Proof-of-Concept of Real-World Quantum Key Distribution with Quantum Frames
Itzel Lucio Martinez, Philip Chan, Xiaofan Mo, Steve Hosier, Wolfgang Tittel
aa r X i v : . [ qu a n t - ph ] O c t Proof-of-Concept of Real-World Quantum KeyDistribution with Quantum Frames
I. Lucio-Martinez , P. Chan , X. Mo , S. Hosier , W.Tittel University of Calgary, Institute for Quantum Information Science andDepartment of Physics and Astronomy University of Calgary, Advanced Technology Information Processing SystemsLaboratory and Department of Electrical and Computer Engineering Southern Alberta Institute of Technology
Abstract.
We propose a fibre-based quantum key distribution system, whichemploys polarization qubits encoded into faint laser pulses. As a novel feature,it allows sending of classical framing information via sequences of strong laserpulses that precede the quantum data. This allows synchronization, sender andreceiver identification, and compensation of time-varying birefringence in thecommunication channel. In addition, this method also provides a platform tocommunicate implementation specific information such as encoding and protocolin view of future optical quantum networks. We demonstrate in a long-term (37 hour) proof-of-principle study that polarization information encodedin the classical control frames can indeed be used to stabilize unwanted qubittransformation in the quantum channel. All optical elements in our setup can beoperated at Gbps rates, which is a first requirement for a future system deliveringsecret keys at Mbps. In order to remove another bottleneck towards a high ratesystem, we investigate forward error correction based on Low-Density Parity-Check Codes. roof-of-Concept of Real-World Quantum Key Distribution with Quantum Frames
1. Introduction
Based on the particular properties of single quantum systems, quantum keydistribution (QKD) promises cryptographic key exchange over an untrusted,authenticated public communication channel with information theoretic security[1, 2]. Significant academic [3, 4], and industrial effort [5] has been devoted tothe development of point-to-point (P2P) QKD systems based on attenuated laserpulses or entangled photons, and the first fully functional prototype of a quantumcryptographic network consisting of pre-established P2P links in a trusted nodescenario has recently been demonstrated [6] (see also [7]). Furthermore, various proof-of-principle demonstrations of quantum teleportation and quantum memory (see [8, 9]and references therein) have been reported, which will eventually allow building of fullyquantum enabled networks [10, 11], e.g. for perfectly secure communication in settingswith un-trusted nodes and over large distances [12, 13].Despite these remarkable achievements, the building of a reconfigurable real-world QKD network still requires significant progress, even when limiting quantumcommunication to qubits encoded into faint laser pulses and to entangled qubits.Among the issues to be solved is the necessity to route quantum data from anysender to any receiver. The possibility to use active optical switches to send quantuminformation to different users has first been demonstrated in 2003 [14]. However,the question regarding the addition of sender and receiver addresses to the quantumdata (which is not required in pre-established P2P links) has, to the best of ourknowledge, never been addressed. Beyond routing, another requirement for quantumnetworks is path stabilization between sender and receiver, i.e. to ensure that carriersof qubits prepared at Alice’s arrive unperturbed at Bob’s. This includes controlof the properties of the quantum channel, e.g. birefringence in an optical fibre,and the establishment of a common reference frame at Alice’s and Bob’s, e.g. adirection or a precise time-difference, depending on the property chosen to encodethe qubit [15]. Current P2P QKD systems are either of the ’plug & play’ type andautomatically stabilize the quantum channel [16, 17], or achieve unperturbed quantumcommunication by adding from time to time short sequences of classical controlinformation [18]. However, neither method allows communication of the propertiesthat are important in reconfigurable networks, including sender and receiver address,or the specific QKD protocol or type of qubit encoding chosen ‡ .In this article we propose the use of quantum frames as a flexible framework forsensing, communicating and controlling the parameters relevant in a QKD networksetting. Our approach is sufficiently flexible to accommodate for current and futurequantum technology or applications, including technology from different vendors,which is important in view of open quantum networks. We demonstrate the suitabilityof our solution for quantum key distribution with polarization qubits over a 12 kmreal-world fibre optic link.This article is organized as follows: In section 2 we present the general idea ofquantum frames. We then discuss the principle QKD setup (section 3), and givefurther details of key components (section 4). After presenting the properties of ourfibre optics link (section 5), we describe the QKD field tests and discuss the results ‡ Note that this information can also be sent through another (classical) channel. However, given thatcontrol information for channel stabilization has to be sent in any case (except for auto-compensatingsystems such as the ’plug & play’ system), it is natural to consider sending the network relevant controlinformation through the quantum channel as well. roof-of-Concept of Real-World Quantum Key Distribution with Quantum Frames quantum dataquantum dataclassical data Q-frame Figure 1.
Quantum framing with alternating classical control frames (C-frames, inspired by the Ethernet protocol) and quantum data. In the herereported implementation, subsequent C-frames encode different polarizationstates (horizontal, vertical and circular), each one used to independently stabilizeone particular set of polarization qubit basis states. (section 6), and then elaborate briefly on some issues related to the security of thekey establishment (section 7). In section 8 we present the status of our classicalpost processing, required to distill a secret key, specifically the possibility of hardwareimplementation of one-way error correction. We present our conclusions in section 9.
2. Quantum Frames
To add control functionalities to the communication between Alice and Bob, wepropose supplementing the quantum data (e.g. qubits) with classical control frames.The control frames (C-frame), encoded into strong laser pulses, alternate with thequantum data, and a pair of classical/quantum data forms a quantum frame (Q-frame), see figure 1. The C-frame allows synchronizing sender Alice and receiver Bob,facilitates time-tagging, and provides a platform to communicate sender and receiveraddress (for routing or packet switching) plus implementation specific informationsuch as encoding (e.g. polarization or time-bin qubit [15]) and protocol (e.g. BB84 [1],decoy state [19, 20, 21], or B92 [22]). This is interesting in view of open, reconfigurablenetworks comprising different QKD technologies.The classical information in our implementation is encoded into specific polariza-tion states, allowing assessment and compensation of time-varying birefringence in thequantum channel. Note that the compensation scheme can easily be adapted to otherQKD setups employing e.g. time-bin qubits, entanglement, or quantum repeaters.Furthermore, the C-frames can be used to asses channel loss, which may be importantfor routing.
3. Our QKD System
Our QKD system is based on polarization qubits, and employs the BB84 protocol [1],supplemented with two decoy states [19, 20, 21]. It allows alternating sequences ofstrong and faint laser pulses, encoding classical data and quantum data, respectively.A simplified schematic of the QKD system is depicted in figure 2. Alice uses twolaser diodes to generate the classical data (LD C ) and the quantum data (LD Q ). Thepulses emitted from LD Q are first attenuated by an optical attenuator (ATT), andthen sent through an intensity modulator (IM) to create signal and decoy states withdifferent mean photon numbers. To create vacuum decoy states, no electrical pulses roof-of-Concept of Real-World Quantum Key Distribution with Quantum Frames Figure 2.
