTON DETECTION CAPABILITY 115 the A2D converter. Because the pulse area is proportional to the number of electrons in the pulse, the pulse area histogram is proportional to the probability distribution of the number of electrons emitted by the VLPC. This probability distribution features a series of peaks. The first peak is a zero photon event, followed by one photon, two photons, and so on. In the absence of electronic noise and multiplication noise, these peaks would be perfectly sharp, allowing perfect discrimination of the photon number. Due to electronic noise however, the peaks become broadened and start to partially overlap. The broadening of the zero photon peak is due exclusively to electronic noise. Note that the boxcar integrator adds an arbitrary constant to the pulse area, which is why the zero photon peak is centered around 450 instead of 0. The one photon peak is broadened by both electronic noise and multiplication noise. Thus, it is much broader than the zero photon peak. As the photon number increases, the width of the pulses also increases due to buildup of multiplication noise. This eventually causes the smearing out of the probability distribution at around seven photons. In order to numerically analyze the results, each peak is fit to a gaussian distribution. Theoretical studies predict that the distribution of the one photon peak is a bi-sigmoidal distribution, rather than a gaussian [78]. However, when the multiplication gain is large, as in the case of the VLPC, this distribution is well approximated by a gaussian. This approximation is used because higher order number states are sums of several single photon events. A gaussian distribution has the nice property that a sum of gaussian distributions is also a gaussian distribution. In the limit of large photon numbers this approximation is expected to improve due to the central limit theorem. The most general fit would allow the area, mean, and variance of each peak to be independently adjustable. This allows too many degrees of freedom, which often results in the optimization algorithm falling into a local minimum. To help avoid this, the average of each peak is not independently adjustable. Instead, the averages are required to be equally spaced, as would be expected from the detection model of the VLPC. Thus, the average of the i th peak, denoted x i, is determined by the relation x i = x 0 + i i 2 α. (6.5)

132 116 CHAPTER 6. THE VISIBLE LIGHT PHOTON COUNTER a) Counts Data point Total Fit Single Peak 5 b) Counts c) Pulse Area (AU) d) Pulse Area (AU) Counts Pulse Area (AU) Counts Pulse Area (AU) Figure 6.8: Pulse area spectrum from VLPC. The dotted lines represent the fitted distribution of each photon number peak. The solid line is the total sum of all the peaks. Diamonds denote measured data points. Student Version of MATLAB

133 6.6. CHARACTERIZING MULTI-PHOTON DETECTION CAPABILITY 117 In the above equation, x 0 is the average of the zero photon peak, is the spacing between peaks, and α is a small correction factor that can account for effects such as amplifier saturation. These three parameters are all independently adjustable. In all of the fits, α was much smaller the indicating the peaks are, for the most part, equally spaced. Figure 6.8 shows the results of the fits for each excitation intensity. The dotted lines plot the individual gaussian distributions for the different photon numbers, and the solid line plots the sum of all of the gaussians. The diamond markers represent the measured data points. Table 6.1 shows the center value and standard deviation of the different peaks in panel c of the figure. In order to do photon number discrimination, a decision region must be established for each photon number state. This will depend, in general, on the a-priori photon number distribution. The case of equal a-priori probability is considered, which is the worst case scenario. The optimal decision threshold between two consecutive gaussian peaks is given by the point where they intersect. The value of this point can be easily solved, and is given by, x d = x i + σ 2 i (x i+1 x i ) + σ i σ i+1 (x i+1 x i ) 2 2 ( σ 2 i+1 σ2 i ) ln σ i σ i+1 σ 2 i+1 σ2 i. (6.6) The probability of error for this decision is given by the area of all other photon number peaks in the decision region. This probability is also shown in Table 6.1. From the data one would like to infer whether the VLPC is being saturated at higher photon numbers. If too many photons are simultaneously incident on the Table 6.1: Results of fit for panel (c) of Figure 6.8. Photon number Avg. Area Std. Dev. %Error

