quantum information processing with non-classical light

QUANTUM INFORMATION PROCESSING

WITH NON-CLASSICAL LIGHT

a dissertation

submitted to the department of electrical engineering

and the committee on graduate studies

of stanford university

in partial fulfillment of the requirements

for the degree of

doctor of philosophy

Edo Waks

May 2003

c© Copyright by Edo Waks 2003

All Rights Reserved

ii

I certify that I have read this dissertation and that, in

my opinion, it is fully adequate in scope and quality as a

dissertation for the degree of Doctor of Philosophy.

Yoshihisa Yamamoto(Principal Adviser)




Robert L. Byer




Martin M. Fejer

Approved for the University Committee on Graduate

Studies:

iii

Abstract

Quantum information processing (QIP) is a field concerned with technological appli-

cations of quantum mechanical phenonomena. In many cases, photons are an ideal

quantum system for such applications. Photons exhibit superb coherence properties,

are robust to environmental noise, and can be transmitted over long distances.

One of the main difficulties of photon based quantum information processing is

the generation of non-classical light fields. Non-classical light fields exhibit counting

statistics which are inconsistent with the classical theory of radiation. These non-

classical statistics are precisely what QIP applications make use of in many cases.

This thesis explores the applications of non-classical light fields for quantum in-

formation processing applications. There are three main parts to this work. The first

part is a theoretical analysis of quantum cryptography based on non-classical light

sources. In this part, a theoretical study on sub-Poisson light sources is presented,

which quantitatively characterizes their advantage over classical sources such atten-

uated laser. Next, the security of quantum cryptography with entangled photons is

investigated. A security proof is presented, and it is shown that such protocols have

significantly enhanced security properties, potentially allowing quantum cryptogra-

phy over 170km with currently available technology.

The second part is an experimental demonstration of quantum cryptography using

sub-Poisson light from an InAs quantum dot. A fully functional system is presented,

and an experimental comparison between the quantum dot source and an attenuated

laser is made. It is shown that the quantum dot can withstand 5dB of additional

channel loss over the attenuated laser.

iv

In the final part, a method for photon number generation is presented using para-

metric down-conversion and the Visible Light Photon Counter (VLPC). The VLPC is

a photon counter that has the ability to do photon number discrimination with very

high quantum efficiency. When combined with a non-linear optical process called

parameric down-cnversion, one can generate photon number states. An experimental

demonstration of 1,2,3 and 4 photon number states is presented.

v

Acknowledgements

Over the past six years, there are many people who I owe thanks to for their help and

support. First and foremost, I owe a great deal to my advisor, Professor Yoshihisa

Yamamoto, for his outstanding guidance and support. I have also been extremely for-

tunate to work with many bright colleagues in the Yamamoto group. Interaction and

brain-storming with the group members has been an important part of my graduate

career.

Over the past years I have had many mentors who have shared their expertise

with me. I was extremely fortunate to work for three months with Dr. Paul Kwiat,

who taught me virtually all of my optics skills. Later, I worked with Dr. Jungsang

Kim, who taught me how to operate the VLPC. Xavier Maitre was extremely helpful

in many of the later phases of operating the VLPC detector as well. I also had the

pleasure of working with Dr. Chung Ki Hong, who helped with the initial phases of my

experiments with parametric down conversion. During the cryptography experiment

I worked a lot with Dr. Kyo Inoue from NTT basic research. Finally, Dr. Barry

Sanders from Macquarie University was a great resource of new ideas.

I would also like to thank the colleagues in the Yamamoti group who I have had the

pleasure of working with. Will Oliver provided us with valuable help in the amplifier

design for the VLPC. The single photon source for the cryptogtraphy experiment

was designed by Charles Santori and David Fattal, who spent long hours in the lab

helping us get data. In the final phases of my Ph.D., I was fortunate to work with

Eleni Diamanti, who helped with the photon number generation experiment.

I would like to thank my defense committee Professor Yamamoto, Professor Byer,

Professor Fejer, and Professor Gratta, for attending my defense. I would like to thank

vi

the first three members for also agreeing to be on my reading committee.

I would like to thank all my friends who have supported throughout these year.

And finally, I would like to thank my Mom, my Dad, and my brother for their

unwavering support and sympathy through all the highes and lows.

vii

Contents

Abstract iv

Acknowledgements vi

1 Introduction 1

1.1 Quantum information . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

1.2 Quantum cryptography . . . . . . . . . . . . . . . . . . . . . . . . . . 3

1.3 Photon number detection . . . . . . . . . . . . . . . . . . . . . . . . . 6

1.4 Number State Generation . . . . . . . . . . . . . . . . . . . . . . . . 6

2 Classical Information and Communication 8

2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

2.2 Entropy and Mutual Information . . . . . . . . . . . . . . . . . . . . 8

2.3 Cryptography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

3 Encoding quantum information 17

3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

3.2 The qubit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

3.3 Positive Operator Value Measures (POVMs) . . . . . . . . . . . . . . 22

3.4 The photonic qubit . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

3.5 Entaglement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

3.6 Teleportation and entanglement swapping . . . . . . . . . . . . . . . 33

viii

4 Theory of Quantum Cryptography 35

4.1 The BB84 protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

4.2 Practical aspects of BB84 . . . . . . . . . . . . . . . . . . . . . . . . 38

4.2.1 Error Correction . . . . . . . . . . . . . . . . . . . . . . . . . 42

4.2.2 Privacy amplification . . . . . . . . . . . . . . . . . . . . . . . 43

4.2.3 Proof of security by Lutkenhaus . . . . . . . . . . . . . . . . . 47

4.2.4 Photon source characterization . . . . . . . . . . . . . . . . . 52

4.2.5 Communication rates for BB84 with sub-Poisson light . . . . . 57

4.2.6 Estimates for sub-Poisson light sources . . . . . . . . . . . . . 64

4.3 Quantum cryptography with entangled photons . . . . . . . . . . . . 67

4.3.1 The BBM92 protocol . . . . . . . . . . . . . . . . . . . . . . . 68

4.3.2 Proof of security for BBM92 . . . . . . . . . . . . . . . . . . . 70

4.3.3 Ideal entangled photon source . . . . . . . . . . . . . . . . . . 74

4.3.4 Entangled photons from parametric down-conversion . . . . . 76

4.3.5 Calculations . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80

4.3.6 Entanglement Swapping . . . . . . . . . . . . . . . . . . . . . 82

5 Quantum cryptography with sub-Poisson light 87

5.1 Sub-Poisson light from InAs quantum dots . . . . . . . . . . . . . . . 88

5.2 Quantum cryptography with a quantum dot . . . . . . . . . . . . . . 95

6 The Visible Light Photon Counter 101

6.1 VLPC operation principle . . . . . . . . . . . . . . . . . . . . . . . . 101

6.2 Cryogenic system for operating the VLPC . . . . . . . . . . . . . . . 103

6.3 Quantum efficiency and dark counts of the VLPC . . . . . . . . . . . 105

6.4 Noise properties of the VLPC . . . . . . . . . . . . . . . . . . . . . . 109

6.5 Multi-photon detection with the VLPC . . . . . . . . . . . . . . . . . 111

6.6 Characterizing multi-photon detection capability . . . . . . . . . . . . 112

7 Non-classical statistics from parametric down-conversion 122

7.1 Basics of parametric down-conversion . . . . . . . . . . . . . . . . . . 122

7.2 Non-classical photon statistics . . . . . . . . . . . . . . . . . . . . . . 124

ix

7.3 Observation of non-classical statistics . . . . . . . . . . . . . . . . . . 125

7.4 Reconstruction of photon number oscillations . . . . . . . . . . . . . 128

8 Photon number state generation 134

8.1 Single photon generation . . . . . . . . . . . . . . . . . . . . . . . . . 136

8.1.1 Theory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136

8.1.2 Experiment . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141

8.2 Multi-photon generation . . . . . . . . . . . . . . . . . . . . . . . . . 144

9 Conclusion 155

A Handling side information from error correction 158

B One photon contribution 161

C Higher order number contributions 166

Bibliography 168

x

List of Tables

4.1 Values of f(e) for different error rates. . . . . . . . . . . . . . . . . . 59

6.1 Results of fit for panel (c) of Figure 6.8. . . . . . . . . . . . . . . . . 117

xi

List of Figures

2.1 Schematic of binary symmetric channel. . . . . . . . . . . . . . . . . . 11

2.2 Schematic of system for unconditionally secure cryptography. . . . . . 14

3.1 The Bloch sphere. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

3.2 Model for generalized, delayed quantum measurements. . . . . . . . . 24

3.3 Implementation of a dual rail quantum bit. a, spatial mode implemen-

tation. b, polarization mode implementation. . . . . . . . . . . . . . 26

3.4 Time slot based qubit for optical fiber applications. . . . . . . . . . . 29

4.1 Different types of eavesdropping attacks considered in security proofs. 40

4.2 Basic system for performing the BB84 protocol. . . . . . . . . . . . . 48

4.3 Two methods of implementing Bob’s detection apparatus. . . . . . . 49

4.4 Hanbury Brown-Twiss intensity interferometer. . . . . . . . . . . . . 55

4.5 Communication rate as a function of channel loss for different values

of g(2), assuming the device efficiency is 1. . . . . . . . . . . . . . . . 61

4.6 Communication as a function of channel loss for different device effi-

ciencies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

4.7 Basic system for performing the BB84 protocol. . . . . . . . . . . . . 66

4.8 Comparison between BB84 protocol and BBM92 using both ideal and

realistic sources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81

4.9 BBM92 implementation with entanglement swapping. Boxes labelled

B represent bell state analyzers, while EPR represents an entangled

photon source. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83

4.10 Comparison of no swap, one swap, and two swap scheme. . . . . . . 86

xii

5.1 Atomic force microscope image of uncapped quantum dot sample. . . 88

5.2 Scanning electron microscope image of micro-post structure. a, image

of several micro pillars. b, close up image of micro-post showing DBR

mirror structure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89

5.3 Experimental setup for characterizing quantum dot photon source. . . 91

5.4 a, wavelength spectrum of quantum dot. The dot features a narrow

emission line at 920nm. b, the lifetime of the dot is measured by a

streak camera to be 0.174ns. . . . . . . . . . . . . . . . . . . . . . . 92

5.5 Energy level diagram of quantum dot showing resonant excitation

scheme. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93

5.6 Saturation curve for quantum dot. . . . . . . . . . . . . . . . . . . . . 93

5.7 Autocorrelation measurement for quantum dot single photon source.

The area of the τ = 0 peak is suppressed to 0.14 of a far off side peak. 94

5.8 Experimental setup for implementing BB84 with quantum dot photon

source. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96

5.9 Data correlation between Alice and Bob. . . . . . . . . . . . . . . . . 97

5.10 Comparison between attenuated laser and quantum dot single photon

source. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

5.11 Demonstration of one time pad encryption. The message is a 140x141

pixel bitmap of Stanford’s memorial church, approximately 20kilobyte

in length. a, a 20kilobyte key is exchanged over the quantum cryptog-

raphy system and used to encode the message. The encoded message

looks like white noise to anyone who does not possess the key. Decryp-

tion allows perfect recovery of the original message. b, a pixel value

histogram of the original and encrypted message. The original mes-

sage shows definite structure, while the distribution for the encrypted

message appears flat, reminiscent of white noise. . . . . . . . . . . . . 99

6.1 Schematic of the structure of the VLPC detector. . . . . . . . . . . . 102

6.2 Schematic of cryogenic setup for VLPC. . . . . . . . . . . . . . . . . 104

6.3 Experimental setup to measure quantum efficiency of the VLPC. . . . 106

xiii

6.4 Quantum efficiency of VLPC vs. bias voltage for different temperatures.108

6.5 Quantum efficiency of VLPC vs. dark counts for different temperatures.108

6.6 Experimental setup to measure multi-photon detection capability of

the VLPC. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114

6.7 Oscilloscope pulse trace of VLPC output after room temperature RF

amplifiers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114

6.8 Pulse area spectrum from VLPC. The dotted lines represent the fitted

distribution of each photon number peak. The solid line is the total

sum of all the peaks. Diamonds denote measured data points. . . . . 116

6.9 Pulse area spectrum fit to Poisson constraint on normalized peak areas. 119

6.10 Variance as a function of photon number detection. The linear relation

is consistent with the independent detection model. . . . . . . . . . . 120

7.1 Experimental setup for observation of non-classical counting statistics

from parametric down-conversion. . . . . . . . . . . . . . . . . . . . . 126

7.2 Pulse area spectrum using 1µW pump power. . . . . . . . . . . . . . 127

7.3 Measured value of Γ as a funtion of pump power. The black line

represents the classical limit. . . . . . . . . . . . . . . . . . . . . . . . 128

7.4 Detected photon number distribution from parametric down conver-

sion. (a) Measured distribution with perfect detection efficiency η. (b)

Measured distribution with detection efficiency η = 0.7. . . . . . . . . 129

7.5 Backgrounds vs. pump power. . . . . . . . . . . . . . . . . . . . . . . 131

7.6 Reconstructed even-odd photon number oscillations for several pump

powers. (a), 4µW pump. (b) 6µW pump. (c) 8µW pump. . . . . . . 132

8.1 Single photon generation with parametric down-converiosn. . . . . . 136

8.2 Communication rate vs. channel loss for different values of G. . . . . 140

8.3 Experimental setup for generation of single photons. . . . . . . . . . . 141

8.4 Pulse height spectrum emitted from charge sensitive amplifier. . . . . 142

8.5 Pulse height spectrum emitted from charge sensitive amplifier. . . . . 143

8.6 Correlation measurements for different upper thresholds of the SCA. . 145

8.7 Correlation measurements for different bias voltages of the VLPC. . . 146

xiv

8.8 Measured value of G as a function of quantum efficiency of the VLPC. 147

8.9 Experimental setup for generating N photon number state. . . . . . . 148

8.10 Pulse height histogram for VLPC 1. . . . . . . . . . . . . . . . . . . . 149

8.11 Pulse area histogram of VLPC 2 without postselection from VLPC 1. 149

8.12 Pulse area histogram and reconstructed photon number probabilities

for VLPC 2, conditioned on photon number detection from VLPC 1. 151

8.13 Pulse area histogram of VLPC 2 for the case of 3 photon generation

as a function of pump power. . . . . . . . . . . . . . . . . . . . . . . 152

8.14 Generation efficiency and number state quality as a function of pump

power for 2,3, and 4 photon number generation. Data denoted by

squares corresponds to Pn, the probability the correct photon number

was generated. Data denoted by diamonds shows the probability that

the VLPC observes the correct photon number on a given laser pulse.

The squares reference the left y axis, while the diamonds reference the

right y axis. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154

xv

Chapter 1

Introduction

1.1 Quantum information

Quantum mechanics has radically changed our understanding of the physical world

in which we live. The success of this theory in modelling physical reality has been

unparalleled, leaving little doubt about its validity. One of the most profound aspects

of quantum mechanics is that it predicts effects which would not have been expected

by classical theory, and in some sense run counter to our notion of how the world

should behave. Aspects such as quantum uncertainty and non-local statistics have

had profound impact on our conceptual view of the world.

For many years these so-called quantum mechanical effects were regarded as nu-

ances. Although interesting physically, they are only observed under very controlled

physical environments. Recently however, it has been shown that these properties

can be harnessed to perform computationally significant tasks. This observation has

transformed quantum mechanics research from a purely academic endeavor into an

area of promising technological advancement. A new field, known as quantum infor-

mation processing (QIP), has emerged whose focus is on the technological application

of quantum mechanics.

To date, two important application of quantum mechanics have been identified,

quantum cryptography and quantum computation. Quantum cryptography incor-

porates quantum uncertainty, and in some cases non-locality, in order to perform

1

2 CHAPTER 1. INTRODUCTION

unconditionally secure communication. Quantum computation utilizes the proper-

ties of a collection of coupled quantum systems to achieve exponential speedup of

certain computational tasks. Quantum computational algorithms have the potential

to perform fast searches, and factor prime numbers in polynomial time scales. The

search for other applications of quantum technology is currently a very active area of

research.

One of the main obstacles for quantum information processing is the difficulty of

the experimental implementation. Quantum information tasks require unprecedented

isolation and control of complicated systems. Of the two main applications, quantum

cryptography is the easier to implement. This application requires manipulation of

only simple quantum systems. At the time of this work, there are already several im-

plementations of quantum cryptography over long distances [1–3], with commercial

quantum cryptography systems just on the horizon. In contrast, quantum compu-

tation has been an extremely challenging experimental problem. So far, only very

simple quantum computational tasks have been performed [4–6]. A scalable quantum

computer that is capable of solving large problems is beyond reach of the foreseeable

future.

In order to implement a QIP application, one needs a candidate quantum system

which can serve as the building block for more complicated systems. This building

block is typically referred to as the quantum bit, or qubit for short. A good qubit

system should be easily decoupled from its environment in order to exhibit quantum

mechanical effects. At the same time, it is often necessary for the qubit to interact

with other qubits in a controlled way. Quantum cryptography only requires the first

condition, while for quantum computation both conditions must be satisfied. This is

why quantum computation is an inherently more difficult task.

When only isolation is required, the photon is an excellent candidate for a qubit.

Photons exhibit strong quantum mechanical effects, and are very robust to envi-

ronmental noise. For this reason photons are the exclusive information carriers in

quantum cryptography. The main drawback to using photons in QIP is that they do

not readily interact with other photons. This makes it very challenging to implement

1.2. QUANTUM CRYPTOGRAPHY 3

quantum computation. Most proposals for quantum computation with photons re-

quire very high optical non-linearities, orders of magnitude beyond what is currently

attainable. Recently, however, it has been shown that such non-linearities are not re-

quired. Linear optics alone, combined with single photons and detectors, can be used

to implement quantum computation [7]. Although these proposals suffer from other

practical difficulties, such as requiring extremely low losses [8], they have rekindled

interest in the photon based quantum computer.

1.2 Quantum cryptography

This thesis is concerned with photon based quantum information processing. The

emphasis is placed on quantum cryptography. Photon based quantum computation

remains too difficult to address experimentally. Nevertheless, the tools and concepts

developed here may have applications in future quantum computational efforts.

The field of quantum cryptography has been around for nearly twenty years. The

first protocol was proposed by Bennett and Brassard in 1984 [9]. This protocol is

referred to as BB84. Since the discovery of BB84, the field has undergone rapid ad-

vancement. A host of additional protocols have been presented, each with their own

distinct advantages and dis-advantages [10–12]. The security of quantum cryptog-

raphy has been conclusively established for many of these protocols, yet a security

proof for some protocols remains elusive. The investigation of security in quantum

cryptography has transcended beyond the practical importance of secure communi-

cation. This field has solidified our understanding of very fundamental concepts in

quantum measurement and non-locality.

The experimental effort to perform quantum cryptography has also made great

progress. Initial experimental efforts were restricted to proof of principle experiments

over short distances [13]. More recent efforts have achieved distances of tens of kilo-

meters [1–3]. Extensive work is being invested in extending these distances, as well

as performing earth to satellite cryptography.

To date, two main challenges remain in the field of quantum cryptography. The

first is in the area of theoretical security. Although the security of some protocols,


such as BB84, have been extensively proven, security proofs for other protocols remain

elusive. In particular, security proofs for entanglement based protocols such as that

of Ekert [14], and that of Bennett, Brassard, and Mermin [15], have been difficult to

formulate. The second difficulty is the engineering of single photon sources. Many

protocols require the generation of a single photon as an information carrier. Yet

experimental implementations to date have relied on highly attenuated lasers or LEDs

for this task. These sources have inherent photon number fluctuations, making it

impossible to generate exactly one photon.

Lasers and LEDs fall into the class of light emitters known as classical sources.

To properly define classical light sources, it is necessary to introduce the coherent P

representation of a light field. Define ρ as the reduced density matrix of a light field

spanning the number state basis. This density matrix can always be expanded in the

coherent state basis in the form

ρ =

∫α

P (α) |α〉〈α| (1.1)

where α is a complex amplitude and |α〉 is a coherent state defined as

|α〉 = e−|α|2/2

∞∑n=0

α2

√n!|n〉. (1.2)

In the above equation |n〉 is an n photon Fock state. The function P (α) is the distri-

bution function for the emitted field. For many sources, such as lasers and LEDs, this

function is non-negative. It thus satisfies the properties of a valid probability distri-

bution. Any source whose P distribution function is a valid probability distribution is

referred to as a classical source. The reason for this name is that all photon counting

statistics for a classical source do not require quantum mechanical treatment of the

radiation field. Such statistics are perfectly modelled by classical field amplitudes,

and quantized atomic levels for the detectors.

For non-classical sources, the P distribution function becomes negative. Thus,

it no longer can be interpreted as a probability distribution. Non-classical sources

require full quantum treatment of the radiation field. They also lead to experimental

observable effects which are inconsistent with classical electromagnetic theory. Ex-

amples of such effects are photon anti-bunching, negativity of the Wigner function,

1.2. QUANTUM CRYPTOGRAPHY 5

and non-local correlations [16].

Non-classical light sources play an important role in quantum information process-

ing. For quantum computational schemes, these types of sources are required. It is

precisely the quantum mechanical properties of the field which allows the exponential

speedup promised by quantum algorithms [17]. In quantum cryptography, however,

classical sources such as attenuated lasers are often used. Using such sources comes

at the expense of significantly reduced security properties [18].

This work will mainly be concerned with how non-classical sources can improve

the security behavior of a quantum cryptography system. The focus will be on two

important examples of non-classical light, the emission from a single Indium Arsenide

(InAs) quantum dot, and spontaneous parametric down-conversion. The first source

is useful for generating sub-Poisson light, which features improved security properties

for quantum cryptography protocols over classical light sources. The second source

allows generation of photon twins, which in some cases are in an entangled state. Such

states are important for other quantum cryptography protocols based on non-local

statistics.

Chapter 2 will discuss the basics of classical information theory and cryptography.

The concepts developed in this chapter will play an important role in the security

of quantum cryptography. Chapter 3 will introduce the concept of the quantum bit,

and the properties that make it unique and useful. Chapter 4 will deal with the

theoretical security issues of quantum cryptography. First, quantum cryptography

with sub-Poisson light sources will be considered. A quantitative analysis of how

much improvement such sources can provide will be derived. Then, an alternate

protocol for quantum cryptography based on entangled photons will be analyzed. A

proof of security for this protocol will be given, and it will be shown that this protocol

has potential for significantly improved security behavior.

Having established the advantages of sub-Poisson light, Chapter 5 will describe

an experimental demonstration of quantum cryptography using such a light source

based on InAs quantum dots. Comparison with a standard attenuated laser will show

that this source allows communication in a security regime unattainable by a classical

light sources.


1.3 Photon number detection

Single photon detection is an important task in virtually all quantum optics ex-

periments. The standard tools for single photon detection are photomultipliers and

avalanche photo-diodes. These detectors absorb a photon and emit a macroscopic cur-

rent which can be discriminated by digital electronics. One of the main limitations

of such detectors is that they cannot distinguish photon number. If two photons

are absorbed by the detector on very short time scales (relative to the electronic

pulse duration), the electronic pulse which is generated will not differ significantly

from that of a single photon absorption. This is due both to detector dead time and

multiplication noise properties.

Recently, a new detector known known as the Visible Light Photon Counter

(VLPC) has been shown to have the ability to distinguish photon number with very

high quantum efficiency [19, 20]. This makes the VLPC a unique tool for quantum

optics experiments. Photon number detection is already known to be important for

many types of experiments. One of the main applications is in linear optics quantum

computation [7]. Many of the basic building blocks for this scheme rely on the ability

to discriminate photon number on very short time scales.

Chapter 6 investigates the ability of the VLPC to do photon number detection.

Limitations imposed by both quantum efficiency and multiplication noise properties

are investigated. Multiplication noise refers to fluctuations in the number of elec-

trons the VLPC emits when detecting a photon. These fluctuations can limit the

photon number state resolution. Fortunately, the VLPC features nearly noise free

multiplication [21], allowing it to do very accurate photon number discrimination.

1.4 Number State Generation

One application of the photon number detection capability of the VLPC is to do

photon number state generation. This is done in conjunction with a non-linear optical

process known as parametric down conversion [22]. Parametric down-conversion is

implemented by pumping a non-linear crystal with a bright ultra-violet pump. Each

1.4. NUMBER STATE GENERATION 7

pump photon has a small probability of splitting into two visible wavelength photons.

The two-photon nature of parametric down-conversion makes it a non-classical

light source. Since photons come two at a time, the photon number distribution

features even-odd oscillations. This causes the P distribution function to become

negative. The non-classicality of this effect is investigated in Chapter 7. A theoreti-

cal threshold for classical light is derived. This inequality is violated by the even-odd

oscillations generated in parametric down-conversion. The VLPC allows one to ex-

perimentally observe this violation. By correcting for the quantum efficiency of the

detector, one can furthermore reconstruct the oscillatory behavior of the photon num-

ber distribution.

Parametric down conversion can be used to perform photon number generation.

Under appropriate conditions, a pump photon can be made to split into two photons

travelling in different directions. Detection of one photon signals that a second photon

exists in the conjugate mode. This applies as well for any higher photon number.

If one can discriminate the number of photons in one arm, then the other arm is

prepared in an appropriate photon number state. To do this, one needs a detector

capable of doing photon number detection, such as the VLPC. Chapter 8 discusses a

demonstration of photon number generation using the VLPC and parametric down

conversion. This scheme allows the preparation of a 1,2,3 and 4 photon number state.

Such number states may find applications in quantum networking and multi-party

quantum cryptography.

Chapter 2

Classical Information and

Communication

2.1 Introduction

The upcoming chapters will often draw upon the basic principles of classical informa-

tion theory. This field, pioneered by Claude Shannon in the 1940s, is predominantly

concerned with the fundamental limitations of communication and compression. In-

formation theory also plays a very important role in cryptography. In fact, much of

Shannon’s original work was intended for the purposes of analyzing the security of

cryptographic protocols [23].

This chapter will present the basics of classical information theory. These concepts

will be important in the upcoming chapters which deal with security of quantum

cryptography. A full treatment of information theory is well beyond the scope of this

work. The reader can refer to [24] for good reference on this vast topic.

2.2 Entropy and Mutual Information

One of the main insights that led to Shannon’s pioneering work is the relationship

between information and entropy. It is this relationship which allows one to treat

information quantitatively. Lets consider an arbitrary random variable X, which can

8

2.2. ENTROPY AND MUTUAL INFORMATION 9

take on one of n different values, denoted as x1 . . . xn, with probabilities p(x1) . . . p(xn)

respectively. The entropy associated with this random variable is defined as

H(X) = −n∑i=1

p(xi) log2 p(xi). (2.1)

Note that the entropy does not depend on the actual value which the random variable

takes, only its probabilities. The choice of base for the log is somewhat arbitrary.

The base defines the units in which information is to be quantified. When using the

natural logarithm, information is quantified in ”knats”. If, instead, one takes the

base 2 logarithm the information is measured in ”bits”. In this work, information

will always be quantified in units of ”bits”. Hence all logarithms will be taken to base

2.

One of the main postulates of information theory is that the entropy, H(X),

quantifies the self information of a random variable. That is, H(X) denotes the

amount of information one gains by learning what value X took. There are many

ways to justify entropy as a measure of the information content of a variable. One of

the main arguments is that entropy has many properties which agree with our intuitive

notion of how information behaves. For example, suppose that X takes on the value

Xi with probability 1. By Equation 2.1, this random variable has zero information

content. This is compatible with what one intuitively expects. Since X always takes

on the same value, no information is learned by actually observing it. In the opposite

limit, if X takes on each one of its values with equal probability, the information

content is log2 n. One can prove that this value maximizes the information content.

One can also define the entropy conditioned on an event. If Y is a second random

variable which can take on the values y1 . . . ym with probabilities p(y1) . . . p(ym), the

conditional entropy H(X|Y = yi) can be calculated by using the conditional probabil-

ity distribution p(xi|yi) in Equation 2.1. The average conditional entropy, H(X|Y ),

is determined by averaging H(X|Y = yi) over all values of Y. That is,

H(X|Y ) = −n,m∑

i=1,j=1

p(xi, yi) log2 p(xi|yu). (2.2)

10 CHAPTER 2. CLASSICAL INFORMATION AND COMMUNICATION

One can also define the joint entropy H(X, Y ) as

H(X, Y ) = −n,m∑

i=1,j=1

p(xi, yi) log2 p(xi, yi). (2.3)

The joint entropy of two random variables satisfy a well known chain rule which can

be easily proven from the definitions. This chain rule is given by

H(X, Y ) = H(X) +H(Y |X). (2.4)

The above equation establishes, first and foremost, that one’s information can only

increase in light of new knowledge. That is, if someone is allowed to observe both

X and Y, the information they learn is at list as much as that of observing just

X. Furthermore, if X and Y are independent, the amount of information gained by

observing the two variables is the sum of the information content of each individual

variable. Again, these properties naturally mesh with our intuitive notion of how

information should behave. Equation 2.4 is one of the main reasons why entropy is

strongly associated with information content.

A final important concept is that of mutual information. Mutual information,

written as I(X;Y ), denotes the amount of information one gains on random variable

X, given that they are allowed to observe Y. Mathematically, one can express this

as

I(X;Y ) = H(X)−H(X|Y ) (2.5)

That is, mutual information is the change in entropy of random variable X from

before one observes Y to after. Note that I(X;X) = H(X), reinforcing our notion

that H(X) represents self information.

Let’s consider a simple example which will play an important role in the upcoming

chapters. Using the definitions of information, one of the simplest communication

scenarios known as the binary symmetric channel will be analyzed. In the binary

symmetric channel the message sender sends N bits, randomly taking on the values

[0, 1], over a noisy channel. The N bit message string will be referred to as X. The

receiver of the message obtains Y, which is a distorted version of the message due to

channel noise. In a binary symmetric channel, noise is characterized by a very simple

2.2. ENTROPY AND MUTUAL INFORMATION 11

0

1 1

0(1-e)

(1-e)

e

e

Figure 2.1: Schematic of binary symmetric channel.

bit flip model shown in Figure 2.1. In this model each bit experiences a bit flip with

probability e, referred to as the bit error rate (BER). It will be assumed that each

bit in the message is independent of the other bits, and that it can take on the value

0 or 1 with equal probability. Although this is a restrictive assumption, it will turn

out to be a valid one for the upcoming analysis of quantum cryptography.

It is easy to show that, under the above conditions, the mutual information is

given by

I(X;Y ) = N [1 + e log2 e+ (1− e) log2(1− e)] . (2.6)

The constant

C = [1 + e log2 e+ (1− e) log2(1− e)] (2.7)

is often referred to as the channel capacity. It defines the maximum communication

rate which one can communicate over the channel without noise. If the communication

rate is below this critical rate, it is possible, at least in principle, to have completely

noise free communication. Once the rate exceeds this threshold by any amount,

noise free communication is not possible. This result, known as the noiseless coding

theorem, is one of the cornerstones of information theory.

It is easiest to understand the noiseless coding theorem in the context of error

correcting codes. Error correcting codes use redundancy to achieve noise free com-

munication over a noisy channel. An N bit message is encoded in a larger R bit string.

Define R = N + M , thus M denotes the number of additional bits of information


needed to do error correction. By introducing the proper amount of redundancy into

the message, one can make the overall error rate negligibly small, reproducing the

noiseless communication scenario. The noiseless coding theorem tells us that, in the

limit of large strings,

M

N≥ −e log2 e− (1− e) log2(1− e). (2.8)

If equality holds, the error correction algorithm is working in the Shannon limit.

Note that the noiseless coding theorem is not constructive, it does not explain how

to generate error correction codes at the Shannon limit. It only says that such codes

are in principle possible.

Another way to interpret the noiseless coding theorem is to consider communica-

tion rates, instead of the total message. Let’s consider a communication system which

can send one bit each clock cycle. For a given bit error rate e, the noiseless coding

theorem tells states that, at best, one can use a fraction C of the clock cycles to do

communication, while the remaining (1− C) cycles are needed for error correction.

For practical error correcting codes, it is difficult to approach the Shannon limit.

Although there are known codes which achieve this limit, these codes require the

receiver to perform computationally intractable tasks [25]. The generation of codes

which are both computationally feasible and operate close to the Shannon limit is a

challenging field of research.

2.3 Cryptography

One of the first applications of information theory was in the field of cryptography.

