Quantum Key Distribution Using Decoy State Protocol

Transcription

1 American J. of Engineering and Applied Sciences 2 (4): , 2009 ISSN Science Pblications Qantm Key Distribtion sing Decoy State Protocol,2 Sellami Ali, 2 Shhairi Sahardin and,2 M.R.B. Wahiddin Department of Comptational and Theoretical Sciences, Faclty of Science, International Islamic niversity Malaysia, Malaysia 2 Information Secrity Clster, Mimos Berhad, Technology Park Malaysia, Malaysia Abstract: Problem statement: Qantm key distribtion provides nconditional secrity garanteed by the fndamental laws of qantm physics. nfortnately, for real-life experimental set-ps, which mainly based on faint laser plses, the occasional prodction of mlti-photons and channel loss make it possible for sophisticated eavesdroppers to lanch varios sbtle eavesdropping attacks inclding the Photon Nmber Splitting (PNS) attack. The decoy state protocols recently proposed to beat PNS attack and to improve dramatically distance and secre key generation rate of Qantm Key Distribtion (QKD). Approach: Objective of this stdy was experimental implementation of weak decoy + vacm states QKD for increasing the performance of QKD system. To show conceptally how simple it was to apply the weak decoy + vacm state idea to a commercial QKD system, we chosen ID-3000 commercial qantm key distribtion system manfactred by id qantiqe. To implement the weak decoy + vacm state protocol, we had to add some new optical and electronics components to id qantiqe and to attenate each signal to the intensity of either signal state or weak decoy or vacm state randomly. Reslts: In or implementation, the attenation will be done by placing a VOA (variable optical attenator) in Alice s side. Specifically, or QKD system reqired the polarizations of 2 plses from the same signal to be orthogonal. Therefore the VOA mst be polarization independent so as to attenate the two plses eqally. The VOA tilized in experiment to attenate signals dynamically was Intensity Modlator (IM). We had implemented weak + vacm protocol on a modified commercial QKD system over a 25 km of telecom fibers with an nconditionally secre key rate of per plse. Conclsion: By making simple modifications to a commercial qantm key distribtion system, we cold achieve mch better performance with sbstantially higher key generation rate and longer distance than QKD system withot decoy state. Key words: Qantm cryptography, qantm key distribtion, decoy state protocol and optical commnications INTRODCTION Qantm Key Distribtion (QKD) has drawn many attentions from scientists. Different from the classical cryptography, Qantm Key Distribtion (QKD) [-3] can help two remote parties to set p the secre key by noncloning theorem [4]. Frther, proofs for the nconditional secrity over noisy channel have been given [5-8]. nfortnately, in view of implementation, perfect devices are always very hard to bild. Therefore most p-to-date QKD systems sbstitte the desired perfect single photon sorces by heavily attenated coherent laser sorces. QKD can be performed with these laser sorces over more than 20 km of telecom fibers [9,0]. However, this sbstittion raises some severe secrity concern. The otpt of coherent laser sorce obeys Poisson distribtion. Ths the occasional prodction of mlti-photon signals is inevitable no matter how heavily people attenate the laser. Recall that the secrity of BB84 protocol [3] is garanteed by qantm no-cloning theorem, the prodction of mltiphoton signals is fatal for the secrity: The eavesdropper (normally denoted by Eve) can simply keep an identical copy of what Bob possesses by blocking all single-photon signals and splitting all mlti-photon signals. Most p-to-date QKD experiments have not taken this Photon-Nmber Splitting (PNS) attack into accont and ths are, in principle, insecre. Hwang [] proposed the decoy state method as an important weapon to combat those sophisticated attack: By preparing and testing the transmission properties of Corresponding Athor: Sellami Ali, Department of Comptational and Theoretical Sciences, Faclty of Science, International Islamic niversity Malaysia, Malaysia 694