134 118 CHAPTER 6. THE VISIBLE LIGHT PHOTON COUNTER detector, the detector surface may become depleted of active area. This would result in a reduced quantum efficiency for higher photon numbers. In order to investigate this possibility, an additional constraint is added to the fit that the pulse areas must scale according to a Poisson distribution. Since the laser is a Poisson light source, the detection statistics are expected to have the same distribution. However, detector saturation causes a number dependant loss. Poisson detection statistics. This would result in deviation from Figure 6.9 plots the result of the fit when the peak areas scale as a Poisson distribution. One can see that the imposition of Poisson statistics does not change the fitting result in an appreciable way. Thus, it is inferred that detector saturation is not a strong effect at the excitation levels being used. The effect of multiplication noise buildup on the pulse height spectrum can be investigated from the previous data. The pulse area variance is expected to be a linearly increasing function of photon number. This is consistent with the independent detection model, in which an n photon peak is a sum of n single photon peaks coming from different areas of the detector. To investigate the validity of this model, the variance as a function of photon number is plotted in Figure The electrical noise variance, given by the zero photon peak, is subtracted. The variance is fit to a linear model given by σ 2 i = σ iσ 2 M. (6.7) In the above model, i is the photon number, σm 2 is the variance contribution from multiplication noise, and σ0 2 is a potential additive noise term. From the data, one obtain the values σ 2 M = 276, and σ2 0 = 246. A surprising aspect of this result is the large value of σ 2 0. Since electrical noise has been subtracted, it would be expected that the only remaining contribution to the variance is multiplication noise. If this were true, the value of σ 0 would be very small. Instead, the additive noise term is calculated to be nearly equal to that of σ 2 m. This indicates that the electrical noise is higher when the VLPC is firing, as opposed to when its not. Further investigation is required to determine whether this is an inherent property of the detector, or is due to subsequent amplifiers. If the latter is true, it may be possible to eliminate this noise contribution and obtain better photon

135 6.6. CHARACTERIZING MULTI-PHOTON DETECTION CAPABILITY 119 Counts Counts a) b) n = 2.17 n = 3.15 Data Poisson FIt Pulse Area (AU) Counts c) d) Pulse Area (AU) 2000 n = 3.88 n = 4.94 Counts Pulse Area (AU) Pulse Area (AU) Figure 6.9: Pulse area spectrum fit to Poisson constraint on normalized peak areas. Student Version of MATLAB

136 120 CHAPTER 6. THE VISIBLE LIGHT PHOTON COUNTER Peak Variance (Au) data Linear Fit σ N 2 = N Photon Number Figure 6.10: Variance as a function of photon number detection. The linear relation is consistent with the independent detection model. Student Version of MATLAB

137 6.6. CHARACTERIZING MULTI-PHOTON DETECTION CAPABILITY 121 number resolution. The above measurements of variance versus photon number gives a very accurate measurement of the excess noise factor F of the VLPC [21]. Previous measurements of F for the VLPC have determined that it is less than 1.03 [21], which is nearly noise free multiplication. This number was obtained by measuring the variance of the 1 photon peak, and comparing to the mean. However, it is difficult to separate the electrical noise contribution from the internal multiplication noise using this technique. Thus, the measurement ultimately determines only an upper bound of F. By considering how the variance scales with photon numbers, as was done in Figure 6.10, the multiplication noise can be accurately differentiated from additive electrical noise. This determines an exact value for the excess noise factor. From the measurement of σ 2 M and M, one obtains an excess noise factor of F =

138 Chapter 7 Non-classical statistics from parametric down-conversion Parametric down-conversion (PDC) has already been introduced in section The process is discussed in more detail in this chapter. First, the non-classical nature of PDC is theoretically described. Tests of classical theory are discussed which can be used demonstrate that parametric down-conversion is a non-classical light source. These tests, which require the photon number detection capability of the VLPC, are experimentally demonstrated. 7.1 Basics of parametric down-conversion When a photon propagates inside a material that lacks inversion symmetry, there is a finite probability that it can spontaneously split into two photons of lower energy. This is caused by the non-linearity in the dipole moment of the material which, for most systems, is an extremely weak effect. The process by which this photon splitting occurs is known as parametric down-conversion. Parametric down-conversion is often observed when exciting a non-linear crystal with a bright pump field. A pump photon will spontaneously split into two photons which, for historical reasons, are referred to as the signal photon and the idler photon. The energy and momentum of the signal and idler are determined by energy and 122