The purpose of cryptography is to transmit a secret message over a channel that

may potentially be wiretapped. The goal is to transmit the message to the intended

receiver, while simultaneously making it difficult for any potential wiretapper to in-

tercept the communication.

In order to discuss security in cryptography, one first has to specify what is meant

by security. There are two general approaches to discussing the security of a cryptog-

raphy system, or cryptosystem for short. These two approaches are computational

2.3. CRYPTOGRAPHY 13

security and unconditional security.

In computational security one is mainly concerned with the computational dif-

ficulty required in breaking the code. One may define a cryptosystem as secure if

the best known algorithm for breaking it requires a very large number of operations.

Often times, this problem is approached from the perspective of complexity theory.

From this point of view a secure cryptosystem requires the wiretapper to perform a

computationally intractable task in order to break the system. An intractable algo-

rithm is one which scales exponentially in execution time as the size of the problem

is increased. The main drawback of computational security is that it is extremely

difficult to prove that a mathematical problem is intractable. One must show that

no algorithm exists, even in principle, which can efficiently find a solution. Such

proofs are nearly impossible to formulate. Often times one considers only the best

currently available algorithms for computational security. If a new algorithm is dis-

covered which can efficiently break the system, all communication over the system,

past or present, is rendered insecure.

In the second approach, no restrictions is placed on the the time or computational

resources of a wiretapper. A cryptosystem is defined as unconditionally secure if there

is no way to break it, even with infinite computational resources. Put simply, the

information available to the wiretapper from the encrypted message is not enough to

reliably reconstruct the original message. It is this type of security which quantum

cryptography is concerned with.

Figure 2.2 shows the basic model for unconditionally secure cryptography. The

sender of the message, referred to as Alice, wants to communicate with the receiver,

Bob, over a public channel that can be potentially wiretapped. To ensure the secrecy

of the communication, Alice will also generate a secret key K, which she uses to

encrypt the message M . This generates the encrypted message R, referred to as the

cryptogram, which is sent over the public channel. Alice must also send a copy of

the secret key to Bob, so that he can properly decrypt the cryptogram. In classical

cryptography this can only be done using a secure channel that cannot be wiretapped.

Let us assume that the message M takes on one of a finite set of P messages

m1, . . . ,mP . In order to account for the encryption, it is easier to treat the key not


Message

Generator

Key

Generator

Encrypter

Alice

Decrypter

KK

Public

Channel

Secure

Channel

M RMessage

Receiver

Bob

Figure 2.2: Schematic of system for unconditionally secure cryptography.

as a string of data, but rather as a transformation T which generates the cryptogram

R from the original message. Thus, the key enumerates a set of Q transformations,

T1, . . . , TQ, such that if the i′th key is selected, Alice generates the cryptogram R =

TiM . Perfect secrecy is defined to be the case when

P (M |R) = P (M) (2.9)

That is, observing R does not in any way change the probability that M might take

on any one of its values. Using Bayes’ rule,

P (M |R) =P (R|M)P (M)

P (R)(2.10)

directly leads to the following theorem.

Theorem 1 A necessary and sufficient condition for perfect secrecy is that

P (R|M) = P (R) (2.11)

for all M and E.

One way to interpret the above theorem is that the total probability of all keys which

transform mi into a given encrypted message R must equal the total probability of

all keys which transform mj into that same message, for any i and j.

2.3. CRYPTOGRAPHY 15

First, note that the number of possible cryptograms must be at least equal to

H(M). This is because the cryptogram must be able to encode all of the information

content of M . To do this, it must at the very least have as many possible states as the

information it is encoding. One then note that to have perfect secrecy, there must be

at least one key transforming any M to any value of R. This comes immediately from

the previous theorem. These two results combine to form one of the most important

results in Shannon’s work. In order to have perfect secrecy the length of the key must

be at least as big as H(M), the information content of the message [23].

One algorithm which achieves this limit is known as the Vernam cipher. Consider

the case where the message H(M) = P , the total number of bits in M . This means

that the message is maximally compressed. A random key K is generated which is of

the same length as the message. Define Mi, Ki, and Ri is the i’th bit of the message,

key, and cryptogram respectively. In the Vernam cipher these are related by

Ri = Mi +Ki (Mod 2) (2.12)

In other words, one takes the sum modulo 2, or alternately the bitwise exclusive or

of each bit of the key with each bit of the message to form the cryptogram. It is easy

to prove that the Vernam cipher satisfies the definition of perfect secrecy if the key

is picked randomly [23].

Although the Vernam cipher provides unconditional security in the most efficient

way, it has not attained widespread use to date. This is due mainly to one critical

drawback, the key distribution problem. The previous discussion assumed that Alice

and Bob had a way of exchanging the key securely, for example by trusted courier.

However, the final conclusion showed that, for perfect secrecy, the key must be at

least as long as the actual message. Once the key is used it cannot be recycled, it

must instead be discarded. Recycling will eventually allow Eve to determine the key

through the techniques of code breaking. If the key is learned all the transmissions

are rendered insecure. For this reason the Vernam cipher is sometimes referred to

as one time pad encryption. In the past, the overhead of using trusted courier to

exchange a new key for each transmission proved impractical. For this reason most

cryptosystems settled for computational security instead of unconditional security.


Recently, however, the advent of quantum cryptography has given a solution to the

key distribution problem. Quantum cryptography allows the exchange of secret keys

without the use of a trusted courier. Security is instead guaranteed by the laws of

quantum mechanics. Furthermore, quantum cryptography can be performed using

the tools and techniques of the optical telecommunication industry, giving it the

potential to generate keys at high data rates. This development opens up the door

for the use of unconditionally secure communication in practical applications.

Chapter 3

Encoding quantum information

3.1 Introduction

The previous chapter showed that there exist encryption techniques which allow un-

conditional security. This is achieved using a one time pad key to encrypt the message.

After encryption, the cryptogram conveys no information about the message unless

the key is known. This leads to the problem of how Alice and Bob can actually

exchange a secret key without interception.

Using only classical information theory it is impossible to prove that any secret

key exchanged by the two communicating parties is secure. Classical information can

be copied many times over, at least in principle. So if only a classical communication

channel is used, the security of the key must be assumed.

The same is not true when one starts to consider quantum communication. In

quantum communication, information is encoded in quantum bits, which are the

quantum mechanical analog of the classical bit. Quantum bits, or qubits for short,

are two state systems like their classical counterparts. The two states, representing

binary 0 and 1, allow us to encode information in the same way as classical bits. In

fact, exchanging quantum bits allows us to reproduce any classical communication

protocol. But qubits have the additional functionality that they can be put in a

superposition state, and can exhibit quantum mechanical coherence properties. Be-

cause of this, quantum information is a superset of classical information theory. All

17

18 CHAPTER 3. ENCODING QUANTUM INFORMATION

classical information protocols can be implemented with qubits, but there are quan-

tum information protocols which cannot be implemented using classical bits. One

example is quantum cryptography, a method of sharing unconditionally secure secret

keys.

3.2 The qubit

Before beginning a basic discussion of quantum cryptography, it will be useful to

discuss the qubit in more detail. A qubit is a two dimensional quantum system. The

two states of the system are denoted as |0〉 and |1〉. These two orthogonal states form

a complete basis for the Hilbert space of the qubit. This basis is referred to as the

computational basis. All states of the qubit can be expressed in the computational

basis as

|ψqubit〉 = cos θ|0〉+ eiφ sin θ|1〉 (3.1)

The angles θ and φ are two independent degrees of freedom. These angles define

a point on the unit sphere in three dimensional space. Thus one can visualize the

state of the qubit as a vector pointing from the origin to the unit sphere, as shown

in Figure 3.1. This sphere, which we often refer to as the Bloch sphere, is a helpful

tool in understanding the behavior of a qubit.

In order to have a useful qubit, one must be able to perform three fundamental

operations on it. The first is initialization. Initialization means that the qubit is

prepared in a well known state, for example |0〉, with very high probability. This

allows the qubit to be treated as a pure state. There are generally two ways to

initialize a qubit. The first way is by cooling. In many instances, the computational

basis commutes with the Hamiltonian of the system. This means that |0〉 and |1〉 are

energy eigenstates. Typically |0〉 would be represented by the energy ground state of

the system, and |1〉 would be the first excited state. If this is true one can perform

initialization by cooling the system down to its ground state. This can work when

the two states are separated by large energies. If the energy separation is too small,

unreasonably low temperatures will be required to do proper initialization. In cases

were the energy separations are very small, or the computational basis represents

3.2. THE QUBIT 19

01

( )10 1

2+

( )10 1

2-

Figure 3.1: The Bloch sphere.

energy degenerate states, cooling is not an option. Initialization in this case can be

done by measurement and post-selection. That is, one measures the state of each

qubit, and if it is found not to be in the state |0〉 it is discarded. Some techniques

use a combination of cooling and post-selection to achieve initialization [26].

The second required operation is the ability to perform controlled unitary evo-

lution. One must be able to transform the qubit from its initial state to any other

state on the Bloch sphere. This transformation must conserve probability, thus it

must be described by a unitary operators. All unitary operators can be visualized as

rotations, or combinations of rotations on the Bloch sphere. It is convenient in the

discussion of unitary evolution to revert to matrix notation for the state of the qubit.


One can associate a matrix notation with the computational basis as follows

|0〉 =

[1

0

]; |1〉 =

[0

1

]. (3.2)

A convenient tool in the discussion of unitary evolution are the three Pauli matrices

σx, σy, and σz. These matrices are defined as

σx =

[0 1

1 0

];σy =

[0 −ii 0

];σx =

[1 0

0 −1

]. (3.3)

Any unitary operation can be expressed by these matrices [27]. Let’s define r as a

unit vector on the Bloch sphere. Define the operator R as

R = e−iθσ·r/2, (3.4)

where

σ · r = rxσx + ryσy + rzσz. (3.5)

R generates a rotation on the Bloch sphere of angle θ around an axis defined by r.

One needs to be able to implement any rotation defined by Eq. 3.4 in order to have

full control of the qubit. It turns out that any rotation operator can be decomposed

as

R = eiασz/2eiβσy/2eiγσz/2 (3.6)

if value for the angles α, β, and γ are chosen correctly [27]. Thus, arbitrary rotations

along the y-axis and z-axis of the Bloch sphere can be combined to generate any

unitary operation. This dramatically reduced the amount of resources needed to

manipulate a qubit.

The final operation that is required on a qubit is the ability to measure it. That is,

one must be able to observe the qubit and determine its current state. The difference

between a qubit and a classical bit become strongly pronounced during measurement.

When a classical bit is observed the result is an unambiguous answer. Either the bit

was 0, or it was 1. In contrast, a quantum bit will not give an unambiguous answer

unless the basis in which it was prepared is known. The behavior of a measurement

system on a quantum state is characterized by several postulates [27]. These postu-

lates are fundamental to the theory of quantum mechanics, and are defined below.

3.2. THE QUBIT 21

Postulate 1 The wavefunction of a quantum particle is represented by a vector in a

normalized hilbert space which is spanned by an orthonormal basis |0〉, |1〉, . . . , |n−1〉,where n is the dimensionality of the hilbert space. Every measurement is represented

by a projection onto a complete orthonormal basis which spans the hilbert space. De-

fine this basis as |P0〉, |P1〉, . . . , |Pn−1〉. The probability of measuring the qubit in the

state |Pi〉 is simply given by | 〈Pi| ψ〉 |2, where |ψ〉 is the wavefuntion of the qubit.

The above postulate states that if the qubit is prepared in one of the states |Pi〉,the measurement result will identify this state with 100% probability . If, however, the

qubit is prepared in a superposition state of the measurement basis, the measurement

result will be ambiguous. A qubit repeatedly prepared in the same state and measured

in the same basis will yield a different measurement result from shot to shot. A second

important postulate of quantum mechanics is known as the projection postulate.

Postulate 2 Projection postulate: Define the wavefunction of a quantum system

before a measurement as |ψ〉. Define the measurement basis as |P0〉, . . . |Pn−1〉. Given

that the system was measured in the state |Pi〉, the wavefunction of the system after

the meaurement is also |Pi〉.

From the projection postulate one ascertains that unless a quantum system is

prepared in one of the eigenstates |Pi〉, the measurement process will destroy the

wavefunction of the system. The above two postulates combine to form one of the

most important aspects of quantum measurement. The wavefunction of a single

quantum system cannot be determined unless the preparation basis is known [28].

If the system is measured in the wrong basis, the first postulate states that one

will obtain an ambiguous answer. Furthermore, due to the projection postulate one

cannot go back and re-measure the state because it has already been destroyed.

The qubit is a two dimensional quantum system, meaning that its Hilbert space

is spanned by two basis states. The computational basis, formed by |0〉 and |1〉,is one basis set. Any other basis can be expressed by linear combinations of the


computational basis as

|0θ,φ〉 = cos θ|0〉+ eiφ sin θθ|1〉 (3.7)

|1θ,φ〉 = sin θ|0〉 − eiφ cos θ|1〉 (3.8)

In quantum communication, one has the freedom of choosing any one of these bases to

encode information. However, error free communication can only occur if the sender

and receiver use the same basis to encode and measure the qubit.

3.3 Positive Operator Value Measures (POVMs)

The previous section discussed measurement under the framework of projections in

an orthonormal Hilbert space. It turns out that there is a more general formalism

for quantum measurement, which will prove useful in subsequent discussion. This is

known as the Positive Operator Valued Measure (POVM) formalism [29].

A POVM measurement on an N dimensional Hilbert space has n possible mea-

surement outcomes. Each outcome is associated with an operator on the Hilbert space

of the measured quantum system. Define the operators for the different outcomes as

M1, . . . ,Mn. If a system is in a state |ψ〉, then the probability of the i′th outcome is

Pi = 〈ψ|Mi|ψ〉 (3.9)

The operators must satisfy two properties. First, they must be positive semi-definite,

which means

〈ψ|Mi|ψ〉 ≥ 0 (3.10)

for any |ψ〉. This property ensures that all the calculated probabilities are non-

negative. A necessary and sufficient condition for positive semi-definiteness is that

the operator eigenvalues are all non-negative. The second property of the operators

is that they must satisfy the completeness relationship

n∑k=1

Mi = I. (3.11)

This constraint ensures that all of the probabilities will add up to one.

3.3. POSITIVE OPERATOR VALUE MEASURES (POVMS) 23

Having defined a POVM, it remains to be shown how such a measurement can

be physically implemented. Suppose the measured subsystem occupies the Hilbert

space Ha. A POVM is implemented by augmenting the quantum system with a

second Hilbert space Hb, and making projective measurements on the total space

H = Ha ⊗ Hb. That is, all POVMs are implemented by embedding our quantum

system in a larger Hilbert space and making measurements on the total system. This

result is known as Neumark’s theorem [29]. Thus, POVMs do not represent any new

physic above the projective measurements presented in the previous section. One

can always talk only about projective measurements on a properly defined Hilbert

space. However, the POVM formalism is a useful mathematical tool, which allows us

to generalize the measurement concept to cases were the external environment has

an effect on the system.

The POVM formalism can be extended to describe generalized delayed measure-

ments [30]. Such measurements are performed by using a probe state, contained in

a Hilbert space Hp, to measure the system in the space Hs. Figure 3.3 shows a

schematic of how such measurements are made. Assume that the probe and system

are initially unentangled, such that the initial density matrix is ρs⊗ρp. An interaction

Hamiltonian is then turned on between the two systems for a fixed amount of time.

This interaction will cause a unitary evolution of the collective system, defined by the

unitary operator U. After the interaction, the two systems are in an entangled state.

Measuring the probe will then yield information about the state of the system.

To put this type of measurement into a more general mathematical framework,

lets first write the final density matrix, which is given by

ρf = U†ρs ⊗ ρpU (3.12)

Suppose one is interested in the final state of the system after the measurement. This

can be calculated by tracing out the probe Hilbert space in an orthonormal basis |k〉.The probe density matrix is expressed as

ρp =∑j

ρjj |j〉〈j| (3.13)


Qubit Probe

Interaction

|Yinitialñ = ñ Ä ñ|Y |Yqubit probe

|Y |Yfinal entangledñ = U ñ|Y |Yqubit probeñ Ä ñ=

Figure 3.2: Model for generalized, delayed quantum measurements.

Thus,

ρfs =∑k,j

ρjj〈k|U†|j〉ρs〈j|U|k〉. (3.14)

The complex operator Ak can be defined as

Ak =∑j

√ρjj〈j|U|k〉, (3.15)

and the final density matrix of the system becomes

ρfs =∑k

A†kρsAk (3.16)

The set of operators Ak are referred to as a complete positive map (CP map). They

express the backaction noise on a quantum system from a general measurement. They

also provide a convenient way to express the result of the measurement on the system.

One can verify that the probability of measuring the probe in its k’th state is given

by

Pk = Tr{A†kρsAk

}. (3.17)

Because a trace is invariant under circular permutation, one can define the operator

MK = A†kAk. Thus,

Pk = Tr {ρsMk} . (3.18)

It is easy to verify that the operators Mk satisfy positive semi-definiteness and com-

pleteness. They thus form a valid POVM. In fact, any POVM can be generated by

3.4. THE PHOTONIC QUBIT 25

a generalized measurement. The advantage of using Ak instead of Mk is that this

formalism not only provides the correct probabilities for the measurement results, but

also characterize the backaction noise of the measurement on the quantum system,

given by Eq. 3.16.

Once again, it is important to emphasize that generalized measurements do not

represent new physics above the standard quantum formalism. One could discuss

everything from the perspective of unitary evolution and projective measurements

instead of CP maps. The CP map formalism will serve as a convenient mathematical

tool, which allows the treatment of the most general quantum measurements in a

compact notation.

3.4 The photonic qubit

The previous section focussed on the qubit as a mathematical structure with unique

properties. This section will discuss the practical implementation of qubits in physical

systems.

As mentioned previously, a practical qubit requires a convenient way to perform

initialization, unitary evolution, and measurement. In some applications, another

important property is required, the means to exchange qubits over long distances.

This is especially important in quantum communication and networking.

In applications that require long distance exchange of qubits the photon is the

only practical information carrier. Photons are extremely robust to environmental

noise, and can be transmitted over long distances using free space or optical fibers.

There are many techniques for implementing a qubit using photons. This section will

discuss some of the ways and compare their merits and disadvantages.

Figure 3.3 illustrates one common way for implementing a qubit using a single

photon. This is known as the dual rail method, in which the photon is split into two

different spatially separated modes. Suppose the initial state, denoted |ψ0〉, is a single

photon in mode a. Thus,

|ψ0〉 = a†|v〉, (3.19)

where the state |v〉 is the vaccuum state containing zero photons. After the first


F

J

a

b

c

d

e

BSP1t = cos ar = sin a

BSP2t = cos br = sin b

l/2plate

l/4plate

l/2plate

l/4plate

a)

b)

Figure 3.3: Implementation of a dual rail quantum bit. a, spatial mode implementa-tion. b, polarization mode implementation.

3.4. THE PHOTONIC QUBIT 27

beamsplitter and phase delay, the state becomes

|ψqubit〉 = cosαb† + eiθ sinαc†|v〉 (3.20)

Thus, one can encode binary 0 and 1 in the following way

|0〉 = b†|v〉

|1〉 = c†|v〉

Any qubit state can be prepared by properly selecting the splitting ratio and phase

shift. To measure the qubit one inserts a second phase shifter and beamsplitter. It is

easy to verify that, up to an irrelevant global phase shift,

d† = cos βb† + e−iφ sin βc†

e† = sin βb† − e−iφ cos βc†

Measuring a photon in modes d and e corresponds to a projective measurement on the

qubit system. Adjustment of the splitting ratio and phase shift of the measurement

apparatus allows the measurment of the qubit in any desired basis. The measurement

result is indicated by a counting event on the photon counters at each port of the

beamsplitter.

The above implementation is simply a Mach-Zehnder interferometer. A binary 0 is

encoded by a photon in the upper arm, while 1 is a photon in the lower arm. Although

this implementation is conceptually simple, and is often how one visualizes a photonic

qubit, it is impractical for long distance qubit transmission. Long Mach-Zhender

interferometers suffer from many practical difficulties including phase stability and

high sensitivity to polarization distortion. For this reason these types of quantum

channels are rarely implemented. An alternative way for implementing a dual rail

qubit is to use polarization, as shown in Figure 3.3b. This is fundamentally equivalent

to the first method where the two spatial modes are replaced by the two polarization

states of a single spatial mode. Thus, binary information can be encoded as

|0〉 = |H〉

|1〉 = |V 〉


Any unitary rotation can be generated on the Bloch sphere by using a half waveplate

and a quarter waveplate, whose optic axes are properly rotated relative to the hor-

izontal reference. Polarization encoding has the advantage of ease of use. It is the

method of choice for most free-space implementations [1,2]. However, it has only lim-

ited utility in fiber based systems. This is because fibers induce a random polarization

transformation on the guided light. This transformation is unitary in principle and

can be corrected for with additional waveplates at the output, but such correction

schemes usually suffer from long term drift which limits their stability.

For long distance fiber applications, neither the spatial dual rail nor polarization

qubit give a practical solution. For such systems there is an alternate implementation

originally proposed by Brendel et. al. [31]. This method utilizes time bin encoding.

Figure 3.4 shows how this is done. A single photon, initially in mode a is sent

into an unbalanced interferometer. Assume that mode a defines a transform limited

wavepacket in both space and time. The unbalanced interferometer has a long arm

and a short arm. The long arm introduces a delay, relative to the short arm, which is

greater than the coherence length of the input photon. The output of the unbalanced

interferometer is thus two pulses separated in time. Assume that this time separation

is sufficiently long so that the two time slots can be treated as orthogonal modes.

Define d1 and d2 as the modes corresponding to time slots t1 and t2 respectively. It

is straightforward to show that, given that a photon was not lost to mode l, the state

after the unbalanced interferometer is given by

|ψqubit〉 = d†1 cosα+ d†

2eiθ sinα|v〉. (3.21)

The angle α is determined by the splitting ratio of the first beamsplitter. The qubit

can be measured by a second unbalanced interferometer. The two time slots will

interfere with each other at time t2 on the second beamsplitter. Given that a photon

was detected at this time slot,

g† = d†1 cos β + d†

2e−iφ sin β

h† = d†1 sin β − d†

2e−iφ cos β

Thus, detection of a photon by one of the counters results in a projective measurement

on the qubit state.

3.5. ENTAGLEMENT 29

F J

a bc d

e

f

h

g

t2t1

t2t1 t3

l 50-50BSP

BSP1t = cos ar = sin a

BSP2t = cos br = sin b

50-50BSP

Figure 3.4: Time slot based qubit for optical fiber applications.

The advantage of time bin encoding is that the two time slots are usually separated

by a very short time, typically on the order of several nanoseconds. Because phase and

polarization drifts occur on slow time scales, each pulse undergoes exactly the same

distortion in the fiber. Since the information is encoded by the relative phase of these

two time slots, this information is undisturbed. The main difficulty in implementing

such a system is that it requires two unbalanced interferometers whose relative phase

shift is stabilized. A second disadvantage is that the scheme is partially inefficient.

Some qubits are lost initially to loss mode l, and in the general case more qubits are

also lost during measurement since they are measured at t1 and t3, not t2. This loss

could be eliminated in principle by using a fast optical switch.

3.5 Entaglement

So far, the emphasis has been on the preparation and transmission of single qubits over

a quantum channel. This section will consider the properties of systems composed

of more than one qubit. The discussion begins by considering a two qubit system.

This seemingly modest extension will bring out some of the most fascinating aspects


of quantum mechanics.

The Hilbert space of a two qubit system is described by the product space of

each individual qubit. This product space is spanned by four basis vectors: |0〉|0〉,|0〉|1〉,|1〉|0〉, and |1〉|1〉. These states represent the computational basis of a two qubit

hilbert space. The two qubit system can take on any complex superposition of these

basis states.

Consider the situation where the system takes on the following state

|ψentangled〉 =1√2

(|0〉|0〉+ |1〉|1〉) . (3.22)

The above state cannot be factorized into a product state of the two qubits. Any

quantum state which satisfies this property is referred to as an entangled state. En-

tangled states have the fascinating property that, even if the individual qubits are

separated by great distances, one cannot describe their behaviors independently. The

two qubits must still be treated as single quantum system. This leads to measur-

able effects which run highly counterintuitive to our notion of how a physical system

should behave [32].

On first inspection one might not see anything counterintuitive about Eq. 3.22. It

simply says that both qubits will take on the value 0 with 50% probability, otherwise

they both take on the value 1. An analogy can be made to a system of buckets and

balls. Suppose there are two buckets, each of which can either contain a red ball or

a blue ball. A fair coin is then flipped. If the coin lands heads, a blue ball is placed

in each bucket, otherwise a red ball is placed in the buckets instead. If the buckets

are separated by great distances, there is still a correlation between them. If one

looks inside one of the buckets and sees a blue ball, they instantaneously learn with

certainty that the other bucket also contained a blue ball.

Nevertheless, the state in Eq. 3.22 has strikingly different properties than the

bucket and balls experiment just discussed. These properties only become apparent

when the system is measured in a basis other than the computational basis. Define

the following notation:

|0θ〉 = cos θ|0〉+ sin θ|1〉 (3.23a)

|1θ〉 = sin θ|0〉 − cos θ|1〉. (3.23b)

3.5. ENTAGLEMENT 31

This change of basis is performed by a rotation of 2θ across the horizontal equator of

the Bloch sphere. It is easy to verify that

|ψentangled〉 =1√2

(|0θ〉|0θ〉+ |1θ〉|1θ〉) . (3.24)

The expression in Eq. 3.22 is, in fact, partially misleading because it implies that the

computational basis is the preferred basis for the state. From Eq. 3.24 it becomes

clear that this is not true. There is a perfect correlation between the two qubits

regardless of which value of θ is chosen.

Suppose that two qubits are prepared in an entangled state. One of the qubits

is given to Alice in California, while the other qubit is given to Bob in North Car-

olina. Alice will then pick an angle θ, and measure her qubit in the basis defined by

Eq. 3.23. Eq. 3.24 indicates that if Alice’s qubit is measured in the state |0θ〉, Bob’s

wavefunction instantaneously becomes |0θ〉 as well. This seemingly counterintuitive

action at a distance lies at the heart of entanglement. If two systems are entangled,

then measuring one system will have an instantaneous effect on the wavefunction of

the other system.

One may speculate that the above discussion allows superluminal communication.

Take the following protocol as an example. Alice will encode a binary 0 by measuring

her photon in the computational basis. Doing this will prepare Bob’s qubit in one

of the states |00〉 or |10〉, using the notation from Eq. 3.23. Of course, Alice cannot

control which one of these states is generated. In order to encode binary 1, Alice will

measure her photon in the basis defined by θ = π/2. Thus, Bob’s qubit is prepared in

the |0π/2〉, |1π/2〉, again with equal probability. To decode Alice’s transmission, Bob

simply needs to determine if his qubit is in the state |00〉 or |10〉 for binary 0, and

|0π/2〉 or |1π/2〉 for binary 1.

Unfortunately, the measurement Bob must perform is physically impossible. As

discussed in the previous sections, any measurement Bob performs is described by

a projection onto an orthonormal basis. The state of Bob’s qubit is described by a

density matrix ρb which can be calculated as

ρb =Tra {|ψentangled〉〈ψentangled|}Tr {|ψentangled〉〈ψentangled|}

= I, (3.25)


where the operator Tra is a trace over Alice’s qubit. Thus, Bob’s qubit state is an

incoherent mixture of 0 and 1. Regardless of which basis he chooses to measure, the

measurement is completely unaffected by the basis which Alice measures her qubit

in. This means that no communication is possible.

Bob’s inability to decode Alice’s message stems from a very fundamental principle,

the wavefunction of a single quantum system cannot be measured unless the prepa-

ration basis is known. Although Alice can instantaneously modify the wavefunction

of Bob’s qubit, a wavefunction is not a physical quantity. Thus, non-locality cannot

be used to directly do superluminal communication. However, non-local states can

lead to measurement results which deviate from the natural concept of local real-

ism. These effects become apparent when the correlations between Alice and Bob’s

measurement is considered.

Assume that Alice measures her qubit in the θ basis, while Bob measures his qubit

in the φ basis. There are four possible measurement results: 00, 11, 01, and 10. These

results occur with probabilities

P (0, 0) =1

2cos2 (θ − φ)

P (1, 1) =1

2cos2 (θ − φ)

P (1, 0) =1

2sin2 (θ − φ)

P (0, 1) =1

2sin2 (θ − φ) .

If θ = φ, Alice and Bob’s measurement results have perfect correlation, they will

both either measure 0 or 1. If instead, α − φ = π/4, there is no correlation between

the measurement results. All measurement combinations are equally likely. This

behavior is inconsistent with the concept of local reality. The probabilities described

in Eq. 3.26 cannot be reproduced by statistical mixtures of qubits whose states are

well defined. Theories that restrict the individual qubit states to be well defined

are known as local hidden variable theories (LHVTs). All measurement statistics

produced by such theories must satisfy a relationship known as Bell’s Inequality [33].

The measurement statistics in Eq. 3.26 predicts that this inequality can be violated.

Thus, Bell’s inequality gives us a measurable test of the validity of local hidden

3.6. TELEPORTATION AND ENTANGLEMENT SWAPPING 33

variable theories. The fact that Bell’s inequality can be violated has been conclusively

demonstrated under many different experimental conditions using numerous types of

qubits [34–36].

The utility of entangled states extends beyond fundamental tests of basic physical

principles such as Bell’s inequality. They are also an extremely useful tool in quantum

communication. They play an important role in quantum cryptography, quantum

computation, and quantum networking. Of central importance are the four states

|ψ+〉 =1√2

(|01〉+ |10〉) (3.27a)

|ψ−〉 =1√2

(|01〉 − |10〉) (3.27b)

|φ+〉 =1√2

(|00〉+ |11〉) (3.27c)

|φ−〉 =1√2

(|00〉 − |11〉) . (3.27d)

In the above equations we use the less cumbersome notation |ab〉 to represent the state

|a〉|b〉. The states in Eq. 3.27 are often referred to as Bell states, because these states

lead to a maximal violation of Bell’s inequality. The Bell states form a complete,

orthonormal basis of the two qubit Hilbert space, which we refer to as the Bell basis.

3.6 Teleportation and entanglement swapping

The concept of entanglement and the Bell basis was introduced in the previous sec-

tion. One of the most important applications of entangled states is quantum tele-

portation [37]. Teleportation allows the transmission of an unknown quantum state

from one party to another. In some sense, teleportation offers an alternative form

of quantum channel. Instead of directly preparing a qubit and transmitting it over

optical fibers, one can teleport the state of the qubit.

Assume that Alice and Bob have shared a pair of entangled qubits. For definite-

ness, assume that the qubits are the state |ψ−〉 defined in Eq. 3.27. Bob’s qubit will

be referred to as qubit 1, and Alice’s as qubit 2. Suppose Alice wants to teleport a


third qubit to bob in the state

|ψ〉3 = α|0〉+ β|1〉 (3.28)

The three qubit wavefunction can be written as

|ψ〉123 = |ψ−〉12|ψ〉3 (3.29)

By expanding qubits 2 and 3 in the Bell basis, one can rewrite this wavefunction in

the alternate form

|ψ〉123 =1

2[(−α|0〉1 − β|1〉1) |ψ−〉23 (3.30)

+ (−α|0〉1 + β|1〉1) |ψ+〉23+ (β|0〉1 + α|1〉1) |φ−〉23+ (β|0〉1 − α|1〉1) |φ+〉23]

If Alice performs a Bell measurement on qubits 2 and 3, the measurement result leaves

qubit 1 in one of four possible states. Alice can then tell Bob over a public channel

which of the Bell states she measured. Depending on the result, Bob will either do

nothing, change |1〉 to −|1〉, flip |0〉 with |1〉, or do both. After this, the state of qubit

3 is teleported onto qubit 1. Several experimental demonstrations of this effect have

been reported [38,39].

