Security and implementation of differential phase shift quantum key distribution systems

Transcription

1 Security and implementation of differential phase shift quantum key distribution systems Eleni Diamanti University Ph.D. Oral Examination June 1 st, 2006

2 Classical cryptography cryptography = κρυπτός + γράφω = write secretly Ancient Greece Scytale Alice World War II Enigma Unconditional security One time pad Today computational security e.g. computational difficulty of factoring large integers Bob cryptogram Eve message M key K cryptogram S = M K cryptogram S key K message M = S K

3 Quantum cryptography Public channel Quantum channel Information Error Quantum cryptography relies on fundamental laws of quantum mechanics to solve the key distribution problem Quantum Key Distribution (QKD) Information is encoded in quantum bits (qubits) vector in a two dimensional Hilbert space: ψ = α 0 + β 1 Photons are ideal qubits for QKD because they can be transmitted over long distances in optical fibers

4 Limitations in quantum cryptography First proposal of using the quantum properties of light by Bennett and Brassard in 1984 BB84 QKD protocol First demonstration of a quantum cryptography system in 1992, information was transmitted over 32 cm of free space Performance of current fiber-optic QKD systems is mainly limited by two factors: Vulnerability of QKD protocols to powerful eavesdropping attacks, when classical light from a laser is used instead of non-classical light from a single-photon source Single-photon detectors communication rate remains very low, communication distance is limited to a few tens of kilometers Challenge Invent ways of extending the distance and increasing the speed of QKD systems

5 Outline The BB84 quantum key distribution protocol Differential phase shift quantum key distribution (DPS-QKD) The up-conversion single-photon detector Implementation of a 1 GHz DPS-QKD system Implementation of a 10 GHz DPS-QKD system Conclusion Future directions

6 The BB84 QKD protocol Alice Electro-optic modulator Quantum channel 50/50 BS H, V basis Bob Single-photon source H V PBS Single-photon detectors + 45, 45 basis Quantum transmission Information is encoded in two non-orthogonal bases Raw key generation rate: Repetition rate Rraw = ν ( μt + 4 d) Average photon number per pulse Transmission efficiency T Dark counts per clock cycle ( α L Lr )/10 =η10 +

7 Sifting and error correction Sifting Alice and Bob discard the bits for which they chose a different basis Sifted key generation rate: 1 1 Rsifted = Rraw = ν ( μt + 4 d ) 2 2 If the transmission is error-free, sifted key is unconditionally secure, any eavesdropping will unavoidably cause errors But all practical systems have errors Error correction Alice provides Bob with additional information about the key to correct errors, e.g. parity check by segment Leakage of additional information to Eve need algorithm to minimize number of revealed bits Length of error correction string Length of sifted key Shannon s noiseless coding theorem κ lim n = f ( e) elog 2e+ (1 e)log 2(1 e) n [ ] Efficiency of error correction algorithm

8 Privacy amplification Privacy amplification Key information has leaked to Eve Innocent error rate due to system imperfections Error correction We need to compress key so that Eve s information becomes exponentially small, e.g. randomly choose two bits and calculate XOR secure key Generalized privacy amplification theory: { τ ( )[ log (1 ) log (1 )]} R = R + f e e e+ e e secure sifted 2 2 Eve uses innocent system error rate to obtain key information by general quantum measurements on individual single photons shrinking factor calculated from security proof: 1 τ = log2 + 2e 2e 2 2

9 Photon number splitting attacks in BB84 Eve Lossless channel Alice QND photon number measurement Bob Quantum memory Delayed measurement For multi-photon states, Eve learns bit information without causing any error As the channel loss increases she blocks more and more single-photon states Modified shrinking factor: Poisson source 2 e e μt μ = + = 2 β β μt 2 1 e= 0 τ βlog2 2 2 β Fraction of single-photon states

10 Secure key distribution distance for BB84 μ For e ~0, d ~0: Rpoisson opt μt 2 μ T R T poisson Quadratic decrease with channel transmission 2 Rideal T Linear decrease with channel transmission BB84 with Poisson source is vulnerable to photon number splitting attacks

11 Outline The BB84 quantum key distribution protocol Differential phase shift quantum key distribution (DPS-QKD) The up-conversion single-photon detector Implementation of a 1 GHz DPS-QKD system Implementation of a 10 GHz DPS-QKD system Conclusion Future directions

12 Differential phase shift quantum key distribution (DPS-QKD) Alice Quantum channel Δt DET1 (0) Bob Coherent light source ATT PM (0,π) 0 π 0 0 BS BS Δt DET2 (1) Sifted key generation rate: Rsifted = Rraw = ν ( μt + 2 d) Principle of security non-deterministic collapse of a wavefunction in a quantum measurement 1 = N iφ1 iφ2 iφn iφn ψ e 1 e 2... e n... e N Detection event occurs at a time instance n randomly and reveals phase difference Δφ n =φ n+1 -φ n