Schematic of our QKD system. are sent to LD Q . The horizontally polarized faint pulses are then transmitted througha polarization beam splitter (PBS), and combined with the strong, vertically polarizedpulses from LD C . All pulses are then sent to a polarization modulator (PM), wherehorizontal (H), vertical (V), right (R), or left (L) circular polarization states can becreated.Quantum and classical data is transmitted to Bob through a quantum channel. AtBob’s end, 10% of the light is directed towards a fast photo detector (PD) followed bya logic device (LOG). The detector and the logic device, which were not implementedin our investigation, will read the information encoded in the classical data and takeappropriate action, e.g. for clock synchronization, optical routing, or communicationof protocol specific information used by Bob for the measurement and subsequentprocessing of the quantum data.The remaining light is split at a 50/50 beam splitter (BS), and directedto two polarization stabilizers (PS1, PS2) followed by polarization beam splitters(PBS1, PBS2) and single photon detectors (SPDs). PS1 ensures that horizontallypolarized classical data, and hence qubits, emitted at Alice’s arrive unchanged atPBS1. Similarly, PS2 is set up such that right circular polarized classical data andqubits emitted at Alice’s always impinge horizontally polarized on PBS2. Sincethe transformation in the quantum channel is described by a unitary matrix (i.e.orthogonal states remain orthogonal), our stabilization scheme ensures that qubitsprepared in H and V, or R and L states arrive horizontally and vertically polarized onPBS1 or PBS2, respectively. Hence, the two sets of PS, PBS and two SPDs both allowcompensation of unwanted polarization transformations in the quantum channel, andprojection measurements onto H, V, R and L, as required in the BB84 protocol. Notethat our scheme does not prevent H and V created at Alice’s from arriving in anarbitrary superposition of H and V at PBS2 (similar for R and L at PBS1). However,these cases do not cause errors as they are eliminated during key sifting.
4. Polarization and Intensity Modulators
Initially, we used a commercial LiNbO phase modulator (PM) and a Mach-Zehnderintensity modulator in a one-way configuration to achieve fast polarization andintensity modulation. Figure 3(a) shows the schematics of the polarization modulator,i.e. a phase modulator with polarization maintaining input fibre (PMF) whose slowaxis is rotated 45 degrees (R ) with respect to the optical axis of the modulator roof-of-Concept of Real-World Quantum Key Distribution with Quantum Frames (a) (b)(c) (d) Figure 3.
Schematics of (a) one-way polarization modulator, (b) basic unit,(c) two-way polarization modulator based on basic unit, (d) two-way intensitymodulator based on basic unit. waveguide, and standard single mode output fibre (SMF). Hence, horizontallypolarized input light, which propagates parallel to the slow axis of the PMF, is splitinto two components, where each one propagates along one axis of the waveguide. Byapplying a control voltage to the phase modulator, a phase shift is introduced betweenthe two components, resulting in a polarization modulation.Unfortunately, the phase modulator features significant polarization modedispersion (PMD) for 500 ps long optical pulses resulting in a polarization extinctionratio (PER), i.e. the ratio between optical power in two orthogonal polarization states,of only 16 dB. Moreover, we found both the phase and intensity modulator to betemperature sensitive – a change of environmental temperature or heating caused bypassing a current through the impedance matching resistance inside the modulatorscauses a variation of the polarization state, or the intensity level, of the output light.This would have a direct impact on the quantum bit error rate (QBER) and stabilityof our QKD system.
To overcome these problems, we designed a “basic unit” (see figure 3(b)) consistingof a phase modulator (PM) with 45 degree rotated input PMF and a Faraday mirror(FM) [23]. As explained below, this allows building stable polarization and intensitymodulators by means of a go-and-return configuration (the light travels twice and inorthogonal polarization states through the phase modulator).To explain how the basic unit works, we calculate the polarization evolution oflight using Jones calculus: J out = M BU · J in . (1) J in and J out denote the Jones polarization vectors of the input and output light,respectively, and M BU is the polarization transformation matrix of the basic unit: M BU = ←− M PMF · R † · ←− M WG · ←− M SMF · F M · −→ M SMF · −→ M WG · R · −→ M PMF . (2) roof-of-Concept of Real-World Quantum Key Distribution with Quantum Frames M SMF , M PMF , and M WG denote the polarization transformation matrices of the singlemode fibre, the polarization maintaining fibre and the waveguide, respectively, andthe arrows on top of the matrices specify the direction of light propagation. F M denotes the effect of the Faraday mirror, and R characterizes the rotation betweenthe polarization maintaining fibre and the waveguide. Assuming that one can neglectall temperature or mechanical stress mediated changes of the properties of the fibresand the waveguide between two subsequent passages of a pulse of light (aroundten nanoseconds in our setup), and that these elements do not feature polarizationdependent loss, we have ←− M PMF = M † PMF , −→ M PMF = M PMF ,M PMF = (cid:20) e iφ PMF (cid:21) , (3)where M † stands for the adjoint matrix of M , and φ PMF is the phase shift caused bythe birefringence of the polarization maintaining fibre. Furthermore, we have ←− M SMF = M † SMF , −→ M SMF = M SMF ,M SMF = (cid:20) √ a √ − ae iα √ − ae iβ −√ ae i ( α + β ) (cid:21) , (4)where M SMF is the most general unitary matrix describing polarization transforma-tions. The matrices of the waveguide are given by −→ M WG = (cid:20) e i ( φ inm + φ e ) (cid:21) , ←− M WG = (cid:20) e − i ( φ outm + φ e ) (cid:21) , (5)where φ inm and φ outm denote the phase shifts during the two subsequent passages ofthe light through the waveguide, as determined by the modulation voltage applied tothe waveguide, and φ e refers to an additional, wavelength and polarization dependentphase shift (leading to PMD).The effect of the Faraday mirror is to transform the polarization state of anarbitrary input state of light J in with components j , j into the orthogonal state [3]: F M · J in = F M · (cid:20) j j (cid:21) = (cid:20) j ∗ − j ∗ (cid:21) ≡ J ⊥ in . (6)Hence, from equation (6), we obtain the identity F M · M · J in = F M · (cid:20) A BC D (cid:21) · J in = (cid:20) D ∗ − C ∗ − B ∗ A ∗ (cid:21) · F M · J in (7)and thus M † · F M · M · J in = (cid:20) A BC D (cid:21) † · F M · (cid:20) A BC D (cid:21) · J in = (cid:20) A ∗ C ∗ B ∗ D ∗ (cid:21) · (cid:20) D ∗ − C ∗ − B ∗ A ∗ (cid:21) · F M · J in = ( A ∗ D ∗ − B ∗ C ∗ ) · · F M · J in = det ( M ∗ ) · J ⊥ in , (8) roof-of-Concept of Real-World Quantum Key Distribution with Quantum Frames M is an arbitrary two-by-two matrix, which may describe wavelength dependentpolarization rotations or polarization dependent loss, and is the two-by-two identitymatrix. Equation (8) shows that any polarization transformation is compensated bythe Faraday mirror; the output polarization state J out is always orthogonal to theinput state J in , regardless of M .Calculating the product of all matrices in equation (2), we obtain M BU = e − i ( φ SMF + φ PMF + φ e + φ ′ m ) · (cid:20) cos ∆ φ m − ie iφ PMF sin ∆ φ m − ie − iφ PMF sin ∆ φ m cos ∆ φ m (cid:21) · F M, (9)where φ ′ m = φ inm + φ outm , ∆ φ m = φ outm − φ inm , and φ SMF = π − α − β . Accordingly, for ahorizontal input state, we find J out = M BU · (cid:20) (cid:21) = e − i ( φ SMF + φ PMF + φ e + φ ′ m ) · (cid:20) − ie iφ PMF sin ∆ φ m cos ∆ φ m (cid:21) = e − i ( φ SMF + φ PMF + φ e + φ ′ m ) · (cid:20) e iφ PMF
00 1 (cid:21) · (cid:20) − i sin ∆ φ m cos ∆ φ m (cid:21) . (10)Hence, owing to the use of a Faraday mirror, the polarization and wavelengthdependent phase shift φ e introduced by the waveguide impacts now on the globalphase but does not lead to polarization mode dispersion any more. Furthermore, all(slow) modifications of the polarization modulation due to changes in temperature ormechanical stress of the SM and PM fibres are automatically compensated. The outputpolarization state thus only depends on the modulation of the waveguide (∆ φ m ) andthe phase shift induced by the polarization maintaining fibre ( φ PMF ). We complemented the basic unit to a polarization modulator by preceding it by apolarization maintaining circulator (CIR) that allows separating the input and outputoptical pulses (see figure 3(c)). By applying appropriate, short voltage pulses, whichare synchronized with the propagations of the optical pulse, to the phase modulator, wecan generate horizontal (∆ φ m = π/ φ m = 0), right-hand (∆ φ m = − π/ φ m = π/
4) states. We point out that the existenceof the phase introduced by the PM fibre, φ PMF , makes circular polarization statesunstable. However, note that the four generated polarization states always form twomutually unbiased bases, regardless the value of this phase, as required for secureQKD. Furthermore, as the change in the polarization maintaining fibre is slow, it canbe compensated by a polarization stabilizer at Bob’s, allowing for the establishmentof a sifted key with a small quantum bit error rate (QBER).We obtained a polarization extinction ratio of 20 dB for horizontal andvertical polarization states (limited by the light source used to test the polarizationmodulator), see figure 4, and of 15 dB for left and right circular polarization. Webelieve the reduced ratio to be caused by state dependent polarization mode dispersionin the circulator, which will be replaced in the near future. roof-of-Concept of Real-World Quantum Key Distribution with Quantum Frames -50-45-40-35-30-25 0 1 2 3 4 5 6 7 8 9 10 P o w e r ( d B m ) Amplitude (V)HV -30-20-10 0 10 20 30 0 1 2 3 4 5 6 7 8 9 10 PE R ( d B ) Amplitude (V)
Figure 4.
Test of the two-way polarization modulator. In the experiment, thelight exiting the modulator was split by a polarization beam splitter (PBS) and thepower was measured at the two outputs (H and V) as a function of the modulationvoltage. The polarization extinction ratio (PER) is defined as the ratio betweenthe power in the two outputs.
Similarly, we built an intensity modulator by preceding the basic unit by a PBS, asshown in figure 3(d). The PBS reflects the vertical component of the impinging light.Hence, by varying the polarization state of the light at the output of the basic unit,we can vary the intensity of the vertical component at the output of the PBS. -45-40-35-30-25-20-15 0 1 2 3 4 5 6 7 8 9 10 P o w e r ( d B m ) Amplitude (V) (a) P o w e r ( a . u . ) Time (hours) (b)
Figure 5.
Tests of the two-way intensity modulator. Figure (a) shows the outputpower as a function of the applied voltage pulse to the phase modulator. Themodulator features an extinction ratio of 23 dB. Figure (b) depicts the outputpower as a function of time. For this measurement, the output power was set to50% of its maximum value. The total variation in 12 hours is less than ± . ± .
15% in 3 hours (note that the latter can be further reduced usingexternal power control). roof-of-Concept of Real-World Quantum Key Distribution with Quantum Frames Figure 6.
Satellite view of Calgary, showing the University of Calgary (U of C)and the Southern Alberta Institute of Technology (SAIT).
The intensity extinction ratio, i.e. the ratio between the maximum and minimumintensity at the output of the PBS, exceeds 20 dB (see figure 5(a)). Moreover, asthe phase, φ PMF , does not impact on the output intensity, our modulator features anoutstanding stability, as depicted in figure 5(b). This is important when implementinga decoy state QKD protocol, which relies on accurate preparation of average photonnumbers per faint laser pulse.
5. The Fiber Link
The link consists of two single-mode dark fibres connecting laboratories at theUniversity of Calgary (U of C) and the Southern Alberta Institute of Technology(SAIT), see figure 6. The fibres, which we refer to as channel 1 and channel 2, runthrough tunnels on the two campuses, and are buried or run through train tunnelsin between the two institutions. They feature insertion loss of 7.8 dB and 6.5 dB,respectively. The fibre length is 12.4 km while the straight-line distance between thetwo laboratories is 3.3 km. A 1300 nm optical time-domain reflectometer (OTDR)with a 1 km dead zone eliminator was used to characterize the installed fibres. Figure7 shows the measured OTDR traces. The figure clearly shows that the last severalkilometers of fibre have bad connections, which result in high transmission loss inour system. The peaks at the distance of 1 km are induced by the core diametermismatch between the tested fibre and the dead zone eliminator, where the latter oneis a multi-mode fibre. roof-of-Concept of Real-World Quantum Key Distribution with Quantum Frames B a ck S c a tt e r ed P o w e r ( d B ) Distance (km)Channel 1 0 5 10 15 20 25 30 35 40 0 2 4 6 8 10 12 14 16 18 B a ck S c a tt e r ed P o w e r ( d B ) Distance (km)Channel 2
Figure 7.
OTDR traces of the installed fibres. The horizontal axis denotes thedistance measured from the laboratory at SAIT. The vertical axis denotes thelogarithm of the ratio between the back scattered power detected by the OTDRand a reference power set by the instrument, where a higher value corresponds tomore reflected power.