2 some decoy states, Alice and Bob are in a mch better position to catch an eavesdropper. Hwang specifically proposed to se a decoy state with an average nmber of photon of order. Hwang s idea was highly innovative. Decoy plse QKD theory gives a rigoros bond of the characteristics of the single photon plses, which are the only sorce plses that contribte to the secre bit rate. In [2], combining the idea of secrity proofs sing the entanglement distillation approach in GP [0] with decoy method; they gave a formla for the key generation rate: { µ µ 2 µ 2 } R q Q f (E )H (E ) + Q [ H (e )] () Where: q = Depends on the protocol, the sbscript µ = The average photon nmber per signal in signal states Q µ = The gain of signal states E µ = The qantm bit error rate (QBER) of signal states Q = The gain of the single photon states in signal states e = The error rate of single photon states f(x) = The bi-directional error correction rate [3] H 2 (x) = Binary shannon information fnction H 2(x) = -x log 2(x) - ( - x) log 2( - x) (2) Or implementation is based on BB84 [3] protocol. Among total N plses sent in experiment, N S plses are sed as signal states. Therefore the factor q is given by q = ½ N S /N. Q µ and E µ can be measred directly from experiments. In [2], they have proposed a practical protocol with Weak + Vacm states with average photon nmber 0 and v. sch a protocol is relatively simple to implement. The gain of the weak decoy state Qv and its error rate E µ cold also be reqired directly from experiments. Considering statistical flctations, the lower bonds of Q and the pper bond of e are given by [2] : 2 µ µ e v µ v µ v Q Q = Q 2 e Qµ e Y µ v v e µ 0µ E Q 0 o e µ µ Q (3) e Y e e = (4) In which: Q ν = Q ν Y0 = Y0 Y0 = Y0 + N Q ν ν N Y 0 0 N Y 0 0 In this stdy, we will present the experimental implementation of weak decoy + vacm states QKD sing commercial QKD systems are bi-directional. To show conceptally how simple it is to apply the weak decoy + vacm state idea to a commercial QKD system, we chose ID-3000 commercial qantm key distribtion system manfactred by id qantiqe. To implement the weak decoy + vacm state protocol, we have to add some new optical and electronics components to id qantiqe and have to attenate each signal to the intensity of either signal state or weak decoy or vacm state randomly. In or implementation, the attenation will be done by placing a VOA (variable optical attenator) in Alice s side. Specifically, or QKD system reqires the polarizations of the two plses from the same signal to be orthogonal. Therefore the VOA mst be polarization independent so as to attenate the two plses eqally. The VOA tilized in or experiment to attenate signals dynamically is Intensity Modlator (IM). MATERIAS AND METHODS Experimental setp: Existing commercial QKD systems are bi-directional. To show conceptally how simple it is to apply the decoy state idea to a commercial QKD system, we chose ID-3000 commercial Qantm Key Distribtion system manfactred by id qantiqe. The prototype of this QKD system is described in [8]. Here we describe it briefly: A frame of NP plses (in or experiment, NP = 624) is generated from Bob and sent to Alice. Within a frame, the time interval between signals is 200ns. The next frame will not be generated ntil the whole frame has retrned to Bob. The long delay line inside Jr. Alice promises that the incoming signal and retrning signal will not overlap in the channel between Bob and Jr. Alice so as to avoid Rayleigh scattering. This QKD system is called p and p atocompensating set-p, where the key is encoded in the 695

3 phase between two plses traveling from Bob to Alice and back (Fig.. A strong laser plse (@ 550 nm) emitted at Bob is separated at a first 50/50 Beam Splitter (BS), after having traveled throgh a short arm and a long arm, inclding a Phase Modlator (PMb) and a 50 ns Delay ine (D), respectively. All fibers and optical elements at Bob are polarization maintaining. The linear polarization is trned by 90 in the short arm, therefore the two plses exit Bob s stepp by the same port of the PBS. The plses travel down to Alice, are reflected on a Fraday mirror, attenated and come back orthogonally polarized. In trn, both plses now take the other path at Bob and arrive at the same time at BS where they