Coherent State Quantum Key Distribution with Entanglement Witnessing
aa r X i v : . [ qu a n t - ph ] S e p Coherent State Quantum Key Distribution with Entanglement Witnessing
David S. Simon,
1, 2
Gregg Jaeger,
2, 3 and Alexander V. Sergienko
2, 4, 5 Dept. of Physics and Astronomy, Stonehill College, 320 Washington Street, Easton, MA 02357 Department of Electrical and Computer Engineering,Boston University, 8 Saint Mary’s St., Boston, MA 02215, USA Division of Natural Sciences and Mathematics, Boston University, Boston, MA 02215, USA Photonics Center, Boston University, 8 Saint Mary’s St., Boston, MA 02215, USA Dept. of Physics, Boston University, 590 Commonwealth Ave., Boston, MA 02215, USA
An entanglement witness approach to quantum coherent state key distribution and a system forits practical implementation are described. In this approach, eavesdropping can be detected by achange in sign of either of two witness functions, an entanglement witness S or an eavesdroppingwitness W . The effects of loss and eavesdropping on system operation are evaluated as a functionof distance. Although the eavesdropping witness W does not directly witness entanglement forthe system, its behavior remains related to that of the true entanglement witness S . Furthermore, W is easier to implement experimentally than S . W crosses the axis at a finite distance, in amanner reminiscent of entanglement sudden death. The distance at which this occurs changesmeasurably when an eavesdropper is present. The distance dependance of the two witnesses due toamplitude reduction and due to increased variance resulting from both ordinary propagation lossesand possible eavesdropping activity is provided. Finally, the information content and secure keyrate of a continuous variable protocol using this witness approach are given. PACS numbers: 03.67.Dd, 03.65Ud, 03.67.Hk, 42.50.Ex
I. INTRODUCTION
The goal of quantum key distribution (QKD) is fortwo participants (Alice and Bob) to generate a sharedcryptographic key of bits in such a way that quantummechanics prevents an eavesdropper (Eve) from obtain-ing significant information about the key without beingdetected. QKD schemes [1, 2] based on the transmis-sion of single photons or entangled photon pairs tendto be highly secure [3]. However, because single pho-tons can be easily absorbed or deflected, the operationaldistances and key generation rates of these schemes arelimited. It is often desirable to instead use pairs of en-tangled coherent states, because individual-photon-levellosses have little effect on them. Along with this benefitcomes the challenge of revealing the action of eavesdrop-pers: it suffices for Eve to obtain only a small fractionof the coherent state beam to measure the transmittedstate. Moreover, although pairs of entangled coherentstates can be created [4, 5], randomly modulating themas needed for QKD is a nontrivial task.Recently [6], a technique applicable to detection of aneavesdropper on a quantum optical communication chan-nel was proposed which involved phase-entangling twocoherent state beams by interaction with a single photoninside a nonlinear medium. In that scheme, a beam split-ter first puts a photon into a superposition of two pos-sible path states. A phase shift is induced conditionally,depending on the path state, so that the pair of beamsbecomes phase-entangled. Alice and Bob each receiveone beam and make homodyne measurements to deter-mine its phase. The relative phase between the beamsdetermines the bit value to be used in the key. Effectsdue to eavesdropping are made detectable by introducing additional interferometers with controllable phase shifts σ and σ just before each of the detectors, respectively.Interference terms then appear in the joint detection rateas σ and σ are varied. If the beams have not been dis-turbed in transit, the visibility of this interference shouldbe greater than √ ≈ . . S [9] used is negative for all finite dis-tances when the coherent states propagate undisturbed;however, S changes sign to a positive value in the pres-ence of eavesdropping, thus revealing Eve’s intervention.Another related witness function W which is more easilymeasured but does not directly indicate entanglement inour system can also serve this purpose. To our knowl-edge, this is the first time such an approach has beenproposed for use in QKD.As in [6], which involves the Bell inequality, the maingoal of these functions is simply to reveal the presence ofeavesdropping on the line; when the eavesdropper’s signa-ture is observed, the communicating parties know to shutdown the line and seek another communication channel.The actual bits either may be derived from the entangledphases or they may arise from normal telecom approachesof modulating the intense coherent states. In this sense,the goal is to provide a “quantum tripwire” for practicaluse, as opposed to absolute security in the sense that thephrase is commonly used in QKD. In other words, thebasic idea is to take a more pragmatic approach to com-munication by providing an extra quantum-based layerof security to support highly efficient classical communi-cation. As a result, our primary goal is less general andless difficult to achieve than other continuous variableprotocols [10–16] that have been proposed with the goalof unconditional security in mind. Nonetheless, as dis-cussed in Sec. VII the witness approach is used directlyon the key-bit transmitting system to provide security tofully quantum communication as well.It is because the witness S itself involves third-ordercorrelation functions, which may be inconvenient to im-plement experimentally, that we also consider the sec-ond witness function W . W is related by rescaling ofthe quadratures to a well-known entanglement witness W s [17, 18], but is not in the strict sense a true entan-glement witness in the current context. Despite this, itgives eavesdropper-detection results that match well withthose of S , and has the additional advantage that it isbuilt from the covariance matrix of the system, whichis easily accessible experimentally. W starts from an ini-tially negative value, but then crosses the axis to positivevalues at finite distance, both during free propagationand in the presence of eavesdropping. This is closely anal-ogous to the phenomenon of entanglement sudden death(ESD) [19], in which entanglement is lost after propagat-ing a finite distance. The crossing occurs at a distancethat can be easily predicted when there is no eavesdrop-ping present. When eavesdropping occurs, the curve of W versus distance shifts by a measurable amount; in par-ticular, there is a clear alteration of the distance at whichthe sign changes, allowing for easy detection.We will collectively refer to quantities which are mea-surably altered by predictable amounts in the presenceof eavesdropping as eavesdropping witnesses; both thetrue entanglement witness S and the additional function W are examples of such functions. It is shown that thetwo give consistent results for the distance over which theentanglement becomes unusable for eavesdropper detec-tion.Throughout this paper, coherent state quadratures willbe defined in terms of creation and annihilation operatorsvia the relationsˆ q = 12 (cid:0) ˆ a + ˆ a † (cid:1) , ˆ p = 12 i (cid:0) ˆ a − ˆ a † (cid:1) . (1)It should be noted that there are several other normal- ization conventions that are common in the literature,with different constants in front on the right-hand side.Accordingly, when results from other authors are quotedin the following sections, the form used here may differfrom their originally published forms by factors of two insome terms.We begin in Section II by describing the entangledstates under consideration and their means of produc-tion. The eavesdropping model assumed is described inSec. III. There, we model the eavesdropping procedureby introducing a Gaussian cloner into the path of one ofthe coherent states. We then introduce the entanglementwitness S and analyze its behavior in Section IV. In or-der to have a more convenient experimental measure, wethen introduce W in V, and look in section VI at someof its properties, with emphasis on its behavior undereavesdropping. Discussion of some information-relatedaspects in Sec. VII is then followed by a brief discussionof the results in section VIII. II. PHASE-ENTANGLED COHERENT STATES
