arX

iv:q

uant

-ph/

0605

118

v1

13 M

ay 2

006

Experimental Test of Two-way Quantum Key Distribution

in Presence of Controlled Noise

Alessandro Cere, Marco Lucamarini, Giovanni Di Giuseppe, and Paolo TombesiDipartimento di Fisica, Universita di Camerino, I-62032 Camerino, Italy

(Dated: May 16, 2006)

We describe the experimental test of a quantum key distribution performed with a two-wayprotocol without using entanglement. An individual incoherent eavesdropping is simulated andinduces a variable amount of noise on the communication channel. This allows a direct verificationof the agreement between theory and practice.

PACS numbers: 03.67.Dd, 03.67.Hk

One of the most attractive application of quantum me-chanics is the quantum key distribution (QKD), whichallows for the secret sharing of correlated random databetween two (or more) users, traditionally called Aliceand Bob. Since the seminal works by Bennett and Bras-sard [1] and Ekert [2], QKD developed into a promis-ing field of research for near-future technology ([3]; for areview see [4]), and both theoretical [5] and experimen-tal [6] work has been done in order to prove its securityand feasibility. A feature of QKD is that none of the usersknows in advance the final form of the generated key. Onthe contrary the secure transmission of a predeterminedkey has been recently investigated through schemes thatexploit [7, 8, 9] or do not exploit [10, 11] entanglement,and that are usually cited as deterministic, with refer-ence to Bob’s in principle possibility of knowing withcertainty the information encoded by Alice [12].

In this Letter we present the experimental test of aQKD realized with the two-way protocol described inRef. [11] and termed LM05. We simulate the noise re-lated to a class of attacks by Eve, and by accordinglyvarying it we measure all the quantities relevant to aneffective transmission of information.The Protocol– In LM05 Bob prepares a qubit in one ofthe four states |0〉, |1〉 (the Pauli Z eigenstates), |+〉, |−〉(Pauli X eigenstates), and sends it to his counterpartAlice. With probability c Alice uses the qubit to test thechannel noise (control mode, CM) or, with probability1− c, she uses it to encode a bit of information (encoding

mode, EM). The CM consists in a projective measure-ment of the qubit along a basis randomly chosen betweenZ and X , followed by the preparation of a new qubit inthe same state as the outcome of the measurement. TheEM is the modification of the qubit state according toone of the following transformations: the identity oper-ation I , which leaves the qubit unchanged and encodesthe logical ‘0’, or iY ≡ ZX , which flips the qubit andencodes the logical ‘1’. Alice can now send the qubitback to Bob who measures it in the same basis he pre-pared it; in case of an EM run this feature allows Bob todeterministically infer Alice’s operation. After the wholetransmission Alice declares the CM and the EM runs.Comparing the data collected during the CM the usersestimate the Quantum Bit Error Rates (QBERs) on the

forward and backward channels; we call these two ‘par-tial’ QBERs respectively q1 and q2. Comparing a part ofthe data collected during the EM the users estimate alsoa third, ‘total’, QBER QAB. This quantity is not nec-essary for the security of the protocol but proves usefulfor estimating the mutual information between Alice andBob. As usual for a QKD the exchange of the raw key isthen followed by the procedures of error correction [13]and privacy amplification [14].

The communication is realized exploiting linear polar-ization states of near infrared photons. In Fig.1 is re-ported a sketch of the experimental setup. The pho-tons are generated by a type II down-conversion process:a UV pump beam from a diode laser (λ = 406.5nm,power 25mW) impinges on a 1.5mm thick BBO crys-tal cut at an angle of 43◦. We select the intersectionof the ordinary propagating light cone and the extraor-dinary one at an angular aperture of the two beamsaround ∼ 3.5◦ [15]. The wide spectral width of the pumpbeam (∆λ = 0.9nm) affects the entanglement of the two-photon, as in the case of pulsed pump [16]; to obtain atotally symmetrical spectrum we used an interferomet-ric technique [17]. The two output modes of PBS1 arelaunched into single mode fibers [18] at 810nm through apair of interference filters centered at 810nm and a band-width of 40nm, which are used to reduce the backgroundlight. The fibers terminate onto the sensible area of twoAPD modules with quantum efficiency ∼ 70% at 810nm.The coincidence rate is around 1000cps for single countrate of around 12000cps. The polarization state afterthe PBS1 can be expressed as |ψ〉 = (|00〉 − |11〉)/

√2.