We experimentally studied the time evolution of polarization in the installed fibre.In the experiment, a stable polarized light source was launched into the fibre link,where channel 1 and channel 2 were looped at SAIT. We used a polarimeter to recordStokes parameters of the output light every second. Figure 8(a) presents the results ofone-week of continuous monitoring from April 16, 2008 to April 24, 2008. Figure 8(b)shows the temperature curve for the Calgary Airport during the measurement (datafrom Canada Environment Weather Office). Comparing figure 8(a) and figure 8(b), weobserve a clear correlation between the variation of temperature and the fluctuationof polarization. This phenomenon is particularly obvious for the measurement fromApril 19 to April 23, where we observe small polarization variation during night, andmuch more pronounced variations during day-time. Figure 8(c) is a zoom-in of themeasurement on April 19 (around lunch time), where particularly rapid polarizationfluctuations are observed. Even for this case, we find that the polarization is stable ona time scale of tens of seconds. This sets an upper limit to the duration of quantumdata between consecutive stabilization cycles.
6. Field Tests
A schematic of the complete experimental setup is shown in figure 9. A 10 GS/sfunction generator (FG1) with two independent outputs drives the quantum laserdiode (LD Q ) and the classical laser diode (LD C ) via broadband RF amplifiers (APs).Both laser diodes produce horizontally polarized optical pulses with a duration of500 ps and a repetition rate of 50 MHz. By adjusting the temperature, we couldclosely match the spectral properties of the two laser diodes. We obtained centerwavelengths of 1548.07 nm and 1548.11 nm, and spectral widths (FWHM) of 0.214 nmand 0.224 nm for LD Q and LD C , respectively. This is important to ensure that thepolarization transformation sensed by means of the C-frames (generated with LD C ) roof-of-Concept of Real-World Quantum Key Distribution with Quantum Frames -1 0 1 S -1 0 1 S -1 0 1 S -1 0 1 S -1 0 1 Apr 16 Apr 17 Apr 18 Apr 19 Apr 20 Apr 21 Apr 22 Apr 23 S -1 0 1 S -1 0 1 S (a) -16-8 0 8 16 Apr 16 Apr 17 Apr 18 Apr 19 Apr 20 Apr 21 Apr 22 Apr 23 T e m pe r a t u r e ( o C ) -16-8 0 8 16 T e m pe r a t u r e ( o C ) -16-8 0 8 16 T e m pe r a t u r e ( o C ) (b) -1 0 1 S -1 0 1 S -1 0 11:12pm 1:30pm 1:48pm 2:06pm 2:24pm S (c) Figure 8. (a)Time evolution of Stokes parameters during a full week in 2008. Theshaded regions indicate night-time from 8:00 p.m. to 8:00 a.m. (b) Temperaturecurve for Calgary. (c) Zoom of (a) around April 19, lunch time. roof-of-Concept of Real-World Quantum Key Distribution with Quantum Frames Figure 9.
Schematics of the QKD setup. equals the one experienced by the quantum data (generated with LD Q ).The pulses from LD Q , eventually encoding quantum data at different meanphoton numbers, propagate through a two-by-two polarizing beam splitter (PBS) andenter the intensity modulator, which is described in detail in section 4. To reducetheir energy to the single-photon level, a fixed optical attenuator (ATT) is placedbetween the Faraday mirror (FM) and the phase modulator (PM). Birefringence andpolarization dependent loss of the attenuator are automatically compensated by theFaraday effect and therefore a stable attenuation is achieved. At the output of thePBS, the now vertically polarized weak laser pulses are combined with the horizontallypolarized strong pulses from LD C , which encode the C-frame, to form a complete Q-frame. Quantum and classical data is then sent through the polarization modulator,which is also presented in section 4. The intensity and the polarization modulatorare driven by a function generator (FG2) with a pulse width of 4 ns. Note that thepolarization maintaining circulator (CIR) that is part of the polarization modulatoronly allows horizontally polarized light to enter, while the pulses from LD C andLD Q impinge with orthogonal polarization. Therefore, we aligned the axes of thepolarization maintaining fibre at the output of the PBS at 45 degrees with respectto the axes of the polarization maintaining fibre at the input of the circulator. Thisalignment makes the circulator work with both directions of polarization, yet, at theexpense of 3 dB loss. Finally, the polarization modulated data is forwarded to Bobthrough fibre channel 2.Alice’s electronic equipment is synchronized using a clock signal at 10 MHzfrom a clock generator (CG). Using a function generator, a laser diode (LD S ), aphotodiode (PD), and a delay generator (DG), the clock signal (reduced to 1 MHz)is also transmitted to Bob, where it provides trigger signals for the single photondetectors, synchronized with the arrival time of the quantum data.At Bob’s side, 90% of the optical power encoded into each Q-frame is transmittedthrough a 10/90 beam splitter and is then equally divided by a 50/50 beam splitter.For each part, the C-frames are sensed by a polarization stabilizer (PS, from GeneralPhotonics) to compensate for the polarization change in the transmission line, andthe quantum data is detected by a measurement module consisting of a PBS and twoInGaAs based single photon detectors (SPDs). The SPDs are triggered at 1 MHz, andoperated with a gate width of 5 ns, a deadtime of 10 µs and a quantum efficiency of roof-of-Concept of Real-World Quantum Key Distribution with Quantum Frames C and the PBS. The EDFA is turnedoff after each C-frame to avoid flooding the SPDs at Bob’s with photons from amplifiedspontaneous emission. While the turn-off time is only tens of milliseconds (consistentwith the radiative lifetime of population in the upper laser level), we found the turn-ontime of the EDFA to be as long as 3 seconds, resulting in 5-second long C-frames. Thelength of quantum data is set to 2 seconds, according to the “worst-case” polarizationstability of the fibre link, which is discussed in section 5. From this, we find that oursetup currently limits the time for quantum key distribution to 30% of the operationtime. Note, however, that the duty cycle of the classical pulse sequence can easilybe increased by several orders of magnitude. In this case the duration of a C-framewould be limited by the response time of the polarization stabilizer, and the time forQKD could exceed 99% of the system’s operation time. We performed a variety of measurements to assess the performance of our QKD system.For , Alice repetitively creates sequences of Q-frames withpolarizations HH, HL, HV, HR, LH, LL, LV, LR, VH, VL, VV, VR, RH, RL, RV,and RR. The first letter indicates the polarization of the C-frame and the second oneindicates that of the quantum data. Bob uses one measurement module to processthe frames. The polarization stabilizer compensates the polarization transformationin the quantum channel for states belonging to the basis indicated by the first letter,i.e. linear or circular. For , Alice modulates the polarizationof the Q-frames in the more complicated order of HH, RH, VH, LH, RH, HH, LH,VH, HR, RR, VR, LR, RR, HR, LR, VR, HV, RV, VV, LV, RV, HV, LV, VV, HL,RL, VL, LL, RL, HL, LL, VL. Bob uses two measurement modules to process theQ-frames. The polarization stabilizer of one module is always activated for odd framenumbers, and that of the other module is always activated for even frame numbers(see figure 1). In this way, the two measurement modules compensate polarizationtransformation for states encoded in the linear, or the circular basis, respectively. Wecollect the number of trigger events and counts for all single photon detectors for eachcombination of polarization states and different mean number of photons per qubit.This allows calculating average quantum bit error rates (QBER) and key generationprobabilities (KGP), where the KGP is defined as the probability of generating a siftedkey bit from a qubit encoded into a weak signal state when Alice and Bob use thesame basis:
QBER = P wrong P wrong + P correct ,KGP = P correct + P wrong . (11)The probabilities for correct ( P correct ) and wrong sifted key bits ( P wrong ) are obtainedfrom experimental data by dividing the number of correct, or wrong, detection events roof-of-Concept of Real-World Quantum Key Distribution with Quantum Frames P correct and P wrong can be calculated using P correct = 1 − ∞ X n =0 µ n e − µ n ! (1 − Y − tηa ) n = 1 − (1 − Y e − µtηa P wrong = 1 − ∞ X n =0 µ n e − µ n ! (1 − Y (cid:0) − tη (1 − a ) (cid:1) n = 1 − (1 − Y e − µtη (1 − a ) . (12) Y / µ is the averagephoton number of the weak pulses at Alice’s output, t is the overall transmission, whichincludes the fibre link and Bob’s optical components, and η is the quantum efficiencyof the single photon detectors. Finally, a describes the polarization extinction ratioof the PBS, i.e. the probability for a horizontally polarized photon to be transmittedthrough the PBS, normalized to the probability to exit.The experimental results of the measurements are summarized in figure 10,together with the theoretical predictions. Note that all parameters requiredto calculate the QBER and the KGP have been obtained through independentmeasurements. We see that the experimental values match the theoretical calculationsvery well. We also find that the average QBER of the 4-detector measurement is largerthan that of the 2-detector measurement at the same mean photon number. This isdue to an increased dark count probability of the two additional SPDs, and slightlyworse alignment of the polarization stabilizer in the second measurement module.Furthermore, the 4-detector measurement features a higher KGP as no qubits are lostat the 50/50 beam splitter. The individual data of the 4-detector measurement withan average photon number of 0.5 photons per pulse is listed in table 1. To study the stability of the system, we performed a long time measurement over 37hours. In the measurement, Alice sends qubits encoded into weak laser pulses withan average photon number of 0.5, and Bob implements a 2-detector measurementusing measurement module one. At the end of each C-frame, i.e. after stabilization,Bob records the polarization of the C-frame with PS1. Meanwhile, the polarizationstabilizer (PS2) in the second measurement module monitors the polarization of the C-frame without polarization control. In figure 11(a), the red points indicate the Stokesvectors of the classical pulses measured by PS2, which are randomly distributed onthe surface of the Poincar´e sphere due to the time-varying polarization transformation roof-of-Concept of Real-World Quantum Key Distribution with Quantum Frames Q BE R ( % ) Average Photon Number -45-40-35-30-25-20-15 0 0.2 0.4 0.6 0.8 1 K G P ( d B ) Average Photon Number
Figure 10.
Average QBER and KGP (in dB) as a function of the meanphoton number per weak laser pulse used to encode the polarization qubits.The squares and circles indicate the experimental results for the 2-detector and4-detector measurements, respectively, and the solid and dashed lines are thecorresponding theoretical predictions (no fit). Error bars (corresponding to onestandard deviation) are smaller than the size of each experimental data point.
Table 1.
Results of the 4-detector measurement with an average photon numberof 0.5 photons per pulse, where pol indicates the polarizations of the Q-frames, det and trg are the number of photon detections and trigger events recorded bythe single photon detectors, and prob is the detection probability (in dB).SPD SPD pol det trg prob (dB) det trg prob (dB)HH 1,569 13,254,716 − − − − − − − − − − − − − − − − SPD pol det trg prob (dB) det trg prob (dB)HH 37,577 12,468,543 − .
21 1,050 12,416,198 − − − − − − − − − − − − − − − roof-of-Concept of Real-World Quantum Key Distribution with Quantum Frames -1-0.5 0 0.5 1-1 -0.5 0 0.5 1-1-0.5 0 0.5 1S3 S1S2S3 (a) Q BE R ( % ) T e m pe r a t u r e ( o C ) Time (hours)QBERTemp (b)
Figure 11.
Results of the long-term measurement. (a) Stokes vectors of C-frames with (blue points) and without (red points) polarization stabilization. (b)Average QBER and temperature for the same time interval as a function of time. in the transmission line. The blue points depict the measurements made by PS1, i.e.after polarization control. Even though the result slightly deviates from a single spot,which is expected in the ideal case, it clearly demonstrates the good long-term stabilityof our QKD system.For a more quantitative analysis, we also recorded the evolution of the QBERover the same time interval, see figure 11(b). The temperature curve for the CalgaryAirport (data from Canada Environment Weather Office) is shown as well. The QBERvaries between 2.85% and 3.35% in over 35 hours, and the variation is less than 0.1%in the last 15 hours.
7. Security Issues
For any cryptographic system, be it of quantum or classical nature, it is important tocarefully analyze the actual implementation for weak points that may compromise itsprinciple security. Applied to quantum key distribution, these include deficiencies inthe preparation of quantum data at Alice’s that can be exploited by an eavesdropperto gain information about the sifted key. We refer to these kind of attacks as quantumstate attacks . Furthermore, Eve may also attempt to actively sense the classical devicesthat create or measure the quantum data, or try to actively impact on the interactionbetween quantum and classical systems to influence the outcomes of measurements.We refer to these kind of attacks as classical system attacks .Note that, once the deficiencies are found, it may be possible to eliminate them bydevising a better optical setup, or to remove the corresponding amount of informationthat Eve may have obtained through additional privacy amplification [26]. Yet, wepoint out that loopholes may also arise from a careless implementation of privacyamplification, e.g. improper choice of Hash function, or of insufficient authenticationof the classical channel. Finally, the size of the error corrected key has to be consideredwhen calculating the appropriate amount of privacy amplification, i.e. to distil a securekey [27, 28].In the following, we will briefly discuss our current optical setup in view of suchweak points. Yet, a complete security analysis of our system is beyond the scope of roof-of-Concept of Real-World Quantum Key Distribution with Quantum Frames
The use of attenuated laser pulses, as opposed to pairs of entangled photons [3], entailsthe possibility that non-orthogonal qubit states (here encoded into the polarizationdegrees of freedom) may become distinguishable when taking into account otherdegrees of freedom needed to fully describe the quantum data, e.g. frequency, temporalmodes, or transverse modes. Obviously, in this case, the security offered by QKDwould break down. We refer to these attacks as quantum side channel attacks .Furthermore, as the number of photons in the attenuated laser pulses is described bya Poissonian distribution, it may be possible for an eavesdropper to gain informationbased on photon-number-splitting (PNS) attacks . Attacks Exploiting Quantum Side Channels:
In our QKD system, all four qubitstates are produced by the same laser diode, which is triggered independently ofthe subsequent action of the polarization or intensity modulators. Together withthe polarization independent spectral transmission of both modulators and theattenuator, due to the use of the Faraday mirrors, this ensures that correlation betweenpolarization state and spectrum or temporal mode do not exist. However, we recallthat the circulator (CIR) at the output of the polarization modulator adds basisdependent polarization mode dispersion, which manifests as a basis dependent QBER.This may induce detectable temporal broadening of the photonic wavepackets, i.e. maypartially reveal the basis used for encoding the qubit. The circulator will be replacedin a future, improved setup.Furthermore, as the entire setup is built with (transverse) single mode opticalfibres, correlation between polarization states and transverse modes, which may bepresent in a free space system, are ruled out.