The apparatus for the proposed system is shown inFig. 1 (a). A laser followed by a beam splitter producesa pair of optical coherent states, each in state | α i . As in[6], the coherent state subsystem pair initially producedin state | α i A | α i B becomes entangled in an interferometerby coupling to a single photon. A beam splitter firstcauses the photon state to enter a superposition of twopath eigenstates. Then if the photon is in the upper pathstate, beam B gains a phase shift 2 φ due to cross-phasemodulation of the photon with that beam in a nonlinearKerr medium [20–25], whereas if the photon is in thelower path state, then there is a phase shift of 2 φ inbeam A . Finally, by adding another constant phase shiftto each beam, we can then arrange the output to be inthe entangled state | ψ i = N √ (cid:0) | α + i A | α − i B + e iθ | α − i A | α + i B (cid:1) , (2)where | N | − = (cid:16) θ e − | α | sin φ (cid:17) (3)and α ± ≡ αe ± iφ . (For simplicity, we do not explicitly in-dicate the single-photon states.) In the following, opera-tors with subscripts 1 and 2, respectively, will correspondto Alice’s beam and to Bob’s.Note that, whereas ± φ are the phase shifts of the co-herent states within a given path state, θ is the relativephase between the two joint path states of the photon.The value of joint phase θ can be controlled by the ex-perimenters: Keeping only events in which the photonis detected at detector 1 leads to θ = π , while events inwhich it exits at detector 2 lead to θ = 0. (Other valuesof θ can be achieved if desired by, for example, puttinga piece of glass in one of the potential single photon L ase r KerrKerr + +-- BSBS ToAliceToBob
EntanglingInterferometer
DetectionStageDetectionStage (a) L ase r KerrKerr + +-- +-+ - σ σ BS BSBS BSBS
Alice’sHomodyneDetector
EntanglingInterferometer BellInterferometers
Bob’sHomodyneDetector (b)
FIG. 1: (Color online) Schemes for phase-based coherent statekey distribution with single-photon triggers. (a) Scheme ofthe current paper. A beam splitter splits a laser beam intotwo beams in identical coherent states (solid black lines); aphase shifter compensates for the phase gained in the reflectedstate. A single photon also enters a superposition of two pathstates (dashed red lines). Due to the joint interaction of co-herent state and the photon within Kerr media, the beamsenter an equal-weight superposition of product states of pairsof oppositely phase-shifted coherent states. The specific formof the detection unit will be different for each of the applica-tions to be discussed in the text. (b) Scheme of [6], with twoadditional interferometers to test for Bell violations. paths.) If the interferometer lacks stability, randomly-varying phases in the single-photon paths could lead todecoherence. But these photons could be kept on a sin-gle bench in Alice’s lab and be well-controlled to pre-vent this. Fluctuations in the phases of the coherentstates | α ± i A | α ∓ i B → | α ± e iδφ ( t ) i A | α ∓ e iδφ ( t ) i B wouldbe a more serious problem because these are shared be-tween labs that may be widely separated. This randomphase variation is an independent source of entanglementloss, separate from the entanglement loss due to ampli-tude decay and eavesdropping. (We focus here on thelatter, leaving the former to be discussed elsewhere.)Using homodyne detection, each participant can mea-sure the phase of his or her beam to determine the sign ofits shift. Because the shifts in the two beams are alwaysopposite, this is sufficient for Alice and Bob to obtaincommon key bits; for example, if Alice has + φ and Bob has − φ , they can take the common bit value to be 0,while the opposite case then corresponds to 1.Unfortunately, an eavesdropper may extract part of thebeam and determine the bit transmitted. Although thiscannot be prevented , it can be detected , so that Alice andBob can prevent key material from being compromisedby shutting down the communication line. Recall that,for the purpose of revealing Eve’s intervention, the pro-posal of [6] is to include two additional interferometers(Fig. 1 (b)), each coupling one beam to another photonin order to detect nonlocal interference for Bell inequalitytests. That approach has at least two limitations: (i) Onthe theoretical side, detecting Eve only requires entan-glement , which in practice may still exist even when theBell inequality is not violated [26]; thus, the setup testsfor a less than ideal property. (ii) On the experimen-tal side, simultaneous single-photon events are needed in three independent interferometers . This low-probabilitytriple-coincidence in widely-separated interferometers isa significant practical limitation. The method given inthe present paper avoids this problem by removing theneed for more than one interferometer.Because the amplitude of the input beam can be easilytuned, the system can be adjusted to work at different op-erating distances, potentially (as we see in the followingsections) up to distances of several hundred kilometers.Current technology can realistically reach amplitudes | α | of up to 10 − without doing damage to the fibers orproducing high amounts of fluorescence and scattering;but for illustrative purposes of future potential we haveincluded plots with values of up to 10 at some points inthe following. III. THE EFFECT OF EAVESDROPPING
To examine measures against eavesdropping, we con-sider the case in which Eve attaches a Gaussian cloner[27] to one of the beams, which we assume to be Bob’s.The cloner takes an input beam and makes two copiesthat have the same mean amplitude as the input. Evekeeps one beam and sends the other on to Bob. But in-evitably, there is a net increase in the variance of Bob’sbeam that will indicate her presence. Moreover, the moreexact a copy Eve’s beam is (i.e. the lower its variance),the larger the disturbance to Bob’s beam. Specifically,if σ Bj and σ Ej (for j = q, p ) are the added variances toBob’s beam and to Eve’s, in excess of the initial variance,then these variance increases must satisfy [27]: σ Bq σ Ep ≥ , σ Bp σ Eq ≥ . (4)For optimal cloning devices, the effect on the q and p quadratures should be the same; henceforth, we thereforeassume that σ q = σ p ≡ σ for all participants.In addition to the increased variance, any cloning de-vice will involve additional input ports besides the one Cloner ĉ in Input (To Eve)(To Bob)Vacuum â in b in ˆ Output ĉ out â out b out ˆ (Ancilla)FromSource (a) NOPABS BS â IN â OUT c IN b OUT b IN c OUT ˆ ˆ ˆˆ (b)
