Communications Quantiques

Transcription

1 Communications Quantiques Hugo Zbinden Groupe de Physique Appliquée Quantum Technologies Université de Genève Cryptographie Quantique Génération de nombres aléatoires Stéganographie basée sur du bruit quantique

2

3 What s Cryptography? Plain Text Alice Bob Plain Text Alice Bob Alice Cipher Text asuektüds&l Bob Key Eve Key Secure communication between Alice and Bob The spy, Eve, tries to read the encoded message

4 Classical Cryptography Based on Complexity DES, AES (secret key) RSA (public key) Security unproven One-way functions Integer factorisation = x 5671 = y z

5 Classical Cryptography based on Information Theory one time pad (Vernam) plaintext : key: cyphertext: security proven problem: key distribution

6 1) Quantum Key Distribution Quantum Crpytography is not a new coding method Send key with individual photons (quantum states) The eavesdropper may not measure without perturbation (Heisenbergs uncertainty principle) Eavesdropping can be detected by Alice and Bob! QKD is proven information theoretically secure!

7 BB84 protocol (Bennett, Brassard, 1984) Bob H/V Basis Polarizers Horizontal - Vertical Alice 45 Basis Diagonal (-45, +45 ) Alice's Bit Sequence Bob's Bases Bob's Results Key

8 Eavesdropping Alice Eve 50% 50% 50% 50% Bob 50% 50% 50% 50% Ok Error Ok Error Ok Error with 25 % probability I AE = 2 QBER (quantum bit error rate) 8

9 Shannon Information Eve s attacks: information curves I AB 1 H( QBER) Secret key rate I AE Probabilistic I-R I AE = 2 QBER QBER 0.4 9

10 Shannon Information Incoherent attacks: information curves I AB 1 H( QBER) Secret key rate I AE I AE = 1 - H(1/2 + Sqrt(QBER(1-QBER)) I AE Probabilistic I-R I AE = 2 QBER QBER 0.4

11 The steps to a secret key Alice Raw key Quantum channel (losses) Public channel Bob Sifted key Key Key + Authentication!!!

12 Smolin and Bennett IBM 1989

13 Swiss QCRYPT project (2013)

14 Efficient protocol Finite key analysis Low noise detectors Low loss fibres Nature Photonics 9, (2015)

15 Ingredient 1: efficient and simple QKD scheme QBER Visibility Coherent One Way (COW) Characteristics 1.25 GHz clock (625 MHz bit generation rate) No active elements at Bob, robust bit measurement basis Robust against PNS attacks Reveals action of eavesdropper Input for key distillation Security proof for collective attacks

16 Ingredient 2: tight finite key analysis Allows around an order of magnitude reduction of post-processing block size Comparison of secret key rate using different postprocessing blocksizes (10⁴, 10⁵, 10⁶, 10⁷ left to right) Solid red: New tail inequality Dashed blue: Previous tail inequality

17 Ingredient 3: low noise single photon detectors 1 cps System requirements: Low dark count rate of SPD Compact ( no SNSPD) 100 cps APDs: afterpulsing! afterpulsing Optical QBER

18 APD s in photon counting mode Bias over breakdown voltage U Bias I A single photon can generate a macroscopic pulse U How to stop the avalanche Passive quenching Active quenching APD 50 RQ U Bias Active gating + U Bias + U Signal U Breakdown t

19 Afterpulsing in APDs Photon Detection Absorption region Trapped charges Absorption region Afterpulse Absorption region Multiplication region Multiplication region Multiplication region Trapped charges Macroscopic current Macroscopic current More current flow = More trapped charges = More afterpulsing

20 Free running Negative Feedback Aavalanche Photo Diode Rapid passive quenching + hold-off time -> low afterpulsing 1 darkcount/s ( 10% eff, 160 K) M. Itzler et al., Proc. SPIE 2009, 7222, 72221K-1 B. Korzh et al., Appl. Phys. Lett. 104, (2014)

21 Tradeoff: Temperature and noise Afterpulse mitigation with longer hold-off time Afterpulse Compensate with hold-off Dark counts Temperature

22 Specs: dark count rate vs temperature Reduction due to lower breakdown voltage => smaller field 1.2 cps reduction of 2 o.m. Trap-assisted tunneling InP Thermal generation InGaAs B. Korzh et al., Free-running InGaAs single photon detector with 1 dark count per second at 10% efficiency, Appl. Phys. Lett. 104, (2014)