Two Glenn-Laser polarizer (GL) were inserted after thePBS1 to verify the quality of the polarization entangle-ment of the state. The state purity has been tested by atomographic reconstruction [19]. We measured an entan-glement of formation of 0.989±0.005 [20] and a violationof the CHSH Bell inequality of over 98 standard devi-ations [21]. Bob prepares the qubits measuring one ofthe output mode of the interferometer with a λ/2 wave-plate (WP1), a GL and detector T. The detection of thisphoton projects the other one on the desired polarizationstate and serves also as trigger for the whole communica-tion system. We note that entanglement is not necessaryfor the protocol itself. This specific preparation proce-

2

FIG. 1: Sketch of the experimental setup. Inset: the distri-bution of QBER for different sets of preparation by Bob andoperation by Alice. Bob’s preparation is reported on the over-lay, Alice’s encoding is represented by the area colour: lightergray for I (logical ‘0’), darker gray for iY (logical ‘1’).

dure was chosen because it can be easily extended for atrue random passive choice of the initial state using onlylinear optics components. The prepared photon is thenlaunched into a 5m long single mode fiber at 810nm to-wards Alice.

Alice passively switches between CM and EM via a50/50 BS. Control mode: when Alice’s measuring ba-sis is the same as Bob’s the coincidence clicks betweenthe two detectors A0 and A1 and the trigger detec-tor T permit to estimate q1 through the usual formula:q1 = Cerr/(C0+C1), where C0,1 is the rate of coincidenceand Cerr = C0,1 depending on Bob’s state preparation.To complete the control mode, Alice injects an atten-uated light pulse of definite polarization with a wave-length of 810nm in the BS. This pulse is generated bya pulsed diode laser (not shown in figure) with a rep-etition rate of 80MHz, pulse width 88ps FWHM, at-tenuated to an average number of photons per pulse ofµ = (1.20 ± 0.05) × 10−3. Encoding Mode: for encodingthe message is necessary to realize the I and the iY Paulioperators. A couple of λ/2 waveplates (WP2,3) allows tospan all the equator of the Bloch sphere (an eventualphase has no importance for the rest of the protocol). Aslast step, the photon travels back to Bob through a dif-ferent fiber, 5m long too. The photons sent by Alice areeventually polarization-analyzed at Bob’s side by PBS3

and a λ/2 waveplate (WP4) set so that the photons aremeasured in the same basis as they were prepared. Thephotons are collected after the PBS3 into two multimodefibers and then detected by two APD modules, B0 andB1. During CM runs a measure of q2 is obtained in thesame way as q1 with the difference that the photons comefrom the pulsed laser that also supplies a trigger signal.Coincidence counts between B0 or B1 and the trigger Tcan be associated to logical values ‘0’ or ‘1’ correspondingto Alice encoding in the EM runs. In our experimentaltests we used all the coincidence counts to estimate QAB.

In the inset of Fig.1 is reported a typical communicationtest. It consists in a direct measurement of QAB fordifferent state preparations performed by Bob and dif-ferent encodings by Alice. All the eight configurationsof interest are reported. The best value we obtained forQAB is (4.05± 0.22)× 10−2. Before every test the fiberswere aligned using two polarization control pads, one foreach fiber. The pads are set so that any polarizationinput state exits almost unchanged. The usual fidelityfor the polarization state after the alignment is ∼ 96%.The fibers proved to remain stable for quite long periods(∼ 4h), enough for several runs after the alignment [22].Eavesdropping– The CM of LM05 comprises the samesecurity test of BB84 [1], repeated twice. This gives tothe two-way LM05 at least the same security level of theone-way BB84. Nevertheless there are indications thatthe security threshold of two-way schemes can overcomethat of one-way schemes. In particular LM05 results se-cure against individual incoherent attack (IIA) regard-less of the noise introduced on the channel by an eaves-dropper (Eve) [11]; on the contrary BB84 results secureagainst individual attacks only if the noise threshold islower than ∼15% ([23], [4] Sec.VI.E). In the optimal IIAEve prepares two sets of ancillae ε, η and makes theminteract with the qubit: the ε’s on the forward path andthe η’s on the backward one, after Alice’s encoding stage.By proper measure of her two sets of ancillae, Eve cangain information about the key. There are two mutually

exclusive interactions that minimize Eve’s noise on thechannel while maximizing her gain [11]:Z-attack:

|0〉 |ε〉 → |0〉∣

∣εZ

0

⟩

|+〉 |ε〉→ |+〉∣

∣εZ

+

⟩

+ |−〉∣

∣εZ

−

⟩

|1〉 |ε〉 → |1〉∣

∣εZ

1

⟩

|−〉 |ε〉→ |+〉∣

∣εZ

−

⟩

+ |−〉∣

∣εZ

+

⟩ (1)

