Experimental Extraction of Secure Correlations from a Noisy Private State
Krzysztof Dobek, Michal Karpinski, Rafal Demkowicz-Dobrzanski, Konrad Banaszek, Pawel Horodecki
aa r X i v : . [ qu a n t - ph ] J a n Experimental extraction of secure correlations from a noisy private state
K. Dobek,
1, 2
M. Karpi´nski, R. Demkowicz-Dobrza´nski, K. Banaszek,
1, 3 and P. Horodecki Institute of Physics, Nicolaus Copernicus University, ul. Grudziadzka 5/7, 87-100 Toru´n, Poland Faculty of Physics, Adam Mickiewicz University, ul. Umultowska 85, 61-614 Pozna´n, Poland Faculty of Physics, University of Warsaw, ul. Ho˙za 69, 00-681 Warsaw, Poland Faculty of Applied Physics and Mathematics, Technical University of Gda´nsk, ul. Narutowicza 11/12, 80-952 Gda´nsk, Poland (Dated: December 17, 2017)We report experimental generation of a noisy entangled four-photon state that exhibits a separa-tion between the secure key contents and distillable entanglement, a hallmark feature of the recentlyestablished quantum theory of private states. The privacy analysis, based on the full tomographicreconstruction of the prepared state, is utilized in a proof-of-principle key generation. The inferi-ority of distillation-based strategies to extract the key is demonstrated by an implementation of anentanglement distillation protocol for the produced state.
Quantum entanglement can guarantee secure commu-nication as demonstrated by Ekert’s protocol [1] for quan-tum key distribution [2] (QKD), where the random keyobtained from a maximally entangled state is known ex-clusively to legitimate users. A natural way to realiseQKD using imperfect noisy entanglement is to attemptits distillation into the maximal form using local oper-ations and classical communication [3]. This strategyhowever may reduce the attainable key length or evenpreclude its generation altogether, which follows from therecently developed theory of private quantum states [4].The secure key can be extracted in general at higher ratesthan that implied by distillable entanglement, and evenfrom certain classes of bound entangled states.In this Letter we report experimental generation andutilization of a noisy entangled four-photon state thatexhibits the separation between secure key contents anddistillable entanglement. We perform a full tomographicreconstruction of the produced state using the maximum-likelihood [5] and Bayesian reconstruction methods [6, 7],which allows us to obtain credible estimates for the quan-tities of interest despite their nonlinear character andhigh sensitivity to statistical noise and experimental im-perfections. We present a proof-of-principle extraction ofa secure key and implement an entanglement distillationprotocol verified to perform suboptimally.The original example of extracting privacy from quan-tum entanglement is Ekert’s QKD protocol, in which twocommunicating parties—Alice and Bob—need a sequenceof bipartite systems prepared in a maximally entangledtwo-qubit state such as | φ + i = √ (cid:0) | i + | i (cid:1) . Lo-cal projections performed by Alice and Bob in the com-putational basis | i , | i yield perfectly correlated ran-dom key bits. The security is checked by measuringthe qubits in superposition bases to test coherence be-tween the components | i and | i . If the state usedfor QKD is indeed pure, the monogamy of entangle-ment [8] prevents an eavesdropper Eve from learningmeasurement outcomes obtained by legitimate users. Ofcourse, a state | φ − i = √ (cid:0) | i − | i (cid:1) would be equally suitable for key generation. But an equiprobable sta-tistical mixture of | φ + i and | φ − i ensures no security.This is because it can be viewed as a partial trace (cid:0) | φ − i AB h φ − | + | φ + i AB h φ + | (cid:1) = Tr E (cid:0) | Φ i ABE h Φ | (cid:1) of atripartite state | Φ i ABE = 1 √ (cid:0) | i AB ⊗ | i E + | i AB ⊗ | i E (cid:1) (1)involving a qubit E in possession of Eve, who can gaincomplete information about the results of Alice’s andBob’s measurements in the computational basis withoutintroducing any disturbance.Suppose now that in addition to qubits A and B , Aliceand Bob possess also qubits A ′ and B ′ prepared jointly ina statistical mixture of | φ − i AB ⊗ | i A ′ B ′ and | φ + i AB ⊗| i A ′ B ′ . Obviously, a local measurement of A ′ or B ′ in the