139 7.1. BASICS OF PARAMETRIC DOWN-CONVERSION 123 momentum conservation rules. Specifically, ω p =ω s + ω p k p =k s + k p (7.1a) (7.1b) The above equations are referred to as phase matching conditions. In a crystal with normal dispersion there are generally two ways to satisfy the phase matching conditions. They are known as Type I and Type II phase matching. In Type I, the polarization of the signal and idler are the same, while in Type II the signal and idler have orthogonal polarizations. In most cases the energy and momentum of the signal and idler can be selected by tuning the optical axis of the non-linear crystal. Spatial and spectral filters are often employed to select a narrow range of momentums and energies for the downconverted twins. The operating condition where the signal and idler have the same energy is referred to as degenerate down-conversion. If they have different energies the process is referred to as non-degenerate. Similarly, if both signal and idler propagate in the same direction as the pump, this is referred to as collinear phase matching. In non-collinear phase matching the signal, idler, and pump all travel in different directions. The theory of single mode parametric down-conversion has already been discussed. The interaction hamiltonian for a two-mode parametric down-converter is H I = i hχ (2) V e i(ω ωa ω b)tâ ˆb + h.c. (7.2) where â and ˆb are distinguishable modes for the signal and idler photon respectively. The amplitude V represents the pump field, which is considered bright enough to treat classically. The result of this interaction is the number correlated state ψ = 1 tanh n χ n a n b. (7.3) cosh χ n=0 In most cases it is difficult to isolate a single mode for the signal and idler using spatial and spectral filters. Thus, the actual field is a sum of many modes, each of which satisfy the phase-matching conditions. In the limit of a large number of modes, the photon pair distribution approaches a Poisson distribution, instead of the thermal distribution shown above.

140 124CHAPTER 7. NON-CLASSICAL STATISTICS FROM PARAMETRIC DOWN-CONVERSION 7.2 Non-classical photon statistics In parametric down-conversion, the signal and idler photons always come in pairs. Thus, the total number of photons emitted by this process will always be an even number over a finite time scale. Such a state is non-classical in the sense that its photon number distribution cannot be expressed as a mixture of Poisson distributions. In order to test this experimentally, an inequality must be derived which distinguishes such a state from all classical states. The inequality presented here relies only on the photon number distribution. Therefore it constitutes a very direct and conceptually simple demonstration of nonclassical light statistics. However, the experimental demonstration of this effect is not trivial. It requires high photon detection efficiency, as well as the ability to discriminate photon number states. Fortunately, as we have shown, the Visible Light Photon Counter (VLPC) has the ability to do this. Consider the output of parametric down-conversion, where the probabilities P 1 and P 3 are zero. Define Γ as Γ = P 2 P 1 + P 2 + P 3, (7.4) For parametric down-conversion, Γ = 1. For a Poisson photon number distribution, it can be shown that this ratio has a maximum value Γ = 3/( ) The Poisson distribution that saturates this bound has average photon number n = 6. However, one can show that this optimal value holds not only for a Poisson distribution, but for any weighted sum of Poisson distributions. Consider a weighted sum P n = αpn max + (1 α)p n of two Poisson distributions Pn max and P n, where Pn max has average photon number n = 6, and P n is any other Poisson distribution. The ratio Γ for this weighted sum is Because P max n Γ = αp2 max + (1 α)p 2 α(p1 max + P2 max + P3 max ) + (1 α)(p 1 + P 2 + P 3). (7.5) maximizes Γ for any single Poisson distribution, the condition x y < x y αx + (1 α)x αy + (1 α)y < x y, α < 1, (7.6)

141 7.3. OBSERVATION OF NON-CLASSICAL STATISTICS 125 proves that Γ 3/( ). Thus, no sum of Poisson distributions can give rise to a distribution with Γ > Γ classical All classical light fields will lead to statistics that can be expressed as weighted sums of Poisson photon number states. Thus, the classical theory of light predicts that the inequality 3 Γ , (7.7) cannot be violated. In contrast, one expects that light from parametric downconversion will lead to a violation of this condition, which can be demonstrated by simply measuring P 1, P 2, and P 3. In the presence of imperfect detection efficiency, however, this is not always true. Consider a parametric down-conversion experiment in which the pump is sufficiently weak that the probability of generating more than one photon pair is very small. In this case the ratio in Eq. 7.4 is given by Γ = η/(2 η), where η is the detection efficiency. One will not observe a violation of the inequality unless η 3/(3 + 6) Observation of non-classical statistics The experimental setup for observing non-classical statistics from parametric downconversion is shown in Figure 7.1. The pump source for the down-conversion process is the 266nm fourth harmonic of a Q-switched Nd:YAG laser, firing at a 45KHz repetition rate. The pulses are approximately 30ns in duration. A dispersion prism is first used to separate the residual second harmonic from the fourth harmonic. The second harmonic is illuminated onto a high speed photo-diode with a 1ns rise time. The output of the diode is used as a triggering signal. The fourth harmonic is used as a pump for the parametric down-conversion. The pump is slightly focussed before the crystal. The focus is selected so that the beam waste is smallest at the collection iris in front of the detector. This configuration maximizes the collection efficiency, by producing a sharp two-photon image at the collection point. The laser pumps a beta barium borate (BBO) crystal, whose optic axis is set for Type I collinear degenerate phase-matching. This occurs when the optic axis is