PNS Attacks and Decoy States:
The use of faint laser pulses makes our systemprincipally susceptible to photon-number-splitting (PNS) attacks, which were firstmentioned in [29] and have been analyzed thoroughly in [30, 31]. A possibility toremove the threat of the PNS attack is the use of so-called decoy states [19, 20, 21].This allows establishing a conservative lower bound for the key that can be createdfrom single photons emitted at Alice’s, i.e. key that was not subject to the PNS attack.As described before, our setup has been devised to allow for the implementation ofdecoy states. In the following we will examine experimentally the accuracy with whichthe decoy state method allows bounding the size of the secret key.With the GLLP method the secure key rate per emitted faint pulse with meanphoton number of µ is given by [32] S ≥ (cid:2) Q (1 − H ( E )) − Q µ f ( E µ ) H ( E µ ) (cid:3) (13)where the factor 1 / H ( x ) = − xlog ( x ) − (1 − x ) log (1 − x ) denotes the Shannon entropy, Q , Q µ , E and E µ specify the gains and roof-of-Concept of Real-World Quantum Key Distribution with Quantum Frames f ( E µ ) is the errorcorrection efficiency which is assumed to be 1.22 [33].In the first analysis, we assume that no PNS attack took place during themeasurement, which is a reasonable assumption. Using equations (12), we can estimatethe gain and error rate for signal states with mean photon number µ : Q µ = P correct ( µ ) + P wrong ( µ )= 2 − (1 − Y / e − µtηa + e − µtη (1 − a ) ) E µ = P wrong ( µ ) P correct ( µ ) + P wrong ( µ )= 1 − (1 − Y / e − µtηa − (1 − Y / e − µtηa + e − µtη (1 − a ) ) . (14)Similarly, the gain and error rate for single photon pulses are given by Q = µe − µ (cid:0) − (cid:0) − Y / (cid:1) (2 − tη ) (cid:1) E = 1 − (cid:0) − Y / − (1 − a ) tη )2 − (cid:0) − Y / (cid:1) (2 − tη ) . (15)Using equation (13), (14) and (15) and taking into account the measured values for t , η , a and Y /
2, we can calculate the secret key rate for different µ , see curve A offigure 12.In the second analysis, which again relies on the assumption of fair loss, we useequation (14) to calculate the gains and error rates for the signal state with meanphoton number µ and the decoy state with mean photon number ν of 0.1. To calculatethe gain and error rate for single photon pulses, we use equations (34), (35) and (37)from [20]: Q ≥ Q ν, = µ e − µ µν − ν (cid:16) Q ν e ν − Q µ e µ ν µ − µ − ν µ Y (cid:17) e ≤ e ν, = E ν Q ν e ν − e Y Y L ,ν, νY ≥ Y L ,ν, = µµν − ν (cid:16) Q ν e ν − Q µ e µ ν µ − µ − ν µ Y (cid:17) . (16)The resulting secret key rate follows from equation (13). It is shown in curve B offigure 12.Finally, we calculate the secret key rate using the experimentally measured gainand error rates for signal and decoy states, as opposed to the previous case where theywere calculated. The gain and error rate for single photons are estimated as beforeusing equations (16). The result is plotted in curve C of figure 12. Note that themeasurement does not rely on the fair loss assumption.Comparing the three different curves, we find that the rates estimated from thedecoy state method (curves B and C) is somewhat smaller than the one plotted incurve A. This is natural as the decoy state method with decoy states of finite photonmean number only yields a conservative lower bound [20]. As an example, for µ = 0 . roof-of-Concept of Real-World Quantum Key Distribution with Quantum Frames K e y gene r a t i on r a t e pe r pu l s e Mean photon number per pulse ( µ )ABC Figure 12.
Comparison of secret key rates versus mean number of photons inthe signal states. Curve A is the secret key rate calculated from the fraction ofsingle photons emitted at Alice’s and assuming fair loss (i.e. assuming it is knownthat all loss is of technological origin and that there is no PNS attack). CurveB shows the secret key rate calculated via the decoy state method (using decoystates with mean photon number of 0.1 and vacuum states) and assuming fairloss. Curve C is the secret key rate obtained via the decoy state method usingexperimental data. All calculations assume an infinite sifted key length.
We attribute the remaining discrepancy to a systematic error in the estimation of thesingle photon gain Q , resulting from a slightly wrong estimation of the transmissionin the link, quantum efficiency of the detectors, or error rate due to wrongly receivedphotons. Factors like fluctuations in the mean photon number could also have aneffect. This systematic error also affects the estimation of the single photon errorrate E . Furthermore, curve B and C show that the secret key rate in our QKDsystem is maximized for signal states with a mean number of photons of µ ≈ .
6. Thisvalue agrees with estimations in [20] when taking into account the actual values fordark count rates, transmission, detector quantum efficiency, and error rate caused bywrongly received photons. Indeed, we calculate µ opt = 0 .
62, in very good agreementwith our experimental results.To finish this discussion, we emphasize that the secret key rate in an actualimplementation of an information-theoretic secure QKD session must be calculatedusing the decoy state method used in the third analysis and must not rely onassumptions about fair loss in the quantum channel.
Other deficiencies:
We have noted that each faint pulse that encodes a qubit ispreceded by another faint pulse, originating from a reflection on the PBS that ispart of the intensity modulator (see section 4). Note that the number of photonsin both pulses is comparable. Obviously, for our assessment of the eavesdropper’sinformation to be correct, we have to make sure that this pulse, which also transitsthrough the polarization modulator, does not encode any polarization information.Therefore, we have carefully adjusted the electrical trigger signal for the polarizationmodulator such that it only acts on the “real” faint pulse, and not on the spuriousone. roof-of-Concept of Real-World Quantum Key Distribution with Quantum Frames As in any QKD system, regardless whether it employs one-wayor two-way quantum communication, appropriate measures have to be implemented toprotect against Trojan-Horse attacks [34]. In these attacks, the eavesdropper injectslight through the optical fibre into Alice’s or Bob’s preparation or measurement device,respectively, and analyzes the back reflection, which may reveal information aboutthe quantum state created at Alice’s or the measurement basis to be used at Bob’s.In both cases, the security of the key distribution would be compromised as Eveeither knows the state, or knows in which basis to perform an intercept resend attackwithout creating errors. In our QKD system, given the static setup at Bob’s, TrojanHorse attacks have to be considered only at Alice’s. Towards this end, a polarizationindependent optical isolator and a spectral filter that absorbs all wavelengths notblocked by the isolator should be placed at the output of Alice’s.