23 Stirling coolers 3.5 kg 153 K 220 g 110 K Jean-Yves Martin et al., Thales Cryogenics rotary cryocoolers for HOT applications, Proc. of SPIE Vol (2012)

24 Ingredient 4: Low Loss Optical Fibres Total attenuation of an optical fiber: Not major contribution contributors Eliminated by CVD Reduced by Cl dry Reduced stresses Fiber design Coating materials RS IR UV TM OH IM BL Intrinsic Extrinsic Rayleigh scattering is dominant: density and dopant fluctuations minimized by choosing optimum (small) dopant concentration Corning Incorporated

25 Ultra low loss fibers Vascade EX m 2 Vascade EX m 2 Submarine applications Vascade EX m 2 Terrestrial applications SMF28 ULL 80 m 2 SMF28 Ultra 80 m 2 SMF28 e+ 80 m Attenuation (db/km) 2015 Corning Incorporated

26 .putting all together: FPGA is essential!

27 Results: Secret (finite key) rates vs distance η = 22% t off = 9 µs µ = 0.06 ppbs = 2x10 7 t pp = 537 s 13 kb/s η = 27% t off = 42 µs µ = 0.1 ppbs = 1.1x10 7 t pp = 308 s 1kb/s η = 22% t off = 114 µs µ = ppbs = 6.6x10 5 t pp = s 3 b/s ε QKD = 4x10-9

28 Stability over 70h (200km) Automatic tracking: QBER Temporal alignment: Quantum signal clock recovery with 10 ps resolution Extinction ratio: Modulator bias voltage Visibility Adjust Laser current (wavelength)

29 Summary: Notable QKD demonstrations First long distance experiment with APDs First long distance experiment with finite key analysis and quantifiable security statement B. Korzh, C. W. Lim et al., Provably Secure and Practical Quantum Key Distribution over 307 km of Optical Fibre, Nature Photonics 9, (2015)

30 Current developments Make it smaller (ATCA Telecom standard) Make it cheaper Make it faster longer distances (quantum repeater, satellite)

31 2) Quantum Random Number Generator Why RNG? Game/Simulation/Classical Cryptography (RSA, DSA )/ Quantum Key Distribution Why Physical RNG? "Anyone who considers arithmetical methods of producing random digits is, of course, in a state of sin. John von Neumann (1951) Why Quantum RNG? Random classical noise could be predictable Possibility to estimate/certify the entropy

32 Realisations of QRNGs using single photons Rate: 4 Mbit/s per module

33 Exploiting photon statistics (shot noise) Example with a Nokia N10 If Possibility to extract quantum randomness Sanguinetti B., et al Phys. Rev. X

34 PART 3: Quantum Secure Steganography arxiv Disclaimer: We are physicists.

35 Steganography from Greek steganos, or "covered," and graphie, or "writing"): hiding of a secret message within an ordinary message Cryptography guarantees secrecy, but not privacy. Steganography important in countries with untrustworthy, totalitarian regimes Universal Declaration of Human Rights: Art. 19

36 Hiding secret information in a picture

37 Steganography exploiting shot noise Example with a Nokia N10 Sanguinetti B., et al Phys. Rev. X

38 Naive idea Use least significant bit to transmit (OTP) encoded data Simulated Histogram of the pixel values of a homogeneous area

39 Better idea Take photographs of a static object in rapid succession Assumptions: 1. state of object and camera unchanged between to consecutive pictures K and C 2. Each pixel is statistical independent (no crosstalk). Protocol: given Text T, create a new picture S as follows: S cannot be distinguished from any real photograph

40 Private key steganography

41 Experimental realisation Tests with scientific mono-chrome and consumer colour cameras with raw image files 8 Mpix 16 bit tiff files error-correction applied (Reed-Solomon code)

42 It works! Results no cross-pixel correlations stability depends on experimental situation colour camera needs more investigations works also for jpeg files (less bits can be hidden)

43 Conclusions «Practical» QKD over 300 km range (reasonable limit 400km) «True Random Numbers» have quantum origin Provable secure steganography is possible (more work needed to test it in more «practical» situations) Quantum Communication: some quantum physics - lots of high tech