X-attack:

|+〉 |ε〉 → |+〉∣

∣εX

+

⟩

|0〉 |ε〉→ |0〉∣

∣εX

0

⟩

+ |1〉∣

∣εX

1

⟩

|−〉 |ε〉 → |−〉∣

∣εX

−

⟩

|1〉 |ε〉→ |0〉∣

∣εX

1

⟩

+ |1〉∣

∣εX

0

⟩ (2)

where we have introduced the states |εZ

0,1〉, |εX

+,−〉,|εZ

+,−〉 = [|εZ

0 〉 ± |εZ

1〉]/2 and |εX

0,1〉 = [|εX

+〉 ± |εX

−〉]/2. The

Z and X indicate the basis whose eigenstates remain un-changed under Eve’s action. The states |εZ

0,1〉 and |εX

+,−〉are normalized and non orthogonal: 〈εZ

0,1|εZ

1,0〉 = cosφZ

ε

and 〈εX

+,−|εX

−,+〉 = cosφX

ε , with φZ,Xε ∈ [0, π/2]. Analo-

gous expressions hold for backward propagation with η’sancillae in the place of ǫ’s. If Eve chooses the Z-attack,Eqs.(1), she introduces no noise on the channel when Bobprepares the eigenstates of the Z-basis but creates dis-turbance in the conjugate basis X ; the same argumentapplies for the X-attack, Eqs.(2). The absence of a publicbasis revelation in the LM05 protocol prevents Eve fromalways choosing the best attack strategy between the Z

and the X-attack. In the frame of the IIA attack an ex-plicit functional relation among the three QBERs, q1, q2and QAB can be found. Let us consider the expressionof the forward QBER for the Z and X-state preparation,q1z and q1x respectively, as functions of the angles φZ

ε and

3

φX

ε chosen by Eve on the forward path:

q1z = (1 − cosφX

ε )/2 q1x = (1 − cosφZ

ε )/2 (3)

Through these relations Alice and Bob can guess Eve’sangles φX

ε , φZ

ε from the measured quantities q1z, q1x, re-spectively. Analogous results (with angles φX

η and φZ

η)hold for the partial QBERs q2z and q2x of the backwardchannel. The expression of the third QBER QAB canbe derived as the average probability that Alice and Bobfind an error on the total two-way channel in the EM:

QABi = q1i + q2i − 2q1i q2i i = (x, z) (4)

This relation is suitable for direct verification since theQBERs on the left side and those on the right sideare measured through independent processes, i.e. respec-tively during EM and CM.

To simulate the presence of an eavesdropper we mustcontrol the noise on the channels to generate the same ef-fect caused by Eve’s action described in Eqs.(1) and (2).Consider the following unitary transformation:

UZ

φZε

= cosφZ

ε I + i sinφZ

ε Z , (5)

where φZ

ε is the same angle defined for the Eve’s Z-attack.

Following the action of UZ

φZε/2 on the input states of the

X-basis, we find that they are flipped with probabil-ity sin2 (φz

ε/2) = (1 − cosφzε) /2, equal to the expression

of qZ

1x in Eq.(3). Therefore the unitary transformation

UZ

φzε/2 determines on the forward channel the same effect

as Eve’s attack. An analogous result is true for the back-ward path. To evaluate the total QBER QAB, we mustconsider the transformations on the X-states for the for-ward and backward channel, U Z

φZε/2 and U

Z

φZη/2, and both

Alice’s encoding operations, I and iY . In this way wefind the two expression: QZ

ABx(I ) = sin2(φZ

ε/2 + φZ

η/2)

and QZ

ABx(iY ) = sin2(φZ

ε/2 − φZ

η/2). This quantitiesdepend on Alice’s transformation, but if we take the

average between them we find the expression QZ

ABx =(1 − cosφZ

ε cosφZ

η )/2, exactly equal to Eq.(4) after ex-pressing the partial QBERs through Eqs. (3).