One extension of the teleportation protocol is called an entanglement swap. In

a swap, Alice and Bob have exchanged a pair of entangled qubits, which again are

referred to as 1 and 2. Alice also has in her possession a second pair of entangled

qubits 3 and 4. Assume that qubits 1 and 2 are in the state |ψ−〉, and so are qubits

3 and 4. The product state |ψ〉12|ψ〉34 can be written as

|ψ〉1234 =1

2[|ψ+〉14|ψ+〉23 − |ψ−〉14|ψ−〉23 − |φ+〉14|φ+〉23 + |φ+〉14|φ+〉23] (3.31)

A Bell measurement on qubits 2 and 3 leave qubits 1 and 4 in an entangled state,

even though qubits 1 and 4 never interacted. Swapping is an important operation in

quantum repeaters [40], which allow high fidelity exchange of entangled states over

arbitrarily long distances. Experimental demonstration of this effect have also been

reported [41].

Chapter 4

Theory of Quantum Cryptography

The previous chapter discussed the quantum bit and its unique properties. There

are two striking differences between a qubit and classical bits. The first is that a

qubit cannot be measured without knowledge of the basis it was prepared in. The

second is that qubits can be in entangled states, which feature non-local correlations

that cannot be emulated by classical bits. One important application of these unique

properties is quantum cryptography.

Quantum cryptography is the process of exchanging unconditionally secure keys

using the laws of quantum mechanics. An alternate name for this is quantum key

distribution (QKD). The latter name emphasizes the fact that one is not exchanging

a real message, only a secret key. If the security of this key can be guaranteed, it can

then be use as a one time pad for unconditionally secure cryptography protocols such

as the Vernam cipher.

There have been many proposed schemes for doing QKD. Most protocols fall into

one of two categories, single qubit protocols, and entangled qubit protocols. Single

qubit protocols make use of the measurement uncertainty properties discussed in

Section 3.2 to ensure secrecy. Some examples of single qubit protocols are BB84,

B92, Koashi01, and the six-state protocol [9–12]. Entangled qubit protocols instead

use non-local correlations to achieve security. They rely on the fact that if any local

variable exists which can predict the state of an entangled qubit pair, then non-local

correlations are washed out. Two important examples of entangled photon protocols

35

36 CHAPTER 4. THEORY OF QUANTUM CRYPTOGRAPHY

are Ekert91 and BBM92 [14, 15]. This work will focus exclusively on two protocols,

BB84 and BBM92.

4.1 The BB84 protocol

Lets suppose that Alice wants to exchange a secret key with Bob. In the BB84 proto-

col Alice generates a stream of single qubits to encode information. This information

can be encoded in one of two bases. The first basis is the computational basis. That

is, Alice will use the states |0〉 and |1〉 to encode binary 0 and 1 respectively. The

second is the α = π/4 basis, which is referred to as the diagonal basis. The eigenstates

of this basis are denoted as |0〉 and |1〉, and from Eq 3.23 we have

|0〉 =1√2

(|0〉+ |1〉)

|1〉 =1√2

(|0〉 − |1〉) .

Alice randomly chooses one of the two bases with equal probability for each photon,

and then randomly encodes a binary 0 or 1 with equal probability. Thus, Alice can

transmit the four possible states |0〉,|1〉,|0〉, and |1〉 each with probability of 0.25.

Bob receives each qubit and measures it to learn the value of the bit. Because

he does not know the preparation basis, Bob must guess whether to measure in the

computational or the diagonal basis. It is important that Bob randomly select one

of these two with equal probability for each individual qubit. This way a potential

eavesdropper cannot know the basis Bob is using and tailor their attack accord-

ingly. Bob’s measurement can be described by a Positive Operator Valued Measure

(POVM), which corresponds to the following four projectors

E0 =1

2|0〉〈0| (4.1a)

E1 =1

2|1〉〈1| (4.1b)

E0 =1

2

∣∣0⟩ ⟨0∣∣ (4.1c)

E1 =1

2

∣∣1⟩ ⟨1∣∣ (4.1d)

4.1. THE BB84 PROTOCOL 37

When Bob measures in the correct basis he learns the value of the bit with 100%

probability, giving him complete information. When he measures in the wrong basis

his result is completely uncorrelated with Alice’s transmission, giving him no infor-

mation. Later, after all the qubits have been transmitted Alice and Bob can reveal

the basis in which the qubits were encoded and measured, but not the measurement

results. They agree to discard all bits which were measured in the wrong basis. The

remaining bits form a key to be used for one time pad encryption.

The security of the BB84 protocol relies on the fact that an eavesdropper, referred

to as Eve, doesn’t know which basis the qubit was encoded in. She learns this

information only after the qubit has been received by Bob, and at that point its too

late to modify her measurement. Let us first consider the simplest possible attack Eve

may perform, known as the intercept and re-send attack. The eavesdropper simply

intercepts each qubit from the quantum channel, measures its state, and then relays

a second qubit to Bob prepared in the same state that was measured. But Eve does

not know the measurement basis used to prepare the qubit, so she must guess. She

can, for instance, simply use the same POVM that Bob uses to measure the photon,

randomly deciding between the computational basis and the mixed basis. Half of the

time she will guess wrong, and relay the wrong wavefunction to Bob which causes

a 50% error rate. Hence this type of intercept re-send attack will create an overall

error rate of 25% in the transmission. This increase in errors can be used to detect

the presence of the eavesdropper. Alice and Bob can simply sacrifice a small fraction

of their key over the public channel to estimate the error rate. If errors are detected

they discard the key.

Of course, Eve is not restricted to making measurements only in the computational

basis. She could choose any projective basis of the form Eq. 3.23. It is not difficult

to prove that any basis she chooses will result in an overall error rate of 25%. Thus,

any intercept and re-send strategy will result in Eve being detected. Nevertheless,

intercept and re-send in not the most general attack strategy. In the most general

case, an eavesdropper can perform a generalized delayed measurement of the form

discussed in section 3.3. But no such measurement can yield information about the

quantum state of the system without imposing an unavoidable backaction. So there


should be no way for Eve to learn any information about the transmitted key without

causing some amount of error.

The above conjecture is not difficult to prove. Assume that Eve performs a gen-

eralized delayed measurement, in which she entangles the Hilbert space of her probe

with the qubit. Lets define Eve’s initial probe state as |Ei〉. All unitary operators

she implements can be characterized by the following evolution

U |0〉|Ei〉 =|0〉|E00〉+ |1〉|E01〉 (4.2a)

U |1〉|Ei〉 =|0〉|E10〉+ |1〉|E11〉. (4.2b)

The states |E00〉,|E01〉,|E10〉, and |E11〉 are not normalized, nor is it assumed that

they are orthogonal. Furthermore, the dimensionality or structure of their Hilbert

space is also unknown. In order for the error rate to be zero, however, we require

|E10〉 = |E01〉 = 0. Suppose instead that Alice sends the state |0〉. Then

U |0〉|Ei〉 =1√2

(|0〉|E00〉+ |1〉|E11〉) . (4.3)

The above comes from expanding |0〉 in the computational basis, along with the

linearity property of quantum mechanics. This state can be rewritten in the diagonal

basis as

U |0〉|Ei〉 =1

2√

2

[|0〉 (|E00 > +|E11〉) + |1〉 (|E00 > −|E11〉)

]. (4.4)

In order for there to be no errors, one must have |E00〉 = |E11〉. But if this is true, then

the final state of the probe, as well as all of Eve’s measurements on that probe, are

completely independent of which state was sent. Therefore Eve learns no information

about the transmission.

4.2 Practical aspects of BB84

In the previous section it was established that an eavesdropper cannot obtain infor-

mation about the key in the BB84 protocol without also introducing errors into the

transmission. Unfortunately, the situation becomes more complicated when dealing

4.2. PRACTICAL ASPECTS OF BB84 39

with practical systems. In any communication system errors will naturally occur due

to imperfections in the individual components. Errors coming from the system can-

not be distinguished from errors due to eavesdropping. In quantum cryptography,

one must make the worst case assumption that all errors were potentially caused by

eavesdropping. Thus, for practical systems, the statement that any eavesdropping

will unavoidably cause errors is not a sufficient security proof. There is always a

baseline error rate, so it must be conceded that some information has been leaked

about the quantum transmission. One needs to be able to put a bound on the amount

of information leakage given the error rate.

Practical quantum cryptography systems handle errors by augmenting the raw

quantum transmission, described in the previous section, with two additional steps,

error correction and privacy amplification. Both of these steps can be done using pub-

lic discussion, they do not require additional exchange of qubits. In error correction

Alice reveals some additional information to Bob about her key that will allow him

to find and correct all of the error bits. Because this information is sent over a public

channel, error correction unavoidably leaks additional information to an eavesdrop-

per. In order to account for the information leaked in the raw quantum transmission

and during error correction, a final step called privacy amplification is performed. In

privacy amplification the error corrected key is compressed into a shorter final key that

is almost completely secure. The amount of compression required depends on how

much information may have been leaked in the previous phases of the transmission.

In order for a proof of security to be useful, it must bound the amount of informa-

tion leaked during the raw quantum transmission and error correction, and relate it to

how much compression must be done in privacy amplification. The formulation of a

complete security proof of this type is a complex subject with several open questions

still remaining. Only recently has a proof of security been presented that considers

the most general attacks allowed by the laws of quantum mechanics [42]. The earliest

work on this subject considered only intercept and re-send attacks [43,44]. Later work

tackled the problem of generalized delayed measurements. In this context, there are

three categories of generalized attacks that have been considered; individual attacks,

collective attacks, and joint attacks. Figure 4.1 illustrates the three categories. In


a) Individual attacks

Alice Bob

Qubit

probe probe probe probe probe

b) Collective Attacks

Alice Bob

Qubit

probe probe probe probe probe

Quantum Computer

c) Joint Attacks

Alice Bob

Qubit

Probe

Figure 4.1: Different types of eavesdropping attacks considered in security proofs.


an individual attack the eavesdropper is restricted to measuring each quantum trans-

mission independently, but is allowed to use any measurement which is not forbidden

by quantum mechanics. Security against these types of attacks has been proven

in [45–47], and these proofs were extended to practical photon sources in [48]. Col-

lective attacks allow Eve to interact each qubit with an independent quantum probe.

Later, she can use a quantum computer to make collective measurements on her probe

system. This allows her to take advantage of correlations introduced during error cor-

rection and privacy amplification by exchange of block parities. Such correlations can

potentially refine an eavesdropper’s quantum measurement. Security against collec-

tive attacks has been shown in [49]. The most general type of attack is known as a

joint attack where the eavesdropper treats the entire quantum transmission as one

system which she entangles with a probe of very large dimensionality. There are cur-

rently several proofs of security against this most general scenario [50–52]. However,

these proofs do not apply when one uses practical qubit sources which sometimes

emit more than one qubit. Recently, a complete proof of security for BB84 against

all joint attacks that applies to practical qubit sources has been proposed by Inamori,

Lutkenhaus, and Mayers [42].

This work is predominantly interested in the effect of practical sources on the BB84

protocol. For this reason the analysis is restricted to individual attacks and uses the

proof of security proposed by Lutkenhaus [48]. This restriction is made for several

reasons. First, at the time of this work, this is the only proof of security which could

be applied to realistic sources. Second, restriction to individual attacks makes the

problem mathematically much simpler, while maintaining all of the relevant effects in

the quantum transmission. Finally, the ability to perform collective or joint attacks

is well beyond today’s technological capabilities, or even those of the foreseeable

future. Since the technology of tomorrow cannot be used to eavesdrop on today’s

transmission, the restriction to individual attacks is very realistic.

Before discussing the proof of security by Lutkenhuas, the basic theory behind

error correction and privacy amplification needs to be introduced.


4.2.1 Error Correction

In a real communication system errors are bound to occur. In order to achieve noise

free communication these errors must be corrected, and this can be done through

public discussion.

Following the raw quantum transmission Alice and Bob each possess the strings

X and Y respectively. In order to correct the errors, Alice and Bob exchange an addi-

tional message U such that knowledge of string Y and U leave very little uncertainty

about string X. The message U should provide Bob with enough information so

that H(X|Y U) ≈ 0. Since string U is publicly disclosed, Eve may learn additional

information as well, but good error correction algorithm will reduce this information

leakage to a minimum. Unfortunately, given the error rate e, a lower bound exists

on the minimum number of bits in U . This is simply the Shannon limit discussed

earlier, which states that

limn→∞

κ

n≥ h (e) , (4.5)

where n is the length of the string, κ is the number of bits in message U , and h(e)

is the conditional entropy of a single bit over a binary symmetric channel which is

given by

h (e) = −e log e− (1− e) log (1− e) . (4.6)

An error correction algorithm should ideally operate very close to this limit. At the

same time the algorithm should be computationally efficient or the execution time

may become prohibitively long.

Error correction algorithms can usually be divided into two classes, unidirectional

and bidirectional. In a unidirectional algorithm information flows only from Alice to

Bob. Alice provides Bob with an additional string U which he then uses to try to find

his errors. This makes it difficult to design algorithms which are both computation-

ally efficient and operate near the Shannon limit [25,47]. In a bidirectional algorithm

information can flow both ways, and Alice can use the feedback from Bob to deter-

mine what additional information she should provide him. This makes it easier to

approach the Shannon limit. These two classes can be further subdivided into two

subclasses, one for algorithms which discard errors and one for those which correct


them. Discarding errors is usually done in order to prevent additional side informa-

tion from leaking to Eve. By correcting the errors one allows for this additional flow

of side information, which can be accounted for during privacy amplification. Since

privacy amplification is typically a very efficient process, algorithms which correct the

errors tends to perform better.

Subsequent sections will deal with estimating the communication rate of QKD

systems based on system parameters such as channel loss and detector dark counts.

These estimations will strong depend on how well one assumes the error correction

algorithms works. The calculations presented will assume the algorithm given in [25],

which is bi-directional and corrects the errors. This algorithm works within about

15%− 35% of the Shannon limit, even with substantial error rates.

4.2.2 Privacy amplification

After error correction, Alice and Bob share an error free string X. Eve has also

potentially obtained at least partial information about this string from attacks on the

raw quantum transmission and side information leaked during error correction. In [45]

it is shown that even with a measured error rate of 1%− 5% a non-negligible amount

of information on string X could have been revealed. Thus, X cannot by itself be used

as a key. However, through the method of generalized privacy amplification [53], the

string X can be compressed to a shorter string K over which any eavesdropper has

only a negligible amount of information. The amount of compression needed depends

on how much information may have been compromised during the previous phases of

the transmission.

To do privacy amplification Alice picks a function g out of a universal class of

functions G which map all n bit strings to r bit strings where r < n (see [53] for more

details). Once g has been picked and publicly announced both parties calculate the

string K = g(X), which serves as the final key. This key is considered secure if Eve’s

mutual information on K, defined as

IE(K;GV ) = H(K)−H(K|GV ), (4.7)

is negligibly small, where G is the random variable corresponding to the choice of


function g and V is all the information available to Eve.

Let us define Z as all of the information obtained by Eve from attacks on the raw

quantum transmission. An important quantity in the analysis of privacy amplification

is the collision probability defined as

Pc(X) =∑x

p2(x). (4.8)

One can show that the conditional entropy H(K|G) is bounded by [53, Thm. 3]

H(K|G) ≥ r − 2r

ln 2Pc(X). (4.9)

This theorem can be applied to conditional distributions as well, which leads to

H(K|G,Z = z) ≥ r − 2r

ln 2Pc(X|Z = z), (4.10)

where Pc(X|Z = z) is just the collision probability of the distribution p(x|Z = z).

Averaging both sides of the above equation results in

H(K|GZ) ≥ r − 2r

ln 2〈Pc(X|Z = z)〉z, (4.11)

where

〈Pc(X|Z = z)〉z =∑z

p(z)Pc(X|Z = z) (4.12)

is the average collision probability. This is a quantity of central importance in privacy

amplification. In the case of individual attacks, the i’th bit in Z depends only on the

i’th bit in X. Under these circumstances the average collision probability factors into

the product of the average collision probability of each bit [54]. Thus,

〈Pc(X|Z = z)〉z = (pc)n, (4.13)

where n is the number of bits in string X and

pc =∑α=0,1

k∑β=1

p2(α, β)

p(β). (4.14)

In the above expression α sums over the possible values of a single bit in Alice’s

string and β sums over the possible measurement outcomes of the probe, which are


enumerated from 1 to k. Suppose that a bound of the form− log2〈Pc(X|Z = z)〉z ≥ c

could be proven. If one sets r = c − s, where s is a security parameter chosen by

Alice and Bob, then Eq. 4.11 leads to

IE(X;Z) ≤ 2−s/ ln 2. (4.15)

Thus, a bound on the average collision probability allows the two parties to make

Eve’s mutual information exponentially small in s.

If the only information available to Eve comes from string Z, which is obtained

from attacks on the quantum transmission, then the discussion in the previous section

is sufficient. But if Alice and Bob correct their errors Eve will also learn an additional

string U which gives her more information about Alice’s key. This side information

must also be included in the calculation. The bound in Eq. 4.9 can be applied to the

conditional distribution p(x|U = u, Z = z), which leads to

H(K|G,U = u, Z = z) ≥ r − 2r

ln 2Pc(X|U = u, Z = z). (4.16)

Averaging both sides of the above expression introduces additional complications.

The random variable U creates correlations between different bits in strings X and

Z. Because of this the average collision probability no longer factors into the product

of individual bits, as in Eq. 4.13. This makes the problem of finding a bound on the

average collision probability significantly more difficult.

In the past, the problem of side information from error correction was handled in

two ways. The first was to devise error correction algorithms which do not leak side

information. The error correction was performed using exchanges of block parities.

One bit from each exchanged block parity was discarded, leaving the parity of the

remaining block unknown. This approach has two major disadavatages. First, it

is difficult to create error correction algorithms of this type that operate near the

Shannon limit. Second, the fact that the errors are discarded can be utilized by

Eve to improve her overall knowledge on the transmission [47]. The second method

for overcoming side information was to assume that the transmission during error

correction is encrypted. This method requires the assumption that Alice and Bob

already posses a short secure key. Using the quantum channel this secure key can


be grown into a larger one. This changes the overall protocol from quantum key

distribution to quantum key growing [47].

The following discussion presents a method for handling side information directly.

Instead of resorting to the two previous method of handling side information, a bound

on Eve’s mutual information is derived using the number of exchanged bits from

error correction. This problem has been previously investigated in [55], where several

bounds on the collision probability Pc(X|Z = z, U = u) were derived as a function

of Pc(X|Z = z). This work is extended to the average collision probability, which

involves a few subtleties. The complete proof is given in Appendix A. In this appendix

it is shown that if

r = nτ − κ− t− s, (4.17)

where

τ = − log2 pc, (4.18)

κ is the number of bits in message U , n is the length of the error corrected key, and

both s and t are security parameters chosen by Alice and Bob, then

IE ≤ 2−tr +2−s

ln 2. (4.19)

This bound on Eve’s information is still exponentially small in the security parame-

ters, and only involves the collision probability averaged over her measurements on

the quantum transmission.

Before concluding this section on the main concepts in privacy amplification, a few

comments should be made on the notion of security in QKD. As stated previously,

the key is considered secure if the mutual information is very small. This definition

of security may raise some concern. The mutual information can be interpreted as

the average number of bits Eve will obtain on the final key. In any given experiment

it is possible that Eve can obtain significantly more bits than the average, but this

happens with small probability. Perhaps a more satisfactory notion of security would

be a statement of the form, with probability no greater than ε Eve obtains no more

than ς bits of information on the final key. The mutual information is an important

quantity because it can be used to obtain such a bound. A simple method for doing


this is to use the Markov bound

P (I ≥ ς) ≤ IE(K;GUZ)

ς, (4.20)

where I is the actual number of bits of information Eve has obtained. This may

serve as a more convincing statement of security than statements about the average.

Plugging (4.15) into the above expression shows that the probability that Eve obtains

more than an acceptably small number of bits on the final key is exponentially small

in the security parameter s.

4.2.3 Proof of security by Lutkenhaus

The proof of security proposed by Lutkenhaus has signified important progress in

the field of quantum cryptography. This proof is very versatile, allowing the analysis

the security of BB84 in the presence of many imperfections including channel losses,

detector dark counts, and imperfect sources.

Lets begin by considering a general system for performing the BB84 protocol.

Figure 4.2 shows a schematic of such a system. The subsequent discussion assumes

that the qubit is physically implemented in the form of a photon, as this is the only

qubit implementation that can be transmitted over long distances. The proof itself

does not require this assumption. The assumption is made in order to present a real

physical system that can be analyzed. For definiteness it will also be assumed that

information is encoded in polarization. Other encoding methods can be treated in a

completely analagous way.

The initialization of the qubit is performed by a photon source. To start with,

an ideal photon source will be considered. This source emits exactly one photon in a

known polarization state. The extension to realistic sources will be discussed later.

The polarization of the photon is prepared by an electrooptic modulator (EOM),

then the photon is sent over the quantum channel to Bob’s detection apparatus. This

apparatus is responsible for randomly selecting the computational or diagonal basis,

and measuring the photon in that basis. Figure 4.3 shows two possible implemen-

tations for the detection apparatus. The first implementation is known as an active

modulation scheme. This scheme uses an EOM to actively select the measurement


Source EOMDetectionApparatus

AliceBob

Channel

Figure 4.2: Basic system for performing the BB84 protocol.

Bob performs. The second method is known as a passive modulation scheme. Instead

of using an EOM, Bob uses a 50-50 beamsplitter to partition the photon into two dif-

ferent polarization analyzers. It is easy to verify that detection events at each counter

correspond to a measurement of one of the POVM elements in Eq. 4.1. Real systems

almost always use a passive modulation scheme because it is easier to implement. It

will later be shown that passive modulation can also simplify the proof of security.

Hence, from this point it will be assumed that Bob’s detection apparatus uses passive

modulation.

In order to account for optical losses, a beamsplitter is placed in front of the

detection apparatus to reflect off a specified fraction of the light into a loss mode.

All losses are lumped into this beamsplitter and the subsequent optical components

can be regarded as lossless. This model is realistic under two conditions. First, the

use of a beamsplitter model is valid if the loss is linear. A linear beamsplitter cannot

effectively model loss due to nonlinear effects such as two-photon absorption. To

incorporate such effects a more complicated loss model is required. However, in real

system multi-photon absorption is typically many orders of magnitude weaker than

linear absorption, so a beamsplitter approximation is usually extremely good. Second,

placing the beamsplitter in front of the detection apparatus requires that the loss to


50-50 BSP

45/-45PBS

H/V PBS

a/(1-a) BSP

Channel

b) Passive modulation

a) Active modulation

Channel

a/(1-a) BSP

EOM

H/V PBS

Figure 4.3: Two methods of implementing Bob’s detection apparatus.


each detector is equal. This is an important point in passive modulation. A passive

modulation scheme must be constructed in such a way that a photon has the same

probability of being detected regardless of which path it takes. If, for example, one

detector has higher quantum efficiency than the other three, additional loss should

be placed in front of it to make sure that the above property is satisfied.

Having modelled the loss, the operation of the lossless components can now be

defined. For each detection unit, E(0) is defined as the projector onto vaccuum and

Enψ as the projector onto the state which has n photons with polarization ψ, where

ψ ∈ {x, y, u, v}. The detection apparatus performs a POVM measurement whose ele-

ments corresponds to different combinations of detection events from the four photon

counters. The elements of this POVM can be broken up into Fvac, Fψ, and FD which

correspond to no detections, one detection corresponding to polarization ψ, and more

than one detection respectively. These operators are given by [47]

Fvac =E0, (4.21a)

Fψ =∞∑n=1

(1

2

)nEnψ, (4.21b)

FD =∞∑n=2

{[1

2−(

1

2

)n]∑ψ

Enψ

}+

1

2

∞∑n,m=1

EnxE

my + En

uEmv . (4.21c)

Multiple detection events, corresponding to the operator FD, are possible if more

than one photon is incident on the detection apparatus. These events should not be

discarded, because keeping track of them can prevent certain security loopholes. By

incorporating the multiple detection events in the proof of security for BB84, one can

make it disadvantageous for Eve to add additional photons to Alice’s signal [47]. Mul-

tiple detection events are included in the proof of security by defining the disturbance

parameter ε. This parameter is given by

ε =nerr + wDnD

nrec(4.22)

where nerr, nD, and nrec are the number of error bits, dual fire events, and number of

bits that entered the error corrected key respectively, and wD is a weighting parameter

chosen by Alice and Bob. This weighting parameter should be made sufficiently large


so that it is to Eve’s disadvantage to cause dual fire events. If passive modulation

is used, then wd = 1/2 is a sufficiently large number for this to be true. Note that

in the limit that the dual fire rates are negligibly small the disturbance parameter

simplifies to the bit error rate.

As mentioned in the previous section, a security proof for BB84 involves finding

a bound on the collision probability given in Eq. 4.14. This expression must be

optimized over all possible attacks on a qubit, which are always characterized by a

CP map. This bound should be a function of the disturbance given in Eq. 4.22. Such

a bound has been derived in [47], and is given by the following expression

pc ≤1

2+ 2ε− 2ε2. (4.23)

This expression can be directly plugged into Eq. 4.17 to calculate the length of the final

key. From the above expression one can see the when ε = 0, the collision probability

is 1/2, which means Eve gets no information about the key. In the opposite limit, if

ε = 1/2, the collision probability is 1 and Eve can learn the entire string. This can

be done if Eve intercepts each photon Alice sends and stores it, while relaying an

unpolarized photon to Bob.

The above proof of security applies when the source is ideal, meaning it generates

a single photon in a known polarization state. But no realistic source can do this.

All practical sources suffer from optical losses, meaning that they sometimes generate

vacuum instead of one photon. Worse yet, such sources can also produce multi-

photon states. These states are vulnerable to photon splitting attacks, which can

cause a security loophole in the communication [18]. In a photon splitting attack,

Eve splits off one of the photons and stores it coherently, allowing the second photon

to propagate to Bob undisturbed. Later, when Alice and Bob reveal the measurement

basis they used, Eve can measure her photon and learn the value of the bit with 100%

probability, while causing no errors. Thus, any source which is to be used for the BB84

protocol must have a very low probability of generating multi-photon states. But even

if the probability of a multi-photon state is small, it can still cause a large security

hazard in the presence of channel losses. When the channel is lossy, Eve can pick off

one of the photons from a multi-photon state at the beginning of the channel. She can


then replace the lossy channel with a lossless channel to ensure that the second photon

reaches Bob. She can subsequently block off a fraction of the single photon states to

conserve the overall communication rate. This gives her complete information over a

larger fraction of the key. At some sufficiently high channel loss, Eve can only relay

the multi-photon states while blocking off all of the single photon states. This renders

the entire key completely insecure. Thus, the multi-photon states put an upper limit

on the amount of channel loss a system can have for secure communication to be

possible.

Photon splitting attacks can be accounted for by modifying the compression factor

τ , defined in Eq. 4.18 [48]. First, the parameter β is defined to be the fraction of

detection events in Bob’s apparatus that originated from single photon states. Thus,

β =n− nmn

(4.24)

where n is the total number of detections, and nm is the total number of multi-photon

states that were injected into the quantum channel. τ is then redefined as

τ = −β log2 pc (ε/β) . (4.25)

The above equation shows that photon splitting attacks have two effects on the com-

pression factor. First, each multi-photon state reveals a bit of information to Eve.

This is accounted for by the outer factor of β in the expression. Second, because Eve

learns a fraction of the key without causing errors, she can create a larger error rate

on the remainder of the key while maintaining the same overall bit error rate. This

is accounted for by normalizing ε by β in the expression.

4.2.4 Photon source characterization

Light emitters abound in our everyday lives. We encounter photons from light bulbs,

candles, lasers, light emitting diodes, and sunlight on a daily basis. Could such

photons be easily used for doing quantum information processing? This is actually a

difficult question to answer.

As discussed in the introduction, light sources can be generally categorized into

two classes, classical sources and non-classical sources. To rigorously define these two


classes, the coherent state

|α〉 = e−|α|2

∞∑j=0

αi√i!|i〉 (4.26)

is introduced. The complex number α is the amplitude of the coherent field, and |α|2

is the average number of photons in the field. The set of all coherent states form a

complete basis. That is ∫α

|α〉〈α| = I. (4.27)

However the coherent states are not orthogonal to each other. Their inner products

are given by

〈α| β〉 = e|α−β|2

(4.28)

Because of this, the coherent state basis is overcomplete.

The output of a field emitted by a light source can always be expanded in the

coherent state basis [16]. The result of this expansion is referred to as the coherent

state representation of the field, and takes on the following form

ρfield =

∫α

P (α) |α〉〈α| . (4.29)

The function P (α) is known as the P distribution function. This function is always

real, and obeys the normalization ∫α

P (α) = 1 (4.30)

For many sources this function also obeys the property that it is non-negative for

all α. If this is the case, then the P distribution function obeys all of the properties

of a probability distribution. We refer to all sources whose P distribution function

is non-negative as classical sources. All of the sources mentioned in the beginning

of this section satisfy this condition. The reason for the name ”classical” is that all

photon counting statistics exhibited by such a source do not require quantization of

the electromagnetic field. One could instead work with classical field amplitudes, and

use Maxwell’s equations to determine their dynamics. The detection statistics can

be attributed to the photon counters, which are made of a collection of atoms with

quantized energy levels. This type of description, known as the semi-classical theory

of photon counting, is adequate in many cases.


Some sources emit fields whose P distribution function becomes negative. Such

sources can exhibit effects which cannot be predicted by semiclassical detection the-

ory. Examples of such effects include photon anti-bunching, negativity of the Wigner

function, and non-local effects such as violations of Bell’s inequality [16]. Such sources

are referred to as non-classical sources, because quantization of the electromagnetic

field is required in order to explain the counting statistics they generate.

The ideal source for quantum cryptography emits exactly one photon, which is

is non-classical field. The engineering of a single photon source is an experimentally

challenging task. For this reason, the photon sources used to date to perform BB84

have been classical sources such as attenuated laser light. Using such classical sources

comes at a significant price. The security behavior of a system based on such sources

is vulnerable to photon splitting attacks [18]. In order to quantitatively analyze the

performance differences between classical and non-classical sources one needs a way

to characterize the security behavior for different photon sources .

From the discussion of the previous section, an important quantity is the number

of multi-photon states injected into the quantum channel, denoted nm. This number

cannot be measured from the communication. Instead, it is necessary to characterize

the source and measure the probability that it creates a multi-photon state. In the

limit of large strings, nm = Npm where N is the number of clock pulses in the

experiment and pm is the probability that the source creates a multi-photon state per

pulse.

In principle, pm could be calculated by measuring the photon number distribution

in an optical pulse. Unfortunately, conventional photon counters do not have the

ability to distinguish an optical pulse containing a single photon from one containing

multiple photons if all of the photons arrive within the dead time of the detector. This

topic will be re-explored later when the Visible Light Photon Counter is discussed.

For the current discussion, assume that the photon counters used are avalanche pho-

todiodes (APDs). When these detector are excited by a pulse which is shorter than

the dead time, they will signal if the pulse contained zero or more than zero photons.

In order to measure pm, a more indirect approach is required that circumvents the

dead time of the APDs. The solution is to do an intensity correlation measurement


Source

APD

APD

Time resolvedCoincidenceCounter

Figure 4.4: Hanbury Brown-Twiss intensity interferometer.

using a Hanbury Brown-Twiss intensity interferometer, shown in Figure 4.4. To

analyze the results of this correlation measurement, assume that the photon source

creates a train of light pulses at a fixed repetition rate. Each light pulse is assumed

to be contained in an interval [0,∆], which is smaller than the duty cycle of the

experiment. Under these conditions, the photon number operator can be defined as

n =

∫ ∆

0

a†(t)a(t)dt. (4.31)

In the above equation a†(t) is the photon creation operator in the time domain. The

average number of photons in a duty cycle is simply given by n = 〈n〉. The second

order correlation, g(2), is given by [22]

g(2) =

∫ ∆

0

∫ ∆

0〈a†(t)a†(t′)a(t′)a(t)〉dtdt′

n2. (4.32)

It is not difficult to show, using the commutation relation[a(t), a†(t′)

]= δ(t− t′), (4.33)

that the expression for g(2) can be rewritten in the form

g(2) =〈n (n− 1)〉

n2. (4.34)

The parameters n and g(2) are important because they place a bound on the

probability that the source emits a multi photon state. This bound is obtained by


first writing

g(2) =

∑∞i=2 i(i− 1)p(i)

n2. (4.35)

Using the fact that i(i− 1) ≥ 2 for all i ≥ 2 leads to the bound

g(2) ≥∑∞

i=2 2p(i)

n2

=2pmn2

,

or alternately

pm ≤n2g(2)

2. (4.36)

This bound can be used to calculate β.