142 126CHAPTER 7. NON-CLASSICAL STATISTICS FROM PARAMETRIC DOWN-CONVERSION 500mm lens BBO IF 266nm 2m lens /2 plate PBS Atten. VLPC diode amplifiers signal trigger prism Boxcar integrator Nd:YAG 4 th Harmonic 266nm Figure 7.1: Experimental setup for observation of non-classical counting statistics from parametric down-conversion. tilted 47.6 degrees from the plane normal to the propagation of the pump. The downconversion is separated from the pump by a brewster s angle dispersion prism. The down-converted photons are then collected by a 500mm lens and focussed onto the VLPC detector. The electrical pulse from the VLPC is amplified by a series of room temperature RF amplifiers. The amplified signal is then integrated by the boxcar integrator, which is triggered by the signal generated from the photodiode. Figure 7.2 shows the pulse area histogram when the pump power is set 1µW. At this weak pump intensity, a single pump pulse will usually generate zero photons, while a photon pair is generated with a small probability. The probability of generating more than one photon pair is very small. The figure focusses on the 1,2, and 3 photon detection peaks, which are the important ones for verification of non-classical statistics. The photon number probability distribution is calculated by fitting each peak to a gaussian. These areas are normalized by the total area of all the peaks. The calculated probability distribution is shown in the inset. One can see that the

143 7.3. OBSERVATION OF NON-CLASSICAL STATISTICS Counts Pulse Area (AU) Figure 7.2: Pulse area spectrum using 1µW pump power. probability of 1 and 2 photon detection is nearly equal, but the probability of 3 photon detection is nearly zero. These probabilities are P 1 = , P 2 = , and P 3 = , which yields Γ = 0.442, representing a 40 standard deviations violation of the classical limit. This demonstrates the non-classical nature of parametric down conversion. The large 1 photon probability is due to losses from the detector and collection optics. In the limit of low excitation, the 1 photon and 2 photon probability can be used to calculate the detection efficiency, given by η = 2 P 2 P P 2 P 1. (7.8) From the measurements it is calculated that the detection efficiency is Using the measured VLPC quantum efficiency of 0.85, the photon collection efficiency is calculated to be Figure 7.3 shows the measured value of Γ as a function of pumping intensity. The black line represents the classical limit. This limit is violated for a large range of pumping intensities. At high pumping intensities Γ begins to drop. This is due to an increase in the two pair creation probability, which, in the presence of losses,

144 128CHAPTER 7. NON-CLASSICAL STATISTICS FROM PARAMETRIC DOWN-CONVERSION Power (uw) Figure 7.3: Measured value of Γ as a funtion of pump power. The black line represents the classical limit. will enhance the 3 photon detection probability. The parameter Γ also drops at low pumping intensities. This drop is attributed to the dark counts of the VLPC. At low pumping intensities the relative fraction of detection events originating from dark counts becomes large. This enhances the 1 photon probability, which reduces the value of Γ. 7.4 Reconstruction of photon number oscillations The emitted output of parametric down-conversion features even odd oscillations, due to the two photon nature of the process. These oscillations result in the non-classical statistics discussed in the previous section. It would be nice to observe these oscillations directly, using the photon counting capability of the VLPC. Unfortunately, direct observation of the even-odd oscillations requires extremely high quantum efficiencies. Figure 7.4 demonstrates the problem. Panel (a) shows a typical distribution from a multi-mode parametric down-conversion experiment. In such a case the photon

145 7.4. RECONSTRUCTION OF PHOTON NUMBER OSCILLATIONS 129 a) Probability η = 1 b) Photon Number Probability η = Photon Number Figure 7.4: Detected photon number distribution from parametric down conversion. (a) Measured distribution with perfect detection efficiency η. (b) Measured distribution with detection efficiency η = 0.7. Student Version of MATLAB pair distribution is a Poisson distribution, and odd photon number states are completely absent. Panel (b) shows the detection statistics for the same distribution if each photon is detected with a probability of 0.7. This is a high detection probability for down-conversion experiments. One can see that the detection inefficiency quickly washes out the even-odd oscillation, resulting in a much more uniform looking distribution. The requirement of very high quantum efficiency makes direct observation of the photon number oscillation nearly impossible in practice. However, one can make an accurate independent measurement of the photon detection efficiency, and correct for this effect in the photon number distribution. This allows the reconstruction of the original even-odd oscillations of the field. The detection efficiency of the system has already been measured in the previous section. This was done by measuring the photon number distribution at low pumping power, where the probability of generating two photon pairs is negligibly small. In this regime the detection efficiency is determined by Eq The detection efficiency was measured to be 0.67.