FIG. 2: (Color online) A model of a Gaussian cloner [28] applied by Eve to Bob’s beam. The cloner can be realized by combiningan amplifier with a beam splitter. Besides the input from the source ( a in ), there are two additional inputs: one to the amplifier( b in ), the other to the first beam splitter ( c in ). The result is two outputs with quadratures that have means equal to that ofthe input. One copy ( a out ) is sent on to Bob. Eve keeps the other ( c out ) to make measurements on. carrying the state to be cloned. These will introduce ad-ditional unmeasured fluctuations, converting a pure in-put state into a mixed output state [27], consequentlyleading to a loss of coherence between previously entan-gled states. We consider eavesdropping on only one ofthe two channels because, given our emphasis on eaves-dropper detection, this is the most advantageous situa-tion for Eve: placing cloners in both channels can onlymake make her situation worse by affecting Alice’s stateas well.A generic schematic of a Gaussian cloner is shown inFig. 2(a). In addition to the input beam to be cloned(represented by annihilation operator ˆ a in = ˆ a ), thereis an input ˆ c in , assumed to be in a vacuum state, ontowhich the clone is to be imprinted at output. One fur-ther input port ˆ b in leads to an internal amplifier. Weassume the specific model of Ref. [28], realized in termsof two beam splitters and a nondegenerate optical para-metric amplifier (NOPA), as in Fig. 2(b). There arethree output beams: an ancilla (ˆ b out ) and two clones ofthe input state. One clone (ˆ a out ) is sent on to Bob, andone (ˆ c out ) is kept by Eve. The input-output relations forthe operators in the Heisenberg picture are [28]ˆ a out = ˆ a in − e − γ √ (cid:16) ˆ c in + ˆ b † in (cid:17) (5)ˆ b out = −√ γ ˆ c † in + √ γ ˆ b in − ˆ a † in (6)ˆ c out = ˆ a in + e + γ √ (cid:16) ˆ c in − ˆ b † in (cid:17) . (7)Here, the asymmetry between the two clones is measuredby a parameter ξ which has value ξ = ln 22 for the sym-metric case. Then γ = ξ − ln 22 measures the deviationfrom symmetry. The optimal case of γ = 0 produces fi-delity F a = F c = for both clones. It is readily verifiedthat the mean values at both outputs are unchanged fromthe input, h ˆ q E i = h ˆ q ′ i = h ˆ q i and h ˆ p E i = h ˆ p ′ i = h ˆ p i . Itis also straightforward to show that the variances satisfy∆ q a,out = ∆ q a,out + 14 e − γ (8)∆ p a,out = ∆ p a,out + 14 e − γ (9) for the clone sent to Bob, and∆ q c,out = ∆ q c,out + 14 e +2 γ (10)∆ p c,out = ∆ p c,out + 14 e +2 γ (11)for the clone kept by Eve. Due to the cloning procedure,Bob and Eve each therefore gain added variances (beyondthe original variance of the beam in transit to Bob) of σ B = e − γ and σ E = e γ , respectively.In the Schr¨odinger picture, the cloner has the effect ofaltering the state: a pure input state will be converted toa mixed output with a probability distribution of width σ B [27], which will inevitably damage or destroy the en-tanglement of the cloned state with Alice’s state. IV. ENTANGLEMENT WITNESS APPROACH.
Recall that, using the Bell–CHSH inequality, the ab-solute value of the expectation value of the Bell–CHSHoperator B , when properly applied, provides a necessaryand sufficient indication of the presence or absence of en-tanglement for pure states. In that sense, the absolutevalue |B| is the longest-used strong entanglement witness.Here, in place of |B| falling below the critical Bell inequal-ity value 2 as the indicator of loss of entanglement, weuse the loss of the negative-valuedness of an entangle-ment witness S that is observable with a much simplerapparatus. To our knowledge, this is the first time theuse of an entanglement indicator other than the expecta-tion value of a Bell-type operator has been proposed foruse in entangled coherent state QKD.An entanglement witness is a quantity which is neg-ative whenever a system is entangled; in general, whenit is non-negative this is no longer the case and nothingcan be said about the entanglement or separability of thesystem. Entanglement witnesses can often be based onthe positive partial trace (PPT) criterion of [29, 30]. Forcontinuous variables, the most common such witnessesare formed from the second-order correlation functions(i.e. on covariance matrices). These are extremely use-ful because Gaussian states are completely determinedby their means and covariance matrices; as a result, suchwitnesses often completely characterize the entanglementproperties of Gaussian states. In particular, some entan-glement witnesses, such as the function W s mentioned insection V, are both necessary and sufficient conditionsfor entanglement when applied to Gaussian states, be-ing positive if and only if the state is separable. Suchwitnesses are referred to as strong witnesses.However, covariance-based entanglement measures,which do not take into account correlations among highermoments, may not be fine enough a measure to de-tect entanglement in non-Gaussian systems, so a num-ber of higher-order entanglement measures have been dis-cussed in the literature [9, 31–34]. These involve expec-tation values of operators formed from products of morethan two creation or annihilation operators (or, equiv-alently, products of more than two quadrature opera-tors). Here we will consider one such measure, denoted S , and show that it can detect the presence of eavesdrop-ping: when an eavesdropper acts, it will switch sign fromnegative to positive values. Because S is only a neces-sary and not a sufficient measure for entanglement - inother words, it is not a strong witness - it cannot be saidwith certainty that entanglement is lost when the signchanges. Whether or not entanglement persists after thesign change is ultimately beside the point for our cur-rent purpose: the sign change in any case indicates thepresence of an eavesdropper, which is our goal. In addi-tion, so long as the sign does remain negative we can saywith certainty that the system remains entangled, andthat under an appropriate protocol it therefore remainssecure. If S < S ≥
0, communicationshould be shut down in order to assure security, eventhough there is a chance that entanglement still persists.The entanglement witness to be used here was intro-duced in [9] and is defined by the determinant S = (cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12) h ˆ a † i h ˆ a ˆ a † ih ˆ a i h ˆ a † ˆ a i h ˆ a ˆ a † ˆ a ih ˆ a † ˆ a i h ˆ a † ˆ a † ˆ a i h ˆ a † ˆ a ˆ a † ˆ a i . (cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12) (12)Here ˆ a is the annihilation operator at Alice’s locationand ˆ a is the corresponding operator for Bob’s. Thiswitness is valid for any state, Gaussian or otherwise, andwhen it is negative the state is guaranteed to be en-tangled. Because S involves third-order correlations inaddition to second and fourth order, it is more difficultto measure experimentally, although such measurementshave been done [35]. The only change of the setup fromFig. 1(a) is that the homodyne detectors would be re-placed by a more complex detection unit.Given the explicit form of the entangled bipartite co-herent state | ψ i given in Eq. (2), S can be readily calcu-lated. We find the elements of the matrix at zero distance are h ˆ a † i = h ˆ a i = α cos φ (13) h ˆ a ˆ a † i = h ˆ a † ˆ a i = α | N | (cid:16) cos 2 φ + e − α sin φ (cid:17) (14) h ˆ a † ˆ a i = α | N | (cid:16) φe − α sin φ (cid:17) (15) h ˆ a ˆ a † ˆ a i = α cos φ (16) h ˆ a † ˆ a ˆ a † ˆ a i = α . (17)It is straightforward to verify that S → α → α → ∞ , while S < α . Allterms in the determinant are proportional to α , withadditional amplitude dependence coming from the expo-nential terms in Eqs. (14) and (16); the latter terms arenegligible except when α <<