The parameter g(2) is relevant to the previous discussion on classical and non-

classical sources. All classical sources satisfy the property g(2) ≥ 1. Equality is

achieved for a Poisson distributed photon number distribution. Most experimental

demonstrations of quantum cryptography to date have relied on highly attenuated

laser light as a source of single photons. An attenuated laser with perfect intensity

stability is a Poisson light source. Eq. 4.36 indicates that the only way to reduce the

multi-photon states from such a source is to make n small. This can be achieved by

adding a lot of attenuation to the laser. But adding attenuation comes at a price. If

the average is very small, then most of the time the source emits no photons. This

reduces the communication rate. Furthermore, the average cannot be made arbitrarily

small. At some point the dark counts of the detectors will start to dominate the

transmission, increasing the error rate.

In order to eliminate this problem, there has been extensive effort in engineering

sources which behave closer to an ideal single photon source [56–66]. Such a source is

impossible to generate in practice. All sources will suffer from some form of optical

losses, causing an unavoidable vacuum contribution to the emission. Furthermore,

practical sources still sometimes emit multi-photon states due to effects such as back-

ground light collection, substrate photoluminescence, and device non-idealities.

Any source with g(2) < 1 is referred to as a sub-Poisson light source. Aside from

g(2), these sources are characterized by a second important parameter, the device

efficiency ndev. This is the average number of photons emitted from the source in a


clock cycle. The average number of photons injected into the quantum channel, n,

can be made smaller than this by introducing attenuation, but it cannot be made

larger. For attenuated lasers this parameter is not relevant, because lasers start with

a macroscopically large number of photons that can be attenuated to any desired av-

erage. Furthermore, any optical losses before the quantum channel can be accounted

for by slightly increasing the laser intensity. This is not true for sub-Poisson light.

For such sources the average photon number cannot be made arbitrarily large and is

ultimately limited by g(2). From Eq. 4.34 and the fact that 〈n2〉 ≥ n2, one obtains

the bound

n ≤ 1

1− g(2). (4.37)

For small g(2), the bound approaches n ≤ 1. The best devices to date feature g(2) ∼0.05 and n ∼ 10− 40%.

4.2.5 Communication rates for BB84 with sub-Poisson light

The previous section has provided the tools necessary to investigate how the two

parameters, g(2) and ndev affect the communication rate of a quantum cryptography

system. Define pclick as the probability that Bob experiences a detection event on a

given clock cycle. Detection events may triggered by photons sent from Alice, or by

dark counts in Bob’s detectors. These two sources may be assumed to be independent.

Thus

pclick = psignal + pd − pdpsignal. (4.38)

If pd and pclick are sufficiently small then the probability of a simultaneous signal and

dark count detection in the same clock cycle is negligible. Thus,

pclick ≈ psignal + pd. (4.39)

In general, the analysis will assume that the probability of multiple detection events

in the same clock pulse is small. Such an assumption is valid if the probability of a

multi-photon state is low, and the channel losses are sufficiently large so that even

if two photons are injected into the channel, the probability both of them will be

transmitted is low. These conditions are satisfied by most practical systems. They


will simplify the analysis considerably, and give accurate numbers at high channel

losses, which is the regime of interest.

Eq. 4.17 gives the length of the final string after privacy amplification. In the

following calculations, it is more useful to calculate a normalized communication

rate, in units of bits per clock cycle. This communication rate R can be defined as

R = limN→∞

r

N. (4.40)

Note that n = Npclick, where n was defined previously as the length of the final string.

Plugging into Eq. 4.17, one obtains

R = limn→∞

pclick

[τ − κ

n− s+ t

n

]. (4.41)

The security parameter s is not a function of n, while t grows only logarithmically

with n. Thus, in the limit of large n, (s + t)/n = 0. The term κ/n is the fraction

of additional information exposed during error correction. If the error correction

algorithm works at the Shannon limit, then in the limit of large strings κ/n = h(e),

where h(e) is the Shannon entropy function defined previously. However, an algorithm

that is computationally feasible and works at this limit does not exist. All practical

algorithms are inefficient, to some extent, and this is accounted for by inroducing

a function f(e), defined as the ratio of the algorithm performance to that of the

Shannon limit. Thus,

limn→∞

κ

n= f(e)h(e) (4.42)

where f(e) ≥ 1. This function can be determined by benchmark testing the algorithm

under a broad range of strings. Subsequent calculations assume that the algorithm

being used is the one proposed by [25]. This algorithm works within 35% of the

Shannon limit, even with large error rates. Table 4.1 shows values of f(e) for several

different error rates, produced by benchmark tests. These values are linearly inter-

polated to determine intermediate values of f(e) . Putting everything together, the

final expression for the communication rate is

R = pclick [τ − f(e)h(e)] , (4.43)

where τ can be calculated from 4.25.


Table 4.1: Values of f(e) for different error rates.e f(e)

0.01 1.160.05 1.160.1 1.220.15 1.35

The above equation can be used to determine how a system based on sources with

different g(2) and ndev behaves in the presence of practical experimental imperfections

such as channel loss and detector dark counts. First, one needs to calculate psignal,

pd, e, and β. The signal contribution to the detection events is given by

psignal =∞∑n=0

p(n) [1− (1− T )n] . (4.44)

The parameter T in the above equation is the total optical loss from the quan-

tum channel and Bob’s detection apparatus. In general, this expression cannot be

evaluated because p(n) is unknown. But as mentioned before, all calculations are

taken in the limit where multiple detection events are negligible. In this limit, the

above expression can be kept only to first order in T . Using the approximation

(1− T )n ≈ (1− nT ), one obtains

psignal ≈ nT. (4.45)

The probability pd is given by the dark count rate of the detectors multiplied

by the measurement time window. Thus, d = rdτw. The error rate e will receive a

contribution from both the signal and dark count component. Errors from the signal

component occur because of imperfect state preparation, channel decoherence, and

imperfect polarization optics at Bob’s detection unit. The baseline signal error rate,

denoted as µ, accounts for all of these effects. For good systems, µ is typically less

than 2%. A second error component comes from the dark counts at Bob’s detection

unit. Each dark count is completely uncorrelated with Alice’s signal and thus causes


a 50% error rate. Using the above definitions, one obtains

e =µpsignal + pd/2

pclick. (4.46)

Finally, the parameter β is simply given by

β =pclick − pmpclick

. (4.47)

In the above expressions the parameters pd, T , and µ are fixed parameters which

characterize the non-idealities of the system. The parameter g(2) is a also a fixed

parameter which characterizes the source. There is one other parameter, n, which is

adjustable. By introducing losses one can continuously adjust it from 0 to ndev. On

first look, it may seem that the best thing to do is to set it to its maximal value of

ndev, and hence maximize the amount of signal injected into the channel. It turns out,

however, that this is not always the optimal strategy. To understand why, consider

the expressions for pclick and pm shown below.

pclick → nT + d (4.48)

pm → n2g(2)

2. (4.49)

The probability pclick reduces linearly with n while pm reduces quadratically. If n is

set too high, the communication rate will drop due to an increase in pm. If it is instead

set too low the communication rate will once again drop due to a decrease in pclick.

It turns out that there is a unique optimal n which maximizes the communication

rate. Thus, the communication rate must be optimized with respect to n in order to

achieve the best possible communication rate.

The communication rate as a function of the channel loss T for various sources

ranging from Poisson light to ideal single photon devices, is shown in Figure 4.5.

The dark count rate rd is assumed to be 20s−1, corresponding to a good commercial

avalanche photodiode. The measurement window τw is ultimately limited by the

time jitter of the detector which is assumed to be 500ps. The dark count probability

under these conditions is d = 4 × 10−8, where the factor of four comes from four

detectors. The baseline error rate µ is set to 1%. The average photon number n is


1n =

Figure 4.5: Communication rate as a function of channel loss for different values ofg(2), assuming the device efficiency is 1.


numerically optimized for each value of T . Figure 4.5 shows the calculation results

for the case where ndev = 1, which is nearly perfect device efficiency. The normalized

communication rate is plotted as a function of channel loss for different values of g(2).

Poisson light corresponds to the curve g(2) = 1, while the curve g(2) = 0 is an ideal

single photon device. Note that the Poisson light bit rate decreases faster than the

ideal single photon device. This is because the single photon device does not suffer

from photon splitting attacks. The rate decrease is only due to the increasing channel

loss. For Poisson light, as the channel loss increases the effect of the multi-photon

states is enhanced, forcing a reduction of the average number of photons. Intermediate

devices with 0 < g(2) < 1 feature two types of behaviors. At low channel losses they

behave very similar to the ideal device where the bit rate decreases in proportion to

the channel transmission. At higher loss levels the multi-photon states start to make

a significant contribution and the behavior gradually switches over to that of Poisson

light.

As can be seen, each curve features a cutoff channel loss, beyond which secure

communication is no longer possible. A smaller g(2) implies that more loss can be

tolerated. Next, consider the situation when the device efficiency is not ideal. Fig-

ure 4.6 shows the communication rate as a function of channel loss for a fixed g(2) and

several different values of ndev. At low loss levels the bit rate of the system decreases

with decreased efficiency. But at higher loss levels most of the curves meet with the

ideal curve, leaving the cutoff loss unaffected. Only the extremely lossy device with

ndev of 10−3 fails to rejoin the ideal curve, and features a smaller cutoff loss. Most

of the curves rejoin the ideal curve because, at high loss levels, added attenuation is

already required in order to reduce the effect of photon splitting attacks. For lossy

devices, some of this attenuation is provided by device inefficiency. If this inefficiency

does not exceed the attenuation required at the cutoff loss, than at some loss level the

curve for the lossy device will rejoin that of a lossless one. This leads us to the con-

clusion that, given g(2) and the system parameters, a critical efficiency value exists.

If the device efficiency exceeds this critical efficiency, than the device can tolerate

the same maximum channel losses as a perfectly efficient one. Furthermore, as chan-

nel losses increase there will be a crossover point where the communication will no


nnnn

Figure 4.6: Communication as a function of channel loss for different device efficien-cies.


longer depend on the device efficiency. Figure 4.6 shows that for the particular value

of g(2) = 0.01, which is a realistic value for good single photon devices, the critical

efficiency is below 10−2. Such efficiencies are within the reach of today’s technological

capabilities.

Unfortunately, it is very difficult to get a closed form solution of the critical effi-

ciency and loss cutoff from Eq. 4.43 because of the non-linear nature of the equation.

This forces us to resort to numerical methods. In the next section, an approximate

method is introduced to get a closed form estimate on these two important quantities.

This estimate will provide a better intuitive understanding of the different tradeoffs

involved.

4.2.6 Estimates for sub-Poisson light sources

In this section closed form approximations will be derived for the cutoff loss and

critical efficiency of a sub-Poisson light source. Using the arguments presented in [18],

one can put an upper bound on the allowable error rate using the condition

e =β

4. (4.50)

Since β is the fraction of single photon states in the key, the condition above defines

the point where Eve can intercept and re-send all single photon states, and perform

a photon splitting attack on the multi-photon states. Secure communication is not

possible beyond this point. The channel loss where the above condition is satisfied

will serve as an estimate for the loss cutoff. The efficiency that optimizes the cutoff

loss will give an estimate for the critical efficiency. A device with efficiency exceeding

this value can be attenuated down to the critical efficiency if the channel losses are

close to the cutoff. Comparison with numerical calculations from Eq. 4.43 will show

that the above estimates give a remarkably close approximation to the real value.

Note that both the error rate, given in Eq. 4.46, and the parameter β given in

Eq. 4.47 are functions of the channel transmission T . Plugging these equations back

into Eq. 4.50, one can solve for the channel transmission which is given by

T =1

1− 4µ

(d

n+ng(2)

2

). (4.51)


The above equation gives the value of the channel transmission where Eve can in-

tercept and resend all single photons and perform a photon splitting attack on all

multi-photon states. Here µ, d, and g(2) are considered to be fixed system parame-

ters. When using Poisson light sources the average photon number n is an adjustable

parameter, which can be made arbitrarily large or small. This is because Poisson

light sources, such as lasers, start with a macroscopically large number of photons

that can be attenuated down to the desired final average. With sub-Poisson light the

average is only adjustable by introducing loss, as previously discussed, and can never

exceed the device efficiency.

Equation 4.51 shows more clearly the tradeoffs involved in optimizing T . If n is

set too low the first term on the right side of the equation becomes large. If it is set

too high the second term becomes large. For an ideal device one can set n = 1 and

g(2) = 0, so that

T idealmin = d/(1− 4µ). (4.52)

When the device is not ideal, T can be minimized with respect to n, resulting in the

conditions

nc =

√2d

g(2)(4.53)

Tmin =

√2dg(2)

1− 4µ. (4.54)

In the above equations nc is the average photon number which minimizes Eq. 4.51,

and Tmin is the obtained minimum channel transmission. Equation 4.53 gives an

estimate for the critical efficiency. If the device efficiency exceeds this value one can

always attenuate down to optimal value when the channel transmission is close to

its minimum. If the device efficiency is below this value however, there is no way

to increase it in order to achieve the optimal efficiency. Note that when µ = 0

and g(2) = 1 the bound derived in [18] for Poisson light is reproduced. The above

equations, however, can now be applied to any sources between Poisson light and

ideal single photon devices.

On initial inspection there is an apparent inconsistency in Eq. 4.54 in the limit

g(2) → 0. The equation predicts Tmin = 0 in this limit, but one can never do better


Figure 4.7: Basic system for performing the BB84 protocol.

than an ideal single photon source which is bounded by Eq. 4.52. However, in this

limit nc →∞, which is a contradiction. The average photon number cannot be made

arbitrarily large and is ultimately limited by Eq. 4.37. When g(2) → 0, n ≤ 1 with

equality holding when the device creates exactly one photon per pulse. Thus, one

should only use Eq. 4.53 and 4.54 if nc ≤ 1. Typical experiments feature g(2) = 0.01

and d = 4× 10−8, giving us nc = 3× 10−3, which is well below 1.

Figure 4.7 shows a comparison between the estimate for the cutoff loss and critical

efficiency, and the actual value calculated numerically from Eq. 4.43. In both cases the

estimate predicts the actual value to within a factor of 2 over a 4 order of magnitude

range for g(2).

4.3. QUANTUM CRYPTOGRAPHY WITH ENTANGLED PHOTONS 67

4.3 Quantum cryptography with entangled pho-

tons

This section considers the security of entangled photon protocols. The security of such

protocols have not been studied as thoroughly as BB84. Several proofs of security

exist for entanglement based protocols against enemies with unlimited computational

power. Some of these proofs require that the receivers process their qubits through

some form of quantum computer [67, 68]. Others apply to more standard entangled

photon protocols but require that the source generate only one photon for each re-

ceiver [69]. Although these proofs represent important progress in the security of

entangled photon protocols, they cannot yet be used directly to analyze the security

of practical systems.

In order to treat practical systems a proof of security must apply to realistic

sources. Furthermore, in most of these systems the source can be located in between

the two receivers and is not trustable. An eavesdropper can replace it with a differ-

ent source that may provide more information without changing the error rate. In

the worst case one must also consider the detection apparatus to be untrustable, so

that an eavesdropper can in some way modify the measurements made by the two

communicating parties. The issue of untrustable source and detection apparatus has

previously been investigated by Mayers and Yao [70, 71]. Mayers and Yao present

a protocol in which two receiving parties measure their respective signals randomly

in one of three non-orthogonal bases. It is proven that if the probabilities of the

measurement results are consistent with those produced by a Bell state, then the

security of the communication channel is ensured. An eavesdropper cannot simulate

these probabilities while learning a non-negligible amount of information about the

secret key, even if she is allowed to modify or control all aspects of the source and

detection apparatus (i.e. number of particles per pulse, measurement bases, losses).

This proof has the potential to guarantee security for realistic systems with virtually

no assumptions. However, at this point the proof considers only the idealized limit

where the probabilities are perfect, so it cannot be applied to practical systems either.

The extension of this proof to imperfect probabilities due to effects such as imperfect


state preparation and channel losses remains an important but difficult question.

This section provides a proof of security for an entangled photon protocol which

can be applied to practical systems. This is done by extending the proof of Lutkenhaus

for BB84 with realistic sources [48] to apply to the entangled photon variant of the

BB84 protocol proposed by Bennett, Brassard, and Mermin [15], BBM92 for short.

The proof of security relies on two assumptions. The first is that all eavesdropping

is restricted to individual attacks. The second assumption is that the the detection

apparatus is trustable. This means that the detection apparatus behaves according

to a specific model. The eavesdropper cannot modify the measurement apparatus

beyond this model. This assumption is required in virtually all proofs of BB84, as

well as the entangled photon proofs presented in [67–69]. With these restrictions,

a quantitative relationship between the security of the final key and experimentally

measurable quantities such as the error rate is obtained. This is achieved by finding

an upper bound on the average collision probability. The proof works for realistic

sources, and allows the source to be placed outside the labs of the two receivers.

Although the proof makes assumptions about the eavesdropper and the detection

units, these assumptions are realistic under many experimental conditions. The tech-

nology to perform collective and joint measurements does not exist, and may not for

quite some time. Thus, the assumption of individual attacks is realistic for current

systems. The assumption that the measurement apparatus is reliable may also be

argued as reasonable because the measurement systems are located in the labs of the

receivers. They can therefore be tested to make sure they are operating according to

expectation, and cannot be physically manipulated by the eavesdropper. This is in

contrast to the source which is located somewhere between the two receivers and can

easily be modified.

4.3.1 The BBM92 protocol

This sections describes the BBM92 protocol, and discusses why it is secure. In BBM92

Alice and Bob share a pair of photons from a source presumed to be somewhere in

between both parties. In the ideal case the photon pair is in a quantum mechanically


entangled state such as

|ψ〉 =1√2

(|00〉+ |11〉) , (4.55)

The above state implies that if both receivers measure their photon in computational

basis, their measurement results will be completely correlated. However, the two

receivers don’t necessarily need to measure in the computational basis. If they instead

measure in the diagonal basis, they will also have a perfectly correlated result. This

suggests the following protocol for quantum cryptography. Each receiver measures

their respective photon randomly in either the computational or diagonal basis. Later

they agree to keep only the instances in which the measurement bases were the same,

forming the sifted key.

To understand why BBM92 is secure, consider the arguments presented by Ben-

nett, Brassard, and Mermin. Since the source is somewhere between the two parties,

assume that Eve can block it and replace it with her source, which will provide her

with information about Alice and Bob’s measurement results. This source will pro-

vide one qubit for Alice, one for Bob, and a third probe system for Eve. Eve will use

the probe signal to infer the measurement results. The most general state that the

source can create is

|ψ〉abe = |00〉|E00〉+ |11〉|E11〉+ |01〉|E01〉+ |10〉|E10〉. (4.56)

The states |E00〉, |E11〉, |E10〉 and |E01〉 are states of the probe, and are not assumed

to be normalized or orthogonal. If Eve is not allowed to create any errors, then

|E01〉 = |E10〉 = 0. Now, re-express the state in the diagonal basis. It is easy to show

that in this basis

|ψ〉abe =1

2

[(|00〉+ |11〉

)(|E00〉+ |E11〉) +

(|01〉+ |10〉

)(|E00〉 − |E11〉) .

](4.57)

If Eve is not allowed to generate errors in the diagonal basis, the |E00〉 = |E11〉, and

Eve’s probe is completely uncorrelated with the transmitted qubits. Thus, she gains

no information about the measurement result.

The above proof shows that Eve cannot gain any information without inducing at

least some errors. However, this proof cannot be used in practical systems because it

does not quantify the amount of leaked information in the presence of a finite error


rate. Worse yet, the above proof assumes that only one qubit has been sent to Alice

and Bob. There is nothing which prohibits Eve from sending more than one qubit to

either party. In the BB84 protocol, when the source generates more than one qubit,

it creates a severe security loophole. If the same is true in BBM92, then Eve can

simply replace the source with one which always emits more than one qubit for Alice

and Bob, rendering the entire protocol insecure.

The proof of security for BBM92 will be explained in the next section. The

protocol will be shown to be secure even if Eve is allowed to send more than one

photon to each party. The proof will be obtained by finding a bound on the average

collision probability. This will allow a quantitative comparison of the BBM92 protocol

to the BB84 protocol.

4.3.2 Proof of security for BBM92

In BBM92 Alice, Bob, and Eve observe orthogonal Hilbert spaces HA, HB, and HE

respectively. In the most general case Eve can control which density matrix ρabe over

the space HA ⊗ HB ⊗ HE she will share with Alice and Bob. This density matrix

can span all the photon number states of the two receivers, and Eve’s measurable

subspace which can have any number of dimensions. In practice Eve can do this by

blocking out the original source and substituting her own source which generates the

desired state that maximizes her information on the final key. A bound is derived on

the optimal density matrix, which serves as an upper bound, even if Eve is incapable

of generating it in practice.

As mentioned previously, the proof assumes that Eve is restricted to individual

attacks and that Alice and Bob’s detection apparatus is trustable. A trustable detec-

tion apparatus is one whose components behave according to a known model which

cannot be modified by Eve. In order to define this model one first has to specify the

physical implementation of the detection apparatus. It is assumed that both Alice

and Bob implement the same passive modulation scheme that was discussed in the

BB84 protocol. Thus, the POVM which the two receivers implement is described by

Eq. 4.21. Optical losses are once again accounted for by placing a beamsplitter in


front of the detection apparatus which reflects off a specified fraction of the light into

a loss mode. All losses are lumped into this beamsplitter and the subsequent optical

components can be regarded as lossless. The disturbance parameter is also defined in

the same way as was done in BB84, using Eq. 4.22. The values nerr, nD, and nrec are

once again the number of error bits, dual fire events, and number of bits that entered

the error corrected key respectively, and wD is a weighting parameter chosen by Alice

and Bob. As part of the proof, it will be shows that wD = 1/2 is a sufficient number

to ensure security for BBM92, just as it was for BB84.

Eve is allowed to pick any density matrix ρabe which represents some entangled

state of her observable Hilbert space and the signals transmitted to Alice and Bob.

She can send any number of photons she wishes, or a coherent superposition of photon

numbers. The first step is to show that the most general density matrix ρabe can be

written as

ρabe =∞∑

i,j=1

ρ(ij)abe , (4.58)

where ρ(ij)abe is the density operator over the subspace where Alice received i photons

and Bob received j photons. This is due to the fact that the detection units consist of

only passive linear optics with vacuum auxiliary modes and single photon counters.

As can be seen by (4.21a)-(4.21c), a detection event is represented by a projection

operator which is diagonal in the photon number basis. Define Eia as the projector

onto Alice’s i photon subspace, and Ejb as the projector onto Bob’s j photon sub-

space. Suppose that Fa and Fb are positive operators which represent a measurement

corresponding to any combination of detection events for Alice and Bob respectively.

Because these operators are diagonal in the photon number basis they can be written

equivalently as

Fa =∑i

EiaF

iaE

ia (4.59)

Fb =∑j

EjbF

jbE

jb . (4.60)

Let Fe be the positive operator corresponding to Eve’s measurement result on her


own subspace. The joint probability p(a, b, e) can be written as

p(a, b, e) = Tr {ρabeFaFbFe}

=∑ij

Tr{ρabeE

iaE

jbFaFbE

iaE

jbFe}

=∑ij

Tr{EiaE

jbρabeE

iaE

jbFaFbFe

}.

The last step comes from the fact that the projectors commute with Eve’s measure-

ment operator and the invariance of the trace under cyclic permutation. If one defines

ρijabe = EiaE

jbρabeE

iaE

jb , the joint probability does not change if a density matrix of the

form given in (4.58) is selected.

The main consequence of the above result is that Eve can keep track of the num-

ber of photons she is sending to Alice and Bob without changing the measurement

results. Thus, her collision probability can be broken up into different photon number

contributions as

pc =∞∑

i,j=1

p(ij)rec

precp(ij)c , (4.61)

where

p(ij)c =

∑m∈M(ij),ψ

1

p(ij)rec

p2(ψ,m)

p(m). (4.62)

The set M (ij) is defined as the set of all measurement results on Eve’s probe if she

sent i photons to Alice and j to Bob, and p(ij)rec is the probability that the signal

component ρ(ij)abe enters the error corrected key. One can similarly define p

(ij)err and

p(ij)D as the probability that this signal component enters the sifted key as an error or

causes a dual fire event respectively. Using (4.22), the disturbance measure ε can be

broken up into different photon number contributions as

ε =∑ij

p(ij)rec

prec

p(ij)err + wDp

(ij)D

p(ij)rec

=∑ij

p(ij)rec

precε(ij). (4.63)

The next step is to investigate the term p(11)c which is the component corresponding

to Alice and Bob each receiving one photon. Instead of directly finding a bound on

Eve’s collision probability from this component, it is proven show that any bounds


derived for BB84 on single photon state can also be applied to BBM92 when Alice

and Bob each receive one photon. In BB84 Alice sends a photon in one of four

non-orthogonal states to Bob. Eve performs a measurement on the photon and the

backaction noise on the state can be described by a complete positive mapping (CP

map)

ρb =∑k

AkρaA†k (4.64)

where ρa is the density matrix prepared by Alice, and ρb is the density matrix which

Bob receives. The only restriction on the operators Ak is that they satisfy the condi-

tion ∑k

A†kAk = I. (4.65)

In BBM92, Alice does not directly send Bob a density matrix. In the ideal case where

both receivers share a pure entangled pair, if Alice’s measurement corresponds to the

operator Fa she prepares Bob’s density matrix in the state F Ta /Tr {Fa}. If one could

show that, given Alice observes Fa, any eavesdropping strategy incorporated by Eve

could once again be described by a CP map

ρb =∑k

AkF Ta

Tr {Fa}A†k (4.66)

then this seemingly different situation is equivalent to the BB84 attack . Unfortu-

nately, in BBM92 there are many eavesdropping strategies which cannot be described

by such a mathematical formalism. However, Appendix B shows that there is always

an optimal attack which can be described by a CP map. Thus, any bounds which

have been derived for BB84 using a POVM formalism on single photon states can

be directly applied to BBM92 when one photon is sent to each receiver. Specifically,

the bound derived by Lutkenhaus [47, Appendix D], which was used in the previous

sections for BB84, can be directly used to bound p(11)c as follows

p(11)c ≤ 1

2+ 2ε(11) − 2

(ε(11)

)2. (4.67)

In order to account for the components with more than one photon for either receiver,

Appendix C shows that if the weighting parameter wD in Eq. 4.22 is set to 1/2, Eve’s


optimal strategy is to only send one photon to Alice and Bob. This argument follows

the same line as that given for BB84 in [47]. Given that this is the optimal strategy

one is led directly to the result

pc ≤1

2+ 2ε− 2ε2. (4.68)

which is exactly the same as the collision probability for BB84 using a single photon

source.

The above result highlights two important points for the entangled photon pro-

tocol. First, one does not have to confine the source to either Alice or Bob’s lab.

Allowing Eve to have total control of the source does not effect the form of the

collision probability. Second, there is no analog to the photon splitting attack for

BBM92 since the collision probability bound was derived without assumptions on the

source. The error rate and dual fire rate are sufficient to determine how much privacy

amplification is necessary.

4.3.3 Ideal entangled photon source

In this section, the expected communication rate for an ideal entangled photon source

will be calculated. This source creates exactly one pair of photons per clock cycle,

whose quantum state is given by

|ψ+〉 =1√2

(|xx〉+ |yy〉) . (4.69)

Although proposals for creating such a source exist [72], no successful implementations

of such proposals have been reported to date. Nevertheless, this simplified analysis

will set the groundwork for the analysis of practical sources based on parametric

down-conversion.

When doing two photon experiments one is interested in coincidence events where

the two receivers simultaneously detect a photon. As before, the following calculations

will assume that the dual fire rate is negligibly small. Thus, the disturbance parameter

simplifies to the error rate. The channel is assumed to be an exponentially decaying

function of distance. Thus, the channel transmission TF can be written as

TF = 10−(σL/10), (4.70)


where σ is the loss coefficient. All losses to each receiver from the channel, detectors,

and optics are combined into one beamsplitter with transmission

αL = ηTF (L), (4.71)

where η accounts for all distance independent losses in the system. The coincidence

probability is separated into two parts, ptrue is the probability of a true coincidence

from a pair of entangled photons, and pfalse is the probability of a false coincidence

which, for an ideal source, can only occur from a photon and dark count or two dark

counts. In the limit of negligible dual fire events,

pcoin = ptrue + pfalse. (4.72)

The location of the source needs to be determined. If the source is set a distance x

from Alice and L− x from Bob, then

ptrue = αxαL−x

= αL,

and

pfalse = 4αxd+ 4αL−xd+ 16d2. (4.73)

keeping only terms which are second order in αx and d. It can be seen that the

probability of a true coincidence does not change with x, but the false coincidence

rate does. A simple optimization shows that the false coincidence rate achieves a

minimum halfway between Alice and Bob, which is given by

pfalse = 8αL/2d+ 16d2. (4.74)

Define ntot as the total number of signal pulses sent to the receivers, and nrec as the

length of the error corrected key. Thus,

nrec =ntotpclick

2. (4.75)

The error rate e is

e =pfalse/2 + µptrue

pcoin, (4.76)


where µ is the baseline error rate of the signal. Using Eq. 4.17, one obtains

r = nrec

(τ(e)− κ

nrec

)− t− s. (4.77)

The asymptotic communication rate is once again defined as

R = limntot→∞

r

ntot. (4.78)

Using the proof of security for BBM92, and accounting for the side information from

error correction one obtains

R =pcoin

2{τ(e) + f(e) [e log2 e+ (1− e) log2 (1− e)]} . (4.79)

The values of pcoin and e can be calculated from Eq. 4.72 and 4.76.

4.3.4 Entangled photons from parametric down-conversion

A more practical way of generating entangled photons is to use the spontaneous emis-

sion of a non-degenerate parametric amplifier. This technique, known as parametric

down-conversion, is extensively used to generate entanglement in polarization as well

as other degrees of freedom such as energy and momentum. Parametric amplifiers

exploit the second order non-linearities of non-centrosymmetric materials. These non-

linearities couple three different modes of an electromagnetic field via the interaction

Hamiltonian [22]

HI = ihχ(2)V ei(ω−ωa−ωb)ta†b† + h.c. (4.80)

where modes a and b are treated quantum mechanically while the third mode V eiωt

is considered sufficiently strong to be treated classically. The state of the field after

the nonlinear interaction is given by

|ψ〉 = exp

[1

ih

∫ T

0

HI(t)dt

]|0〉. (4.81)

Assuming the energy conservation condition, ω = ωa + ωb, leads directly to

|ψ〉 = eχ(a†b†−ab)|0〉, (4.82)


where the parameter χ depends on several factors including the non-linear coefficient

χ(2), the pump energy, and the interaction time. Using the operator identity [22]

eχ(a†b†−ab) = eΓa†b†e−g(a†a+b†b+1)e−Γab, (4.83)

where

Γ = tanhχ

g = ln coshχ,

directly leads to the relation

|ψ〉 =1

coshχ

∞∑n=0

tanhn χ|n〉a|n〉b. (4.84)

The above equation makes it clear that whenever a photon is detected in one mode,

the conjugate mode must also contain a photon. In order to generate entanglement

in polarization one needs to create a correlation between the polarization of these two

modes. This is typically done using non-collinear Type II phase matching [34], which

leads to the slightly more complicated interaction

HI = ihχ(2)Aeiωt(a†xb

†y + a†yb

†x

)+ h.c. (4.85)

where x and y refer to the polarization of the photon. Since all creation operators in

the Hamiltonian commute, one can apply Eq. 4.83 to both mode pairs which directly

leads to

|ψ〉 =etanhχ(a†xb†y+a†yb

†x)

cosh2 χ|0〉. (4.86)

If χ is sufficiently small that the above expression can be kept only to first order

then a parametric down-converter creates a Bell state. But χ cannot be made small

without sacrificing the rate of down-conversion.