computational basis reveals whether the qubits A and B have been prepared in | φ + i or | φ − i . This enableskey generation and entanglement distillation with equalrates. An intriguing case is the privacy of a mixed four-qubit state [4]: ̺ priv = | φ − i AB h φ − |⊗ ̺ A ′ B ′ − + | φ + i AB h φ + |⊗ ̺ A ′ B ′ + , (2)where ̺ − = | ψ − i h ψ − | , ̺ + = ( − | ψ − i h ψ − | ), and wedenote | ψ ± i = √ (cid:0) | i ± | i (cid:1) . Unlike the preceding ex-ample, the two operators ̺ A ′ B ′ ± cannot be discriminatedunambiguously by Alice and Bob using local operationsand classical communication, which lowers the value ofdistillable entanglement E D [9]. This can be seen froman upper bound E D ≤ L = log Tr | ̺ Γpriv | = log − ≈ . , (3)where L is the log-negativity [10] calculated for the par-tial transposition Γ with respect to the partition AA ′ : BB ′ . In contrast, the theory of private states [4]—ofwhich ̺ priv is an example—shows that results of project-ing qubits A and B in the computational basis cannotbe learnt by Eve, thus providing one bit of a secure key.This leads to a gap between the key rate and E D , imply-ing general sub-optimality of distillation strategies. Figure. 1. Experimental setup. (a) Preparation of noisy pri-vate states. Two maximally entangled photon pairs are gen-erated in two nonlinear crystals XX, collected from four direc-tions AA ′ BB ′ shown in the inset, and subjected to polariza-tion transformations implemented with quarter-wave platesQWP and half-wave plates HWP. D, Soleil-Babinet compen-sators; IF, interference filters; SMF, single-mode fibers. (b)Polarization analyzers. PBS, polarizing beam splitter; MMF,multi-mode fibers; APD, avalanche photodiodes. In order to demonstrate experimentally this hallmarkfeature of private states we generated a noisy entangledfour-photon states using a setup shown in Fig. 1. Itsheart were two 1 mm long type-I down conversion beta-barium borate crystals with optical axes aligned in per-pendicular planes, following the arrangement introducedby Kwiat et al. [11]. The crystals were pumped usingTi:sapphire oscillator (Coherent Chameleon Ultra) emit-ting a 78 MHz train of 180 fs pulses frequency doubled ina 1 mm long lithium triborate crystal to give a 390 nmwavelength pump of an average power of 200 mW, andfocused to a 70 µ m diameter waist. The axial symmetryof type-I down-conversion implies that photons emergingalong any two opposite ends of the emission cone will bemaximally entangled. That way one can collect multi-ple photon pairs, as shown in the inset of Fig. 1(a), andobtain a four-photon state | φ + i AB ⊗ | φ + i A ′ B ′ with | i and | i corresponding to horizontal and vertical polar-izations. Collimated photons after transmission through10 nm full-width-at-half-maximum bandwidth interfer-ence filters were coupled into single-mode fibers woundon manual polarization controllers. Phase relations be-tween two-photon probability amplitudes were controlledby two Soleil-Babinet compensators D placed in the pathof the pump beam and photons A .Photons B were sent through a half-wave plate whosetwo selected orientations introduced a transformation σ x = | ih | + | i h | or σ z = | i h | − | i h | . The set of two quarter-waveplates and a half-wave plate placed inthe path of photons B ′ realized one of four operations σ x , σ z , or σ y = iσ x σ z . Applying combinations σ Bz ⊗ σ B ′ y , σ Bx ⊗ B ′ , σ Bx ⊗ σ B ′ x , and σ Bx ⊗ σ B ′ z randomly with equalprobabilities produced ideally the state ̺ id = | φ − i AB h φ − |⊗ ̺ A ′ B ′ − + | ψ + i AB h ψ + |⊗ ̺ A ′ B ′ + , (4)equivalent up to a local unitary to ̺ priv . The securekey can be obtained by measuring qubits A and B inthe eigenbasis of σ y given by | ¯ v i = √ (cid:0) | i + i ( − v | i (cid:1) , v = 0 , s − for single counts, 6 × s − for two-photon and 2 s − for fourfold coincidences.Assuming that only four-photon events are availableto Alice and Bob, we reconstructed a density matrix ofa private state and performed a proof-of-principle securekey generation. A complete measurement consisted of asequence of 33637 intervals, each 10 s long. Before a sin-gle interval, settings of individual polarization analyzerswere selected randomly and independently on Alice’s andBob’s side to project polarization in the eigenbasis of σ x , σ y , or σ z . The density matrix of the generated state wasreconstructed from fourfold coincidences using two inde-pendent techniques: the Kalman filter (KF) method [7]based on gaussian approximation and Bayesian inferencewhich provides an a posteriori probability distribution onthe set of density matrices, and the maximum-likelihood(ML) method with physical constraints [5]. In the KFapproach the resulting a posteriori distribution servedto generate a sample of 10 physical density matriceswith the help of the slice-sampling technique [12]. Thissample was used to calculate mean values and standarddeviations of individual elements of the density matrixdepicted in Fig. 2, as well as the information-theoreticquantities reported in Eq. (7). Uncertainties of ML esti-mates were obtained by generating 2000 reconstructionsusing perturbed experimental data as an input. Theuncertainties calculated account for both the Poissonianphoton counting noise and 0 . ◦ uncertainty of the wave-plate orientation in polarization analyzers. Calculation ofthe KF a posteriori distribution took 20 s on a standardPC, a significant advantage compared with 20 min forthe ML method. A more time consuming stage, however, Figure. 2. Reconstructed private state. (a) absolute values ofdensity matrix elements in the σ y basis reconstructed usingKF method. (b) diagonal KF values (orange, with error bars)compared with the ML results (yellow). was generation of statistical samples of physical densitymatrices, which took 2 s per matrix using the KF dis-tribution and required repetition each time of the fullreconstruction in the ML case.Fig. 2 depicts the state ̺ exp obtained using the KFmethod. The fidelity F = Tr( p √ ̺ id ̺ exp √ ̺ id ) of thisstate is F KF = 0 . F ML =0 . A and B are indeed strongly corre-lated in the basis | ¯0 i , | ¯1 i . To characterize the privacy ofthese correlations, we consider a purification | Ψ i AA ′ BB ′ E of the complete system AA ′ BB ′ E in the worst-casescenario when Eve controls all environmental degreesof freedom E . Thus ̺ exp = Tr E (cid:0) | Ψ i AA ′ BB ′ E h Ψ | (cid:1) ,which generalizes Eq. (1). After Alice projects thequbit A onto a state | a i , the state of Bob’s qubitreduces to ̺ ( a ) B = p a Tr A ′ B ′ E (cid:0) A h a | Ψ i AA ′ BB ′ E h Ψ | a i A (cid:1) ,while Eve is in possession of a system in a state ̺ ( a ) E = p a Tr A ′ BB ′ (cid:0) A h a | Ψ i AA ′ BB ′ E h Ψ | a i A (cid:1) , where p a =Tr A ′ BB ′ E (cid:0) A h a | Ψ i AA ′ BB ′ E h Ψ | a i A (cid:1) is the probability ofobtaining the projection onto | a i by Alice. An attempt to gain information about Alice’s outcome by either Bobor Eve can be viewed as a classical to quantum com-munication channel A → B or A → E [13]. In such ascenario—denoted as cqq—Alice and Bob can establisha secret key at a rate at least X cqq = χ B − χ E , (5)where χ B ( E ) is the Holevo quantity [14] for the respectivechannel A → B ( E ), defined as: χ B ( E ) = S X a p a ρ ( a ) B ( E ) ! − X a p a S (cid:16) ρ ( a ) B ( E ) (cid:17) , (6) S ( · ) denotes the von Neumann entropy, and the summa-tions are carried out over an orthonormal basis of states | a i , in our case | ¯0 i and | ¯1 i .Based on measured data, the Bayesian a posteriori dis-tribution for density matrices yields the following esti-mates for the attainable key rate and the log-negativity X cqqKF = 0 . , L KF = 0 . . (7)These results show a clear separation, exceeding ten stan-dard deviations, between distillable entanglement andthe key rate, exposing a fundamental feature of gen-eral private states. The ML method yields consistent re-sults X cqqML = 0 . L ML = 0 . X cqqML may be attributed to the fact thatthe ML method returns a lower-rank density matrix withweaker entanglement between the system AA ′ BB ′ andthe environment E .The consistency of KF and ML results was verifiedby calculating the Mahalanobis distance [7] between thedensity matrices produced by both the methods with theKF covariance matrix used as a metric. The obtained dis-tance 16 . . a posteriori distribution is not forced to be positivedefinite, its Mahalanobis distance from the mean of thedistribution with imposed positivity constraints is an in-dicator of possible systematic errors in the measurementprocess [7]. For our data this distance is 17 .