1. For small φ , the terms in S nearly cancel, leaving S with a small (negative) value. S → φ →
0, i.e. as the state becomesseparable.Distance dependance can be taken into account by re-placing the amplitude in each arm by α → α j ( d j ) = αt j ( d k ), where t j is a transmission function in the j thbranch, for j = 1 ,
2. We assume that φ << αφ >> α will eventually decay tosmall values, at which point the phase space regions cen-tered at αe ± iφ may begin to overlap, resulting in entan-glement loss. For propagation losses alone, the transmis-sion functions are of form t j ( d j ) = e − K j d j , with prop-agation distance d j in each arm. When these losses areincluded, expressions of the form h ˆ a l ˆ a † m ˆ a n ˆ a † p i are multi-plied by factors of e − K [( l + m ) d − ( n + p ) d ] , while the expo-nential terms in Eqs. (13)-(17) and in the normalizationconstant Eq. (3) become exp (cid:16) − α e − K ( d + d ) sin φ (cid:17) . Given this, the entanglement witness can be calculatedas a function of distance for various parameter values.Plots of S versus distance are shown in Fig. 3 forseveral parameter values. Two cases are shown: thecase of equal decay in both arms (Alice and Bob equaldistances from the source), and for decay in one armonly (Alice acting as the source). Note that for theasymmetric case, S has been multiplied by 100 in Fig.3(a) in order to display it on the same scale as thesymmetric case. As expected, S is initially small andnegative. As the amplitudes decay, the exponentialterms in Eqs. (14) and (15) start to become significantwhen exp (cid:16) − α e − K ( d + d ) sin φ (cid:17) becomes comparablein size to cos 2 φ . This signals the beginning of significantoverlap between the two phase space regions in Fig. 4.At this point, there is a negative dip is S , followed byan asymptotic decay back toward zero, due to the decayof the overall α ( d ) dependance. The latter decay re-sults from the regions of Fig. 4 approaching the vacuumstate at the origin. Thus, the dips occur at the pointwhere the entanglement starts to become unusable dueto photon loss,and therefore signals the outer limits ofthe distance at which the method is useful for the giveninput parameters. S x 100 S Distance from source (km)
FIG. 3: (Color online) (a) Behavior of entanglement witness S as a function of distance, assuming that the amplitudeshave decay constants K = .
046 k m − . Here, α = 100 and φ = .
1. The red dashed line assumes symmetric decay. Thesolid blue line assumes that the source is in Alice’s lab, sothat decay occurs only on one side; the values in this lattercase were magnified by a factor of 100 before plotting.
Note from the figure that although the large negativedip is orders of magnitudes smaller when the decay is oc-curring in only one arm, it occurs at roughly twice thedistance. The zero crossing of W will similarly be seenin the next section to occur at twice the distance in theasymmetric case. This is significant because it meansthat the mechanism for eavesdropper detection will workover roughly twice the distance in the asymmetric case.As shown in Fig. 4, the entanglement loss is slower inthe asymmetric case because the two states may initiallymove apart as one of them approaches the origin morerapidly than the other. In any event, as will be seen inthe next section, the dips in S occur at roughly the loca-tion where the photon number has decayed to the pointwhere homodyne measurements become imprecise. Thus,predictions beyond the beginning of these dips should beconsidered meaningless. Henceforth, except when statedotherwise, the figures in the remainder of this paper willbe plotted for the symmetric case versus total Alice-Bobdistance, d = d + d ; plotted this way, the asymmetriccase shows only minor differences, aside from a change ofscale.Replacing ˆ a in Eq. (12) by the output ˆ a out of a cloner,the effect of eavesdropping on S can be evaluated. Ex-amples of the results are shown in Fig. 5. It is clear fromthe plots that S < S > S is only slightly negative at most distances, itonly requires a small disturbance to tip it to the posi-tive side of axis. The initially large size of the positive S values in the presence of eavesdropping may seem sur-prising, but it can be traced to its source: the large valueof h ˆ a † ˆ a i acts as a multiplier, magnifying changes in S .To see this, note first that if S is expanded out explic-itly in terms of expectation values, the only terms thatchange when the eavesdropper acts can be written in the FIG. 4: (Color online) The larger distance of disentanglementfor the asymmetric case in Fig. 3 is due the fact that the twocoherent states move apart in phase space, whereas in thesymmetric case both decay toward the same vacuum state. form (cid:16) h ˆ a † ˆ a i − h ˆ a † i (cid:17) h ˆ a † ˆ a ˆ a † ˆ a i . (18)The terms in the parentheses can be written as h ∆ q +∆ p + i [ˆ p , ˆ q ] i , which is nonnegative on general quantummechanical principles; for the specific states considered inthis paper, it can be written more concretely as α sin φ ,which is also clearly non-negative. Since this term is pos-itive, S will increase if the fourth order term multiplyingit increases. With eavesdropping, the fourth-order term does increase by an amount proportional to h ˆ a † ˆ a i e − γ ,which in turn is proportional to Alice’s squared ampli-tude, α . At small distances, S is initially small andnegative, but the amplitude α is large, so that this termadds a large positive value to the entanglement witness.In more physical terms, the cloner transforms the initialpure state en route to Bob into a mixed state, leading toa decrease in entanglement; the effect of this loss on thewitness is large because it is multiplied by the coherentstate amplitude, which we explicitly assume to be large.The loss of decoherence results from the fact that notonly are the phase space regions in Fig. 4 larger, theirlocations fluctuate relative to each other about fixed av-erage positions as a result of the uncontrolled relativephase fluctuations introduced by the cloner. V. AN EAVESDROPPING WITNESS
In analogy to an entanglement witness, we wish now tointroduce the concept of an eavesdropping witness. Wewill define this to be an experimentally measurable func-tion of the system’s state which changes value in a pre-dictable manner whenever an eavesdropper acts on thesystem. Here we will introduce such a measure that willgive results closely related to those of the entanglementwitness S introduced in section IV. So this new function FIG. 5: (Color online) Behavior of entanglement witness S asa function of distance, with and without eavesdropping, for α = 1000 and φ = .