The goal is to calculate the probability pcoin and the error rate e as a function of

the parameter χ, as well as the optical losses and dark counts of the detectors. First,

define the field operator

ψ =etanhχ(a†xb†y+a†yb

†x)

cosh2 χ. (4.87)


The beamsplitter model introduced previously to account for the losses becomes very

useful here. The beamsplitters perform a unitary operation on the modes which is

given by

aσ → √αL/2aσ +

√1− αL/2cσ

bσ → √αL/2bσ +

√1− αL/2dσ,

where σ represents polarization and the modes c and d are the reflected modes of the

beamsplitters. To determine the state of the photons after the losses this beamsplitter

transformation is first applied. To simplify the notation, define another field operator

ψρφ = ρ†xφ†y + ρ†yφ

†x, (4.88)

where ρ and φ are any two independent modes. Using this definition, Eq. 4.87 is

transformed by the two beamsplitters into

ψ =1

cosh2 χexp

[tanhχ

(αL/2ψab +

√αL/2

(1− αL/2

)(ψad + ψbc) +

(1− αL/2

)ψcd

)].

(4.89)

This expression can be expanded in terms of a† and b† as

ψ =1

cosh2 χexp

[tanhχ

(1− αL/2

)ψcd]×{

1 + tanhχ√αL/2(1− αL/2) [ψad + ψcb] +

tanhχψab + tanh2 χαL/2(1− αL/2)ψabψcb + ψD}

where ψD is the wave operator which contains all the terms that create more than

one photon in either mode. It is now necessary to operate on the vacuum and trace

out over modes c and d to get the final density matrix. As shown in Section 4.3.2,

off diagonal terms that couple different photon number states can be ignored because

they do not contribute to the signal. The density matrix ρψ+ is defined as the two

photon density matrix in which the photons are in the entangled state |ψ+〉 given in

Eq. 4.69. The matrices ρa0 and ρb0 represent a zero photon vacuum state in mode a

and b respectively. Finally the matrices ρau and ρbu are defined as

ρa,bu =I

2, (4.90)


where I is the identity matrix. The above matrices correspond to an unpolarized

photon in mode a or b respectively. After tracing out loss modes c and d and ignoring

the coherence between different photon number states, the density matrix becomes

ρAB = Aρψ++Bρa0⊗ρb0+C(ρau ⊗ ρb0 + ρa0 ⊗ ρbu

)+Dρau⊗ρbu+(1− A−B − 2C −D) ρD,

(4.91)

where ρD is the matrix which represents all the possible states in which more than

one photon is in either mode a or b after the losses. The coefficients A, B, C, and D

are

A =1

cosh4 χ

2α2L/2 tanh2 χ(

1− tanh2 χ(1− αL/2

)2)4 (4.92)

B =1

cosh4 χ

1(1− tanh2 χ

(1− αL/2

)2)2 (4.93)

C =1

cosh4 χ

2αL/2(1− αL/2

)tanh2 χ(

1− tanh2 χ(1− αL/2

)2)3 (4.94)

D =1

cosh4 χ

4α2L/2

(1− αL/2

)2tanh4 χ(

1− tanh2 χ(1− αL/2

)2)4 . (4.95)

In the above expression, A is the probability that Alice and Bob share an entangled

pair of photons. This component on the signal will be defined as a true coincidence,

because it leads to error free transmission. The coefficient B is then the probability

that neither receiver gets a photon, either because the source failed to generate a

pair or because all photons where lost. Similarly, C is the probability that one of the

two receivers gets a photon but the other does not. In order for these signals to be

factored into the key they must be accompanied by dark counts. Coefficient D is the

probability that both receivers get a photon, but these photons are unpolarized and

uncorrelated. Note that D is at least fourth order in tanhχ, indicating that at least

two pairs must be created in order for it to exist. The intuitive explanation for the

presence of this unpolarized component is that when higher order number states are

created, and some of these photons are lost, the loss mode c and d play a similar role

to Eve. The photons in these modes can potentially carry some information about


the quantum state of the other photons, and will thus result in decoherence. Since

this component of the signal causes a 50% error, it can be lumped into the definition

of a false coincidence. Hence,

ptrue = A

pfalse = 16d2B + 8dC +D.

The communication rate can be calculated by simply plugging these expressions into

Eq. 4.72, 4.76 and 4.79.

4.3.5 Calculations

The previous sections derived the communication rates for the BB84 protocol and the

BBM92 protocol in the presence of experimental non-idealities. This section provides

a quantitative comparison of the two protocols. Simulations are performed for fiber

optical and free space key distribution experiments. For the fiber optical simulation,

the 1.5µm telecommunication window is considered. For free space communication

the focus is shifted to the visible wavelengths where single photon counters tend to

perform best. In free space communication the channel loss is no longer an expo-

nential function of distance. Instead, it is a complicated function which results from

atmospheric effects, beam diffraction, and beam steering problems. Thus, for free

space one is more interested in the rate as a function of the total loss rather than

distance.

Figure 4.8 shows the calculation results for both BB84 and BBM92 with ideal

and realistic sources. Plot (a) of the figure shows results for fiber optical channels.

Using experimental values from [73], the detector quantum efficiency is set to 0.18,

d = 5 × 10−5, and the channel loss σ = 0.2dB/km. The baseline error rate is set to

µ = 0.01, and an additional 1dB of loss is added to account for losses in the receiver

unit. The curves corresponding to BBM92 plot the distance from Alice to Bob, with

the source assumed halfway in between. Plot (b) shows calculations for free space

quantum key distribution. The communication rate is plotted as a function of the

total loss, including the detector quantum efficiency. In the free space curves for


0 20 40 60 80 100 120 140 160 180 20010 -9

10 -8

10 -7

10 -6

1x10 -5

1x10 -4

10 -3

10 -2

10 -1

10 0

0 20 40 60 80 100 12010 -16

1x10 -14

1x10 -12

1x10 -10

1x10 -8

1x10 -6

1x10 -4

1x10 -2

1x10 0

b)

a)B

its p

er P

ulse

Distance (km)

BB84 - Poisson BB84 - Ideal BBM92 - PDC BBM92 - Ideal

Bits

per

Pul

se

Loss (dB)

BB84 - Poisson BB84 - Ideal BBM92 - PDC BBM92 - Ideal

Figure 2Figure 4.8: Comparison between BB84 protocol and BBM92 using both ideal andrealistic sources.


BBM92, the source is again placed halfway between Alice and Bob, and the rate is

plotted as a function of the total loss in both arms. The dark counts of the detectors

are set to 5 × 10−8. In the curve for BB84 with a Poisson light source the average

photon number n is a free adjustable parameter. Similarly with parametric down-

conversion, χ is a freely adjustable parameter. In both cases the parameters are

chosen to numerically optimize the communication rate at each distance or channel

loss.

Each curve features a cutoff distance where the communication rate quickly drops

to zero. This cutoff is due to the dark counts, which begin to make a non-negligible

contribution to the signal at some point. However the two curves for BBM92 feature

a much longer cutoff distance than their BB84 counterparts. This is due partially to

the absence of the photon splitting attacks. But even when performing BB84 with

ideal single photon sources, which don’t suffer from photon splitting attacks either,

the cutoff distance for BBM92 is still significantly longer. This is because in BBM92

a dark count alone cannot produce an error. It must be accompanied by a photon or

another dark count, so it is much less likely to contribute to the signal. The difference

in rates between the ideal entangled photon source and the parametric down-converter

can be attributed to the interplay between coefficient A in Eq. 4.93, and coefficient

D in Eq. 4.95. Term A is the probability of a real coincidence, and increases with χ.

Term D on the other hand contributes to false coincidences and increases with χ as

well, but is of higher order. One cannot make A arbitrarily large without getting an

increased contribution from D. This leads to an optimum value for χ which is less

than one.

4.3.6 Entanglement Swapping

This section considers a more complicated scheme based on entanglement swapping.

Figure 4.9 gives a diagram of the proposed configuration. A series of entangled photon

sources, which are assumed to be ideal, are spread out an equal distance apart from

Alice to Bob. The sources are clocked to simultaneously emit a single pair of entangled

photons. Each of the pair is sent to a corresponding Bell State Analyzer, whose


B B B B

50/50

H/V H/V

Alice Bob

EPR EPR EPR EPR EPR EPR

Figure 3Figure 4.9: BBM92 implementation with entanglement swapping. Boxes labelled Brepresent bell state analyzers, while EPR represents an entangled photon source.

actions is to perform an entanglement swap. If all the swaps have been successfully

performed, Alice and Bob will share a pair of entangled photons. Experimental

demonstrations of a single entanglement swap can be found in [41]. Entanglement

swapping is a key element for quantum repeaters, which use entanglement purification

protocols to reliably exchange quantum correlated photons between two parties [40].

Here it is shown that even without such protocols, using only linear optical elements,

photon counters, and a clocked source of entangled photons, swapping can enhance

the communication distance.

The key element to the scheme is the Bell Analyzer. Since the implementation is

restricted to passive linear elements and vacuum auxiliary states, one cannot achieve

a complete Bell Measurement. It has recently been shown that Bell Analyzers based

on only these components cannot have better than a 50% efficiency [74]. One scheme

which achieves this maximum is shown on the inset of Figure 4.9. This scheme will

distinguish between the states

|ψ±〉 =1√2(|xy〉 ± |yx〉), (4.96)


but will register an inconclusive result if sent the states

|φ±〉 =1√2(|xx〉 ± |yy〉). (4.97)

The state generated by the entangled photon sources is assumed to be |ψ+〉. Con-

sidering only a single swap, one can write

|ψ+〉12|ψ+〉34 =1

2[|ψ+〉23|ψ+〉14 − |ψ−〉23|ψ−〉14 + |φ+〉23|ψ+〉14 − |φ−〉23|φ−〉14]

(4.98)

The above expression makes it clear that a Bell measurement on photons 2 and 3

leaves photons 1 and 4 in an entangled state, and the measurement result tells which

one. After N such Bell measurements photon 1 and 2N will be entangled, and the N

Bell measurement results will allow Alice and Bob to know which entangled state they

share. Knowledge of this state allows them to do entangled photon key distribution

and interpret their data correctly. Since the Bell analyzer has an efficiency of only

50%, in the best possible case there will be a price of 2−N in communication rate.

Consider the single swap. Define α to be the detection probability for each photon.

The probability that both photon 2 and 3 reach the Bell analyzer and are successfully

projected is

ptrueswap =1

2α2. (4.99)

If a photon is lost in the fiber or due to detector inefficiency the Bell analyzer may still

indicate that a Bell measurement has been performed due to detector dark counts.

The probability of this happening is

pfalseswap = 6αd+ 12d2. (4.100)

Defining the factor

g =ptrueswap

ptrueswap + pfalseswap

, (4.101)

it is straightforward to show that, given the Bell analyzer registered a successful Bell

measurement, the density matrix of photons 1 and 4 is given by

ρ14 = gρψ± + (1− g)I

4, (4.102)


where ρψ± is the pure state |ψ+〉 or |ψ−〉 depending on the measurement result.

For the case of N entanglement swaps the detection probability for each photon

is

α = η10−σL

10(2N+2) , (4.103)

where L is the distance from Alice to Bob. It is again straightforward to show that

after N swaps, the state of photon 1 and 2N is

ρ1,2N = gNρψ± + (1− gN)I

4, (4.104)

and the probability that all N bell measurements registered a successful result is

pBell = (ptrueswap + pfalseswap )N . (4.105)

Thus,

ptrue = pBellgNα2

pfalse = pBell(8αd+ 16d2 + (1− gN)α2).

These can be plugged into Eq. 4.76 and 4.79 to get the final communication rate.

Figure 4.10 compares the BBM92 with an ideal entangled photon source, a one

swap scheme, and a two swap scheme using a fiber optic channel at 1.5µm. The swaps

result in a longer cutoff distance which can lead to longer communication ranges. It

should be noted however that at these distances the natural fiber loss is substantial

and will lead to very slow communication rates. It is unclear whether swapping will

lead to a practical form of quantum key distribution, but a single swap could be useful

for very long distance QKD.


0 100 200 300 400 50010

20

1015

1010

105

100

Distance (km)

Sec

ure

Bits

per

Pul

se

BBM92 1 swap 2 swaps

Figure 4Figure 4.10: Comparison of no swap, one swap, and two swap scheme.

Chapter 5

Quantum cryptography with

sub-Poisson light

The security advantages of sub-Poisson light over attenuated lasers and LEDs have

already been established in the previous chapter. To date, there have been many

experimental implementations of sub-Poisson light sources. Most of these sources are

based on single quantum emitters, such as single molecules or quantum dots [56,60].

When a single emitter is excited by a light pulse whose duration is much shorter

than the radiative lifetime, it can only capture one photon. After the laser pulse it

re-emits this photon which can be collected and used for quantum cryptography. A

second method of generating single photons is to use parametric down-conversion.

This process can create photon pairs propagating in different directions. When a

photon is detected in one arm, the other arm must also contain a photon. This

creates a conditional single photon state. This type of single photon source will be

investigated in chapter 7.

This chapter focusses on generation of sub-Poisson light using InAs quantum dots.

Quantum dots are small confined structures in a semiconductor material which fea-

ture discrete optical resonances. In this sense they behave similarly to single atoms.

Quantum dots achieve superb suppression of g(2), and due to micro-cavity technology,

they can also feature high device efficiencies [57, 75,76].

87

88 CHAPTER 5. QUANTUM CRYPTOGRAPHY WITH SUB-POISSON LIGHT

0.0 0.5

1.0

0.5

0.01.0 mm0.0 0.5

1.0

0.5

0.01.0 mm

Figure 5.1: Atomic force microscope image of uncapped quantum dot sample.

5.1 Sub-Poisson light from InAs quantum dots

A quantum dot is a small spec of lower bandgap semiconductor material embedded in

a higher bandgap semiconductor substrate. In this case, the lower bandgap material

is Indium Arsenide (InAs), which is embedded in a Gallium Arsenide (GaAs) host.

This is done by a process called self assembly. In this process, a thin layer of indium

arsenide (on the order of a few monolayers) is grown on top a of a bulk gallium

arsenide substrate. This thin layer is referred to as the wetting layer. Both the

substrate and the wetting layer are grown by a technique known as Molecular Beam

Epitaxy (MBE). Due to the lattice size mismatch between GaAs and InAs, it becomes

energetically favorable for the InAs to clump into small islands, rather than remain a

smooth layer of material. These islands, which are typically 4-7nm thick and 20-40nm

wide, are called quantum dots (QDs). The size and density of the QDs depends on

many growth parameters such as temperature and material concentrations. Quantum

dot densities can vary from 10µm−2 to 500µm−2.

Figure 5.1 shows an atomic force microscope (AFM) image of a typical quantum

dot sample. The sample is uncapped, meaning that the final layer of GaAs has not

5.1. SUB-POISSON LIGHT FROM INAS QUANTUM DOTS 89

a) b)

QD

Figure 5.2: Scanning electron microscope image of micro-post structure. a, image ofseveral micro pillars. b, close up image of micro-post showing DBR mirror structure.

been grown yet. From the figure it is apparent that there are many quantum dots in

a 1x1µm area. This makes it extremely difficult to isolate a single quantum dot by

optical focussing. To better isolate the dots, the sample is etched into small micro-

post structures, as shown in figure 5.2. The micro-post structures are formed by

laying sapphire dust on the surface of the sample, which is used as an etch mask. The

diameter of the sapphire dust particles ranges from 0.2-2µm in diameter. After the

dust particles are laid out, ion beam etching techniques are used to etch out all of

the material except for the portions which are covered by the sapphire dust particles.

The result are the micro-posts shown in the figure. After this structure is formed one

can search for a post containing a quantum dot.

The emission from a quantum dot embedded in bulk GaAs is difficult to collect

for two primary reasons. The first is that the dot emits a dipole radiation pattern

which emits into a large solid angle of possible directions. The second difficulty is

due to the large mismatch in the index of refraction between air and GaAs. Because


of this index mismatch, most of the light is lost to total internal reflection off the air

GaAs barrier. Only a 30 degree solid angle of emission succeeds in leaking out the

top and making it to the collection lens.

To overcome this problem, the quantum dots are placed in a high-Q optical cavity.

The two mirrors of the cavity are formed by growing alternating quarter wavelength

stacks of GaAs and AlAs. The cavity spacer layer is a half wavelength thick layer of

GaAs containing quantum dots. Figure 5.2b shows a scanning electron microscope

image of a micro-cavity post. The upper mirror is formed of 12 alternating layers

of GaAs and AlAs, while the lower mirror is formed of 20 alternating layers. The

purpose of the cavity is to redirect the spontaneous emission of the quantum dot

into the cavity mode. If the quantum dot is on resonance with the cavity mode, the

spontaneous emission rate into that made is enhanced over other modes by a factor

proportional to the cavity Q. This is known as the Purcell effect [75]. The figure of

merit for the effectiveness of the cavity in re-directing the spontaneous emission is

known as the Purcell factor, which is the ratio of the lifetime of the cavity quantum

dot normalized by its lifetime in bulk GaAs. The micro-post cavities in this work

have achieved Purcell factors as high as 6, implying 83% coupling efficiency into the

cavity mode [76]. Once the photon couples to the cavity, it leaks out the top in a well

defined transverse mode which is very close to Gaussian. This mode can be efficiently

collected by a large numerical aperture lens and used for quantum cryptography.

To generate single photons, the sample containing the micropost structures with

quantum dots is held at a temperature of 5-10K in a cryostat, as shown in figure 5.3.

A micropost is excited every 13ns by picosecond laser pulses from a mode-locked

Ti-Sapphire laser. The laser is tuned to 905nm, which is resonant with an excited

state of the quantum dot, as shown in Figure 5.5. An electron hole pair is generated

in this excited state, and quickly relaxes to a ground state exciton via non-radiative

decay channels. The ground state exciton then re-emits a photon. A spectrometer

can be used to measure the emission spectrum on the dot. The spectrum is shown

in panel a of Figure 5.4. This spectrum features a sharp resonance for the quantum

dot at 920nm, which is the ground state exciton emission wavelength. The lifetime

of the dot is measured by a streak camera. The streak camera measurement is shown


MonitoringDetector

Start

Stop

TimeIntervalAnalyzer

Delay

HeCryostat

QDTi:Sapphire Laser

SM fiberGrating

SpecSlit

50-50BSP

HBT interferometer

SPCM

SPCM

FlipMirror

Figure 5.3: Experimental setup for characterizing quantum dot photon source.

in panel b of the figure. From this measurement, the lifetime is determined to be

0.174ns.

In order to use the emission from the quantum dot, one needs to be able to

isolate the ground state emission wavelength and separate it from other sources of

background photoluminescence. This wavelength selection is done by a grating spec-

trometer. The emission is first coupled to a single mode fiber which serves as the

input slit to this spectrometer. The light is then reflected off of a grating with effi-

ciency of about 70%, and focussed onto a spectrometer slit. After the spectrometer

slit the light can be sent either to a photon counter, to measure the efficiency of the

dot, or onto a HBT intensity interferometer to measure the autocorrelation.

The results of the efficiency measurement are shown in figure 5.6. This plot shows

the count rate on the monitoring detector as a function of pumping power from the

Ti:Saphire laser. The counting rate initially increases in proportion to the excitation

intensity, but eventually saturates ate 245,000 counts per second. The detector ef-

ficiency at the emission wavelength is 0.3. A time resolved measurement is used to


0.174ns

a)

b)

Figure 5.4: a, wavelength spectrum of quantum dot. The dot features a narrowemission line at 920nm. b, the lifetime of the dot is measured by a streak camera tobe 0.174ns.

determine that 25% of the emission is background photoluminescence, which has a

long emission time. In order to calculate the device efficiency, the background photo-

luminescence is subtracted and the counts are corrected for the quantum efficiency of

the detector. The corrected count rate is compared to the repetition rate of the excita-

tion laser, which is 76MHz. This gives an average of 0.007 photons per pulse emitted

from the quantum dot. To determine the actual efficiency of the dot, one needs to

correct for losses from fiber coupling, reflection losses from optics, and grating inef-

ficiency. The transmission efficiency from the fiber and subsequent interconnects is

measured to be 0.3. Reflection losses from optics amounts to a transmission efficiency

of 0.7, while the grating has an efficiency of 0.7. This results in an overall transmis-

sion efficiency from the collection lens to the detector of 0.15. After correcting for

this loss it is determined that the output efficiency of the quantum dot is 4.6%.

The second important measurement is the autocorrelation. This is done with


ConductionBand

ValenceBand

n=2

n=2

n=1

n=1

1.04 - 1.45 eV

Figure 5.5: Energy level diagram of quantum dot showing resonant excitation scheme.

0 200 400 600 800 1000 1200

0.00

0.01

0.02

0.03

0.04

0.05

0.06

0.07

Effic

ienc

y

Pump Power (uW)

OperatingPoint

Figure 5.6: Saturation curve for quantum dot.


-80 -60 -40 -20 0 20 40 60 800

50

100

150

200

1.03 1.041.08

1.18

1.38

1 .92

0.14

1.93

1.37

1.18

1.08 1 .05 1.03

Cou

nts

Time De lay (ns)

Figure 5.7: Autocorrelation measurement for quantum dot single photon source. Thearea of the τ = 0 peak is suppressed to 0.14 of a far off side peak.

an HBT intensity interferometer. The results of the autocorrelation are shown in

Figure 5.7. The correlation features a series of peaks separated by the pulse repetition

rate of the laser. The area of the central τ = 0 peak is proportional to the parameter

g(2), defined in Eq. 4.34. In the low efficiency limit, one can normalize this central peak

by one of the side peaks. However, there is one subtlety that must be considered. As

can be seen from the autocorrelation, the area of the first two side peaks is enhanced

relative to the other peaks. In fact, there is a gradual exponential decay of the side

peaks to a steady state value in the long τ limit. This behavior is indicative of dot

blinking. This means that at times, the dot can oscillate from a bright state, where it

emits photons, to a dark state where it doesn’t emit photons. If a photon is detected

at a certain time, then the dot must be in a bright state at that moment. It is more

likely that for times close to this detection event, the dot will still be in a bright state.

Hence, the probability of detecting a photon a time τ later is enhanced for shorter

times. Because of this blinking effect it is important to normalize the central peak

by a far off side peak, were the blinking effect is averaged out. This results in a g(2)

5.2. QUANTUM CRYPTOGRAPHY WITH A QUANTUM DOT 95

of 0.14, indicating nearly an order of magnitude suppression in multi-photon states

relative to Poisson light.

5.2 Quantum cryptography with a quantum dot

Having characterized the source, it can now be used to exchange a raw quantum key.

The experimental setup for implementing the BB84 protocol is shown in figure 5.8.

The same collection optics and spectrometer are used to isolate the emission resonance

of the quantum dot. An electrooptic modulator is used to prepare the polarization

state of each photon before it enters the channel. A data generator, whose signal

is amplified by a high power amplifier, drives the modulator. The data generator is

synchronized to the Ti-Sapphire laser pulse, and produces a random 4 level signal

corresponding to the four different polarization states in the BB84 protocol. The

quantum channel is a 1m free space propagation. Bob’s detection apparatus is com-

posed of a 50-50 beamsplitter, which partitions each photon randomly to one of two

polarization analyzers. Both Alice and Bob share a common clocking signal from the

data generator. Each of Bob’s detection events is recorded by a time-interval ana-

lyzer (TIA), together with a time stamp of the event relative to the common clock. A

detection is also used to generate a logic pulse (containing no information about the

detection result) which triggers a second TIA in Alice’s apparatus. This TIA records

the polarization state which was prepared, along with a time stamp that can be used

for later comparison with Bob’s data.

To verify that communication is being properly implemented, the data generator

is set to create a random number pattern. A long stream of qubits is then exchanged.

A detection correlation between the state of the data generator and Bob’s detection

events is then performed. The result of this data correlation is shown in Figure 5.9.

When Bob measures in the same basis that Alice sent, the data is well correlated.

However, if Bob measures in an incompatible basis the measurement results are un-

correlated with Alice’s transmission, as expected. The central diagonal of the figure

represents error events, where Alice sent one polarization, and Bob detected the or-

thogonal polarization. These error events are caused by imperfect extinction ratio


HeCryostat

QD

Ti:Sapphire Laser

SM fiberGrating

SpecSlit

Amp

EOM

Det 2

Det 1

Det 3

Det 4

TIA TIA DataGen

Channel

Var.Atten

Figure 5.8: Experimental setup for implementing BB84 with quantum dot photonsource.


Bob

H

Bob

V

Bob

R

Bob

L

Alice

H

Alice

V

Alice

R

Alice

L

0

0.1

0.2

0.3

0.4

0.5

Figure 5.9: Data correlation between Alice and Bob.

of the polarization optics, as well as bias drift in the modulator. From the central

diagonal, the bit error rate is calculated to be 2.5%.

In order to correct the errors in the transmission, the error correction algorithm

described in [25] is implemented. In this algorithm, Alice and Bob’s strings are broken

up into blocks. The parity of each block is compared. In the blocks where the parities

don’t match, a bisective search is performed to find the error and correct it. This

algorithm was able to find all of the errors while operating within 25% of the Shannon

limit.

After error correction, privacy amplification is performed to generate the final

key. The compression function is formed by taking random parity blocks of the

error corrected key. The amount of compression required is given by Eq. 4.43. The

parameters e and κ are experimentally measured. For the measured error rate and

g(2), the key must be compressed by about 60%, yielding a final communication rate


Figure 5.10: Comparison between attenuated laser and quantum dot single photonsource.

of 25kbits/s. The security parameters s and t are selected to be 250 bits each. This

makes Eve’s mutual information on the final key 10−70.

It is important to compare the performance of our quantum cryptography system

to those based on more conventional sources such as attenuated lasers. To do this, an

attenuated Ti:Sapphire laser is used as a second source of photons for the quantum

cryptography system. The performance of the system using the laser, with measured

g(2) = 1, to the performance using the quantum dot with g(2) = 0.14, can then be

compared. The communication rates with both sources are experimentally measured

as a function of channel loss. The channel loss is adjusted by a variable attenuator

which is inserted into the quantum channel. The results of the comparison are shown

in Figure 5.10. At low loss levels the communication rate of the attenuated laser is

higher because a laser starts out with a macroscopically large number of photons,

which can be attenuated to any desired average. This is in contrast to the quantum

dot which is limited by the device efficiency and losses in subsequent optics. How-

ever, at higher channel losses the laser emits too many multi-photon states causing

a more rapid decrease in communication. At around 16dB the quantum dot begins


Alice Key Bob Keyb)

0 50 100 150 200 2500

50

100

150

200

250

300

350

400

Pixe l Va lue

# pi

xels

0 50 100 150 200 2500

500

1000

1500

2000

2500

# pi

xels

P ixe l Value

Original Message Encrypted Message

a)

Figure 5.11: Demonstration of one time pad encryption. The message is a 140x141pixel bitmap of Stanford’s memorial church, approximately 20kilobyte in length. a,a 20kilobyte key is exchanged over the quantum cryptography system and used toencode the message. The encoded message looks like white noise to anyone who doesnot possess the key. Decryption allows perfect recovery of the original message. b,a pixel value histogram of the original and encrypted message. The original messageshows definite structure, while the distribution for the encrypted message appearsflat, reminiscent of white noise.

to outperform an attenuated laser. Above 23dB of loss secure communication is no

longer possible with the laser, while the quantum dot source can withstand channel

losses of about 28dB. This demonstrates the security advantage of this device in the

presence of channel losses.

Finally, it is demonstrated that the system can be used to exchange a real message

by implementing the Vernam cipher described in chapter 2. Figure 5.11 shows how

this is done. A 140x141, 256 color pixel bitmap of Stanford’s Memorial Church serves

as the message. The size of the message is roughly 20 kbytes. The cryptography

system is used to exchange a 20 kilobyte key. Alice uses her copy of the key to

100CHAPTER 5. QUANTUM CRYPTOGRAPHY WITH SUB-POISSON LIGHT

do a bitwise exclusive OR operation with every bit of the message. The resulting

encrypted message looks like white noise to anyone who does not posses a copy of the

key, as shown in the figure. This is further illustrated by the pixel value histograms

shown in panel b of the figure. The pixel value histogram of the message shows

clear structure. The histogram of the encoded message, on the other hand, appears

flat, reminiscent of white noise. Bob decodes the encrypted message by performing

a second bitwise exclusive OR using his copy of the key. This faithfully reproducing

the original message, without any pixel errors.

Chapter 6

The Visible Light Photon Counter

One of the main tools in the upcoming chapters is the Visible Light Photon Counter

(VLPC). The VLPC is a relatively new concept in single photon detection which

features many advantages over more conventional photon counters such as avalanche

photodiodes (APDs) and photomultiplier tubes(PMTs). These advantages include

high quantum efficiency, low pulse height dispersion, and multi-photon counting ca-

pability.

This chapter gives a detailed account of the operation principle and advantages

of the VLPC. Although the VLPC has many advantages, it also has some disadvan-

tages. The main disadvantage is that the VLPC is difficult to use. It requires 6K

operation temperature as well as shielding from room temperature thermal photon.

The cryogenic system for implementing this will be described.

6.1 VLPC operation principle

Figure 6.1 shows the structure of the VLPC detector. Photons are presumed to come

in from the left. The VLPC has two main layers, an intrinsic silicon layer and a

lightly doped arsenic gain layer. The top of the intrinsic silicon layer is covered by

a transparent electrical contact and an anti-reflection coating. The bottom of the

detector is a heavily doped arsenic contact layer, which is used as a second electrical

contact.

101

102 CHAPTER 6. THE VISIBLE LIGHT PHOTON COUNTER

Contact Region and Degenerate Substrate

DriftRegion

GainRegion

IntrinsicRegion

TransparentContact

Anti-reflectionCoating

Visible Photon0.4 mm < l < 1.0 mm

e

e

e h

D+

D+

+V

Contact Region and Degenerate Substrate

DriftRegion

GainRegion

IntrinsicRegion

TransparentContact

Anti-reflectionCoating

Visible Photon0.4 mm < l < 1.0 mm

e

e

e

e

e h

D+

D+

+V

Figure 6.1: Schematic of the structure of the VLPC detector.

A single photon in the visible wavelengths can be absorbed either in the intrinsic

silicon region or in the doped gain region. This absorption event creates a single

electron-hole pair. Due to a small bias voltage (6-7.5V) applied across the device, the

electron is accelerated towards the transparent contact while the hole is accelerated

towards the gain region. The gain region is moderately doped with As impurities,

which are shallow impurities lying only 54meV below the conduction band. Because

the device is cooled to an operation temperature of 6-7K, there is not enough ther-

mal energy to excite donor electrons into the conduction band. These electrons are

effectively frozen out. However, when a hole is accelerated into the conduction band

it easily impact ionizes these impurities, kicking the donor electrons into the conduc-

tion band. These electrons can create subsequent impact ionization events resulting

in avalanche multiplication.

One of the nice properties of the VLPC is that, when an electron is impact ionized

from an As impurity, it leaves behind a hole in the impurity state, rather than in the

valence band as in the case of APDs. The As doping density in the gain region

is carefully selected such that there is partial overlap between the energy states of

adjacent impurities. Thus, a hole trapped in an impurity state can travel through

conduction hopping, a mechanism based on quantum mechanical tunneling. This

conduction hopping mechanism is slow, so the hole never acquires sufficiency kinetic

energy to impact ionize other As sites. The only carrier that can create additional

impact ionization events is the electron kicked into the conduction band. Thus,

6.2. CRYOGENIC SYSTEM FOR OPERATING THE VLPC 103

the VLPC has a natural mechanism for creating single carrier multiplication, which

is known to significantly reduce multiplication noise [77]. The multiplication noise

properties of the VLPC will be discussed in further detail in a later section.

One of the disadvantages of using shallow As impurities for avalanche gain is that

these impurities can easily be excited by room temperature thermal photons. IR

photons with wavelengths of up to 30µm can optically excite an impurity. These

excitations can create extremely high dark count levels. The bi-layer structure of the

VLPC helps to suppress this. A visible photon can be absorbed both in the intrinsic

and doped silicon regions. An IR photon, on the other hand, can only be absorbed

in the doped region, as its energy is smaller than the bandgap of intrinsic silicon.

Thus, the absorption length of IR photons is much smaller than visible photons.

This suppresses the sensitivity of the device to IR photons to about 2%. Despite

this suppression, the background thermal radiation is very bright, requiring orders of

magnitude of additional suppression. In the next section we will discuss how this is

achieved.

6.2 Cryogenic system for operating the VLPC

In order to operate the VLPC, it must be cooled down to cryogenic temperatures

to achieve carrier freezeout of the As impurities. It must also be shielded from the

bright room temperature thermal radiation which it is partially sensitive to. This is

achieved by the cryogenic setup shown in Figure 6.2.