7, implyingthat systematic errors are not significant.In order to extract a secure key from the four photonstate we selected randomly one event from each intervalwhen both the qubits A and B were measured in the σ y bases obtaining N = 3716 raw key bits. We simu-lated a binary interactive error-correction procedure [15]exchanging 990 parity bits, which corrected all errors,and performed privacy amplification using two-universalhashing functions. Using the KF estimate of Eve’s knowl-edge in the asymptotic limit given by χ E , conservativelyenhanced by five standard deviations, and adding a secu-rity margin [16] to guarantee that the probability of Evelearning at least one bit of the key is below 10 − , yields2164 bits of a secure key. Figure. 3. Two-qubit AB state. (a) Absolute values of the elements of the reduced density matrix obtained by tracing outqubits A ′ and B ′ . (b,c) Absolute values of the elements of density matrices conditioned upon finding qubits A ′ and B ′ inidentical (b) or orthogonal (c) states when measured in the same basis. The subsystems A ′ and B ′ play the role of a shield pro-tecting the private key contained in subsystems A and B from an eavesdropping attempt. Given ̺ id , tracingout A ′ and B ′ reduces the qubits A and B to a mixedstate ̺ AB = | φ − i AB h φ − | + | ψ + i AB h ψ + | . The cor-responding experimental state, shown in Fig. 3(a), has X cqqKF = − . ̺ id : if A ′ and B ′ are projected in the same ba-sis, identical outcomes collapse the state of qubits A and B to a maximally entangled state | ψ + i AB , while oppo-site results produce a separable state (cid:0) | φ − i AB h φ − | + | ψ + i AB h ψ + | (cid:1) = ( | ¯0¯0 i AB h ¯0¯0 | + | ¯1¯1 i AB h ¯1¯1 | ) useless forkey generation. Fig. 3(b,c) depict experimental condi-tional density matrices reconstructed for these two casesusing the KF method. The key rate is positive only foridentical outcomes and equals 0 . X cqqKF = 0 . A and B were measured in the same bases. Note that the 50%reduction in the raw key length compared to the four-photon key extraction corresponds exactly to the successrate of the distillation protocol which halves the raw bitrate if only compatible measurements yielding perfectlycorrelated outcomes are applied.In conclusion, we demonstrated experimentally a fun-damental feature of private states, namely the sepa-ration between distillable entanglement and the secretkey contents, using a noisy entangled state of photonquadruplets. The results confirmed the sub-optimalityof distillation-based strategies to extract private correla-tions. This highlights the complex nature of mixed entan-glement in higher dimensions similarly to that exhibitedin multiparty scenarios [17] and paves the way to develop QKD protocols that make optimal use of realistic imper-fect resources.We wish to acknowledge insightful discussions withKoenraad Audenaert and Jan Tuziemski. This work wassupported by FP7 FET project CORNER, the Founda-tion for Polish Science TEAM project, and Polish Min-istry for Scientific Research project. [1] A. K. Ekert, Phys. Rev. Lett., , 661 (1991); T. Jen-newein et al. , ibid. , 4729 (2000); D. S. Naik et al. , ibid. et al. , ibid. et al. , Rev. Mod. Phys., , 145 (2002); V.Scarani et al. , ibid. , 1301 (2009).[3] C. H. Bennett et al. , Phys. Rev. Lett. , 722 (1996); D.Deutsch et al. , ibid. , 2818 (1996).[4] K. Horodecki et al. , Phys. Rev. Lett. , 160502 (2005);IEEE Trans. Inf. Theory , 1898 (2009); J. M. Renesand G. Smith, Phys. Rev. Lett. , 020502 (2007).[5] K. Banaszek et al. , Phys. Rev. A , 010304 (1999);D. F. V. James et al. , ibid. , 052312 (2001); Z. Hradil,D. Mogilevtsev, and J. ˇReh´aˇcek, Phys. Rev. Lett., ,230401 (2006).[6] V. Buˇzek et al. , Ann. Phys. , 454 (1998).[7] K. M. R. Audenaert and S. Scheel,New Journal of Physics, , 023028 (2009).[8] V. Coffman, J. Kundu, and W. K. Wootters, Phys. Rev.A, , 052306 (2000).[9] C. H. Bennett et al. , Phys. Rev. A , 3824 (1996).[10] G. Vidal and R. F. Werner, Phys. Rev. A, , 032314(2002).[11] P. G. Kwiat et al. , Phys. Rev. A , R773 (1999).[12] D. J. C. MacKay, Information Theory, Inference,and Learning Algorithms (Cambridge University Press,2003).[13] I. Devetak and A. Winter, Phys. Rev. Lett. , 080501(2004); Proc. R. Soc. Ser. A , 207 (2005).[14] A. S. Holevo, Probl. Inf. Transm. (USSR), , 177 (1973).[15] C. H. Bennett et al. , J. Cryptol. , 3 (1992).[16] G. V. Assche, Quantum cryptography and secret key dis-tillation (Cambridge University Press, 2006).[17] E. Amselem and M. Bourennane, Nature Physics, , 748(2009); H. Kampermann et al. , Phys. Rev. A , 040304 (2010); J. Lavoie et al. , arXiv.org:1005.1258 (2010); J. T.Barreiro et al.et al.