13 Beamsplitter attack Alice Eve T Lossless channel Bob Quantum memory Optical switch One beam with average photon number N μt is sent to Bob, another with average photon number N μ(1-t ) is used by Eve Each photon in Eve s wavefunction is detected randomly at one of N time instances probability that she obtains the value of a bit at a certain time given that Bob detected a photon at that time is 2μ(1-T ) She obtains complete bit information for a fraction 2μ(1-T ) of bits without causing any error

14 Intercept and resend attack Eve Alice Single-photon source Bob X X Induces 25 % error rate If innocent system error rate is e, Eve can attack 4e bits she obtains complete bit information for a fraction 2e of bits Hybrid beamsplitter + intercept and resend attack: Eve does not have bit information for a fraction 1-2μ(1-T )-2e of bits τ = 1 2 μ(1 T) 2e { τ ( )[ log (1 ) log (1 )]} R = R + f e e e+ e e secure sifted 2 2

15 General individual attacks Eavesdropping strategy: Photon number splitting attack: QND measurement on total photon number in wavefunction, Eve sends N μt photons to Bob and keeps N μ(1-t ) photons, which are stored and measured individually equivalent to beamsplitter attack Optimal measurement on individual single photons, which spread over many pulses with a fixed phase modulation pattern in DPS- QKD Privacy amplification shrinking factor becomes: τ = [ μ ] μ (1 6 e) e= (1 T) log2 1 e 1 2 (1 T)

16 Secure key distribution distance for DPS-QKD For e ~0, d ~0: R μ DPS opt μt(1 2 μ) f ( T) R T DPS Linear decrease with channel transmission illustrates robustness to photon number splitting attacks Performance determined by robustness to photon number splitting attacks, which is accounted for in both analyses. DPS-QKD uses a Poisson source and is robust to photon number splitting attacks

17 Outline The BB84 quantum key distribution protocol Differential phase shift quantum key distribution The up-conversion single-photon detector Implementation of a 1 GHz DPS-QKD system Implementation of a 10 GHz DPS-QKD system Conclusion Future directions

18 Current single-photon detectors Wavelength Quantum efficiency Dark count rate Afterpulse effects InGaAs/InP APD nm ~10 % ~10 4 counts/s Large gated mode Si APD nm ~70 % ~50 counts/s Small non-gated mode No probability of detection All pulses are possibly detected Gate width (~1 ns) Dead time t d (~50 ns) Gate period 1/f g (~1 μs) R f T sifted gated = gμ sifted non-gated R Te νμtt d =νμ

19 The up-conversion single-photon detector 1.5 μm single-photon signal 1.3 μm strong pump 700 nm single-photon idler Periodically poled lithium niobate (PPLN) waveguide Si APD Sum frequency generation ω pump ω SFG ω signal ω pump + ω signal = ω SFG Birefrigent phase-matching: k pump + k signal = k SFG Quasi-phase-matching (QPM): k pump + k signal + K = k SFG, K = 2π/Λ QPM can be achieved for any desired interaction using nonlinear coefficients that couple waves of same polarization, which may be stronger very efficient nonlinear interactions Tight confinement of interacting fields in entire crystal higher signal conversion efficiency bulk waveguide

20 1.55 μm single-photon detection experimental setup 1.32 μm pump source 30 db isolator VATT 20 db Polarization splitter controller 99% Fixed 20 db attenuators splitter VATT 1% Polarization controller 1.55 μm signal source Power monitor 1% 1310/1550 WDM 99% Power monitor Fiber-coupled PPLN waveguide Lens SHG Filter Dichroic BS Pump, signal Temperature-controlled oven Mirror Prism Lens Si APD

21 N SFG int ernal = = Nsignal(0) Quantum efficiency Coupled mode theory for three-wave interactions in a waveguide with undepleted pump and lossless propagation: η ( L) sin 2 ( ηnor pl) η = η T e T T η signal α L SFG int ernal in out collection Si APD 99.9 % signal conversion efficiency in waveguide with ~100 mw of coupled pump power reduced to 83 % due to propagation losses reduced to 65 % due to input coupling, output coupling, fiber pigtail, reflection, and collection setup losses 46 % overall quantum efficiency

22 Dark counts dark counts/s at maximum quantum efficiency point Dark counts are not determined by Si APD but by a parasitic nonlinear process, which strongly depends on pump power