1, assuming symmetric decay. The curvescorrespond to no eavesdropping (solid red), γ = 0 (dashedgreen), γ = − γ = − will also witness eavesdropping but is much easier to mea-sure. This eavesdropping witness W is constructed fromthe covariance matrix of the system, and will change signsfrom negative to positive at a distance that can be easilycalculated. This distance changes in a predictable man-ner when the system is interfered with, thus signallingthe presence of an eavesdropper.Let ˆ q , ˆ p be orthogonal quadratures for beam A andˆ q , ˆ p be corresponding quadratures for B. Form thevector: ˆ η = (ˆ q , ˆ p , ˆ q , ˆ p ) . The covariance matrix V is defined as the 4 × V ij = h{ ˆ η i − h η i i , ˆ η j − h η j i}i , where { .. , .. } denotes the an-ticommutator and angular brackets denote expectationvalue. V can be expressed in terms of three 2 × V = (cid:18) A CC T A (cid:19) . A and A are the self-covariancematrices of each beam separately; C describes correla-tions between the A i . An eavesdropping witness derivedfrom the covariance matrix is then defined as W = 1 + det V + 2 det C − det A − det A . (19)This function W is similar in form to an entanglementwitness W s introduced in [17] and studied in detail in[18], but due to the normalization differences mentionedin the introduction, it is not the same function and sohere is not a true entanglement witness. W and W s are infact related by a rescaling of the quadratures, but for thestates considered in this paper W s vanishes identically.It can be shown that for Gaussian states, a system isentangled if and only if W s < W s , like S , is basedon the positive partial trace criterion [29, 30]; howeverbecause W s is quadratic in the quadrature operators, itis unable to detect some forms of entanglement that canbe detected by the quartic operator S . The vanishing of W s on the states used here is due to the fact that theyare not strictly Gaussian; however we will make use insection VII of the fact that the non-Gaussian terms aresmall for large α .Using an eavesdropping witness derived from the co-variance matrix, as W is, has distinct advantages, since Alice-Bob Distance (km)
FIG. 6: (Color online) Eavesdropping witness W value ver-sus Alice-Bob distance d = d + d . From left to right, thecurves have parameter values | αφ | = 10, | αφ | = 20, | αφ | = 50, | αφ | = 100, | αφ | = 500, | αφ | = 1000, and | αφ | = 5000. K = . km − is used for the 1550 nm telecom window.An expanded view of the region enclosed in the dashed boxis shown in Fig. 7 V is experimentally measurable via heterodyne detectionand its expected behavior with distance is straightfor-ward to calculate. So deviations from its expected dis-tance dependence are easily detected. The eavesdrop-per’s actions affect the various covariances and momentsof the states; the idea is to find a function which distillsthese effects into a single number in a useful way. Clearly,many such functions are possible, but we examine herejust one example.Assuming loss rates K and K in each arm, then thecovariance matrix is V = (cid:18) A ′ C ′ C ′ T A ′ (cid:19) = a ′ b ′ a ′ c ′ b ′ a ′ c ′ a ′ , (20)where a ′ j ( d j ) = | α | (cid:0) | N | f ( θ, φ, d j ) − (cid:1) e − K j d j + 14(21) b ′ ( d , d ) = | α | (cid:0) | N | g ( θ, φ, d , d ) (22) − cos 2 φ ) e − ( K d + K d ) c ′ ( d , d ) = | α | (cid:0) | N | g ( θ, φ, d , d ) (23) − e − ( K d + K d ) with j = 1 ,
2. Here we have also defined f ( θ, φ, d j ) = h φ cos θe − | α | sin φ e − Kdj i (24) g ( θ, φ, d , d ) = [cos 2 φ (25)+ cos θe − | α | sin φ e − ( K d K d / i . The values of a ′ , b ′ , c ′ at zero distance will be denotedby a, b, c . Distance dependance also arises through Alice-Bob Distance (km)
FIG. 7: (Color online) Expanded view of the region enclosedin the dashed box in Fig. 6. The curves have parameter values | αφ | = 500(dashed brown), | αφ | = 1000 (dotted violet), and | αφ | = 5000 (solid red). K = . km − is used for the1550 nm telecom window. N ( d , d ). The entanglement witness is then W = 1 + ( a ′ a ′ ) + ( b ′ c ′ ) − ( b ′ + c ′ ) a ′ a ′ +2 b ′ c ′ − a ′ − a ′ . (26)Henceforth we assume that in both channels the ratefor fiber loss is that of the 1550 nm telecom window, K = K ≡ K = . km − , corresponding to 3 dB lossper 15 km. We also write now for the most part expressresults in terms of the total Alice-to-Bob distance, d = d + d . In this manner, the symmetric case (equal traveldistances in both channels, d = d ) and the case whereAlice generates the state in her lab ( d = 0, with no losseson her side) can both be expressed in a unified manner.Plots of W vs. distance are given in Fig. 6. W starts withlarge negative values at d = 0 and its magnitude decaysrapidly with distance due to propagation losses. Closeinspection shows that W crosses from negative to positivevalues at finite distances (see the expanded version in Fig.7).The exponential terms in f and g are negligible exceptat large distances, by which point the α ( d ) terms thatmultiply them in Eqs. (21)-(23) have decayed away. Asa result, these terms can be neglected for most purposes.Dropping them, it is then seen that all of the curves inFig. 7 converge to a common asymptote as | α | → ∞ ,located at W = (1 − a ) = (cid:0) (cid:1) ≈ . . VI. CROSSING THRESHOLDS