146 130CHAPTER 7. NON-CLASSICAL STATISTICS FROM PARAMETRIC DOWN-CONVERSION The detection efficiency can be corrected for as follows. Define p i as the probability that the photon field contained i photons, and f i as the probability that i photons are detected. In the presence of losses, these two distributions are related by f i = ( ) j η i (1 η) j i p i (7.9) i j=i In order to calculate p i from f i, the above transformation must be inverted. Unfortunately, if the expression is kept to all orders in photon number, there is no clear way to invert the transformation. To get around this problem, one must truncate the photon number distribution at some photon number n, which is sufficiently large such that p n+1 0 is a good approximation. Two vectors are introduced, p and f, which are simply given by p = p 1 p 2. p n ; f = f 1 f 2. f n. (7.10) These two vectors are related by a matrix M, whose coefficients are given by Eq One can calculate p by p = M 1 f. (7.11) Dark counts and backgrounds can also be corrected for using the same method. In order to include the dark counts, one must model the dark count probability distribution. An extremely reasonable assumption is that each dark count even occurs independently of all other dark counts. If this is true, the dark count probability distribution is a Poisson distribution with average d which can be measured. One expects that background photons will also be Poisson distributed, so they can be lumped together with the dark counts in parameter d. In the presence of dark counts, the initial and final probability distributions are related by f i = i k=0 d dk e k! j=i k ( j i k ) η i k (1 η) j i+k p i k (7.12)

147 7.4. RECONSTRUCTION OF PHOTON NUMBER OSCILLATIONS Average Dark Counts y = x Power (uw) Figure 7.5: Backgrounds vs. pump power. Introducing a maximum photon number n, the above relationship is once again a Student Version of MATLAB linear matrix which relates the actual and measured photon number distribution. Figure 7.5 shows the average background number per laser pulse as a function of the pump power. The background rate is measured by rotating the polarization of the pump so that it is orthogonal to the optic axis of the non-linear crystal. When this is done, phase matching cannot be satisfied so no parametric down-conversion is observed. A pulse area distribution is acquired for each pump intensity, which is used to calculate the photon number distribution per pulse. The average is calculated from this distribution. The plot shows that the average increases linearly with pump intensity. This linear increase is caused by background photoluminescence generated by the BBO crystal when it is illuminated by the high energy UV pump. The intercept of the line gives us the raw dark count rate. Figure 7.6 shows the result of the photon number reconstruction. Three different pumping intensities are shown. For each pump intensity, the left panel shows the pulse area histogram, and the inset to the panel shows the calculated photon probability distribution. The right panel shows the reconstructed photon number distribution

148 132CHAPTER 7. NON-CLASSICAL STATISTICS FROM PARAMETRIC DOWN-CONVERSION a) b) c) Counts Counts 4 x x W 1 4 µ W 4 µ W x W Probability Probability µ 6 µ W µ 8 µ W Counts Pulse Area (AU) Probability Photon Number Figure 7.6: Reconstructed even-odd photon number oscillations for several pump powers. (a), 4µW pump. (b) 6µW pump. (c) 8µW pump. Student Version of MATLA

149 7.4. RECONSTRUCTION OF PHOTON NUMBER OSCILLATIONS 133 using the measured quantum efficiency and backgrounds. The photon number distribution is truncated at 10 photons. The reconstructed probabilities demonstrate very clean even-odd oscillations, as one would expect from down-conversion. It is important to emphasize that there are no fitting parameters in the number reconstruction. The only two parameters, the quantum efficiency and background rate, are independently measured. Once they are known there is a one-to-one relationship between the actual and measured photon number distribution. At higher photon numbers, it can be seen that the reconstructed distribution becomes slightly negative. This erroneous effect is caused by truncation error. As the pumping intensity is increased, the approximation that the photon distribution can be truncated after 10 photons becomes less accurate. This error manifests itself in the probabilities becoming slightly negative for the 9 and 7 photon probability. This error is worst at the largest pumping intensity of 8µW, where the truncation approximation is least accurate. One could reduce this probability by truncating at a higher photon number. Unfortunately, because of the limited range of the amplifiers and A2D converters, it is difficult to measure these higher order photon numbers in practice. This puts a limit on the pumping power one can use and still get a good reconstruction. Better numerical algorithms for doing the reconstruction may improve the result. It is possible that an improved numerical technique over simply putting a cutoff in the number distribution may overcome some of these practical difficulties.