The VLPC is held in a helium bath cryostat. A small helium flow is produced

from the helium bath to the cryostat cold finger by a needle valve. The helium bath is

surrounded by a nitrogen jacket for radiation shielding. This improves the helium hold

time. A thermal shroud, cooled to 77K by direct connection to the nitrogen jacket,

covers the VLPC and low temperature shielding. This shroud is intended to improve

the temperature stability of the detector by reducing the thermal radiation load. A

hole at the front of the shroud allows photons to pass through. The detector itself is

encased in a 6K shield made of copper. The shield is cooled by direct connection to

the cold plate of the cryostat. The front windows of the 6K radiation shield, which


AcrylicWindows

RoomTempWindow

77K shield

6K shield

VLPC

Retro-reflector

Room TempVacuum Jacket

Figure 6.2: Schematic of cryogenic setup for VLPC.

are also cooled down to this temperature, are made of acrylic plastic. This material

is highly transparent at optical frequencies, but is almost completely opaque from

2-30µm. The acrylic windows provide the required filtering of room temperature IR

photons for operating the detector. Sufficient extinction of the thermal background

is achieved using 1.5-2 cm of acrylic material. In order to eliminate reflection losses

from the window surfaces, the windows are coated with a broadband anti-reflection

coating at 532nm. Room temperature transmission measurements indicate a 97.5%

transmission efficiency through the acrylic windows.

The surface of the VLPC is anti-reflection coated for 550nm, which is close to

our intended operating wavelength of 532nm. Nevertheless, due to the large index

mismatch between silicon and air, there is still substantial reflection losses on the

order of 10%, even at the correct wavelength. In order to eliminate these reflection

losses, the detector is rotated 45 degrees to the direction of the incoming light. A

spherical refocussing mirror, with reflectance exceeding 99%, is used to redirect any

6.3. QUANTUM EFFICIENCY AND DARK COUNTS OF THE VLPC 105

reflections back onto the detector surface. A photon must reflect twice off of the

surface in order to be lost. This reduces the reflections losses to less than 1%.

The VLPC features high multiplication gains of about 30,000 electrons per photo-

ionization event. Nevertheless, this current must be amplified significantly in order

to achieve sufficiently large signal for subsequent electronics. Two different types

of amplifier configurations have been implemented. The first is a high bandwidth

configuration, consisting of a commercial cryogenic pre-amplifier, with an operating

bandwidth of 30 − 500MHz, followed by additional commercial room temperature

RF amplifiers. Such a configuration creates a 120mV pulse with a 3ns duration

when using 62dB of amplifier gain. This high-bandwidth configuration is used to

characterize the performance of the VLPC. The second amplifier scheme is a charge

integrating configuration. A commercial charge integrating amplifier is used, followed

by a pole-zero canceller and a commercial Ortec amplifier with adjustable gain. The

charge integrating configuration is a low noise technique which allows photon counting

over large time intervals with minimal amplifier input noise. This scheme will be

used in the upcoming chapters describing non-classical statistics and photon number

generation by conditional post-selection.

6.3 Quantum efficiency and dark counts of the VLPC

The quantum efficiency (QE) of the VLPC at 650nm wavelength has been previously

measured to be as high as 88% [19]. The dark counts at this peak QE were 20,000 1/s.

The work shown here uses a different operating wavelength of 532nm, and a different

cryogenic setup. Therefore, another measurements of dark counts and QE at this

wavelength and using the current cryogenic setup is presented.

The setup for measuring the quantum efficiency of the VLPC is shown in Fig-

ure 6.3. A helium neon laser with an output wavelength of 543nm is used as a light

source for the measurement. An intensity stabilizer is used to stabilize the output

of the laser to within about 0.1%. A 50-50 beamsplitter sends part of the laser to

a calibrated PIN diode to measure the power. The power reading from the diode is

accurate to within a 2% calibration error. This power reading is used to calculate the


Attenuators250mmlens

VLPC

Amps

Disc/Counter

PINDiode

50-50BSP

Iris

IntensityStabilizer

HeliumNeon Laser543nm

Figure 6.3: Experimental setup to measure quantum efficiency of the VLPC.

photon flux N , in units of photons per second. This is given by the relation

N =λP

hc, (6.1)

where λ is the wavelength of the laser, P is the power measured by the PIN diode, h

is Planke’s constant, and c is the velocity of light in vacuum.

The laser is attenuated by a series of carefully calibrated neutral density (ND)

filters down to a flux of approximately 20,000 cps. The attenuation required for

this is on the order of 10−9. This flux is sufficiently small to ensure linearity of the

VLPC. At count rates exceeding 105 cps, the efficiency of the VLPC will begin to

drop due to dead time effects. The efficiency of the VLPC is measured by recording

the count rates of the detector, which we label Nc, as well as the background Nd. The

backgrounds are measured by blocking out the laser. The counts are compare the

rate calculated from the power reading on the PIN diode and the attenuation from

the ND filters. The measured efficiency η is given by

η =Nc −Nd

αN, (6.2)

where α is the transmission efficiency of the ND filters.

Figure 6.4 shows the measured quantum efficiency of the VLPC as a function

of applied bias voltage across the device. Efficiencies are given for several different

operating temperatures. At 7.4V bias the VLPC attains its highest quantum efficiency

of 85%. As the bias voltage is decreased the quantum efficiency also decreases. The

reason for this is that, at lower bias voltages, electrons created by impact ionization

6.3. QUANTUM EFFICIENCY AND DARK COUNTS OF THE VLPC 107

of the initial hole are less likely to accumulate sufficient kinetic energy in the gain

region to trigger an avalanche. The bias voltage cannot be increased beyond 7.4V.

Beyond this bias the VLPC breaks down, resulting in large current flow through the

device. This breakdown is attributed to direct tunnelling of electrons from impurity

sites into the conduction band.

One will notice that as the temperature is decreased, more bias voltage is required

to achieve the same quantum efficiency. This effect is attributed to a temperature

dependance of the dielectric constant of the device, which results in a change in the

electric field intensity in the gain region of the VLPC. As the temperature is decreased,

the dielectric constant is increasing, requiring higher bias voltage to achieve the same

electric field intensity. This conjecture is supported by the measurements shown in

Figure 6.5. This figure plots the quantum efficiency as a function of dark counts,

instead of bias voltage. Data is shown for the different temperatures. Increased bias

voltage results not only in increased quantum efficiency, but also in increased dark

counts. Increasing the temperature also increases both quantum efficiency and dark

counts. But when the quantum efficiency is plotted as a function of dark counts, as

is done in Figure 6.5, the data for different temperatures all lie along the same curve.

This suggests that the quantum efficiency and dark counts both depend on a single

parameter, the electric field intensity in the gain region. Changing the temperature

and bias voltage effects these two numbers by effecting this parameter. The figure

shows that the maximum quantum efficiency of 85% is achieved at a dark count rate

of roughly 20,000 cps.

In order to infer the efficiency of the VLPC, all other losses in the detection

system must be characterized. The acrylic windows are a big source of loss in the

system. Although at room temperature they were measured to have a transmission

efficiency of 97.5%, the performance of the windows degrades appreciably when they

are cooled to cryogen temperatures. Reflectance measurement of the windows at low

temperature indicate a 7% reflection loss. In addition to this loss, there a reflection

loss of 1% due to the VLPC, despite the retro-reflector. Other effects such as detector

dead time and beam focussing should contribute only negligibly small corrections to

the device efficiency. Thus, the efficiency of the VLPC detector itself is estimated to


0.600

0.650

0.700

0.750

0.800

0.850

0.900

6.4 6.6 6.8 7 7.2 7.4

Bias (V)

Qu

an

tum

Eff

icie

nc

y

6.3

6.4

6.5

6.6

6.7

Figure 6.4: Quantum efficiency of VLPC vs. bias voltage for different temperatures.

0.500

0.550

0.600

0.650

0.700

0.750

0.800

0.850

0.900

100 1000 10000 100000

Dark Counts (1/s)

Qu

an

tum

Eff

icie

nc

y

6.3K

6.4K

6.5K

6.6K

6.7K

Figure 6.5: Quantum efficiency of VLPC vs. dark counts for different temperatures.

6.4. NOISE PROPERTIES OF THE VLPC 109

be 93% at 543nm wavelengths.

6.4 Noise properties of the VLPC

When a photon is absorbed in a semi-conductor material, it creates a single electron

hole pair. The current produced by this single pair of carriers is, in almost all cases,

too weak to observe due to thermal noise in subsequent electronic components. Sin-

gle photon counters get around this problem by using an internal gain mechanism to

multiply the initial pair into a much greater number of carriers. Avalanche photodi-

odes achieve this by an avalanche breakdown mechanism in the depletion region of

the diode. Photomultipliers instead rely on successive scattering off of dynodes. The

VLPC achieves this gain by impact ionization of shallow arsenic impurities in silicon.

All of the above gain mechanism have an intrinsic noise process associated with

them. That is, a single ionization event does not produce a deterministic number of

electrons. The number of electrons the device emits fluctuate from pulse to pulse.

This internal noise is referred to as multiplication noise, or gain noise. The amount of

multiplication noise that a device features strongly depends on the avalanche mech-

anism. The noise is typically quantified by a parameter F , called the excess noise

factor (ENF). The ENF is mathematically defined as

F =〈M2〉〈M〉2

, (6.3)

where M is the number of electrons produced by a photo-ionization event, and the

brackets notation represents statistical ensemble averages. Noise free multiplication

is represented by F = 1. In this limit, a single photo-ionization event creates a

deterministic number of additional carriers. Fluctuations in the gain process will

result in an ENF exceeding 1.

The noise properties of an avalanche photo-diode are well characterized. The first

theoretical study of such devices was presented by McIntyre in 1966 [77]. McIntyre

studied avalanche gain in the ”Markov” limit. In this limit, the impact ionization

probability for a carrier in the depletion region is a function of the local electric

field intensity at the location of the carrier. In this sense, each impact ionization


event is independent of past history. Under this assumption the ENF of an APD

was calculated. The ENF depends on the number of carriers that can participate in

the avalanche process. If both electrons and holes are equally likely to impact ionize,

then F ≈ 〈M〉. In the large gain limit the ENF is very big. Restricting the impact

ionization process to only electrons or holes significantly reduces the multiplication

noise. In this ideal limit, one obtains F = 2. This limit represents the best noise

performance achievable within the Markov approximation.

PMTs are known to have better noise characteristics than APDs. The ENF of a

typical PMT is around 1.2. This suppressed noise is because, in a PMT, a carrier

is scattered off of a fixed number of dynodes. The only noise in the process is the

number of electrons emitted by each dynode per electron.

The multiplication noise properties of the VLPC have been previously studied.

Theoretical studies of the multiplication noise have predicted that the VLPC features

nearly noise free avalanche multiplication [78]. This is due to three dominant effects.

First, because only electrons can cause impact ionization, the VLPC features a natural

single carrier multiplication process. Second, the VLPC does not require high electric

field intensities to operate. This is because impact ionization events occur off of

shallow arsenic impurities which are only 54meV from the conduction band. Thus,

carriers do not have to acquire a lot of kinetic energy in order to scatter the impurity

electrons. Because of the lower electric field intensities, a carrier requires a fixed

amount of time before it can generate a second impact ionization. This delay time

represents a deviation from the Markov approximation, and is predicted to suppress

the multiplication noise [78]. A third factor is that the positive charged impurity

holes drift very slowly, relative to the conduction band electrons. This builds up a

positive space charge region in the device which helps contain the avalanche. The

ENF of the VLPC has been experimentally measured to be less than 1.03 in [21].

Thus, the VLPC features nearly noise free multiplication, as predicted by theory.

This low noise property will play an important role in multi-photon detection.

6.5. MULTI-PHOTON DETECTION WITH THE VLPC 111

6.5 Multi-photon detection with the VLPC

The nearly noise-free avalanche gain process of the VLPC opens up the door to

perform multi-photon detection. When two photons are detected by the VLPC, the

number of electrons emitted is expected to be twice that of a single photon detection.

If the photons arrive within a time interval which is much shorter than the electronic

time scales of the detection system, one expects to observe a detection pulse which is

twice as high.

In the limit of noise free multiplication, this would certainly be the case. A single

detection event would create M electrons, while a two photon event would create 2M

electrons. Higher photon numbers would follow the same pattern. After amplification,

the area or height of the detector pulse would allow perfect discrimination of the

number of detected photons, even if they arrive on extremely short time scales.

In the presence of multiplicatiom noise, the situation becomes more complicated.

The pulse height of a one photon pulse will fluctuate, as will that of a two photon

pulse. There becomes a finite probability that only one photon is detected, but due

to multiplication noise the height of the pulse appears to be more consistent with a

two photon event, and vice versa. The ability to discriminate the number of detected

photons becomes a question of signal to noise ratio.

There are ultimately two effects which will limit multi-photon detection. One is

the quantum efficiency of the detector, denoted as η. The probability of detecting n

photons is given by ηn, assuming detector saturation is negligible. Thus, the detection

probability is exponentially small in η. For larger n this may produce extremely low

efficiencies. The second limitation is the electrical detection noise, as previously

discussed. There are two contributions to the electrical noise. One is the excess

noise of the detector, and the other is electrical noise originating from amplifiers and

subsequent electronics. The latter can in principle be eliminated by engineering ultra-

low noise circuitry. The former, however, is a fundamental property of the detector

which cannot be circumvented, short of engineering a different detector with better

noise properties.

In the absence of detection inefficiency and amplifier noise, the multiplication noise


will ultimately put a limit on how many photons can be discriminated. Defining σm

and the standard deviation of the multiplication gain, the fluctuations of an n photon

peak will be given by√nσm. This is because the n photon pulse is simply the sum

of n independent single photon pulses from different locations of the VLPC active

area. Summing the pulses also causes the variance to sum, resulting in the buildup

of multiplication noise. The mean pulse height separation between the n photon

peak and the n − 1 photon peak, however, is constant. It is simply proportional to

〈M〉, the average multiplication gain. At some sufficiently high photon number, the

fluctuations in emitted electrons will be so large that there is little distinction between

an n and n−1 photon event. One can arbitrarily establish a cutoff at the point where

the fluctuations in emitted electrons is equal to the mean separation between the n

and n − 1 photon peaks. Using this definition, the maximum photon number that

can be discriminated is

Nmax =1

F − 1. (6.4)

The above condition indicates that even an ideal APD with F = 2 cannot discriminate

between 1 and 2 photon events. A PMT with F = 1.2 could potentially be useful

for up to 5 photon detection, but due to their low quantum efficiency (∼0.2), this

is typically impractical. The VLPC, with F < 1.03 could potentially detect more

that 30 simultaneous photons. Furthermore it could potentially do this with 93%

detection efficiency. However, this limit is difficult to approach due to electronic

noise contribution from subsequent amplifiers.

6.6 Characterizing multi-photon detection capa-

bility

The multi-photon detection capability of the VLPC has been previously studied.

Early studies used long light pulse excitations, with poor electronic time resolution

so that multiple photons appeared as a single electronic pulse [79]. Later studies

used twin photons generated from parametric down-conversion, which arrive nearly

simultaneous, to investigate multi-photon detection [20]. These studies restricted

6.6. CHARACTERIZING MULTI-PHOTON DETECTION CAPABILITY 113

their attention to one and two photon detection. Higher order number states were

not considered.

The experiment described below measures the photon number detection capabil-

ity of the VLPC when excited by a large number of simultaneous photons. Figure 6.6

shows the experimental setup. A Ti:Sapphire laser, emitting pulses of about 3ps du-

ration, is used. The duration of the optical pulses are much shorter than the electrical

pulse of the VLPC detector, which is 2ns. A pulse pick is used to down-sample the

repetition rate of the laser from 76MHz to 15KHz. This is done in order to avoid sat-

uration of the detector. A synchronous countdown module, which generates the pulse

picking signal, is also used to trigger a boxcar integrator. The output of the VLPC is

amplified by high bandwidth RF amplifiers. The first amplifier is a cryogenic module,

cooled to 4K by direct thermalization to the helium bath of the cryostat. This helps

to minimize thermal electrical noise, which is important for multi-photon detection.

The noise figure of the amplifier is about 0.2. Subsequent room temperature RF

amplifiers are used for additional gain. The amplified signal is integrated by a boxcar

integrator. The integrated value of a pulse should be proportional to the number of

electrons emitted by the detector, as long as amplifier saturation is negligible. The

output of the boxcar integrator is digitized by an A2D converted, and stored on a

computer.

Figure 6.7 shows a sample oscilloscope pulse trace of a VLPC pulse after the room

temperature amplifiers. The output features an initial sharp negative peak of about

2ns full width at the half maximum, followed by a positive overshoot. This positive

overshoot is the result of the 30MHz high pass of the cryogenic amplifiers. Comparison

of the variance of the electrical fluctuations before the pulse to the minimum pulse

value indicates a signal to noise ration (SNR) of 27. The figure also illustrates the

integration window used by the boxcar integrator, which captures only the negative

lobe of the pulse.

In order to measure the multi-photon detection capability, the laser is attenuated

to about 1-5 detected photons per pulse. For each laser pulse, the output of the

VLPC is integrated and digitized. Figure 6.8 shows pulse area histograms for four

different excitation powers. The area is expressed in arbitrary units determined by


SyncCount

PulsePicker

Ti:Sapphire

VLPC

CryoAmp

RF Amp

lense250 mm

BoxcarInt.

Figure 6.6: Experimental setup to measure multi-photon detection capability of theVLPC.

-0.3

-0.2

-0.1

0

0.1

0.2

0.3

-30.0 -20.0 -10.0 0.0 10.0 20.0 30.0

Time (ns)

Vo

ltag

e(V

)

Integration

Window

SNR=27

Figure 6.7: Oscilloscope pulse trace of VLPC output after room temperature RFamplifiers.


the A2D converter. Because the pulse area is proportional to the number of electrons

in the pulse, the pulse area histogram is proportional to the probability distribution of

the number of electrons emitted by the VLPC. This probability distribution features

a series of peaks. The first peak is a zero photon event, followed by one photon,

two photons, and so on. In the absence of electronic noise and multiplication noise,

these peaks would be perfectly sharp, allowing perfect discrimination of the photon

number. Due to electronic noise however, the peaks become broadened and start

to partially overlap. The broadening of the zero photon peak is due exclusively to

electronic noise. Note that the boxcar integrator adds an arbitrary constant to the

pulse area, which is why the zero photon peak is centered around 450 instead of 0.

The one photon peak is broadened by both electronic noise and multiplication noise.

Thus, it is much broader than the zero photon peak. As the photon number increases,

the width of the pulses also increases due to buildup of multiplication noise. This

eventually causes the smearing out of the probability distribution at around seven

photons.

In order to numerically analyze the results, each peak is fit to a gaussian distri-

bution. Theoretical studies predict that the distribution of the one photon peak is a

bi-sigmoidal distribution, rather than a gaussian [78]. However, when the multiplica-

tion gain is large, as in the case of the VLPC, this distribution is well approximated

by a gaussian. This approximation is used because higher order number states are

sums of several single photon events. A gaussian distribution has the nice property

that a sum of gaussian distributions is also a gaussian distribution. In the limit of

large photon numbers this approximation is expected to improve due to the central

limit theorem.

The most general fit would allow the area, mean, and variance of each peak to

be independently adjustable. This allows too many degrees of freedom, which often

results in the optimization algorithm falling into a local minimum. To help avoid this,

the average of each peak is not independently adjustable. Instead, the averages are

required to be equally spaced, as would be expected from the detection model of the

VLPC. Thus, the average of the i’th peak, denoted xi, is determined by the relation

xi = x0 + i∆− i2α. (6.5)


400 600 800 1000 1200 14000

1000

2000

3000

4000

Pulse Area (AU)

Cou

nts

Data pointTotal FitSingle Peak

500 1000 15000

1000

2000

3000

4000

Pulse Area (AU)

Cou

nts

500 1000 15000

1000

2000

3000

4000

Pulse Area (AU)

Cou

nts

500 1000 15000

500

1000

1500

2000

Pulse Area (AU)

Cou

nts

01

2

3

4 5

a)

c)

b)

d)

Student Version of MATLAB

Figure 6.8: Pulse area spectrum from VLPC. The dotted lines represent the fitteddistribution of each photon number peak. The solid line is the total sum of all thepeaks. Diamonds denote measured data points.


In the above equation, x0 is the average of the zero photon peak, ∆ is the spacing

between peaks, and α is a small correction factor that can account for effects such

as amplifier saturation. These three parameters are all independently adjustable. In

all of the fits, α was much smaller the ∆ indicating the peaks are, for the most part,

equally spaced.

Figure 6.8 shows the results of the fits for each excitation intensity. The dotted

lines plot the individual gaussian distributions for the different photon numbers, and

the solid line plots the sum of all of the gaussians. The diamond markers represent the

measured data points. Table 6.1 shows the center value and standard deviation of the

different peaks in panel c of the figure. In order to do photon number discrimination, a

decision region must be established for each photon number state. This will depend,

in general, on the a-priori photon number distribution. The case of equal a-priori

probability is considered, which is the worst case scenario. The optimal decision

threshold between two consecutive gaussian peaks is given by the point where they

intersect. The value of this point can be easily solved, and is given by,

xd = xi +−σ2

i (xi+1 − xi) + σiσi+1

√(xi+1 − xi)2 − 2

(σ2i+1 − σ2

i

)ln σi

σi+1

σ2i+1 − σ2

i

. (6.6)

The probability of error for this decision is given by the area of all other photon

number peaks in the decision region. This probability is also shown in Table 6.1.

From the data one would like to infer whether the VLPC is being saturated at

higher photon numbers. If too many photons are simultaneously incident on the

Table 6.1: Results of fit for panel (c) of Figure 6.8.

Photon number Avg. Area Std. Dev. %Error0 0 10.6 0.011 135 24.8 1.12 275 31.7 3.43 416 35.3 6.14 561 39.0 8.55 709 42.2 10.66 859 44.5 11.3


detector, the detector surface may become depleted of active area. This would result

in a reduced quantum efficiency for higher photon numbers. In order to investigate

this possibility, an additional constraint is added to the fit that the pulse areas must

scale according to a Poisson distribution. Since the laser is a Poisson light source, the

detection statistics are expected to have the same distribution. However, detector

saturation causes a number dependant loss. This would result in deviation from

Poisson detection statistics.

Figure 6.9 plots the result of the fit when the peak areas scale as a Poisson dis-

tribution. One can see that the imposition of Poisson statistics does not change the

fitting result in an appreciable way. Thus, it is inferred that detector saturation is

not a strong effect at the excitation levels being used.

The effect of multiplication noise buildup on the pulse height spectrum can be

investigated from the previous data. The pulse area variance is expected to be a

linearly increasing function of photon number. This is consistent with the independent

detection model, in which an n photon peak is a sum of n single photon peaks coming

from different areas of the detector. To investigate the validity of this model, the

variance as a function of photon number is plotted in Figure 6.10. The electrical

noise variance, given by the zero photon peak, is subtracted. The variance is fit to a

linear model given by

σ2i = σ2

0 + iσ2M . (6.7)

In the above model, i is the photon number, σ2M is the variance contribution from

multiplication noise, and σ20 is a potential additive noise term. From the data, one

obtain the values σ2M = 276, and σ2

0 = 246.

A surprising aspect of this result is the large value of σ20. Since electrical noise

has been subtracted, it would be expected that the only remaining contribution to

the variance is multiplication noise. If this were true, the value of σ0 would be very

small. Instead, the additive noise term is calculated to be nearly equal to that of σ2m.

This indicates that the electrical noise is higher when the VLPC is firing, as opposed

to when its not. Further investigation is required to determine whether this is an

inherent property of the detector, or is due to subsequent amplifiers. If the latter is

true, it may be possible to eliminate this noise contribution and obtain better photon


400 600 800 1000 1200 14000

1000

2000

3000

4000

Pulse Area (AU)

Cou

nts

DataPoisson FIt

500 1000 15000

1000

2000

3000

4000

Pulse Area (AU)

Cou

nts

500 1000 15000

1000

2000

3000

4000

Pulse Area (AU)

Cou

nts

500 1000 15000

500

1000

1500

2000

Pulse Area (AU)

Cou

nts

a) b)

c) d)

⟨ n ⟩ = 2.17 ⟨ n ⟩ = 3.15

⟨ n ⟩ = 3.88 ⟨ n ⟩ = 4.94


Figure 6.9: Pulse area spectrum fit to Poisson constraint on normalized peak areas.


0 2 4 6 80

500

1000

1500

2000

Photon Number

Peak

Var

ianc

e (A

u)

dataLinear Fit

σN2 = 248 + N × 276


Figure 6.10: Variance as a function of photon number detection. The linear relationis consistent with the independent detection model.


number resolution.

The above measurements of variance versus photon number gives a very accurate

measurement of the excess noise factor F of the VLPC [21]. Previous measurements

of F for the VLPC have determined that it is less than 1.03 [21], which is nearly

noise free multiplication. This number was obtained by measuring the variance of

the 1 photon peak, and comparing to the mean. However, it is difficult to separate

the electrical noise contribution from the internal multiplication noise using this tech-

nique. Thus, the measurement ultimately determines only an upper bound of F . By

considering how the variance scales with photon numbers, as was done in Figure 6.10,

the multiplication noise can be accurately differentiated from additive electrical noise.

This determines an exact value for the excess noise factor. From the measurement of

σ2M and 〈M〉, one obtains an excess noise factor of F = 1.015.

Chapter 7

Non-classical statistics from

parametric down-conversion

Parametric down-conversion (PDC) has already been introduced in section 4.3.4. The

process is discussed in more detail in this chapter. First, the non-classical nature of

PDC is theoretically described. Tests of classical theory are discussed which can

be used demonstrate that parametric down-conversion is a non-classical light source.

These tests, which require the photon number detection capability of the VLPC, are

experimentally demonstrated.

7.1 Basics of parametric down-conversion

When a photon propagates inside a material that lacks inversion symmetry, there is

a finite probability that it can spontaneously split into two photons of lower energy.

This is caused by the non-linearity in the dipole moment of the material which, for

most systems, is an extremely weak effect. The process by which this photon splitting

occurs is known as parametric down-conversion.

Parametric down-conversion is often observed when exciting a non-linear crystal

with a bright pump field. A pump photon will spontaneously split into two photons

which, for historical reasons, are referred to as the signal photon and the idler photon.

The energy and momentum of the signal and idler are determined by energy and

122

7.1. BASICS OF PARAMETRIC DOWN-CONVERSION 123

momentum conservation rules. Specifically,

ωp =ωs + ωp (7.1a)

kp =ks + kp (7.1b)

The above equations are referred to as phase matching conditions. In a crystal with

normal dispersion there are generally two ways to satisfy the phase matching con-

ditions. They are known as Type I and Type II phase matching. In Type I, the

polarization of the signal and idler are the same, while in Type II the signal and idler

have orthogonal polarizations.

In most cases the energy and momentum of the signal and idler can be selected

by tuning the optical axis of the non-linear crystal. Spatial and spectral filters are

often employed to select a narrow range of momentums and energies for the down-

converted twins. The operating condition where the signal and idler have the same

energy is referred to as degenerate down-conversion. If they have different energies the

process is referred to as non-degenerate. Similarly, if both signal and idler propagate

in the same direction as the pump, this is referred to as collinear phase matching.

In non-collinear phase matching the signal, idler, and pump all travel in different

directions.

The theory of single mode parametric down-conversion has already been discussed.

The interaction hamiltonian for a two-mode parametric down-converter is

HI = ihχ(2)V ei(ω−ωa−ωb)ta†b† + h.c. (7.2)

where a and b are distinguishable modes for the signal and idler photon respectively.

The amplitude V represents the pump field, which is considered bright enough to

treat classically. The result of this interaction is the number correlated state

|ψ〉 =1

coshχ

∞∑n=0

tanhn χ|n〉a|n〉b. (7.3)

In most cases it is difficult to isolate a single mode for the signal and idler using

spatial and spectral filters. Thus, the actual field is a sum of many modes, each of

which satisfy the phase-matching conditions. In the limit of a large number of modes,

the photon pair distribution approaches a Poisson distribution, instead of the thermal

distribution shown above.

124CHAPTER 7. NON-CLASSICAL STATISTICS FROM PARAMETRIC DOWN-CONVERSION

7.2 Non-classical photon statistics

In parametric down-conversion, the signal and idler photons always come in pairs.

Thus, the total number of photons emitted by this process will always be an even

number over a finite time scale. Such a state is non-classical in the sense that its

photon number distribution cannot be expressed as a mixture of Poisson distributions.

In order to test this experimentally, an inequality must be derived which distinguishes

such a state from all classical states.

The inequality presented here relies only on the photon number distribution.

Therefore it constitutes a very direct and conceptually simple demonstration of non-

classical light statistics. However, the experimental demonstration of this effect is not

trivial. It requires high photon detection efficiency, as well as the ability to discrimi-

nate photon number states. Fortunately, as we have shown, the Visible Light Photon

Counter (VLPC) has the ability to do this.

Consider the output of parametric down-conversion, where the probabilities P1

and P3 are zero. Define Γ as

Γ =P2

P1 + P2 + P3

, (7.4)

For parametric down-conversion, Γ = 1. For a Poisson photon number distribution,

it can be shown that this ratio has a maximum value Γ = 3/(3 + 2√

6) ' 0.379.

The Poisson distribution that saturates this bound has average photon number n =√

6. However, one can show that this optimal value holds not only for a Poisson

distribution, but for any weighted sum of Poisson distributions. Consider a weighted

sum Pn = αPmaxn + (1− α)P ′

n of two Poisson distributions Pmaxn and P ′

n, where Pmaxn

has average photon number n =√

6, and P ′n is any other Poisson distribution. The

ratio Γ for this weighted sum is

Γ =αPmax

2 + (1− α)P ′2

α(Pmax1 + Pmax

2 + Pmax3 ) + (1− α)(P ′

1 + P ′2 + P ′

3). (7.5)

Because Pmaxn maximizes Γ for any single Poisson distribution, the condition

x′

y′<x

y⇒ αx+ (1− α)x′

αy + (1− α)y′<x

y, ∀ α < 1 , (7.6)

7.3. OBSERVATION OF NON-CLASSICAL STATISTICS 125

proves that Γ ≤ 3/(3 + 2√

6). Thus, no sum of Poisson distributions can give rise to

a distribution with Γ > Γclassical

All classical light fields will lead to statistics that can be expressed as weighted

sums of Poisson photon number states. Thus, the classical theory of light predicts

that the inequality

Γ ≤ 3

3 + 3√

6, (7.7)

cannot be violated. In contrast, one expects that light from parametric down-

conversion will lead to a violation of this condition, which can be demonstrated by

simply measuring P1, P2, and P3.

In the presence of imperfect detection efficiency, however, this is not always true.

Consider a parametric down-conversion experiment in which the pump is sufficiently

weak that the probability of generating more than one photon pair is very small. In

this case the ratio in Eq. 7.4 is given by Γ = η/(2 − η), where η is the detection

efficiency. One will not observe a violation of the inequality unless η ≥ 3/(3 +√

6) ≈0.55.

7.3 Observation of non-classical statistics

The experimental setup for observing non-classical statistics from parametric down-

conversion is shown in Figure 7.1. The pump source for the down-conversion process

is the 266nm fourth harmonic of a Q-switched Nd:YAG laser, firing at a 45KHz

repetition rate. The pulses are approximately 30ns in duration. A dispersion prism

is first used to separate the residual second harmonic from the fourth harmonic. The

second harmonic is illuminated onto a high speed photo-diode with a 1ns rise time.

The output of the diode is used as a triggering signal. The fourth harmonic is used

as a pump for the parametric down-conversion. The pump is slightly focussed before

the crystal. The focus is selected so that the beam waste is smallest at the collection

iris in front of the detector. This configuration maximizes the collection efficiency, by

producing a sharp two-photon image at the collection point.

The laser pumps a beta barium borate (BBO) crystal, whose optic axis is set

for Type I collinear degenerate phase-matching. This occurs when the optic axis is


triggersignal Boxcar integrator

diode

prismNd:YAG4th Harmonic266nm

Atten.PBSl/2plate

2mlensIF

266nm

BBO

VLPC

lens

amplifiers

triggersignal Boxcar integrator

diode

prismNd:YAG4th Harmonic266nm

Atten.PBSl/2plate

2mlensIF

266nm

BBO

VLPC

500mmlens

amplifiers

Figure 7.1: Experimental setup for observation of non-classical counting statisticsfrom parametric down-conversion.

tilted 47.6 degrees from the plane normal to the propagation of the pump. The down-

conversion is separated from the pump by a brewster’s angle dispersion prism. The

down-converted photons are then collected by a 500mm lens and focussed onto the

VLPC detector. The electrical pulse from the VLPC is amplified by a series of room

temperature RF amplifiers. The amplified signal is then integrated by the boxcar

integrator, which is triggered by the signal generated from the photodiode.