Entanglement sudden death (ESD) is the sudden lossof entanglement in finite time—corresponding here to fi-nite distance—in contrast to the more common asymp-totic loss of entanglement due to decoherence [19, 36, 37].Although, as mentioned, the eavesdropping witness W isnot an entanglement witness, behavior analogous to ESDoccurs here. The point at with the axis is crossed moves FIG. 8: (Color online) The distance d at which axis crossingoccurs, as a function of the parameter | αφ | ≈ | α sin φ | for K = . km − . The solid blue curve is the Alice-to-Bobdistance. This the same as the source-to-Bob distance for thecase of loss in only one arm (source in Alice’s lab), and isdouble the source-to-Bob distance for case of equal distancesin both branches (dashed red curve). in the presence of eavesdropping and closely tracks fea-tures of the true entanglement S witness discussed in Sec.IV; as a result, the location of this crossing point can beused as means of eavesdropper detection.For φ = 0 the matrix elements reduce to a = and b = c = 0, so we find that W = 1 − a − a = (1 − a ) = (cid:0) (cid:1) > , at all distances. But for nonzero φ , W changessign when | α ( d ) | = q csc φ . Solving for distance,we find that the sign change occurs when the distancebetween Alice and Bob is d = 2 K ln r α sin φ ! . (27)These results are plotted in Fig. 8. Although here werestrict ourselves to small φ , it may be noted in passingthat, for fixed α , the crossing distance is largest at φ = π ,i.e. when the entangled states are | α i and | − α i . Asthe distance formula makes clear, crossing can alwaysbe made to occur at any distance desired by choosingappropriate values of φ and α .Let us now consider the effect of eavesdropping on W .The variances on the diagonal of A are increased by e − γ , so the crossing distance is now altered in the pres-ence of eavesdropping to the new value d ( γ ) = 2 K ln "r (cid:18) − e − γ (cid:19) − α sin φ . (28) d ( γ ) becomes complex for γ < γ , where γ ≡ − ln 15 ≈− . γ thereis no crossing, and W is always negative. This lackof axis-crossing provides a clear and unambiguous sig-nal of eavesdropping. For γ > γ , the crossing dis-tance becomes finite, starting at large values and decay-ing rapidly to d as γ increases (Fig. 9). Since the ratio FIG. 9: (Color online) The solid blue line is the distance d ( γ )(in kilometers) between Alice and Bob at which W crossesthe axis, as a function of eavesdropping parameter γ . Theamplitude and phase values assumed are α = 10 and φ = . d in the absence ofeavesdropping.FIG. 10: (Color online) The ratio of added variances for Boband Eve, r = σ E σ B is plotted versus γ , for φ = .
1. The curve isindependent of α . of Eve’s added variance (beyond the vacuum value) toBob’s added variance, r = σ E σ B = e γ , increases expo-nentially with γ , the shift in crossing point is large (orinfinite) for parameter values where Eve can measure thequadratures with precision (large negative γ ). The shiftonly becomes too small to detect exactly in the regionwhere Eve’s variance is too large for her to extract anaccurate measurement (positive γ ). This is illustrated inFig. 10, where r is plotted versus γ . By the time theshift in crossing point is reduced to 1 meter in size, Eve’svariance is 2 . d dropsto . r = 8 . h n i = α , so if the amplitudeis decaying as α ( d ) = αe − Kd/ , then the distance D atwhich the number of photons decays to roughly one is D = 2 K ln α. (29)More generally, the distance at which the number hasdecayed to h n i = N is D N = 2 K ln (cid:18) α √ N (cid:19) . (30) Δ d
100 200 300 400 50000-4000-1000-2000-5000-3000
FIG. 11: (Color online) The curves shift horizontally by ap-proximately a constant amount ∆ d ( γ, Λ) in the presence ofeavesdropping. Here the solid red line is in the absence ofeavesdropping for α = 1000 and φ = .
1. The dashed blue lineis in the presence of eavesdropping with γ = −
1. The crossingof the W = Λ line can be used instead of the W = 0 crossing;this allows more photons to still be present for measurement,increasing measurement accuracy. Unless φ is relatively large (of order . W curve crosses some negative value Λ, instead of the dis-tance where it crosses zero. Let the distance at which W = Λ be d ( γ, Λ). In the absence of an eavesdropper,the distance would be d ( ∞ , Λ), so that the distance thatthis crossing moves in the presence of eavesdropping is∆ d ( γ, Λ) = d ( γ, Λ) − d ( ∞ , Λ) . It is straightforward toshow that d ( γ, Λ) = 2 K ln " α sin φF ( γ ) − Λ F ( γ ) (31)∆ d ( γ, Λ) = 2 K ln " − Λ F ( γ ) − Λ F ( γ ) , (32)where F ( γ ) ≡ (cid:0) − e − γ (cid:1) . This shift is independentof the initial value of α , and varies only very slowly withΛ. The value of Λ used can be chosen as appropriatefor the given experiment to ensure that there are stillsufficient numbers of photons remaining in the beam foraccurate homodyne measurements. The size of this shiftfor the particular values Λ = − −
10 is shownin Fig. 12. For more negative values of Λ, the curves arenearly indistinguishable from that of Λ = − VII. INFORMATION AND SECRET KEY RATE
Although the primary goal in this paper is to use en-tanglement in the phase in order to detect eavesdroppingon a classically modulated channel, rather than to usethe entangled phase for encryption or encoding itself, we0 γ FIG. 12: (Color online) The change ∆ d in the distance atwhich the curve of W crosses the value W is plotted versus theeavesdropping parameter, γ , for the values Λ = − −
10 (solid red). The curves are independentof α and change very little for Λ < −
10. The value φ = . briefly consider here other possibilities which are avail-able in case a full quantum key distribution is desired.In particular, the same setup can be used to gener-ate a key from the homodyne measurements themselves.The possible phase values measured by each participantcan be divided up into bins and the bin in which a mea-surement falls then determines a value for the key. Inthis situation, the mutual information between the par-ticipants and the eavesdropper is relevant to determiningif it is possible to distill a secret key. With a sufficientnumber of bins, the phase variable can still be treated asapproximately continuous.The secret key rate is given by κ = I ( A : B ) − I ( B : E ) , (33)where I ( A : B ) and I ( B : E ) are respectively the mu-tual information between Alice and Bob and betweenBob and Eve. The mutual information is simply thedifference between the von Neumann entropies of theindividual subsystems and the total two-beam system, S vn = − Tr [ ρ ln ρ ]; for example, I ( A : B ) = S vn ( ρ A ) + S vn ( ρ B ) − S vn ( ρ AB ) . If K >