The simulated eavesdropping described by Eq.(5) isrealized via the two polarization controlling pads onthe fibers connecting Alice and Bob. The Z-attack isachieved aligning the pads so that the Z-states remain al-most undisturbed during the propagation. The X-attackis obtained in a similar fashion. The presence of un-desired contributions due to Y ,X operators during thesimulated Z-attack are taken into account through a pa-rameter ∆, which quantifies the distance from a perfectrealization of the unitary transformation of Eq.(5). Oncethe two fibers are aligned, we measured the three QBERsq1, q2 and QAB. A second parameter ξ has been intro-duced to account for the background noise in the detec-tion. In Fig.2 we plotted Qm

AB vs QsAB, i.e. the averages

of the quantities respectively present on the left and onthe right side of Eq.(4) over all the state preparations.

QsAB

QmAB

0.05 0.10 0.15 0.20 0.250.00

0.05

0.10

0.15

0.20

0.25

0.0

0.1

0.2

0.3

0.4

0.5

FIG. 2: Plot of Qm

AB vs Qs

AB, as defined in the text. Theexperimental points along with their statistical errors are re-ported as diamonds. The dashed-line represents the relationgiven in Eq.(4). The solid-line is drawn by setting the param-eters, introduced in the text, ∆ = 0.015 and ξ = 0.03. Resultsfor a uniform random distribution of these parameters in theranges [0, 0.03] and [0, 0.06], respectively, are reported as acontour plot for Nt = 5 × 105 simulated trials. The contourplot represents the frequency of the trials in the bins, equallyspaced with area 0.005 × 0.005 normalized to the maximum.

The dashed-line represents the linear relation given byEq.(4). The slightly sloped band is the result of a nu-merical simulation with values for the parameters ∆ andξ reported in caption of Fig. (2).

In order to prove the security of our setup we mustcompare the information shared by Alice and Bob withthe one possessed by Eve. It is known [24] that a secretkey can be safely distilled with unidirectional classicalcommunication if the condition IAB ≥ min[IAE , IBE ] isaccomplished. The average Alice-Bob mutual informa-tion is given by:

IAB = (IABz + IABx) /2 (6)

where IABi = 1 − h (QABi) with i = (x, z), and h(x) =x log2(x) + (1 − x) log2(1 − x) is the binary entropy. To

evaluate IAE we need an estimate of QZ,XAE , defined as the

error rate between Eve’s guesses on Alice’s encoding andAlice’s real encoding. For Eve’s Z-attack, Eq.(1), QZ

AEreads:

QZ

AE =1

2− 2

√

q1xq2x (1 − q1x) (1 − q2x) . (7)

A similar result holds for QX

AE. We note that these twoquantities are independent of initial basis preparation,and depend only on non-orthogonality of Eve’s ancillae.The average Alice-Eve mutual information is then

IAE = (IZ

AE + IX

AE)/2, (8)

where IZ,XAE = 1− h(QZ,X

AE). An expression for the mutualQBER between Bob and Eve, QBE , can be derived interms of QAB and QAE using the relation QBE = QAB +QAE−2QAB ·QAE [11]. The average mutual information

4

0.05 0.10 0.15 0.20 0.250.0

0.2

0.4

0.6

0.8

1.0

QsAB

I

IAB

IAE IBE

FIG. 3: Mutual information as function of the QBER Qs

AB .The experimental points are reported with their statisticalerrors as crossed-rectangles (IAB), white-crossed-rectangles(IAE) and gray-crossed-rectangles (IBE). The solid lines arethe mutual information with ∆ = 0.015 and ξ = 0.03. Resultsof Nt = 5×105 simulated trials with the same parameters usedfor Fig.2 are reported. The asymmetric imperfection of thetwo channels cause the gray area below the lines IAE, IBE .

between Bob and Eve is then expressed as:

IBE = (IZ

BEz + IZ

BEx + IX

BEx + IX

BEz)/4 , (9)

where I(Z,X)BEi = 1 − h(QZ,X

BEi), with i = (x, z).In Fig.3 are plotted the curves of mutual information I

according to Eqs.(6), (8) and (9) as function of the quan-

tity QsAB, already defined. We report in the same figure

experimental, numerical and theoretical values. The solidlines represent our best fit of the experimental data. Itis worthy of note the almost perfect intersection of theselines for IAB , IAE and the theoretical (dashed) line atQs

AB ≃ 19%, corresponding to the ≃ 23% of detectionprobability in Ref. [11]. Furthermore the curve for IBE

is always below IAB , implying the security of the schemeagainst IIA regardless of the noise on the channel.

In conclusion we reported on the experimental test ofthe two-way deterministic protocol for quantum commu-nication LM05. We modulated the noise on the channelin such a way as to simulate the disturbance introducedby Eve’s IIA. By means of independent measurementsof the various involved QBERs we proved the soundnessof Eq.(4) and rated the quality of our setup. With asubsequent measure we estimated the mutual informa-tion between Alice, Bob and Eve. Although we did notperform a direct, contextual, transmission of a string ofbits we believe that the good agreement between experi-mental data and theoretical predictions presented in thiswork witnesses its potential feasibility.