Time-shift attacks:
In a time-shift attack [35, 36, 37] the eavesdropper exploits thefact that the detection efficiency of different detectors may, for a given arrival time of aphoton, be different. It may thus be possible for an eavesdropper to bias the detectionprobabilities by actively time-shifting the arrival time of photons and thereby acquireinformation for each photon if it was detected in a detector that codes for a bit value0, or 1. This attack, which is possible in our current system, can be overcome if Bobrandomly rotates the polarization state of each incoming qubit by 0 or π/
2, thereby de-correlating a detection in a particular detector with a particular bit value. This can bedone by placing a rapidly variable λ/
8. Classical Post-Processing
Once the quantum part of the QKD protocol is finished, Alice and Bob must performa series of classical steps to go from the raw key to the secret key used for encryption[3]. The steps required are shown in figure 13. In addition to sifting, error correctionis used to ensure that Alice and Bob have an identical key despite any errors thatoccur. Privacy amplification is then used to eliminate any information Eve hasobtained about the key, whether through eavesdropping on the quantum channelor on the classical communication used for error correction. These steps must alsomake use of authenticated communication to prevent Eve from performing a man-in-the-middle attack. Of these steps, error correction is expected to become thebottleneck in the QKD system once higher raw key rates are achieved. The Cascadeprotocol [38] that was originally developed for QKD is not suitable for high keyrates as it requires many rounds of communication between Alice and Bob and iscomputationally expensive [39].
Low-Density Parity-Check (LDPC) codes were originally developed by Gallager in the1960s [40] for classical communications, but their potential performance has only beenrecently been discovered [41]. LDPC codes for QKD differ slightly from those used roof-of-Concept of Real-World Quantum Key Distribution with Quantum Frames Figure 13.
Classical post-processing steps. in the classical case as the parity information is transmitted over a separate classicalchannel [39].A LDPC code is defined using an m × n parity check matrix, H , consisting of zerosand ones. While either Alice’s or Bob’s sifted key may be considered the “correct”key for the purpose of error correction, this discussion will use Alice’s sifted key, the n bit column vector α , i.e. one-way, forward error correction. Alice computes a parityvector as follows: p = H α (mod 2) , (17)where the number of bits m in the parity vector is lower bounded by Shannon’s noisycoding theorem; m = nH ( QBER ) with Shannon Entropy H . Thus, p i indicateswhether the sifted key bits indicated by the ones in the i th row of H contain an even( p i =0) or odd ( p i =1) number of ones. Alice transmits p to Bob, whose task it is todetermine α using H , p , his sifted key, β , and an initial estimate of the QBER. Thisestimate can be based on a characterization of the quantum channel or on the QBERfrom previous executions of the protocol.In order to recover α , Bob uses a process known as belief propagation to refine hisinitial probabilities for the entries of α based on β and the QBER. Note that in thefollowing discussion, Bob has full knowledge of his key vector, β , but his knowledgeof the Alice’s key vector, α is probabilistic. For example, suppose row i of H is aparity check on three bits received by Bob, β = 1, β = 1, and β = 0, where theexpected QBER is 10% (chosen to prevent very small numbers in this example). Theprobability that a key bit α j is zero or one based on the received values and theQBER are denoted P ( j ) and P ( j ), respectively. For each of his bits β j , Bob assumesthat α j = 1 and computes r α j =1 ( i, j ), which denotes the probability that the paritycheck i is satisfied ( p i = α + α + α (mod 2)) given this assumption. Alternatively, r α j =1 ( i, j ) may be viewed as the probability that α j = 1 given the value of p i andwhat is known about the other bits of α involved in the i th parity check. For example, r α j =1 ( i,
1) may be computed as follows: r α j =1 ( i,
1) = ( P (2) P (3) + P (2) P (3) for p i = 0 P (2) P (3) + P (2) P (3) for p i = 1. (18)As can be seen in table 2, the probability that the bits retain their received valueis high when p i = 0 since this is consistent with the received values of β . If instead p i = 1, a high probability for bit flips is obtained since each row assumes that thereceived values for the other bits are likely to be correct. This information is usefulwhen combined with the results of other parity checks.After doing these computations for each row of H , Bob uses the information fromall the parity checks involving a particular key bit β j to compute new values of P ′ ( j ) roof-of-Concept of Real-World Quantum Key Distribution with Quantum Frames Table 2.
Results for r α j =1 ( i, j ). j β j P ( j ) P ( j ) r α j =1 ( i, j ) for p i = 0 r α j =1 ( i, j ) for p i = 11 1 0.1 0.9 0 .
82 0 .
182 1 0.1 0.9 0 .
82 0 .
183 0 0.9 0.1 0 .
18 0 . Table 3.
Results for P ′ ( j ) and P ′ ( j ) values. r α j =1 (1 , j ) r α j =1 (2 , j ) r α j =1 (3 , j ) q α j =0 ( j ) q α j =1 ( j ) P ′ ( j ) P ′ ( j )0.82 0.82 0.82 0.0006 0.4963 0.0012 0.99880.18 0.82 0.82 0.0027 0.1089 0.0238 0.97620.18 0.18 0.82 0.0121 0.0239 0.3361 0.66390.18 0.18 0.18 0.0551 0.0052 0.9131 0.0869and P ′ ( j ). If the j th key bit is involved in three parity checks, Bob computes q α j =0 ( j )and q α j =1 ( j ), which represent the probability that α j is zero or one, respectively,based on β j and the QBER, and that all parity checks involving α j are satisfied: q α j =0 ( j ) = P ( j ) r α j =0 (1 , j ) r α j =0 (2 , j ) r α j =0 (3 , j ) (19) q α j =1 ( j ) = P ( j ) r α j =1 (1 , j ) r α j =1 (2 , j ) r α j =1 (3 , j ) (20)where r α j =0 ( i, j ) = 1 − r α j =1 ( i, j ). Since valid results must be consistent with allparity checks, P ′ ( j ) and P ′ ( j ) are obtained by normalizing q α j =0 ( j ) and q α j =1 ( j ).For example, consider β j = 1, implying P ( j ) = 0 . P ( j ) = 0 . β j = 1 (i.e. β j was received correctly) still increases. With all threeparity checks suggesting a bit flip is necessary, a high confidence is obtained thatthe received value of β j is incorrect. With two parity checks suggesting a bit flip isrequired, the result does not significantly favour either result.Bob can then select the most likely value for each bit to form β ′ , and compute p ′ = H β ′ (mod 2). If p ′ = p , the protocol is finished. Otherwise, additional iterations ofthe protocol are performed. With the additional modification that Bob also computesconditional probabilities, P ′ ( i, j ) and P ′ ( i, j ), to use in (18) during subsequentiterations, this procedure is generalized as the sum-product algorithm [39, 41]. Interest in LDPC codes stems not only from their potential to perform near theShannon limit. Since the computations for each parity check and each key bitare independent, the structure of the sum-product algorithm lends itself to parallelcomputation. This makes sum-product decoding of LDPC codes well suited for highspeed implementation in custom hardware or in reconfigurable devices such as FieldProgrammable Gate Arrays (FPGA) [42]. However, floating-point computations areexpensive in terms of the amount of logic required. Thus, it is desirable to implementLDPC decoding using fixed-point arithmetic (equivalent to integer arithmetic) withas few bits as possible to represent the values. In initial simulations of fixed-pointdecoding, we found that the primary obstacle for a small bit length was the very small roof-of-Concept of Real-World Quantum Key Distribution with Quantum Frames Figure 14.