0, then it is possible to dis-till a secret key via privacy amplification. If the differ-ence in Eq. (33) is negative, then κ is taken to be zero.The mutual information can be calculated numericallyfrom the density operator of the system. However an ap-proximate but simpler and more transparent evaluationcan be obtained by noting that the system in questioncan be treated as an approximately Gaussian system forsmall φ . This can be seen, for example by calculatingthe characteristic function (the Fourier transform of theWeyl operator) or the Wigner function of the system. FIG. 13: (Color online) Mutual information between Aliceand Bob, assuming both have same initial amplitude α . Fromthe top line downward, the initial amplitudes are α = 10 (red), α = 10 (violet), α = 10 (black), and α = 100 (blue). φ = . The characteristic function for example, is of the form γ ( λ, ζ ) = 12 e − ( | q + iζ | + | q + iζ | ) (34) × Z d λ d χ e − ( | α | + | λ | + | χ | ) × e i [( q + iζ ) λ ∗ +( q + iζ ) χ ∗ +( q − iζ ) λ +( q − iζ ) χ ] × (cid:16) e α ( λ r + χ r ) cos φ +2 α ( λ i − χ i ) sin φ + e α ( λ r + χ r ) cos φ +2 α ( χ i − λ i ) sin φ + e α ( λ r + χ r ) cos φ +2 iα ( χ r − λ r ) sin φ + e α ( λ r + χ r ) cos φ +2 α ( χ r − λ r ) sin φ (cid:17) Here, subscripts 1 and 2 label Alice’s and Bob’s sides,while subscripts r and i label real and imaginary parts.Because of the terms in the last large parentheses, γ isa sum of four Gaussians. But when φ is small, the sineterms in the exponentials become negligible compared tothe cosine terms, leaving all four of these terms equal.The only case when this argument breaks down is whenthe differences χ i − λ i or χ r − λ r are large; however thispart of the integration range is strongly suppressed bythe term e − ( | α | + | λ | + | χ | ) in the second line. Thus, to ahigh degree of accuracy, we can treat the system as Gaus-sian. This approximation becomes better as the distancebecomes large and the amplitudes decay to small values,which is exactly the region of greatest interest to us. Wetherefore compute all information-related quantities inthe Gaussian approximation.For a two-mode Gaussian state, the mutual informa-tion can be obtained directly from the covariance matrix.Define the binary entropy function h ( x ) = ( x + ) ln( x + ) + ( x − ) ln( x − ) and the discriminant of the covari-ance matrix ∆ = det ( A ) + det ( B ) + 2 det ( C ). Then thequantum mutual information is [38, 39]: I ( A : B ) = h ( p Det ( A )) + h ( p Det ( B )) − h ( d + ) − h ( d − ) , (35)1 FIG. 14: (Color online) Mutual information between Aliceand Bob in the presence of eavesdropping, assuming they haveequal initial amplitudes and equal losses. Solid red curve: noeavesdropper. Dotted black: γ = −
1. Dash-dot green: γ = 0.Dashed blue: γ = 1. The values φ = . α = 1000 wereused for all curves. The same curves give the mutual informa-tion between Bob and Eve, but with γ and − γ interchanged. where the symplectic eigenvalues of the covariance matrixare d ± = vuut ∆ ± q ∆ − p ∆ − Det ( V )2 . (36)Plots of the mutual information between Alice and Bobin the absence of eavesdropping in Fig. 13. In the pres-ence of eavesdropping, examples are shown in Fig. 14.As would be expected, the mutual information they sharedecreases as γ decreases, i.e. as Bob’s variance increasesand Eve’s drops. Because of the relation between Bob’svariance and Eve’s, it can be noted that the mutual in-formation between Alice and Eve is given by the sameformula, but with the sign of γ reversed. This makescalculating the secret key rate very simple, and leads toresults such as those shown in Fig. 15. The key rate re-mains positive as long as γ >
0, which is is equivalent tosaying σ E > σ B . It should be noted that the distances atwhich the information approaches zero are roughly equalto the distances at which S became small in Sec. IV.Since γ = 0 corresponds to σ E = , it follows that themaximum allowed noise in the system for arrangementto remain secure is σ noise < .As an interesting aside, up to this point, although dif-ferent amounts of loss were allowed in Alice’s and Bob’schannels due to different propagation distances, it has al-ways been assumed that the initial amplitudes were equalfor both lines. If we allow different initial amplitudes α and β , respectively, for Alice and Bob, then the informa-tion decreases more slowly with distance (Fig. 16). Thereason for this is similar to the explanation given earlier(see Fig. 4) for the greater distance in the presence ofasymmetric decay. κ FIG. 15: (Color online) Secret key rate κ between Alice andBob in the presence of eavesdropping, assuming they haveequal initial amplitudes and equal losses. Solid red curve: noeavesdropper. Dotted black: γ = 2. Dashed blue: γ = 1.Dash-dot green: γ = 0. κ vanishes identically for all γ ≤ φ = . α = 1000 were used for all curves. VIII. CONCLUSIONS