interfere. Then, they are detected either in D, or after passing throgh the circlator (C ) in D2. Since the two plses take the same path, inside Bob in reversed other, this interferometer is ato-compensated. The implementation of weak + vacm protocol reqires amplitde modlation of three levels: µ, v and 0. Note that it wold be qite hard for high-speed amplitde modlators to prepare the real vacm state de to finite distinction ratio. However, if the gain of the vacm state is very close (like within a few standard deviations) to the dark cont rate, it wold be a good approximation. In or implementation, the attenation is done by placing a VOA (variable optical attenator) in Alice s side. Figre shows the schematic of the optical and electric layots in or system. The commercial QKD system by id Qantiqe consists of Bob and Jr. Alice. In or decoy state experiment, the actal (sender s) system is called Alice. It consists of Jr. Alice and for new optical and electronics components added by s. More concretely, for or decoy state protocol, we place the Decoy Intensity Modlator IM (denoted by DA in Fig. ) right in front of Jr. Alice. Its idle state is set to maximm transmittance. When the frame comes from Bob, the Decoy IM is in the idle state. After the first plse reaches copler C2, it will be detected by the classical detector and a synchronization signal will be otpt to trigger the Decoy generator. The Decoy Generator (DG in Fig. ), being triggered, Fig.: Experimental setp of weak + vacm state protocol 696 will hold a delay time td before otptting N P modlation voltages driving the Decoy IM to attenate the intensity of each the N P signals to be either that of signal state or decoy state dynamically, according to the Decoy profile. RESTS We performed nmerical simlation to find ot the optimal parameters. According to simlation reslts, we choose the intensities as µ = 0.55, v = Nmbers of plses sed as signal state, weak decoy state and vacm state are N µ = 0.635N, N v = 0.203N and N 0 = 0.62N respectively, where N = 05Mbit is the total nmber of plses sent by Alice in this experiment. After the transmission of all the N signals, Alice broadcasted to Bob the distribtion of decoy states as well as basis information. Bob then annonced which signals he had actally received in correct basis. We assme Alice and Bob annonced the measrement otcomes of all decoy states as well as a sbset of the signal states. From those experimental data, Alice and Bob then determined Q µ, Q v, E µ and E v, whose vales are now listed in Table. Note that or experiment is based on BB84 [0] protocol, S Nµ S ths q = ( / 2), where N µ is the nmber of plses N sed as signal state when Alice and Bob chose the same basis (Eq. ). DISCSSION Alice and Bob have to derive a lower bond on the key generation rate, R, by applying the theory of one decoy state protocol to their experimental data. To begin, we discss the theory of weak + vacm protocol. The weak + vacm protocol was first proposed and analyzed in [2]. In sch a protocol, only vacm and one decoy state are sed (in principle, more decoy states might increase key generation rate) with average photon nmbers 0 and v respectively. The transmittance/gain of the decoy state Q µ and its error rate E µ cold also be acqired directly from experiments. The experimental reslts are shown in Table. Note that the gain of vacm state is indeed very close to the dark cont rate, therefore the vacm state in or experiment is qite vacm. By taking statistical flctations into accont, we cold estimate the lower bond of Q and pper bond of e by plgging these experimental reslts into the Eq. 3 and 4 [2]. In or analysis of experimental data, we estimated e and Q very conservatively as within 0 standard deviations (i.e., a = 0), which promises a confidence interval for statistical flctations of