150 Chapter 8 Photon number state generation In the previous chapter the non-classical nature of parametric down-conversion was investigated. The two photon nature of the process features counting statistics which are not consistent with the classical interpretation of electromagnetic theory. This chapter discusses an application of this special property, the generation of photon number states. The use of parametric down-conversion for single photon generation is already a well known process [18, 48]. This is typically done by setting the non-linear crystal to degenerate, non-collinear phase-matching. In this condition the signal and idler have the same energy but propagate in different directions. The non-linear crystal is pumped by a weak pulsed pump, such that the probability of making more than one pair in the pulse is extremely low. Under these conditions, if a photon counter detects a photon in the signal arm, the idler arm must also contain exactly one photon. By post-selecting only the pulses where a signal photon was detected, one creates a socalled conditional single photon state. The disadvantage of this scheme is that one cannot create a single photon on demand. One must wait for the counter on the signal arm to register a count. But once this happens, a single photon is created in the other arm with very high probability. For many applications, including quantum cryptography, this is sufficient. The improvements of using such a single photon source have already been studied [48]. In applications utilizing this type of single photon source, the pumping intensity 134

151 135 must be carefully selected. If the pumping intensity is too high, the probability of generating more than one pair becomes non-negligible. In virtually all experiments to date, the triggering detector could not distinguish the number of photons in the pulse with high quantum efficiency. Thus, it cannot distinguish between one and more than one pair created in a pulse. Both cases will be accepted as valid, creating undesirable multi-photon states in the idler arm. The only way to suppress these multi-photon states is to make the pumping intensity very low, and in so doing reduce the probability of generating more than one pair in a pulse. This comes at a price. At weak pumping intensities, most pump pulses will fail to generate a single pair of down-converted photons. One has to wait a long time before the triggering detector sees a photon, which properly prepares the state of the conjugate arm. This section considers the advantages of replacing the standard triggering detector, which cannot distinguish photon number, with a triggering detector that does have photon number detection capability, such as the VLPC. This capability is very useful for single photon generation. The VLPC can often distinguish between the case where one and more than one pair was created in a single pump pulse. It not only rejects the cases where no pair was created, it can also reject many of the cases when more than one pair was created. In the presence of perfect detection efficiency, one could set the average photon pair per pulse to 1, optimizing the probability of generating a single pair. However, when the detection efficiency is not perfect, the VLPC will sometimes register a multi-photon event as a single photon event, resulting once again in a finite multi-photon probability. The first section discusses the theoretical improvements one can expect under these conditions. The experimental demonstration of single photon generation using the multi-photon detection capability of the VLPC is then presented. A second advantage of using a VLPC is that it allows one to generate higher order photon number states, which cannot be done with a single avalanche photodiode. By post-conditioning on the case where the VLPC sees 2,3, or 4 photons in the signal arm, one can generate 2,3, or 4 photon number states in the other arm. The last section discusses the implementation of this scheme. A demonstration of efficient generation of up to a 4 photon number state is presented.

152 136 CHAPTER 8. PHOTON NUMBER STATE GENERATION Pump Idler Nonlinear Crystal Signal Trigger Detector Figure 8.1: Single photon generation with parametric down-converiosn. 8.1 Single photon generation Theory Figure 8.1 shows the general setup for single photon generation. A non-linear crystal is pumped by a pulsed source. The phase matching condition is set such that the signal and idler photons propagate in different directions. A triggering detector is placed in the signal arm. When this detector registers a photon count, a single photon state should be prepared in the idler arm. Lets consider the effect of two types of triggering detectors, threshold detectors and photon number detectors. A threshold detector can detect the presence of photons in a laser pulse, but cannot distinguish between one and more the one photon. Thus, a threshold detector performs a POVM measurement with two elements, E 0 and E click. These two elements are defined by E 0 = 0 0 E click = k k. k=1 (8.1a) (8.1b) In contrast, a photon number detector has the ability to distinguish the number of photons in each pulse. The POVM performed by such a detector is given by the