23 Dark count origin Spectral feature appears at SFG wavelength noise photons at 1.55 μm are up-converted via SFG process Possible source of noise photons: spontaneous Raman scattering in fiber and waveguide Solution: use longer pump wavelength than signal wavelength Stokes anti-stokes dark counts/s ω pump ω Stokes ω anti-stokes ω pump dark counts/s ω phonon ω phonon

24 Summary DPS-QKD protocol simple system architecture requires only practical, telecommunication components robust to photon number splitting attacks Up-conversion detector high efficiency (maximum 46 %) in the 1.5 μm telecommunication band quantum efficiency and dark counts depend on pump power convenient tuning tool for optimal operation regime depending on the application non-gated mode operation with small dead time enables fast communication

25 Outline The BB84 quantum key distribution protocol Differential phase shift quantum key distribution The up-conversion single-photon detector Implementation of a 1 GHz DPS-QKD system Implementation of a 10 GHz DPS-QKD system Conclusion Future directions

26 1 GHz DPS-QKD experimental setup 1.55 μm cw light source Polarization controller IM Polarization controller (0,π) PM VATT 20 db splitter 99% VATT Optical fiber 66 ps 15 GHz PPG 1 GHz DG Power monitor 1% 1 ns Clock source Measurement time window START Time Interval Analyzer STOP DET1 Temperature-controlled PLC Mach-Zehnder interferometer 1 ns 1 ns Logic unit 1.55 μm up-conversion single-photon detectors Insertion loss: 2.5 db Extinction ratio: 20 db DET2

27 Experimental setup in the lab Alice Quantum channel Bob Detector

28 Detector timing jitter characteristics Pulse broadening due to timing jitter of Si APD induces errors apply measurement time window, which also reduces effective dark counts 66 ps pulses, 10 5 counts/s FWHM: 75 ps FWTM: 240 ps We can use small measurement time window without significant degradation of the signal to noise ratio

29 Experimental results ( 1 6e) 2 2 Rsecure = Rsifted [1 2 μ(1 T)]log2 1 e + f ( e) [ elog 2 e+ (1 e) log 2(1 e) ] (a) η = 6 % D = counts/s time window = 200 ps d = (b) η = 0.4 % D = 350 counts/s time window = 100 ps d = (a) 2 Mbit/s km (b) km

30 Comparison with existing systems

31 Outline The BB84 quantum key distribution protocol Differential phase shift quantum key distribution The up-conversion single-photon detector Implementation of a 1 GHz DPS-QKD system Implementation of a 10 GHz DPS-QKD system Conclusion Future directions

32 10 GHz DPS-QKD experimental setup 1.55 μm, 10 GHz mode-locked laser Polarization controller (0,π) PM VATT 20 db splitter 99% VATT Optical fiber 10 ps 10 GHz PPG Power monitor 1% 100 ps Clock source Measurement time window START Time Interval Analyzer STOP DET1 Temperature-controlled PLC Mach-Zehnder interferometer 100 ps 100 ps Logic unit 1.55 μm up-conversion single-photon detectors Insertion loss: 2.5 db Extinction ratio: db DET2

33 Detector timing jitter characteristics Histogram of detected photons for fixed phase modulation pattern 10 ps pulses, counts/s Time (1 ns/div.) FWHM: 30 ps FWTM: 116 ps

34 Experimental results η = 0.27 %, D = 320 counts/s, time window = 10 ps d = Fiber length (km) Bit error rate due to dark counts (%) Bit error rate (%) Sifted key generation rate (kbit/s) Narrow pulse width and narrow FWHM we can use very narrow measurement time window extremely small contribution of dark counts to error rate Also verified by independence of total bit error rate on fiber length Error dominated by timing jitter, which is slightly higher for small fiber losses Threshold error rate for secure communication against general individual attacks is 4.5 % secure keys cannot be generated with ~10 % error rate

35 Conclusion We introduced and proved the security of the DPS-QKD protocol simple system architecture, robust to photon number splitting attacks excellent candidate for long distance fiber-optic quantum cryptography systems We demonstrated a fast and efficient single-photon detector in the 1.5 μm telecommunication band We implemented a practical DPS-QKD system operating at 1 GHz 2 Mbit/s sifted key generation rate over 10 km distribution of secure keys over 100 km of optical fiber high speed and long distance quantum cryptography possible with currently available technology We implemented a DPS-QKD system operating at 10 GHz did not yield secure keys due to high error rate, limited by the detector timing jitter

36 Future directions Proof of unconditional security for DPS-QKD Up-conversion detector improvements can lead to megahertz secure key generation rate and communication distance exceeding 250 km Reduce dark counts Improve timing jitter characteristics of avalanche photodiodes Superconducting single-photon detectors have very small dark counts and Gaussian response Entanglement-based BBM92 can withstand larger channel losses Quantum computation and quantum networking