Simulation results of the 1200 × (cid:3) ), 24-bit fixed-point (— · —,*), and floating-point ( · · · · · · , ◦ ). Theinset shows the region where the performance begins to drop in more detail. values obtained for the probabilities. This problem manifested as “divide by zero”errors during the normalization since both q ( j ) and q ( j ) had rounded to zero. Weovercome this limitation by modifying the algorithm to set any occurrences of zero inthe q ( j ) values to the smallest possible non-zero value.A LDPC code was designed with a 1200 × H has a fixed number of ones in each row, known as therow weight, and a variable number of ones in each column, known as the columnweight. The method presented in [43] was used to determine the column weights byapplying a well known optimization technique with the constraints ensuring that thedesign criteria (QBER and code rate) are met. In place of the arbitrary cost functionin [43], we use a function reflecting the computational complexity. Our code wassimulated over 40 iterations, with the number being selected based on tests whichshowed very little improvement beyond this point. The results in figure 14 show that24-bit fixed-point and floating-point have very similar decoding performance.Using VHDL (a hardware description language) code generated in Matlab, we areable to create code for parallel implementations of sum-product decoding for arbitraryvalues of H . While a RTL (Register Transfer Level) simulation of the 1200 × ×
200 LDPC code with a row weight of 12 that is capable of operating at 50MHzwas synthesized using the Artisan 3.0 logic cell library for 0.18 µ m CMOS technology(several generations behind state of the art). This code uses 12-bit arithmetic andrequires 46 clock cycles (0.92 µ s) per iteration of the algorithm. Simulation results forthe performance of this code with a maximum of 40 iterations are given in table 4.The design contains 1860429 cells with a total cell area of approximately 47.24 mm . roof-of-Concept of Real-World Quantum Key Distribution with Quantum Frames Table 4.
Simulation results for 60 ×
200 LDPC decoding.QBER (%) Success rate (%) Mean iterations Sifted key rate (Mb/s)2.5 99.00 4.1070 52.93193.0 91.65 8.6785 25.04943.5 69.80 17.9455 12.1146
Attempts to synthesize a larger LDPC code using the current VHDL code have failed asthe synthesis tool does not have sufficient memory to complete the process. The size ofthe design also suggests that a 1200 × , including interconnect).However, larger codes are preferred because they experience less variance from themean QBER and perform better relative to the Shannon limit.It is important to note that we obtained these results without using any advancedtechniques to reduce the size of the design. More efficient multiplier designs or theuse of alternative number systems such as the multidimensional logarithmic numbersystem (MDLNS) [44] have the potential reduce the hardware required to performthe computations. Larger block sizes could also be achieved using the partiallyparallel implementations proposed in [45], where efficient schedules are used ratherthan updating all probabilities at once, reducing the number of computations done inparallel while mitigating the cost in terms of the run time.
9. Conclusion and Outlook
We have proposed a novel, fibre-based QKD system employing polarization encodingand quantum frames, and have demonstrated in a long-term (37 hours) QKD proof-of-principle study that polarization information encoded in the classical control framescan indeed be used to stabilize unwanted qubit transformation in the quantumchannel. All optical elements in our setup can be operated at Gbps rates, whichis a first requirement for a future system delivering secret keys at Mbps. In order toremove another bottleneck towards a high rate system, we are investigating forwarderror correction based on Low-Density Parity-Check Codes [40, 41]. Work on theimplementation of a system that distributes a quantum key, building on the herepresented proof-of-concept demonstration, is under way.
Acknowledgments
The authors gratefully acknowledge discussions with Xiongfeng Ma. This work issupported by General Dynamics Canada, Alberta’s Informatics Circle of Research Excellence(iCORE), the National Science and Engineering Research Council of Canada (NSERC),QuantumWorks, Canada Foundation for Innovation (CFI), Alberta Advanced Education andTechnology (AET), CMC Microsystems, and the Mexican Consejo Nacional de Ciencia yTecnolog´ıa (CONACYT).
References [1] Bennett C H and Brassard G 1984
Proc. IEEE Int. Conf. Comput. Syst. Signal Process(Bangalore India)
Phys. Rev. Lett roof-of-Concept of Real-World Quantum Key Distribution with Quantum Frames [3] Gisin N, Ribordy G, Tittel W, and Zbinden H 2002 Rev. Mod. Phys , 145–95[4] Scarani V, Bechmann-Pasquinucci H, Cerf N J, Dusek M, Lutkenhaus N and Peev M 2008 Preprint
Preprint arXiv:quant-ph/0503058[8] Tittel W, Afzelius M, Cone R L, Chaneli`ere T, Kr¨oll S, Moiseev S A and Sellars M 2009
Laser& Photonics Review
DOI 10.1002/lpor.200810056[9] Hammerer K, Sorensen A S, and Polzik E S 2008
Preprint arXiv:0807.3358[10] Gisin N and Thew R 2007
Nature Photonics Nature
Phys. Rev. Lett. Nature
IEEE Photonics Technology Letters QIC , 3–56[16] Muller A, Herzog T, Huttner B, Tittel W, Zbinden H and Gisin N 1997 Appl. Phys. Lett. Elect. Lett. Optics Express , 660–5[19] Hwang W Y 2003 Phys. Rev. Lett. Phys. Rev. A Phys. Rev. Lett. Phys. Rev. Lett. Opt. Commun. Phys. Rev. A Phys. Rev. A IEEE Transactions on InformationTheory Phys. Rev. Lett.
Phys. Rev. A Phys. Rev. A Opt. Comm. , 103-8[31] Brassard G, L¨utkenhaus N, Mor T and Sanders B C 2000
Phys. Rev. Lett. Quant. Info. Compu. Advances in Cryptology EUROCRYPT ’93, Lecture Notes inComputer Science , 410-23[34] Gisin N, Fasel S, Kraus B, Zbinden H Ribordy G 2006
Phys. Rev. A Phys. Rev. A Optics Express Phys. Rev. A J. Cryptology Quantum Communication, Measurement and Computing AIP ConferenceProceedings
IRE Transactions on Information Theory Electron. Lett. IEEE Symposium on Field-Programmable CustomComputing Machines
IEEE Transactions onInformation Theory Fourtieth Asilomar Conference on Signals,Systems and Computers (ACSSC ’06) pp 921–5[45] Sharon E, Litsyn S and Goldberger J 2007
IEEE Transactions on Information Theory53