153 8.1. SINGLE PHOTON GENERATION 137 elements E i, where E i = i i. (8.2) To incorporate the effect of detection efficiency, one can place a beamsplitter in front of the triggering detector, which reflects off a fraction of the photons proportional to the detection efficiency. The POVMs for the two types of detectors can then be applied to the field after the beamsplitter. The statistics of the generated field depends on the statistical distribution of the down conversion. In parametric down-conversion there are two main regimes of interest. In the first regime, the pump pulse duration is on the order of the inverse of the measurement bandwidth, which is typically defined by interference filters in from of the down-converted arms. This is the single mode regime, where the Hamiltonian in Eq. 7.3 applies. In such a regime, the photon pair distribution is thermal. The opposite limit occurs when the pump pulse duration is much longer than the inverse of the measurement bandwidth. In this regime there are many downconversion modes which operate simultaneously. This multi-mode down-conversion process creates statistics which approach a Poisson distribution. This work considers only the multi-mode case, which is the appropriate limit for the experiments to be presented. The single mode case can be derived in a completely analogous way. Define K as the event that the trigger detector has detected a single photon, and let M be the event that there is more than one photon in the idler arm. Thus, P (M K) and P (1 K) are the probabilities of a multi-photon state and a single photon state in the idler arm, conditioned on the triggering detector. These probabilities characterize the quality of the generated states. Another important probability is P (K), the probability that the triggering detector sees a photon. This gives the generation efficiency, or the rate at which single photons are prepared. Consider the case where the triggering detector has the ability to distinguish the number of photons in each pulse. A logic pulse is produced only of the detector sees exactly one photon. The detection efficiency of the system for the triggering detector is denoted as η. The parameter α is defined as the average number of twin photons generated per pulse. Assuming a Poisson distributed pair generation process, it is

154 138 CHAPTER 8. PHOTON NUMBER STATE GENERATION straightforward to show that P num (1 K) =e α(1 η) P num (M K) =1 e α(1 η) P num (K) =αηe αη (8.3a) (8.3b) (8.3c) In the limit η 1, one obtains P num (1 K) 1 and P num (M K) 0, which is an ideal single photon state. This occurs regardless of the value of α, which can be set to 1 to achieve maximum generation efficiency. If the detection efficiency is not ideal however, there is a tradeoff between the multi-photon probability and generation efficiency. In the limit of small α, the above expressions simplify to P num (1 K) =1 α(1 η) P num (M K) =α(1 η) P num (K) =αη (8.4a) (8.4b) (8.4c) For the scheme being considered, it is desirable to have a figure of merit one can use to quantify the quality of the generated photon state. It is preferable to use a figure of merit which does not depend on the pumping intensity, or equivalently on α, the average number of generated pairs. In chapter 4, the figure of merit used was g (2). This parameter equals the ratio of the multi-photon probability of the source to that of a Poisson light source, in the limit of small averages. Unfortunately, if one adopts the same definition of g (2), conditioned on the triggering detector, then g (2) will depend on α. In fact, α 0 implies that g (2) 0. That is, if the excitation is extremely small, than whenever the triggering detector sees a photon, there is exactly one photon in the other arm. Thus, the conventional definition of g (2) is not an appropriate figure of merit for this experiment. A better figure of merit is to consider the ratio of the multi-photon probability for the triggering detector to that of an ideal threshold detector. An ideal threshold detector has a quantum efficiency of 1, but cannot distinguish between one and more than one photon. This detector represents the idealized limit of an avalanche photodiode. The only non-ideal behavior which will be considered in the theoretical

155 8.1. SINGLE PHOTON GENERATION 139 analysis is imperfect quantum efficiency. In a practical system, collected background photons and detector dark counts may also affect the performance of the single photon generator. Assuming a detection efficiency η, it is straightforward to show that P thresh (1 K) = αe α 1 e α (8.5a) P thresh (M K) = 1 e α αe α 1 e α (8.5b) P thresh (K) =1 e α In the limit of small α the above expressions simplify to (8.5c) P thresh (1 K) 1 α 2 P thresh (M K) α 2 P thresh (K) α (8.6a) (8.6b) (8.6c) The figure of merit, denoted G, is then defined as P num (M K) G = lim α 0 P thresh (M K) = 2(1 η) (8.7) Thus, G is independent of α at low excitation powers. Furthermore, from Eq. 8.3b it is straightforward to show that P num (M K) Gα 2. (8.8) The above equation has a clear similarity to Eq Knowing G allows us to put a bound on the multi-photon probability, meaning that it is not only a convenient figure of merit, it is a also a practically important parameter in exactly the same way that g (2) was in chapter 4. For quantum cryptography applications, G and α are sufficient to characterize the security performance of the system in the same way as g (2) and n were sufficient for sub-poisson light. From Eq. 8.7 one sees that when η > 0.5, G drops below 1. In this regime the multi-photon probability is suppressed to a level that is unattainable without photon number detection. Using the same definitions above, one can similarly derive the value of G for a non-ideal threshold detector that has a quantum efficiency η. A straightforward