Figure 7.2 shows the pulse area histogram when the pump power is set 1µW . At

this weak pump intensity, a single pump pulse will usually generate zero photons,

while a photon pair is generated with a small probability. The probability of gener-

ating more than one photon pair is very small. The figure focusses on the 1,2, and 3

photon detection peaks, which are the important ones for verification of non-classical

statistics. The photon number probability distribution is calculated by fitting each

peak to a gaussian. These areas are normalized by the total area of all the peaks.

The calculated probability distribution is shown in the inset. One can see that the

7.3. OBSERVATION OF NON-CLASSICAL STATISTICS 127

800 1000 1200 1400 1600 1800 2000 22000

1000

2000

3000

4000

5000

6000

7000

Pulse Area (AU)

Co

un

ts

1 2 30

0.05

0.1

Figure 7.2: Pulse area spectrum using 1µW pump power.

probability of 1 and 2 photon detection is nearly equal, but the probability of 3 pho-

ton detection is nearly zero. These probabilities are P1 = 0.0818, P2 = 0.0696, and

P3 = 0.0061, which yields Γ = 0.442, representing a 40 standard deviations violation

of the classical limit. This demonstrates the non-classical nature of parametric down

conversion.

The large 1 photon probability is due to losses from the detector and collection

optics. In the limit of low excitation, the 1 photon and 2 photon probability can be

used to calculate the detection efficiency, given by

η =2P2

P1

1 + 2P2

P1

. (7.8)

From the measurements it is calculated that the detection efficiency is 0.67. Using

the measured VLPC quantum efficiency of 0.85, the photon collection efficiency is

calculated to be 0.79.

Figure 7.3 shows the measured value of Γ as a function of pumping intensity.

The black line represents the classical limit. This limit is violated for a large range

of pumping intensities. At high pumping intensities Γ begins to drop. This is due

to an increase in the two pair creation probability, which, in the presence of losses,


0.2

0.25

0.3

0.35

0.4

0.45

0.5

0.1 1 10 100

Power (uW)

G

Figure 7.3: Measured value of Γ as a funtion of pump power. The black line representsthe classical limit.

will enhance the 3 photon detection probability. The parameter Γ also drops at low

pumping intensities. This drop is attributed to the dark counts of the VLPC. At low

pumping intensities the relative fraction of detection events originating from dark

counts becomes large. This enhances the 1 photon probability, which reduces the

value of Γ.

7.4 Reconstruction of photon number oscillations

The emitted output of parametric down-conversion features even odd oscillations, due

to the two photon nature of the process. These oscillations result in the non-classical

statistics discussed in the previous section. It would be nice to observe these oscil-

lations directly, using the photon counting capability of the VLPC. Unfortunately,

direct observation of the even-odd oscillations requires extremely high quantum effi-

ciencies.

Figure 7.4 demonstrates the problem. Panel (a) shows a typical distribution from

a multi-mode parametric down-conversion experiment. In such a case the photon

7.4. RECONSTRUCTION OF PHOTON NUMBER OSCILLATIONS 129

0 1 2 3 4 5 6 7 8 9 10 110

0.1

0.2

0.3

0.4

Photon Number

Prob

abilit

y

η = 1

0 1 2 3 4 5 6 7 8 9 10 110

0.1

0.2

0.3

0.4

Photon Number

Prob

abilit

yη = 0.7

a)

b)


Figure 7.4: Detected photon number distribution from parametric down conversion.(a) Measured distribution with perfect detection efficiency η. (b) Measured distribu-tion with detection efficiency η = 0.7.

pair distribution is a Poisson distribution, and odd photon number states are com-

pletely absent. Panel (b) shows the detection statistics for the same distribution if

each photon is detected with a probability of 0.7. This is a high detection proba-

bility for down-conversion experiments. One can see that the detection inefficiency

quickly washes out the even-odd oscillation, resulting in a much more uniform looking

distribution.

The requirement of very high quantum efficiency makes direct observation of the

photon number oscillation nearly impossible in practice. However, one can make an

accurate independent measurement of the photon detection efficiency, and correct

for this effect in the photon number distribution. This allows the reconstruction of

the original even-odd oscillations of the field. The detection efficiency of the system

has already been measured in the previous section. This was done by measuring

the photon number distribution at low pumping power, where the probability of

generating two photon pairs is negligibly small. In this regime the detection efficiency

is determined by Eq. 7.8. The detection efficiency was measured to be 0.67.


The detection efficiency can be corrected for as follows. Define pi as the probability

that the photon field contained i photons, and fi as the probability that i photons

are detected. In the presence of losses, these two distributions are related by

fi =∞∑j=i

(j

i

)ηi (1− η)j−i pi (7.9)

In order to calculate pi from fi, the above transformation must be inverted. Unfor-

tunately, if the expression is kept to all orders in photon number, there is no clear

way to invert the transformation. To get around this problem, one must truncate

the photon number distribution at some photon number n, which is sufficiently large

such that pn+1 ≈ 0 is a good approximation. Two vectors are introduced, p and f ,

which are simply given by

p =

p1

p2

...

pn

; f =

f1

f2

...

fn

. (7.10)

These two vectors are related by a matrix M, whose coefficients are given by Eq. 7.9.

One can calculate p by

p = M−1f . (7.11)

Dark counts and backgrounds can also be corrected for using the same method. In

order to include the dark counts, one must model the dark count probability distri-

bution. An extremely reasonable assumption is that each dark count even occurs

independently of all other dark counts. If this is true, the dark count probability

distribution is a Poisson distribution with average d which can be measured. One ex-

pects that background photons will also be Poisson distributed, so they can be lumped

together with the dark counts in parameter d. In the presence of dark counts, the

initial and final probability distributions are related by

fi =i∑

k=0

e−ddk

k!

∞∑j=i−k

(j

i− k

)ηi−k (1− η)j−i+k pi−k (7.12)


0 20 40 60 800

0.1

0.2

0.3

0.4

0.5

Power (uw)

Aver

age

Dar

k C

ount

s

y = 0.01 + 0.0072x


Figure 7.5: Backgrounds vs. pump power.

Introducing a maximum photon number n, the above relationship is once again a

linear matrix which relates the actual and measured photon number distribution.

Figure 7.5 shows the average background number per laser pulse as a function of

the pump power. The background rate is measured by rotating the polarization of

the pump so that it is orthogonal to the optic axis of the non-linear crystal. When

this is done, phase matching cannot be satisfied so no parametric down-conversion

is observed. A pulse area distribution is acquired for each pump intensity, which is

used to calculate the photon number distribution per pulse. The average is calculated

from this distribution. The plot shows that the average increases linearly with pump

intensity. This linear increase is caused by background photoluminescence generated

by the BBO crystal when it is illuminated by the high energy UV pump. The intercept

of the line gives us the raw dark count rate.

Figure 7.6 shows the result of the photon number reconstruction. Three different

pumping intensities are shown. For each pump intensity, the left panel shows the pulse

area histogram, and the inset to the panel shows the calculated photon probability

distribution. The right panel shows the reconstructed photon number distribution


0 1000 2000 30000

2

4x 10

4

Co

un

ts

0 1 2 3 4 5 6 7 8 9 10

0

0.2

0.4

0.6

Pro

ba

bili

ty

0 1000 2000 30000

1

2x 10

4

Co

un

ts

0 1 2 3 4 5 6 7 8 9 10

0

0.2

0.4

0.6

Pro

ba

bili

ty

0 1000 2000 30000

1

2x 10

4

Pulse Area (AU)

Co

un

ts

0 1 2 3 4 5 6 7 8 9 10

0

0.2

0.4

0.6

Photon Number

Pro

ba

bili

ty

Student Version of MATLA

4 Wµ 4 Wµ

6 Wµ 6 Wµ

8 Wµ 8 Wµ

0 1 2 3 4 5 6 7 80

0.2

0.4

0.6

0 1 2 3 4 5 6 7 8 9 100

0.1

0.2

0.3

0.4

0.5

0.6

0 1 2 3 4 5 6 7 8 9 100

0.1

0.2

0.3

0.4

0.5

0.6

a)

b)

c)

Figure 7.6: Reconstructed even-odd photon number oscillations for several pumppowers. (a), 4µW pump. (b) 6µW pump. (c) 8µW pump.


using the measured quantum efficiency and backgrounds. The photon number dis-

tribution is truncated at 10 photons. The reconstructed probabilities demonstrate

very clean even-odd oscillations, as one would expect from down-conversion. It is

important to emphasize that there are no fitting parameters in the number recon-

struction. The only two parameters, the quantum efficiency and background rate,

are independently measured. Once they are known there is a one-to-one relationship

between the actual and measured photon number distribution.

At higher photon numbers, it can be seen that the reconstructed distribution

becomes slightly negative. This erroneous effect is caused by truncation error. As

the pumping intensity is increased, the approximation that the photon distribution

can be truncated after 10 photons becomes less accurate. This error manifests itself

in the probabilities becoming slightly negative for the 9 and 7 photon probability.

This error is worst at the largest pumping intensity of 8µW , where the truncation

approximation is least accurate. One could reduce this probability by truncating at a

higher photon number. Unfortunately, because of the limited range of the amplifiers

and A2D converters, it is difficult to measure these higher order photon numbers

in practice. This puts a limit on the pumping power one can use and still get a

good reconstruction. Better numerical algorithms for doing the reconstruction may

improve the result. It is possible that an improved numerical technique over simply

putting a cutoff in the number distribution may overcome some of these practical

difficulties.

Chapter 8

Photon number state generation

In the previous chapter the non-classical nature of parametric down-conversion was

investigated. The two photon nature of the process features counting statistics which

are not consistent with the classical interpretation of electromagnetic theory. This

chapter discusses an application of this special property, the generation of photon

number states.

The use of parametric down-conversion for single photon generation is already a

well known process [18, 48]. This is typically done by setting the non-linear crystal

to degenerate, non-collinear phase-matching. In this condition the signal and idler

have the same energy but propagate in different directions. The non-linear crystal is

pumped by a weak pulsed pump, such that the probability of making more than one

pair in the pulse is extremely low. Under these conditions, if a photon counter detects

a photon in the signal arm, the idler arm must also contain exactly one photon. By

post-selecting only the pulses where a signal photon was detected, one creates a so-

called conditional single photon state. The disadvantage of this scheme is that one

cannot create a single photon on demand. One must wait for the counter on the

signal arm to register a count. But once this happens, a single photon is created in

the other arm with very high probability. For many applications, including quantum

cryptography, this is sufficient. The improvements of using such a single photon

source have already been studied [48].

In applications utilizing this type of single photon source, the pumping intensity

134

135

must be carefully selected. If the pumping intensity is too high, the probability of

generating more than one pair becomes non-negligible. In virtually all experiments

to date, the triggering detector could not distinguish the number of photons in the

pulse with high quantum efficiency. Thus, it cannot distinguish between one and

more than one pair created in a pulse. Both cases will be accepted as valid, creating

undesirable multi-photon states in the idler arm. The only way to suppress these

multi-photon states is to make the pumping intensity very low, and in so doing reduce

the probability of generating more than one pair in a pulse. This comes at a price.

At weak pumping intensities, most pump pulses will fail to generate a single pair of

down-converted photons. One has to wait a long time before the triggering detector

sees a photon, which properly prepares the state of the conjugate arm.

This section considers the advantages of replacing the standard triggering detector,

which cannot distinguish photon number, with a triggering detector that does have

photon number detection capability, such as the VLPC. This capability is very useful

for single photon generation. The VLPC can often distinguish between the case where

one and more than one pair was created in a single pump pulse. It not only rejects the

cases where no pair was created, it can also reject many of the cases when more than

one pair was created. In the presence of perfect detection efficiency, one could set the

average photon pair per pulse to 1, optimizing the probability of generating a single

pair. However, when the detection efficiency is not perfect, the VLPC will sometimes

register a multi-photon event as a single photon event, resulting once again in a finite

multi-photon probability. The first section discusses the theoretical improvements

one can expect under these conditions. The experimental demonstration of single

photon generation using the multi-photon detection capability of the VLPC is then

presented.

A second advantage of using a VLPC is that it allows one to generate higher order

photon number states, which cannot be done with a single avalanche photodiode. By

post-conditioning on the case where the VLPC sees 2,3, or 4 photons in the signal

arm, one can generate 2,3, or 4 photon number states in the other arm. The last

section discusses the implementation of this scheme. A demonstration of efficient

generation of up to a 4 photon number state is presented.

136 CHAPTER 8. PHOTON NUMBER STATE GENERATION

Signal

Idler

TriggerDetector

Pump

NonlinearCrystal

Figure 8.1: Single photon generation with parametric down-converiosn.

8.1 Single photon generation

8.1.1 Theory

Figure 8.1 shows the general setup for single photon generation. A non-linear crystal is

pumped by a pulsed source. The phase matching condition is set such that the signal

and idler photons propagate in different directions. A triggering detector is placed in

the signal arm. When this detector registers a photon count, a single photon state

should be prepared in the idler arm.

Lets consider the effect of two types of triggering detectors, threshold detectors and

photon number detectors. A threshold detector can detect the presence of photons in

a laser pulse, but cannot distinguish between one and more the one photon. Thus, a

threshold detector performs a POVM measurement with two elements, E0 and Eclick.

These two elements are defined by

E0 = |0〉〈0| (8.1a)

Eclick =∞∑k=1

|k〉〈k| . (8.1b)

In contrast, a photon number detector has the ability to distinguish the number of

photons in each pulse. The POVM performed by such a detector is given by the

8.1. SINGLE PHOTON GENERATION 137

elements Ei, where

Ei = |i〉〈i| . (8.2)

To incorporate the effect of detection efficiency, one can place a beamsplitter in front

of the triggering detector, which reflects off a fraction of the photons proportional

to the detection efficiency. The POVMs for the two types of detectors can then be

applied to the field after the beamsplitter.

The statistics of the generated field depends on the statistical distribution of

the down conversion. In parametric down-conversion there are two main regimes

of interest. In the first regime, the pump pulse duration is on the order of the

inverse of the measurement bandwidth, which is typically defined by interference

filters in from of the down-converted arms. This is the single mode regime, where

the Hamiltonian in Eq. 7.3 applies. In such a regime, the photon pair distribution

is thermal. The opposite limit occurs when the pump pulse duration is much longer

than the inverse of the measurement bandwidth. In this regime there are many down-

conversion modes which operate simultaneously. This multi-mode down-conversion

process creates statistics which approach a Poisson distribution. This work considers

only the multi-mode case, which is the appropriate limit for the experiments to be

presented. The single mode case can be derived in a completely analogous way.

Define K as the event that the trigger detector has detected a single photon,

and let M be the event that there is more than one photon in the idler arm. Thus,

P (M |K) and P (1|K) are the probabilities of a multi-photon state and a single photon

state in the idler arm, conditioned on the triggering detector. These probabilities

characterize the quality of the generated states. Another important probability is

P (K), the probability that the triggering detector sees a photon. This gives the

generation efficiency, or the rate at which single photons are prepared.

Consider the case where the triggering detector has the ability to distinguish the

number of photons in each pulse. A logic pulse is produced only of the detector sees

exactly one photon. The detection efficiency of the system for the triggering detector

is denoted as η. The parameter α is defined as the average number of twin photons

generated per pulse. Assuming a Poisson distributed pair generation process, it is


straightforward to show that

Pnum(1|K) =e−α(1−η) (8.3a)

Pnum(M |K) =1− e−α(1−η) (8.3b)

Pnum(K) =αηe−αη (8.3c)

In the limit η → 1, one obtains Pnum(1|K) → 1 and Pnum(M |K) → 0, which is

an ideal single photon state. This occurs regardless of the value of α, which can be

set to 1 to achieve maximum generation efficiency. If the detection efficiency is not

ideal however, there is a tradeoff between the multi-photon probability and generation

efficiency. In the limit of small α, the above expressions simplify to

Pnum(1|K) =1− α(1− η) (8.4a)

Pnum(M |K) =α(1− η) (8.4b)

Pnum(K) =αη (8.4c)

For the scheme being considered, it is desirable to have a figure of merit one can

use to quantify the quality of the generated photon state. It is preferable to use a

figure of merit which does not depend on the pumping intensity, or equivalently on

α, the average number of generated pairs. In chapter 4, the figure of merit used was

g(2). This parameter equals the ratio of the multi-photon probability of the source to

that of a Poisson light source, in the limit of small averages. Unfortunately, if one

adopts the same definition of g(2), conditioned on the triggering detector, then g(2)

will depend on α. In fact, α → 0 implies that g(2) → 0. That is, if the excitation

is extremely small, than whenever the triggering detector sees a photon, there is

exactly one photon in the other arm. Thus, the conventional definition of g(2) is not

an appropriate figure of merit for this experiment.

A better figure of merit is to consider the ratio of the multi-photon probability

for the triggering detector to that of an ideal threshold detector. An ideal thresh-

old detector has a quantum efficiency of 1, but cannot distinguish between one and

more than one photon. This detector represents the idealized limit of an avalanche

photodiode. The only non-ideal behavior which will be considered in the theoretical


analysis is imperfect quantum efficiency. In a practical system, collected background

photons and detector dark counts may also affect the performance of the single photon

generator. Assuming a detection efficiency η, it is straightforward to show that

Pthresh(1|K) =αe−α

1− e−α(8.5a)

Pthresh(M |K) =1− e−α − αe−α

1− e−α(8.5b)

Pthresh(K) =1− e−α (8.5c)

In the limit of small α the above expressions simplify to

Pthresh(1|K) ≈1− α

2(8.6a)

Pthresh(M |K) ≈α2

(8.6b)

Pthresh(K) ≈α (8.6c)

The figure of merit, denoted G, is then defined as

G = limα→0

Pnum(M |K)

Pthresh(M |K)= 2(1− η) (8.7)

Thus, G is independent of α at low excitation powers. Furthermore, from Eq. 8.3b it

is straightforward to show that

Pnum(M |K) ≤ Gα

2. (8.8)

The above equation has a clear similarity to Eq. 4.36. Knowing G allows us to put

a bound on the multi-photon probability, meaning that it is not only a convenient

figure of merit, it is a also a practically important parameter in exactly the same

way that g(2) was in chapter 4. For quantum cryptography applications, G and α

are sufficient to characterize the security performance of the system in the same way

as g(2) and n were sufficient for sub-Poisson light. From Eq. 8.7 one sees that when

η > 0.5, G drops below 1. In this regime the multi-photon probability is suppressed

to a level that is unattainable without photon number detection.

Using the same definitions above, one can similarly derive the value of G for

a non-ideal threshold detector that has a quantum efficiency η. A straightforward


0 10 20 30 40 5010-15

10-10

10-5

100

Channel Loss (dB)

Bits

Per

Pul

se

G=0G=0.001G = 0.01G =0.1G=1G=1.5


Figure 8.2: Communication rate vs. channel loss for different values of G.

calculation shows that, in this case,

Gthresh = 2− η (8.9)

The above expression is always greater than one, achieving its best value in the ideal

limit that η → 1. Thus, all threshold detectors are bounded by G > 1. The only way

to suppress the multi-photon probability using such detectors is to make α small.

Figure 8.2 shows simulations for the communication rate of the BB84 protocol

with G taking on a range of values. For each curve, α is numerically optimized at

each value of the channel loss. One can see that all of the curves achieve a maximum

channel loss of approximately 55dB, independent of G. This is expected, since in the

limit of small α a single photon state is generated when the triggering detector sees a

photon, regardless of whether the detector can do photon number detection. However,

when G ∼ 1 the communication rate near the cutoff is unacceptably low, achieving

rates of only 10−12 bits per pulse at best. Using a conventional Ti:Sapphire laser with

76MHz repetition rate, the communication rate is roughly 1 bit every four hours. In


AND start

stop

APD

APD

VLPC

IntegratingAmplifier

BBO

2m lens

IF 266nm l/2 PBS l/2

Nd:YAG266nm

Prism

Diode

2.5msDelay

Multi-ChannelScalar

irisiris

irisiris

500mmlens

Signal

Idler

SCA

Figure 8.3: Experimental setup for generation of single photons.

the opposite extreme, when G = 0 the communication rate at the cutoff is roughly

10−5, a seven order of magnitude improvement. But such improvements can only be

observed if the efficiency is extremely close to one. Even the curve for G = 0.001,

corresponding to an efficiency of 0.9995, shows appreciably degraded performance near

the cutoff. Still, the value of G = 0.1 achieves two orders of magnitude improvement

in communication rate over a threshold detector.

8.1.2 Experiment

Figure 8.3 shows the experimental setup for generation of single photons. A Q-

switched Nd:YAG laser is converted to its fourth harmonic at 266nm. The fourth

harmonic is used to pump a BBO crystal, whose optic axis is tilted for non-collinear

degenerate phase matching (∼47.6 degrees). The parametric down conversion is emit-

ted at an angle of 1 degree from the pump. The pump is loosely focussed to achieve

a minimum waist at the second collection iris. This results in a sharper two-photon

image which enhances the collection efficiency. The signal photon is focussed onto

the VLPC. The output of the VLPC is amplified by a charge integrating amplifier.

This amplifier emits a voltage pulse whose height is proportional to the number of


0

200

400

600

800

1000

1200

1400

0 500 1000 1500 2000 2500 3000

pulse height (mV)

co

un

ts

SCA Window

Figure 8.4: Pulse height spectrum emitted from charge sensitive amplifier.

electrons emitted during a laser pulse. A pulse height histogram of the output of

the charge sensitive amplifier is shown in Figure 8.4. This spectrum features a series

of peaks for the one photon, two photon, and three photon events. A single channel

analyzer (SCA) is used to select pulses whose height is consistent with a single photon

event. Every time such a pulse occurs the SCA outputs a TTL pulse, which signifies

a valid trigger detection.

The important parameter one would like to measure is G. In the theoretical

analysis, only imperfect detection efficiency was considered. In this approximation

G depends only η, so a measurement of quantum efficiency can be used to directly

calculate it. In a practical system, however, collected backgrounds and dark counts

can also effect G. Furthermore, internal multiplication noise can cause photon number

detection errors even in the presence of perfect quantum efficiency, as discussed in

the previous chapter. A model which incorporates all of these non-idealities is very

complicated. It is better if one can directly measure G. This is done by inserting

a 50-50 beamsplitter in the idler arm, and using two APDs to detect the photons.

The APDs used in the experiment are conventional SPCM detectors with quantum

efficiencies of about 60% at the operating wavelength. A multi-channel scalar is used

to perform time-resolved coincidence detection between the two counters. This setup


0 20 40 60 80 100 120 1400

500

1000

1500

2000

2500

Time (µ s)

Cou

nts

0.42


Figure 8.5: Pulse height spectrum emitted from charge sensitive amplifier.

strongly resembles the HBT intensity interferometer used in Chapter 4. There is

one critical difference, however. The start signal of the multi-channel scalar is only

accepted if the VLPC saw exactly one photon. This is accomplished by performing

a logical AND operation between the output of the SCA and the output of the start

detector. The AND gate will only put out a pulse if both the start detector and SCA

create a simultaneous pulse.

Figure 8.5 shows a time resolved coincidence spectrum taken with the setup. As

with a standard HBT correlation, the spectrum features a series of peaks separated

by the pulse repetition rate of the laser. The τ = 0 peak shows a clear suppression

relative to the other side peaks. If the VLPC was a perfect number detector, this

central peak would be suppressed to 0. But due to detection efficiency and other

non-idealities, the central peak is suppressed by a factor 0.42 relative to the side

peaks. In the limit that α� 1, the ratio of the central peak to one of the side peaks

gives the parameter G. This can be shown as follows. In the limit of small α we

can assume that only zero, one, or two photon pairs are created. Higher order pair

number states occur with negligibly small probability. The τ = 0 peak is proportional

to the probability that two pairs were created in the same pulse, given that the VLPC


saw one photon. The side peaks are proportional to the probability that there was

one pair created at time 0, and a second pair created at time τ , given the VLPC saw

a photon at time zero. Thus

A0

Aτ=

P (2|K)/2

α/4 +O(α2)=

2P (2|K)

α+O(α2). (8.10)

If α is sufficiently small such that P (2|K) = P (M |K) and one can keep the expression

to first order in α, the above expression is equal to G. The measurement in Figure 8.5

indicates G = 0.42. This implies a quantum efficiency of 0.79.

To verify that the measured suppression is really caused by the number detection

capability of the VLPC, one can sweep the upper level of the SCA to incorporate

more higher order photon number states. In this way, the VLPC is continuously

transformed from a detector that can distinguish between one and more than one

photon to a threshold detection. Figure 8.6 shows a series of correlations taken for

different upper level thresholds of the SCA. As the upper threshold is increased, the

central peak changes from being suppressed to being slightly enhanced. The slight

enhancement is due mainly to the quantum efficiency of the VLPC.

One can also examine the predicted relationship between efficiency and G. The

efficiency of the VLPC can be adjusted by reducing the bias voltage. Figure 8.7 shows

correlations for several bias voltages of the VLPC. As the bias voltage is reduced, the

central peak moves from being suppressed to being enhanced by a factor very close

to 2, as predicted by the theory. In Figure 8.8, the measured value of G is plotted

as a function of quantum efficiency. The line represents the theoretically predicted

value. The measured G follows closely to the theoretical model. However, there is a

slight non-linear feature to the data. This may be caused by changes in dark counts

for different bias voltages, or by drift in the alignment of the system which may alter

the quantum efficiency.

8.2 Multi-photon generation

The previous section discussed how photon number detection is useful for generating

single photons using parametric down-conversion. One nice aspect of this scheme is

8.2. MULTI-PHOTON GENERATION 145

-40 -20 0 20 40 60 80 100 1200

0.5

1

1.5

2

Upper level - 480mV

G

-40 -20 0 20 40 60 80 100 1200

0.5

1

1.5

2

Upper level - 840 mV

G

-40 -20 0 20 40 60 80 100 1200

0.5

1

1.5

2

Upper level - 1320mV

G

-40 -20 0 20 40 60 80 100 1200

0.5

1

1.5

2

Upper level - 1680mV

G

-40 -20 0 20 40 60 80 100 1200

0.5

1

1.5

2

Upper level - 10,000mV

τ (ns)

G

0.44

0.49

0.65

1.01

1.23

Student Version of MATLABFigure 8.6: Correlation measurements for different upper thresholds of the SCA.


-20 0 20 40 60 80 100 120 140 1600

0.5

1

1.5

2

2.5

Bias - 7.3V

G

-20 0 20 40 60 80 100 120 140 1600

0.5

1

1.5

2

2.5

Bias - 6.7V

G

-20 0 20 40 60 80 100 120 140 1600

0.5

1

1.5

2

2.5

Bias - 6.5V

G

-20 0 20 40 60 80 100 120 140 1600

0.5

1

1.5

2

2.5Bias - 6.2V

G

-20 0 20 40 60 80 100 120 140 1600

0.5

1

1.5

2

2.5

Bias - 5.8V

τ (ns)

G

0.53

0.64

0.82

1.66

2.04

Student Version of MATLABFigure 8.7: Correlation measurements for different bias voltages of the VLPC.


0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.90.2

0.4

0.6

0.8

1

1.2

1.4

1.6

1.8

2

2.2

Quantum Efficiency

G


Figure 8.8: Measured value of G as a function of quantum efficiency of the VLPC.

that it can be extended in a straightforward way to generate higher order photon

number states. The principle of operation is exactly the same. If the VLPC saw N

photons in the signal arm, there should also be N photons in the idler arm. Post

selecting these cases allows for the generation of conditional photon number states.

For single photon generation, a modified HBT interferometer was used to verify

the nature of the emission. Unfortunately, for higher order number states this setup is

insufficient. The HBT interferometer does not give enough information to verify that

a 2-photon or 3-photon state was generated. In order to verify higher order number

states, it is better to use a detector that can directly measure the photon number

distribution. Therefore, the HBT setup is replaced with a second VLPC, which now

serves as a monitoring detector to verify that the appropriate number of photons was

created.

The experimental setup for higher order photon number generation is shown in

Figure 8.9. The setup on the signal arm remains unchanged. The signal photons are

collected by a 500mm focal length lens, and focussed onto VLPC 1. The output of

VLPC 1 is integrated by a charge sensitive amplifier. The output is once again sent

to a single channel analyzer which creates the post-selection signal. Figure 8.10 shows


VLPC 1

IntegratingAmplifier

BBO

2m lens

IF 266nm l/2 PBS l/2

Nd:YAG266nm

Prism

Diode

2.5msDelay

irisiris

irisiris

500mmlens

Signal

Idler

SCA

500mmlens

BoxcarIntegrator

trigger

signal

VLPC 2

Figure 8.9: Experimental setup for generating N photon number state.

a pulse height spectrum created by the charge sensitive amplifier. The gray regions

illustrate post-selection widows of the SCA for 1,2,3, and 4-photon generation. The

output of the SCA is used to trigger a boxcar integrator. The trigger pulse of the

SCA is combined with the triggering pulse from the photodiode via an AND gate.

In this way only trigger pulses which fall during a laser pulse are allowed to start

the boxcar integrator. This technique allows us to reject trigger events due to dark

counts and collected background light.

In the signal arm, the HBT setup is replaced by VLPC 2. The output of this

VLPC is amplified by a second charge sensitive amplifier, and sent to the signal

channel of the boxcar integrator. Figure 8.11 shows a sample pulse area spectrum

when no post-selection is done. The spectrum was taken at 15µW pumping power.

The inset to the figure shows the calculated photon number probability distribution,

which is effectively a Poisson distribution.

Figure 8.12 shows what happens when the post selection signal is incorporated.

The figure shows pulse area histograms for VLPC 2, when VLPC 1 post-selects the

1, 2, 3, and 4 photon detection events. The pulse area histogram is used to calculate

the photon number distribution, which is then corrected for the quantum efficiency

and dark counts of VLPC 2. The photon number distribution after the correction


0

500

1000

1500

2000

2500

0 1000 2000 3000 4000 5000

Pulse Height (mV)

Co

un

ts

1 2 3 4

Figure 8.10: Pulse height histogram for VLPC 1.

600 800 1000 1200 1400 1600 1800 2000 2200 24000

500

1000

1500

2000

2500

3000

Pulse Area (AU)

Cou

nts


0 1 2 3 40

0.2

0.4

0.6

0.8

1

Figure 8.11: Pulse area histogram of VLPC 2 without postselection from VLPC 1.


is shown in Figure 8.12. For 1, 2, and 3 photon generation the state generated is

nearly an ideal photon number state. For 4 photon generation, however, there is

contribution from the 3 and 5 photon number states. This contribution is attributed

to the smearing between the four photon peak and its nearest neighbors in the pulse

height spectrum of VLPC 1. This smearing is caused by buildup of the multiplication

noise, which puts a limit on the photon number resolution.

The rate at which one can generate a photon number state is an important figure

of merit for this experiment. If the VLPC were an ideal number state detector with

perfect efficiency, the optimal strategy would be to make the average pairs gener-

ated per pulse equal to the desired photon number state. This would maximize the

probability that the down conversion process generates the correct photon number.

However, in the presence of imperfect efficiency this may not be the best strategy. A

large average photon number will lead to many higher order number states. Imperfect

detection efficiency will result in mistakes, in which a higher order number state was

misinterpreted as the correct photon number. This unavoidably degrades the quality

of the generated state. These mistakes can be suppressed by reducing the average

such that the probability of higher order number states is small. Thus, there is a

natural tradeoff between the quality of the number state and the rate at which it is

generated.