We thank S. Mancini, D. Vitali and S. Pirandola forfruitful discussions. This work has been supported by theMinistero della Istruzione, dell’ Universita e della Ricerca(FIRB-RBAU01L5AZ and PRIN-2005024254), and theEuropean Commission through the Integrated Project‘Qubit Applications’ (QAP), Contract No 015848, fundedby the IST directorate.

[1] C. H. Bennett and G. Brassard, in Proc. IEEE Int. Conf.

Comp. Syst. Sign. Proc., Bangalore, India, 1984, pp.175-179.

[2] A. K. Ekert, Phys. Rev. Lett. 67, 661 (1991).[3] C. H. Bennett, Phys. Rev. Lett. 68, 3121 (1992); B. Hut-

tner et al., Phys. Rev. A 51, 1863 (1995); D. Bruss, Phys.Rev. Lett. 81, 3018 (1998); K. Inoue et al., Phys. Rev.Lett. 89, 037902 (2002).

[4] N. Gisin, et al., Rev. of Mod. Phys. 74, 145 (2002).[5] D. Mayers, J. ACM 48, 351 (2001); H.-K. Lo and H.

F. Chau, Science 283, 2050 (1999); P. W. Shor and J.Preskill, Phys. Rev. Lett. 85, 441 (2000).

[6] C. Marand and P. D. Townsend, Opt. Lett. 20, 1695(1995); A. Muller et al., Europhys. Lett. 33, 335 (1996);R. J. Hughes et al., J. Mod. Opt. 47, 533 (2000); A.Poppe et al., Opt. Expr. 12, 3865 (2004); C. Gobby et

al., Appl. Phys. Lett. 84, 3762 (2004).[7] G. L. Long and X. S. Liu, Phys. Rev. A 65, 032302

(2002).[8] A. Beige, et al., Acta Phys. Pol. A 101, 357 (2002); I. P.

Degiovanni, et al., Phys. Rev. A 69, 032310 (2004); Q.-Y. Cai and B.-W. Li, Phys. Rev. A 69, 054301 (2004); T.Gao et al., J. Phys. A: Math. Gen., 38 5761-5770 (2005).

[9] K. Bostrom and T. Felbinger, Phys. Rev. Lett. 89,187902 (2002).

[10] Q.-Y. Cai and B.-W. Li, Chin.Phys. Lett. 21, 601 (2004);F.-G. Deng and G. L. Long, Phys. Rev. A 69, 052319

(2004); ibid. 70, 012311 (2004); M. Lucamarini, and G.Di Giuseppe, Int. J. Quant. Inf. 3, 189 (2005).

[11] M. Lucamarini and S. Mancini, Phys. Rev. Lett. 94,140501 (2005).

[12] With ‘in principle’ we essentially mean ‘on a noiselessand lossless channel’.

[13] G. Brassard and L. Salvail, Lect. Notes Comp. Sci. 765,410 (1994); W.T. Buttler et al., Phys. Rev. A 67, 52303(2003).

[14] C.H. Bennett et al., IEEE Trans. Inf. Theory 41, 1915(1995).

[15] M. H. Rubin, Phys. Rev. A 54, 5349 (1996).[16] W. P. Grice and I. A. Walmsley, Phys. Rev. A 56, 1627

(1997); G. Di Giuseppe, et al., Phys. Rev. A 56, R21(1997); T. E. Keller and M. H. Rubin, Phys. Rev. A56, 1534 (1997).

[17] Y.-H. Kim and W. P. Grice, Phys. Rev. A 68,(2003).[18] C. Kurtsiefer, et al., Phys. Rev. A 64, 023802 (2001);

F. A. Bovino, et al., Opt. Comm. 227, 343 (2003).[19] D. F. V. James, et al., Phys. Rev. A 64, 052312 (2001).[20] W. K. Wootters, Phys. Rev. Lett. 80, 2245 (1998).[21] G. Weihs, et al., Phys. Rev. Lett. 81, 5039 (1998).[22] A. Poppe, et al., Opt. Express 12,3865 (2004).[23] C. A. Fuchs et al., Phys. Rev. A 56, 1163 (1997).[24] I. Csiszar and J. Korner, IEEE Transactions on Informa-

tion Theory IT-24, 339 (1978).