156 140 CHAPTER 8. PHOTON NUMBER STATE GENERATION 10 0 Bits Per Pulse G=0 G=0.001 G = 0.01 G =0.1 G=1 G= Channel Loss (db) Figure 8.2: Communication rate vs. channel loss for different values of G. calculation shows that, in this case, G thresh = 2 η (8.9) The above expression is always greater than one, achieving its best value in the ideal Student Version of MATLAB limit that η 1. Thus, all threshold detectors are bounded by G > 1. The only way to suppress the multi-photon probability using such detectors is to make α small. Figure 8.2 shows simulations for the communication rate of the BB84 protocol with G taking on a range of values. For each curve, α is numerically optimized at each value of the channel loss. One can see that all of the curves achieve a maximum channel loss of approximately 55dB, independent of G. This is expected, since in the limit of small α a single photon state is generated when the triggering detector sees a photon, regardless of whether the detector can do photon number detection. However, when G 1 the communication rate near the cutoff is unacceptably low, achieving rates of only bits per pulse at best. Using a conventional Ti:Sapphire laser with 76MHz repetition rate, the communication rate is roughly 1 bit every four hours. In

157 8.1. SINGLE PHOTON GENERATION 141 SCA Integrating Amplifier VLPC 500mm lens iris iris Signal BBO IF 266nm PBS iris iris Idler 2m lens APD 2.5 s Delay APD AND stop start Multi-Channel Scalar Diode Prism Nd:YAG 266nm Figure 8.3: Experimental setup for generation of single photons. the opposite extreme, when G = 0 the communication rate at the cutoff is roughly 10 5, a seven order of magnitude improvement. But such improvements can only be observed if the efficiency is extremely close to one. Even the curve for G = 0.001, corresponding to an efficiency of , shows appreciably degraded performance near the cutoff. Still, the value of G = 0.1 achieves two orders of magnitude improvement in communication rate over a threshold detector Experiment Figure 8.3 shows the experimental setup for generation of single photons. A Q- switched Nd:YAG laser is converted to its fourth harmonic at 266nm. The fourth harmonic is used to pump a BBO crystal, whose optic axis is tilted for non-collinear degenerate phase matching ( 47.6 degrees). The parametric down conversion is emitted at an angle of 1 degree from the pump. The pump is loosely focussed to achieve a minimum waist at the second collection iris. This results in a sharper two-photon image which enhances the collection efficiency. The signal photon is focussed onto the VLPC. The output of the VLPC is amplified by a charge integrating amplifier. This amplifier emits a voltage pulse whose height is proportional to the number of

158 142 CHAPTER 8. PHOTON NUMBER STATE GENERATION SCA Window 1000 counts pulse height (mv) Figure 8.4: Pulse height spectrum emitted from charge sensitive amplifier. electrons emitted during a laser pulse. A pulse height histogram of the output of the charge sensitive amplifier is shown in Figure 8.4. This spectrum features a series of peaks for the one photon, two photon, and three photon events. A single channel analyzer (SCA) is used to select pulses whose height is consistent with a single photon event. Every time such a pulse occurs the SCA outputs a TTL pulse, which signifies a valid trigger detection. The important parameter one would like to measure is G. In the theoretical analysis, only imperfect detection efficiency was considered. In this approximation G depends only η, so a measurement of quantum efficiency can be used to directly calculate it. In a practical system, however, collected backgrounds and dark counts can also effect G. Furthermore, internal multiplication noise can cause photon number detection errors even in the presence of perfect quantum efficiency, as discussed in the previous chapter. A model which incorporates all of these non-idealities is very complicated. It is better if one can directly measure G. This is done by inserting a beamsplitter in the idler arm, and using two APDs to detect the photons. The APDs used in the experiment are conventional SPCM detectors with quantum efficiencies of about 60% at the operating wavelength. A multi-channel scalar is used to perform time-resolved coincidence detection between the two counters. This setup