We have analyzed effects of loss and eavesdropping ina system for distributing key bits via entangled coher-ent states over long distances. We have demonstratedthat when combined with the entanglement-witness oreavesdropping-witness approach, the entangled coherentstate scheme described here can in principle be used todetect eavesdropping over distances on the order of hun-dreds of kilometers.Besides differing conceptually from previous ap-proaches, our results for coherent-state QKD based onthe use of an entanglement and eavesdropping witnessesfor eavesdropper detection offers distinct advantages overuse of a Bell-type inequality for that purpose. In partic-ular, comparing the above results with those in [6], wesee that sign changes of W always occur at larger dis-tances than the loss of Bell non-locality resulting fromthe same external interventions on the coherent statesinduced. Hence, W , as well as S , is available for eaves-dropping detection over larger distances than is the Bell-type inequality of the proposal on [6], extending the rangeof distances in which the phase-entangled coherent statesare known to be useful for QKD: simulations in [6] showedthe Bell inequality method to be useful up to distanceson the order of tens of kilometers, while the method dis-cussed below has promise to extend the range to the orderof several hundred kilometers. Moreover, the entangle-ment witness method requires only a single trigger pho-ton, rather than the triple-coincidence trigger requiredfor testing the Bell-type inequality, a substantial practi-cal improvement.Of the two eavesdropping witnesses, one ( W ) isstraightforward to implement experimentally, while theother ( S ) provides a rigorous measure of entanglementloss in the presence of eavesdropping. The question re-mains as to whether there is some other measure thatprovides both features for this system: a true entangle-2 FIG. 16: (Color online) Mutual information between Aliceand Bob, assuming they have different initial amplitudes α and β . From the right to left, Bob’s initial amplitudes are β = 10 (red), β = 10 (violet), β = 10 (black), and β = 100(blue). φ = . α = 100 for all curves. ment witness that is readily accessible experimentally. Itwould be of particular interest to find a strong entangle-ment witness that would serve this purpose. In any case, the general idea of using an entanglement witness or somerelated function as an eavesdropping witness or quantumtripwire for eavesdroppers can certainly be exported tocommunication systems beyond the specific entangled co-herent state system considered here.Finally, we have shown that the method is potentiallyuseful up to distances of hundreds of kilometers, in con-trast to methods based on single-photon communicationwhich are restricted to distances of tens of kilometers atmost. It remains to be seen if the method may be com-bined with the use of quantum repeaters [40] in order toextend the working distance to even greater lengths. Acknowledgements
This research was supported by the DARPA QUI-NESS program through US Army Research Office awardW31P4Q-12-1-0015. We would like to thank Prof. N.L¨utkenhaus for a very helpful discussion. [1] C. H. Bennett, G. Brassard, in
Proceedings of the IEEEInternational Conference on Computers, Systems, andSignal Processing, Bangalore, India , (IEEE, New York,1984), pp. 175-179.[2] A. K. Ekert, Phys. Rev. Lett.
661 (1991).[3] P. W. Shor and J. Preskill, Physical Review Letters ,441 (2000).[4] B. C. Sanders, Phys. Rev. A , 6811, (1992).[5] D. A. Rice, G. Jaeger, B. C. Sanders, Phys. Rev. A, ,012101 (2000).[6] B. T. Kirby and J. D. Franson, Phys. Rev. A, , 053822(2013).[7] M. Horodecki, P. Horodecki, R. Horodecki, Phys. Lett.A , 1 (1996).[8] Lu-Ming Duan, G. Giedke, J. I. Cirac, and P. Zoller,Phys. Rev. Lett. , 2722 (2000).[9] E. Shchukin, W. Vogel, Phys. Rev. Lett. , 230502(2005).[10] T. C. Ralph, Phys. Rev. A , 010303(R) (1999).[11] M. Hillery, Phys. Rev. A , 022309 (2000).[12] M. D. Reid, Phys. Rev. A , 062308 (2000).[13] N. J. Cerf, M. L´evy, G. Van Assche, Phys. Rev. A ,052311 (2001).[14] F. Grosshans, P. Grangier, Phys. Rev. Lett. , 057902(2002).[15] C. Weedbrook, A. M. Lance, W. P. Bowen, T. Symul, T.C. Ralph, P. K. Lam, Phys. Rev. Lett. , 170504 (2004).[16] R. Garc´ıa-Patr´on, Ph.D. thesis, Universit Libre de Brux-elles (2007).[17] R. Simon, Phys. Rev. Lett. , 2726 (2000).[18] F. A. S. Barbosa, A. J. de Faria, A. S. Coehlo, K. N.Cassemiro, A. S. Villar, P. Nussenzveig, M. Martinelli,Phys. Rev. A , 790 (2009).[20] K. Nemoto and W. J. Munro, Phys. Rev. Lett. , 250502(2004). [21] W. J. Munro, K. Nemoto and T. P. Spiller, New J. Phys. , 137 (2005).[22] M. D. Lukin and A. Imamoglu, Phys. Rev. Lett. , 1419.(2000).[23] S. E. Harris, J. E. Field, and A. Imamoglu, Phys. Rev.Lett. , 1107 (1990).[24] H. Schmidt and A. Imamoglu, Opt. Lett. , 1936 (1996).[25] Q. A. Turchette, C. J. Hood, W. Lange, H. Mabuchi, andH. J. Kimble, Phys. Rev. Lett. , 4710 (1995).[26] R. F. Werner, Phys. Rev. A , 4277 (1989).[27] N. J. Cerf, A. Ipe, X. Rottenberg, Phys. Rev. Lett. ,1754 (2000).[28] J. Fiur´aˇsek, Phys. Rev. Lett. , 4942 (2001).[29] A. Peres, Phys. Rev. Lett. , 1413 (1996).[30] M. Horodecki, P. Horodecki, and R. Horodecki, Phys.Lett. A , 1 (1996).[31] S. Mancini, V. Giovannetti,D. Vitali, P. Tombesi, Phys.Rev. Lett. , 120401 (2002).[32] G. S. Agarwal, A. Biswas, quant-ph/050102 (2005).[33] M. G. Raymer, A. C. Funk, B. C. Sanders, H. de Guise,Phys. Rev. A , 052104 (2003).[34] R. M. Gomes, A. Salles, F. Toscano, P.H. Souto Ribeiro,S. P. Walborn, Proc. Nat. Acad. Sci. USA , 21517(2009).[35] L Dahlstr¨om, B. K¨allsberg, Opt. Comm. , 285 (1971).[36] T. Yu and J. H. Eberly, Science , 598 (2009).[37] M. P. Almeida, F. de Melo, M. Hor-Meyll, A. Salles, S.P. Walborn, P. H. Souto Ribeiro, L. Davidovich, Science , 579 (2007).[38] S. Olivares, Eur. Phys. J. Special Topics , 3 (2012).[39] A. Serafini, F. Illuminati, S. De Siena, J. Phys. B: At.Mol. Opt. Phys. , L21 (2004).[40] H.-J. Briegel, W. D¨ur, J. I. Cirac, P. Zoller, Phys. Rev.Lett.81