4 Table : Direct reslts from or experiment Para Vale Para Vale Para Vale Q µ E µ q 0.39 Qν Eν f (E) [3].22 Y Table 2: The lower bonds of Q, R and the pper bond of e.the vales are calclated from Eq. -4, taking statistical flctation into accont Para Vale Para Vale Q e R The experimental reslts listed in Table are the inpt for Eq. -4, whose otpt is a lower bond of the key generation rate, as shown in Table 2. Even with or very conservative estimation of e and Q, we got a lower bond for the key generation rate R = per plse, which means a final key length of abot = NR = 66 kbit. The finite size of data (05 M) gives a final secre key 66 kbits and introdces statistical flctations and therefore redces the key generation rate (per plse) below the fndamental limit of R perfect, which corresponds to infinite data size and infinite decoy state protocol. We remark that, as discssed in [2], here we consider only the flctations of the parameters, Q s and e s becase we believe they, being rather small nmbers, are the main sorce of statistical flctations. We do not consider, for example, the flctations in the nmber of different type of plses (vacm, single-photon) as sch flctations are negligible, in comparison. Notice that, even with or very conservative estimation for a confidence of , the lower bond of R is still roghly /4 of R perfect. This fact hints that it is not necessary, or rather, not economical, to se either very large data size or a lot of different decoy states. We performed nmerical simlation ranging µ from 0-, while no positive lower bond on R can be fond. This fact indicates that for or set-p, at a distance of 25 km, withot decoy states, we wold have been nable to prove the secrity of or protocol in an analogos manner. We provide the experimental demonstration of decoy state QKD over 25 km of Telecom fibers. Or reslt shows that, with rather simple modifications (by adding commercial variable optical attenators) to a commercial QKD system, decoy state QKD allows s to achieve mch better performance (in terms of sbstantially higher key generation rate and longer distance) than what is otherwise possible. Or experiment gives nconditional secrity against the most general attack allowed by qantm mechanics. 697 Moreover, it gives a rather high key generation rate. We expect that decoy state QKD will play a major role in ftre QKD systems in both fibers and open air. CONCSION Experimental weak + vacm decoy QKD system sing commercial QKD system has been demonstrated over a 25 km fiber with an nconditionally secre key rate of per plse. It is nconditionally secre against all types of attacks, inclding the PNS attack. We conclde that decoy plses improve the secrity and performance of weak plse QKD. However, sorces and detectors mst be calibrated accrately to avoid any artifacts that may compromise secrity. ACKNOWEDGMENT One of the researchers (AS) is gratefl to the Faclty of Science of IIM and Mimos Berhad for the facilities provided to him in the ndertakings of his PhD s degree programme. REFERENCES. Nielsen, M.A. and I.. Chang, Qantm Comptation and Qantm Information. Illstrated Edn., Cambridge niversity Press, K., ISBN: , pp: Gisin, N., G. Ribordy, W. Tittel and H. Zbinden, Qantm cryptography. Rev. Mod. Phys., 74: DOI: 0.03/RevModPhys Bennett, C.H. and G. Brassard, 984. Qantm cryptography: Pblic key distribtion and coin tossing. Proceeding of the IEEE International Conference on Compters, Systems and Signal Processing, (ICCSSP 84), Bangalore, IEEE, New York, pp: Wootters, W.K. and W.H. Zrek, 982. A single qantm cannot be cloned. Natre, 299: DOI: 0.038/299802a0 5. Shor, P.W. and J. Preskill, Simple proof of secrity of the BB84 qantm key distribtion protocol. Phys. Rev. ett., 85: DOI: 0.03/PhysRevett o, H.K. and H.F. Cha, 999. nconditional secrity of qantm key distribtion over arbitrarily long distances. Science, 283: DOI: 0.26/science Mayers, D., 200. nconditional secrity in qantm cryptography. J. ACM., 48:

5 8. Ekert, A.K., 99. Qantm cryptography based on Bell s theorem. Phys. Rev. ett., 67: DOI: 0.03/PhysRevett Gobby, C., Z.. Yan and A.J. Shields, Qantm key distribtion over 22 km of standard telecom fiber. Applied Phys. ett., 84: DOI: 0.063/ Mo, X. et al., Faraday-Michelson system for qantm cryptography. Optics ett., 30: DOI: 0.364/O Hwang, W.Y., Qantm key distribtion with high loss: Toward global secre commnication. Phys. Rev. ett., 9: DOI: 0.03/PhysRevett Ma, X., B. Qi, Y. Zhao and H.K. o, Practical decoy state for qantm key distribtion. March, Brassard, G. and. Salvail, 994. Advances in cryptology EROCRYPT 93. ectre Notes Compt. Sci., 765: ryptology/book/