Figure 8.13 illustrates this tradeoff for the three photon case. The figure shows

the photon number distribution for four different pumping powers. At 5µW pump

the state generated is nearly ideal. As the pumping power is increased, one starts

to observe an increased contribution from 4 and 5 photon number states. When

attempting to generate n photons, one can use Pn, the probability that n photons

were generated given the VLPC triggered, as a figure of merit for the quality of the

state. In the ideal case, Pn = 1, which is a perfect number state. When higher order

number states start to contribute Pn will drop, as seen in Figure 8.13. Figure 8.14

plots the Pn as a function of pump power for 2,3, and 4 photon generation. Also

plotted is the probability that the VLPC will trigger a correct detection on a laser

pulse, which is the normalized generation rate of the number states. For all three

cases, increasing the pump power results in higher generation rates and decreased


500 1000 1500 20000

1000

2000

3000

Cou

nts

1 Photon

0 1 2 3 4 5

0

0.5

1

Prob

abilit

y

1 Photon

1000 1500 20000

1000

2000

3000

Cou

nts

2 Photons

0 1 2 3 4 5

0

0.5

1

Prob

abilit

y

2 Photons

1000 1500 20000

200

400

600

Cou

nts

3 Photons

0 1 2 3 4 5

0

0.5

1

Prob

abilit

y

3 Photons

1000 1500 2000 25000

500

1000

Pulse Area (AU)

Cou

nts

4 Photons

0 1 2 3 4 5

0

0.5

1

Photon Number

Prob

abilit

y

4 Photons

Student Version of MATLABFigure 8.12: Pulse area histogram and reconstructed photon number probabilities forVLPC 2, conditioned on photon number detection from VLPC 1.


1000 1500 20000

200

400

600

Cou

nts

5 µW

0 1 2 3 4 5

0

0.5

1

Prob

abilit

y

5 µW

1000 1500 20000

500

1000

Cou

nts

10 µW

0 1 2 3 4 5

0

0.5

1Pr

obab

ility

10 µW

1000 1500 20000

1000

2000

3000

Cou

nts

20 µW

0 1 2 3 4 5

0

0.5

1

Prob

abilit

y

20 µW

1000 1500 20000

500

1000

1500

Pulse Area (AU)

Cou

nts

40 µW

0 1 2 3 4 5

0

0.5

1

Photon Number

Prob

abilit

y

40 µW

Student Version of MATLABFigure 8.13: Pulse area histogram of VLPC 2 for the case of 3 photon generation asa function of pump power.


state quality.


0 10 20 30 40 500.4

0.6

0.8

1

P 2

0 10 20 30 40 500

0.152 Photons

Effic

ienc

y

0 10 20 30 40 500.4

0.6

0.8

1

P 3

0 10 20 30 40 500

0.13 Photons

Effic

ienc

y

10 20 30 40 500.2

0.4

0.6

P 4

10 20 30 40 500

0.024 Photons

Power (µ W)

Effic

ienc

y


Figure 8.14: Generation efficiency and number state quality as a function of pumppower for 2,3, and 4 photon number generation. Data denoted by squares correspondsto Pn, the probability the correct photon number was generated. Data denoted bydiamonds shows the probability that the VLPC observes the correct photon numberon a given laser pulse. The squares reference the left y axis, while the diamondsreference the right y axis.

Chapter 9

Conclusion

Below I present a list of the main results presented in this work.

1. The security properties of sub-Poisson light sources was investigated. The max-

imum channel loss was determined to be a function of g(2), provided the device

efficiency exceeded a critical value.

2. A proof of security for an entangled photon protocol known as BBM92 was

derived. This is the first proof of security for an entangled photon protocol that

can be applied to realistic systems.

3. A numerical comparison was made between BB84 and BBM92. BBM92 was

shown to have significantly enhanced security properties, potentially allowing

secure communication over 170km distances.

4. An experimental demonstration of quantum cryptography using a single photon

source was presented. This source allowed a 5dB increase in the maximum

channel loss, compared to a Poisson light source such as an attenuated laser.

5. The raw quantum efficiency of the Visible Light Photon Counter (VLPC) was

measured at 543nm wavelength to be 85%. The intrinsic quantum efficiency

was determined to be 93%.

155

156 CHAPTER 9. CONCLUSION

6. The photon number detection capability of the VLPC was investigated. The

effect of multiplication noise on the accuracy of the number detection was mea-

sured.

7. A test for non-classical light statistics was derived using only the photon number

distribution of a field. The output of parametric down-conversion is expected

to demonstrate violations of classical statistics using this test.

8. Using the photon number detection capability of the VLPC, violations of clas-

sical statistics were demonstrated using the proposed test.

9. The predicted oscillation in the photon number distribution of parametric down-

conversion was reconstructed using the number state detection capability of the

VLPC.

10. Single photon generation using the VLPC and parametric down-conversion was

demonstrated. A 58% suppresion in the multi-photon probability over an ideal

threshold detector was shown.

11. Generation of 2,3, and 4 photon number states was demonstrated. This is the

first demonstration of reliable generation of such higher order number states.

In conclusion to this work, I speculate on the potential applications of the above

results.

The most immediate application for much of the work described above is in the

area of long distance quantum cryptography. One of the most important goals in the

area of free space quantum cryptography is the implementation of earth to satellite

communication. It is predicted that a system should be able to withstand 40dB of

channel loss in order to implement satellite keying [13]. However, current systems

based on Poisson light sources can only withstand 23dB of channel losses. The single

photon source demonstrated in this work has extended this limit to 28dB of losses.

More recent sources based on better micro-cavity samples have demonstrated g(2) =

0.01 and higher device efficiencies. These devices are predicted to be able to withstand

the 40dB channel loss required for earth to satellite communication.

157

This work has also elucidated the great potential of entangled photon protocols.

Fiber systems based on entangled protocols could potentially achieve unprecedented

ranges of 170km, using currently available technology. Free space entangled photon

protocols are also very promising. Such protocols could withstand channel losses

exceeding 50dB in each arm. This satisfies the requirements for satellite based key

distribution systems. A satellite with an entangled photon source could provide en-

tangled photons to two communicating parties on the ground, in order to perform

BBM92. This could allow extremely long distance point to point secure communica-

tion.

The combination of single photon sources and the VLPC would represent a first

step towards quantum computation based on linear optics. The requirements for

scalable quantum computation are extremely demanding. Nevertheless, currently

available technology may be useful in implementation of novel tasks in quantum

networking. Of particular interest is the area of quantum networking, where only

limited quantum computational power is required. The VLPC, combined with a

good single photon source, may provide the tools needed to implement a quantum

repeater, an important building block for quantum networks.

Single photon generation using the VLPC and parametric down-conversion also

has important applications in quantum networking. By selecting an appropriate pump

frequency and phase matching condition, one can generate a visible wavelength sig-

nal photon for the VLPC, and a 1.5µm telecommunication wavelength idler photon.

This would be a convenient source of telecommunication wavelength single photons.

Such sources are extremely difficult to implement using quantum dot technology, due

material processing problems.

Applications of number state generation, presented in Chapter 8, remains more

of an open question. An important first step to improving this setup is to introduce

femtosecond pump pulses and wavelength filters. This would allow the generation of

n photons in a single mode, also known as a Fock state. Such states are useful in

defeating the standard quantum limit of interferometry. Other applications of such

states remain an interesting research direction.

Appendix A

Handling side information from

error correction

In this appendix we show how to bound Eve’s expected information IE(K;GUZ) by

the average collision probability

〈pc(x|z)〉z =∑z

p(z)Pc(X|Z = z), (A.1)

where

Pc(X|Z = z) =∑x

p2(x|z). (A.2)

Let U and Z be arbitrary, possibly correlated, random variables over alphabets U and

Z respectively. Let | · | denote the cardinality of a given set. Let t > 0 be a security

parameter chosen by Alice and Bob and define set A as

A =

{(u, z) ∈ (U ,Z) : p(u|z) ≥ 2−t

|U|

}. (A.3)

158

160APPENDIX A. HANDLING SIDE INFORMATION FROM ERROR CORRECTION

using the positivity of the conditional entropy functions, and the fact that U and Z

are independent of G. Plugging (4.16) into the above inequality leads to

H(K|GUZ) ≥∑

(u,z)∈A

p(u, z)

(r − 2r

ln 2pc(X|U = u, Z = z)

)≥ (1− 2−t)r − 2r

ln 22t|U|〈pc(X|Z = z)〉z

= (1− 2−t)r − 2r+t+log2 |U|+log2〈pc(X|Z=z)〉z ,

as follows from (A.4). We can then set

r = − log2〈pc(X|Z = z)〉z − t− κ− s, (A.5)

where κ = log2 |U| is the number of bits in message U and s is another security

parameter. This leads to the bound

H(K|GUZ) ≥ (1− 2−t)r − 2−s

ln 2. (A.6)

Eve’s mutual information can now be bounded by

IE(K;GUZ) = H(K)−H(K|GUZ)

≤ 2−tr +2−s

ln 2.

Plugging ( 4.13) into (A.5) leads directly to

r = nτ − t− κ− s, (A.7)

where τ = − log2 pc.

Appendix B

One photon contribution

In this appendix we show that there is always an optimal eavesdropping strategy for

the contribution from ρ(11)abe which can be described by a set of complete projectors

Ak. These complete projectors may depend on the measurement basis used by Alice

and Bob.

First consider the POVM which Alice performs on her photon. Since we only

look at the subspace where she receives exactly one photon, there can only be one

detection event. The four detectors map out to the four operators

Fx =1

2|x〉〈x| (B.1)

Fy =1

2|y〉〈y| (B.2)

Fu =1

2|u〉〈u| (B.3)

Fv =1

2|v〉〈v| (B.4)

where we use the shorthand notation |x〉, |y〉, |u〉, and |v〉 to indicate one photon

polarized along the direction indicated by the state. Note that for the above four

operators F Ta /Tr {Fa} are the same as the density matrices prepared by Alice in

BB84.

Eve is allowed to choose any density matrix ρ(11)abe . We can assume without loss

of generality that ρ(11)abe is a pure state because any mixed state can be generated by

a pure state with a probe of higher dimensions by ignoring some of its degrees of

161

162 APPENDIX B. ONE PHOTON CONTRIBUTION

freedom. Discarding information cannot enhance Eve’s knowledge on the final key.

The most general pure state can be written as

|ψabe〉 = |xx〉|Pxx〉+ |yy〉|Pyy〉+ |xy〉|Pxy〉+ |yx〉|Pyx〉. (B.5)

where |Pxx〉, |Pyy〉, |Pxy〉, and |Pyx〉 are states of Eve’s probe and are not assumed

to be normalized or orthogonal. Alternately we can write this wavefunction in the

diagonal basis, denoted as |u〉 and |v〉,

|ψabe〉 = |uu〉|Puu〉+ |vv〉|Pvv〉+ |uv〉|Puv〉+ |vu〉|Pvu〉, (B.6)

where Eve’s probe states in this basis are given by

|Puu〉 =1

2(|Pxx〉+ |Pyy〉+ |Pxy〉+ |Pyx〉) (B.7)

|Pvv〉 =1

2(|Pxx〉+ |Pyy〉 − |Pxy〉 − |Pyx〉) (B.8)

|Puv〉 =1

2(|Pxx〉 − |Pyy〉 − |Pxy〉+ |Pyx〉) (B.9)

|Pvu〉 =1

2(|Pxx〉 − |Pyy〉+ |Pxy〉 − |Pyx〉) . (B.10)

Throughout this discussion we will use dirac notation interchangeably with the

matrix notation

|x〉 =

[1

0

]

|y〉 =

[0

1

]

Suppose that Alice measures the positive operator Fa with the general form

Fa =

[a b

b∗ c

]. (B.11)

Then

ρb =Trae {|ψabe〉〈ψabe|Fa}Tr {|ψabe〉〈ψabe|Fa}

. (B.12)

163

If we define the operator

Ak =

√Tr {Fa}

Tr {|ψabe〉〈ψabe|Fa}

[〈k| Pxx〉〈k| Pyx〉〈k| Pxy〉〈k| Pyy〉

].

then one can verify that

ρb =∑k

AkF Ta

Tr {Fa}A†k.

In the ideal case, where Alice and Bob share a maximally entangled pair of photons,

we have

ρb =F Ta

Tr {Fa}.

The operators Ak map the ideal channel to the noisy channel.

We are not done yet. We must still show that the operators satisfy the complete-

ness relation ∑k

A†kAk = I, (B.13)

and that they do not depend on Fa. In BB84 these condition come naturally because

Eve’s interaction with the signal must be unitary. In BBM92 there are attacks which

do not satisfy these conditions and thus cannot be described by a CP map. However,

we will show that there is always an optimal attack which does satisfy these two

conditions, and can thus be characterized by such map.

Without loss of generality we can assume that the operators Ak are real matrices.

If this is not true than one can write Ak as

Ak = Rk + iIk,

where Rk and Ik are real matrices. The joint probability that Alice measures Fa and

Eve measures Ak is

Tr{AkFaA

†k

}= Tr

{RkFaR

Tk

}+ Tr

{IkFaI

Tk

}.

Since there is no mixing between the real and imaginary parts Eve could break up Ak

into two real operators Rk and Ik by adding one more dimension to her probe. This

type of probability split can only enhance her final collision probability [54, Appendix

E].

164 APPENDIX B. ONE PHOTON CONTRIBUTION

Starting with (B.13) we sum over k to get

∑k

A†kAk =

Tr {Fa}Tr {|ψabe〉〈ψabe|Fa}

[〈Pxx| Pxx〉+ 〈Pxy| Pxy〉〈Pxx| Pyx〉+ 〈Pxy| Pyy〉〈Pyx| Pxx〉+ 〈Pyy| Pxy〉〈Pyy| Pyy〉+ 〈Pyx| Pyx〉

].

(B.14)

We now show that there is always an optimal attack which satisfies the following

symmetry conditions

〈Pxx| Pxx〉 = 〈Pyy| Pyy〉 (B.15)

〈Pxy| Pxy〉 = 〈Pyx| Pyx〉 (B.16)

〈Puu| Puu〉 = 〈Puu| Puu〉 (B.17)

〈Puv| Puv〉 = 〈Pvu| Pvu〉 . (B.18)

Suppose that the wavefunction (B.5) does not satisfy these conditions. Eve can apply

the following transformation to both Alice and Bob’s photon

|x〉 7→ |y〉, |y〉 7→ |x〉. (B.19)

and it can be shown that this does not effect the error rate or collision probability.

She can also apply the transformation

|x〉 7→ |x〉, |y〉 7→ −|y〉 (B.20)

which is the same as flipping |u〉 with |v〉. This does not effect the collision probability

or the error rate either. Thus, Eve can send any one of the four states below without

changing anything

1) |xx〉|Pxx〉+ |yy〉|Pyy〉+ |xy〉|Pxy〉+ |yx〉|Pyx〉2) |xx〉|Pyy〉+ |yy〉|Pxx〉+ |xy〉|Pyx〉+ |yx〉|Pxy〉3) |xx〉|Pxx〉+ |yy〉|Pyy〉 − |xy〉|Pxy〉 − |yx〉|Pyx〉4) |xx〉|Pyy〉+ |yy〉|Pxx〉 − |xy〉|Pyx〉 − |yx〉|Pxy〉

The second state is obtained by applying B.19 to the first state. The third state

is obtained by applying B.20 to the first state, and the fourth state is obtained by

first applying B.19, then B.20. Eve could send an equal mixture of all four states

165

without altering the error rate or collision probability, and one can verify that this

equal mixture would satisfy the desired symmetry conditions.

Condition (B.16), along with the fact that (B.5) must be normalized, amounts to

〈Pxx| Pxx〉+ 〈Pxy| Pxy〉 = 〈Pyy| Pyy〉+ 〈Pyx| Pyx〉 = 1/2. (B.21)

Knowing that Ak is a real matrix, we then have from condition (B.18),

〈Pxx| Pyx〉+ 〈Pxy| Pyy〉 = 0. (B.22)

These two relations immediately imply that

Tr {|ψabe〉〈ψabe|Fa} =Tr {Fa}

2

which means that

Ak =√

2

[〈k| Pxx〉〈k| Pyx〉〈k| Pxy〉〈k| Pyy〉

].

So Ak are independent from Fa and the completeness relation (B.13) comes directly

from (B.21) and (B.22).

Appendix C

Higher order number contributions

Higher number states are taken into account by setting wD sufficiently large so that

Eve’s optimal strategy is to only use the ρ(11)abe component. First suppose Eve sends 1

photon to Alice and j photons to Bob, where j > 1. Then

p(1j)D ≥ 2

(1

2−(

1

2

)j)Tr{ρ

(1j)abe

}(C.1)

p(1j)rec ≤ 2

(1

2

)jTr{ρ

(1j)abe

}, (C.2)

which leads to

p(1j)D

p(1j)rec

≥

(12−(

12

)j)(12

)j ≥ 1. (C.3)

The argument is completely equivalent if Eve sends j photons to Alice and one photon

to Bob. Now if Eve sends i photons to Alice and j photons to Bob, where i, j > 1,

then

p(ij)D ≥ 2

(1

2−(

1

2

)i)(1

2−(

1

2

)j)Tr{ρ

(ij)abe

}(C.4)

p(ij)rec ≤ 2

(1

2

)i(1

2

)jTr{ρ

(ij)abe

}, (C.5)

which leads to

p(ij)D

p(ij)rec

≥

(12−(

12

)i)(12

)i(

12−(

12

)j)(12

)j ≥ 1. (C.6)

166

167

A disturbance of 1/2 already implies that Eve can obtain the entire string. So setting

wD to 1/2 means that Eve can do at least as good by sending only ρ(11)abe . Thus

pc ≤1

2+ 2ε− 2ε2. (C.7)

Bibliography

[1] R.J. Hughes, J.E. Nordholt, D. Derkacs, and C.G. Peterson. Practical free-space

quantum key distribution over 10km in daylight and at night. New J. Phys.,

4:43, July 2002.

[2] C. Kurtsiefer, P. Zarda, M. Halder, H. Weinfurter, P.M. Gorman, P.R. Tapster,

and J.G. Rarity. A step towards global key distribution. Nature, 419:450, October

2002.

[3] D. Stucki, N. Gisin, O. Guinnard, G. Robordy, and H. Zbinden. Quantum key

distribution over 67km with a plug and play system. New J. Phys., 4:41, July

2002.

[4] L.M. Vandersypen, M. Steffen, M.H. Sherwood, C.S. Yannoni, G. Breyta, and

I.L. Chuang. Implementation of a three-quantum-bit search algorithm. App.

Phys. Lett., 76(5):646–648, January 2000.

[5] L.M. Vandersypen, M. Steffen, G. Breyta, C.S. Yannoni, M.H. Sherwood, and

I.L. Chuang. Experimental realization of shor’s quantum factoring algorithm

using nuclear magnetic resonance. Nature, 414(6866):883–887, December 2001.

[6] S. Gulde, M. Riebe, G.P. Lancaster, C. Becher, J. Eschner, H. Haffner,

F. Schmidt-Kaler, I.L. Chuang, and R. Blatt. Implmentation of the deutsch-

jozsa algorithm on an ion-trap quantum computer. Nature, 421(6918):48–50,

January 2003.

[7] E. Knill, R. Laflamme, and G.J. Milburn. A scheme for efficient quantum com-

putation with linear optics. Nature, 409:46–52, 2001.

168

BIBLIOGRAPHY 169

[8] S. Glancy, J.M. LoSecco, H.M. Vasconcelos, and C.E. Tanner. Imperfect detec-

tors in linear optical quantum computers. quant-ph/0201047, 2002.

[9] C.H. Bennett and G. Brassard. Proceedings of IEEE International Conference

on Computers, Systems, and Signal Processing, Bangalore, India (IEEE, New

York, 1984), pp. 175-179, 1984.

[10] C.H. Bennett. Quantum cryptography using any two nonorthogonal states. Phys.

Rev. Lett., 68(21):3121–3124, May 1992.

[11] B. Huttner, N. Imoto, N. Gisin, and T. Mor. Quantum cryptography with

coherent states. Phy. Rev. A, 51(3):1863–1869, March 1995.

[12] M. Koashi and N. Imoto. Quantum cryptography based on split transmission of

one-bit information in two steps. Phy. Rev. Lett., 79(12):2383–2386, September

1997.

[13] W.T. Buttler, R.J. Hughes, P.G. Kwiat, S.K. Lamoreaux, C.G. Luther andG.L.

Morgan, J.E. Nordholt, C.G. Peterson, and C.M. Simmons. Practical free-space

quantum key distribution over 1 km. Phys. Rev. Lett., 81(15):3283–3286, October

1998.

[14] A.K. Ekert. Quantum cryptography based on bell’s theorem. Phy. Rev. Lett.,

67(6):661–663, August 1991.

[15] C.H. Bennett, G. Brassard, and N.D. Mermin. Quantum cryptography without

bell’s theorem. Phys. Rev. Lett., 68(5):557–559, 1992.

[16] M.O. Scully and M.S. Zubairy. Quantum optics. Cambridge, 1997.

[17] S.D. Bartlett and B.C. Sanders. Requirements for quantum computation. quant-

ph/0102125, February 2003.

[18] G. Brassard, N. Lutkenhaus, T. Mor, and B.C. Sanders. Limitations on practical

quantum cryptography. Phys. Rev. Lett., 85(6):1330–1333, August 2000.

170 BIBLIOGRAPHY

[19] S. Takeuchi, J. Kim, Y. Yamamto, and H. Hogue. Development of high quantum

efficiency single photon detection system. App. Phys. Lett., 74:1063–1065, 1999.

[20] J. Kim, S. Takeuchi, Y. Yamamoto, and H. Hogue. Multi-photon detection using

visible light photon counter. App. Phys. Lett., 74:902–904, 1999.

[21] J. Kim, Y. Yamamoto, and H.Hogue. Noise-free avalanche multiplication in si

solid state photomultipliers. App. Phys. Lett., 70:2852–2854, 1997.

[22] D.F. Walls and G.J. Milburn. Quantum Optics. Springer, Berlin, 1994.

[23] C. Shannon. Communication theory of secrecy systems. Bell Sys. Tech. J.,

28:656–715, October 1949.

[24] T.M. Cover and J.A. Thomas. Elements of information theory. Wiley, New York,

1991.

[25] G. Brassard and L. Salvail. Secret-key reconciliation by public discussion. Ad-

vances in Cryptology – EUROCRYPT ’93, Vol. 765 of Lecture Notes in Computer

Science, edited by T. Hellseth (Springer, Berlin, 1994), pp. 410-423, 1993.

[26] N.A. Gershenfeld and I.L. Chuang. Bulk spin-resonance quantum computation.

Science, 275(5298):350–356, January 1997.

[27] J.J. Sakurai. Modern quantum mechanics. Addison-Wesley, 1995.

[28] O. Alter and Y. Yamamoto. Inhibition of the measurement of the wave-function

of a single quantum system in repeated weak quantum-nondemolition measure-

ments. Phys. Rev. Lett., 74(21):4106–4109, May 1995.

[29] A. Peres. Quantum Theory: Concepts and methods. Kluwer, 1998.

[30] M.A. Nielsen and I.L. Chuang. Quantum computation and quantum information.

Cambridge, 2000.

[31] J. Brendel, N. Gisin, W. Tittel, and H. Zbinden. Pulsed energy-time entangled

twin-photon source for quantum communication. Phys. Rev. Lett., 82, 1999.

BIBLIOGRAPHY 171

[32] N.D. Mermin. Is the moon there when nobody looks - reality and the quantum-

theory. Physics today, 38(4):38–47, 1985.

[33] J.F. Clauser and A. Shimony. Bells theorem- experimental tests and implications.

Reports on progress in physics, 41(12):1881–1927, 1978.

[34] P.G. Kwiat, K. Mattle, H. Weinfurter, and A. Zeilinger. New high-intensity

source of polarization entangled photon pairs. Phys. Rev. Lett., 75(24):4337–

4341, December 1995.

[35] M.A. Rowe, D. Kielpinski, V. Meyer, C.A. Sackett, W.M. Itano, C. Monroe,

and D.J. Wineland. Experimental violation oa a bell’s inequality with efficienct

detection. Nature, 409(6822):791–794, February 2001.

[36] P.G. Kwiat, E. Waks, A.G. White, I. Appelbaum, and P.H. Eberhard. Ultra-

bright source of polarization-entangled photons. Phys. Rev. A, 60(2):R773–R776,

August 1999.

[37] C.H. Bennett, G. Brassard, C. Crepeau, R. Jozsa, A. Peres, and W.K. Wootters.

Teleporting an unknown quantum state via dual classical and einstein-podolsky-

rosen channels. Phys. Rev. Lett., 70(13):1895–1899, March 1993.

[38] D. Bouwmeester, J.W. Pan, K. Mattle, M. Eibl, H. Weinfurter, and A. Zeilinger.

Experimental quantum teleportation. Nature, 390(6660):575–579, December

1997.

[39] I. Marcikic, H. de Riedmatten, W. Tittel, H. Zbinden, and N. Gisin. Long-

distance teleportation of qubits at telecommunicatiion wavelengths. Nature,

421(6922):509–513, January 2003.

[40] H. J. Briegel, W. Dur, J.I. Cirac, and P. Zoller. Quantum repeaters: The

role of imperfect local operations in quantum communication. Phys. Rev. Lett.,

81(26):5932–5935, December 1998.

172 BIBLIOGRAPHY

[41] J.W. Pan, D. Bouwmeester, H. Weifurter, and A. Zeilinger. Experimental entan-

glement swapping: Entangling photons that never interacted. Phys. Rev. Lett.,

80(18):3891–3894, May 1998.

[42] H. Inamori, N. Lutkenhaus, and D. Mayers. Unconditional security of practical

quantum key distribution. quant-ph/0107017, July 2001.

[43] A.K. Ekert, B. Huttner, G.M. Palma, and A. Peres. Eavesdropping on euantum-

cryptographical systems. Phys. Rev. A, 50(2):1047–1056, 1994.

[44] B. Huttner and A.K. Ekert. Information gain in quantum eavesdropping. J.

Mod. Optics, 41(12):2455–2466, 1994.

[45] C.A. Fuchs, N. Gisin, R.B. Griffiths, C.S. Niu, and A. Peres. Optimal eaves-

dropping in quantum cryptography. i. information bound and optimal strategy.

Phys. Rev. A, 56(2):1163–1172, 1997.

[46] B.A. Slutsky, R. Rao, P.C. Sun, and Y. Fainman. Security of quantum cryptog-

raphy against individual attacks. Phys. Rev. A, 57(4):2383–2398, 1998.

[47] N. Lutkenhaus. Estimates for practical quantum cryptography. Phys. Rev. A,

59(5):3301–3319, 1999.

[48] N. Lutkenhaus. Security against individual attacks for realistic quantum key

distribution. Phys. Rev. A, 61(5):2304–, 2000.

[49] E. Biham and T. Mor. Security of quantum cryptography against collective

attacks. Phys. Rev. Lett., 78(11):2256–2259, March 1997.

[50] D. Mayers. Unconditional security in quantum cryptography. JACM, 48(3):351–

406, May 2001.

[51] E. Biham, M. Boyer, P.O. Boykin, T. Mor, and V. Roychowder. Proceedings

of the Thirty-Second Annual ACS Symposium of Theory of Computing (ACM

Press, New York, 2000), pp. 715-724.

BIBLIOGRAPHY 173

[52] P.W. Shor and J. Preskill. Simple proof of security of the bb84 quantum key

distribution protocol. Phys. Rev. Lett., 85(2):441–444, July 2000.

[53] C.H. Bennett, G. Brassard, C. Crpeau, and U.M. Maurer. Generalized privacy

amplification. IEEE Trans. Inf. Theory, 41(6):1915–1923, 1995.

[54] N. Lutkenhaus. Security against eavesdropping in quantum cryptography. Phys.

Rev. A, 54(1):97–111, 1996.

[55] C. Cachin and U.M. Maurer. Linking information reconciliation and privacy

amplification. J. Cryptology, 10:97, 1997.

[56] C. Santori, M. Pelton, G. Solomon, Y. Dale, and Y. Yamamoto. Triggered single

photons from a quantum dot. Phys. Rev. Lett., 86(8):1502–1505, February 2001.

[57] M. Pelton, C. Santori, J. Vuckovic, B. Zhang, and G.S. Solomon. Efficient source

of single photons: a single quantum dot in a micropost microcavity. Phys. Rev.

Lett., 89(23):233602, December 2002.

[58] J. Kim, O. Benson, H. Kan, and Y. Yamamoto. A single-photon turnstile device.

Nature, 397:500–503, February 1999.

[59] C. Brunel, B. Lounis, P. Tamarat, and M. Orrit. Triggered source of single

photons based on controlled single molecule fluorescence. Phys. Rev. Lett.,

83(14):2722–2725, October 1999.

[60] B. Lounis and W.E. Moerner. Single photons on demand from a single molecule

at room temperature. Nature, 407(28):491–493, September 2000.

[61] C. Kurtsiefer, S. Mayer, P. Zarda, and H. Weinfurter. Stable solid-state source

of single photons. Phys. Rev. Lett., 85(2):290–293, July 2000.

[62] P. Michler, A. Kiraz, C. Becher, W.V. Schoenfeld, P.M. Petroff, L.D. Zhang,

E. Hu, and A. Imamoglu. A quantum dot single-photon turnstile device. Science,

290(5500):2282, December 2000.

174 BIBLIOGRAPHY

[63] E. Moreau, I. Robert, J.M. Gerard, I. Abram, L. Manin, and V. Thierry-Mieg.

Single-mode solid-state single photon source based on isolated quantum dots in

pillar microcavities. App. Phys. Lett., 79(18):2865–2867, October 2001.

[64] Z.L. Yuan, B.E. Kardynal, R.M. Stevenson, A.J. Shields, C.J. Lobo, K. Cooper,

N.S. Beattie, D.A. Ritchie, and M. Pepper. Electrically driven single photon

source. Science, 295(5552):102–105, January 2002.

[65] A. Beveratos, S. Kuhn, R. Brouri, T. Gacoin, J.P. Poizat, and P. Grangier.

Roon temperature stable single photon source. Euro. Phys. J. D, 18(2):191–196,

February 2002.

[66] V. Zwiller, H. Blom, P. Jonsson, N. Panev, S. Jeppesen, T. TSegaye, E. Goobar,

M.E. Pistol, L. Samuelson, and G. Bjork. Single quantum dots emit single

photons at a time: Antibunching experiments. App. Phys. Lett., 78(17):2476–

2478, April 2001.

[67] H.K. Lo and H.F. Chau. Unconditional security of quantum key distribution

over arbitrarily long distances. Science, 283:2050–2056, March 1999.

[68] H. Aschauer and J. Briegel. Secure quantum communication over arbitrary dis-

tances. e-print quant-ph/0008051, 2000.

[69] H. Inamori. Security of epr-based quantum key distribution. e-print quantum-

ph/0008064, 2001.

[70] D. Mayers and A. Yao. Quantum cryptography with imperfect apparatus. e-print

quant-ph/0007058, September 1998.

[71] D. Mayers. Self-checking quantum apparatus and violation of classical locality.

To be published., 2000.

[72] O. Benson, C. Santori, M. Pelton, and Y. Yamamoto. Regulated and entangled

photons from a single quantum dot. Phys. Rev. Lett., 84(11):2513–2516, March

2000.

BIBLIOGRAPHY 175

[73] M. Bourennane, F. Gibson, A. Karlsson, A. Hening, P. Johnson, T. Tsegaye,

D. Ljunggren, and E. Sundberg. Opt. Express, 4:383, 1999.

[74] J. Calsamiglia and N. Lutkenhaus. Maximum efficiency of a linear-optical bell-

state analyzer. e-print quant-ph/0007058, July 2000.

[75] J.M. Gerard and B. Gayral. Strong purcell effect for inas quantum boxes in three-

dimensional solid-state microcavities. J. Lighwave Technol., 17(11):2089–2095,

November 1999.

[76] J. Vuckovic, D. Fattal, C. Santori, G.S. Solomon, and Y. Yamamoto. Enhanced

single-photon emission from a quantum dot in a micropost microcavity. Submit-

ted to App. Phys. Lett.

[77] R. J. McIntyre. Multiplication noise in uniform valanche diodes. IEEE Trans-

actions of Electron Devices, ED-13:164–168, 1966.

[78] R. LaViolette and M. Stapelbroek. A non-markovian model for valanche gain

statistics for a solid-state photomultiplier. Journal of Applied Physics, 65:830–

836, 1989.

[79] M. Atac, J. Park, D. Cline, D. Chrisman, M. Petroff, and E. Anderson. Scin-

tillating fiber tracking for the ssc using visible light photon counters. Nuclear

Instruments and Methods in Physics Reseach A, 314:56–62, 1992.

quantum information processing with non-classical light

Documents

Transcript of quantum information processing with non-classical light