Feasibility of 300 km quantum key distribution with entangled states

Thomas Scheidl¹, Rupert Ursin¹, Alessandro Fedrizzi¹, Sven Ramelow¹, Xiao-Song Ma¹, Thomas Herbst², Robert Prevedel², Lothar Ratschbacher¹, Johannes Kofler¹, Thomas Jennewein¹ and Anton Zeilinger^1,2,3

¹ Institute for Quantum Optics and Quantum Information, Austrian Academy of Sciences, Boltzmanngasse 3, 1090 Vienna, Austria
² Faculty of Physics, University of Vienna, Boltzmanngasse 5, 1090 Vienna, Austria

³ Author to whom any correspondence should be addressed.

E-mail: zeilinger-office@univie.ac.at

Received 12 February 2009
Published 4 August 2009

Contents

• 1. Introduction
  • 1.1. Entanglement-based QKD
  • 1.2. Theoretical error model
• 2. Description of the experiments and results
  • 2.1. Source at Alice
  • 2.2. Source asymmetric in between Alice and Bob
  • 2.3. Source in the middle
  • 2.4. Clock synchronization
• 3. Conclusion
• Acknowledgments
• References

1. Introduction

Quantum cryptography, which promises to solve the problem of secure key distribution for the encryption of messages, is the most mature technical application in the field of quantum information and quantum communication. Current quantum key distribution (QKD) architectures can be broadly categorized into systems based on weak coherent laser pulses (WCP) [2]–[5], on continuous variables [6]–[10] or on entanglement [11]–[13]. On the commercial market, WCP systems have been available for a while [14, 15]. Most recently a QKD network was successfully demonstrated in Vienna [16], including a fully automatic entanglement-based QKD system, operating reliably with installed telecom fibers [17].

An important benchmark for a QKD system is the secure key rate that can be achieved for a given quantum channel attenuation. Due to absorptive losses in the communication channels and detector imperfections, the distance/attenuation over which a secure key can still be generated is limited for all QKD systems. The experimental method that presently offers the best performance in high loss regimes is symmetric entanglement-based systems. This was recently shown by Ma et al  [1], where the authors conclude that state-of-the-art pulsed entanglement-based QKD systems with the source placed symmetrically in the middle between the receivers can cover up to twice as much attenuation as WCP systems. In their particular example, the maximal attenuation was evaluated to be an astonishing 70 dB (in the case of optimized mean photon number in the limit of an infinite number of key bits) when using experimental parameters as in [18]. Comparatively, a WCP system based on the same parameters can cover only up to 35 dB attenuation.

The quantum channels in a future global quantum communication network will mostly consist of optical fibers, which are already widely installed. As an alternative, free-space connections will allow to quickly build up connections between parties with direct line- of-sight [18]–[26]. Additionally, orbital free-space links, e.g. satellite-to-ground links or inter-satellite links, will allow the efficient global interconnection of regional quantum networks  [27, 28]. The attenuation expected for a single link ground connection from a satellite is at least 30 dB, and its feasibility has been shown in first ground-based tests [5, 18]. In the more demanding two-link satellite scenario, QKD systems will have to cope with 60 dB attenuation.

In this work, we experimentally test the performance of entanglement-based QKD in an attenuation range from 35 to 70 dB over a distance of 144 km. We demonstrate the feasibility of entanglement-based QKD in loss regimes, where secure communication is no longer possible using WCP systems. With respect to the channel symmetry, we show that the obtained secure key rates confirm the predicted advantage of the symmetric scenario over commonly used asymmetric systems and we compare our results with the theoretical model devised by Ma et al  [1].

1.1. Entanglement-based QKD

The most commonly used entanglement-based QKD scheme is the BBM92 protocol [12], which was shown to be equivalent to the original BB84 scheme [29] under ideal conditions. Ideally, a source generates polarization entangled photons in the state

where |H (|V) denotes horizontal (vertical) polarization. The photons in modes a and b are sent through quantum channels to the two communicating parties, Alice and Bob. Both perform measurements on the incoming photons in one out of two randomly chosen, complementary bases. Let us assume that they choose between the |H,V-basis and the |P,M-basis, with and . Alice and Bob individually record their measurement outcomes, including the information about the measurement basis. Assigning the binary value `0' to the results |H and |P and the value `1' to the results |V and |M, each of the observers obtains a completely random bit string, the raw key. The sifted key is gained after basis reconciliation, where the raw key is reduced by the basis reconciliation factor of 2. This is due to the fact that Alice and Bob discard those events where they have accidentally chosen different bases. Since the quantum state (1) received by Alice and Bob was entangled, the retained measurement outcomes are perfectly anti-correlated, i.e. Alice's and Bob's sifted keys are perfectly inverse to each other. This key is then further used to encode a message that can be transmitted over a public channel.

The security against an eavesdropper, Eve, is guaranteed by the laws of quantum mechanics. Any attempt by Eve to gain information on the transmitted qubits will inevitably reduce the entanglement and introduce errors in the sifted key. The quantum bit error ratio (QBER) q is constantly monitored by Alice and Bob by comparing small parts of their keys. As long as the QBER stays below a certain value, classical error correction and privacy amplification protocols can be used to distill an unconditional secure key.

In real-world QKD experiments, errors will most probably be caused by imperfections in the setup rather than by Eve. However, for unconditional security, all errors need to be treated as if coming from an attempted eavesdropping attack. The next section is devoted to a theoretical analysis on how the various imperfections affect the QBER and in consequence limit the achievable secure key rate.

1.2. Theoretical error model

In practical QKD setups, most errors will actually originate from experimental imperfections, e.g. non-perfect entanglement and higher order photon emissions at the source, noisy quantum channels, imperfect polarization analyzers and photon detectors. A direct estimate of the expected QBER in a quantum optics QKD experiment can be obtained by measuring the total quantum correlation visibility V_tot, which has a simple relation to q:

and can be obtained from the maxima, N_max, and minima, N_min, of the observed coincidences:

Given that all these parameters are experimentally accessible, one can model the performance of a QKD system. Firstly, a finite coincidence time window τ_c, limited by the timing resolution of the detection apparatus, results in a certain probability to accidentally detect two uncorrelated photons in coincidence, which do not belong to the same pair. Secondly, the statistical nature of the down-conversion process inherently generates multi-photon emissions within the coherence time of the photons. This also results in uncorrelated detection events at Alice and Bob. Furthermore, the finite coincidence time window leads to uncorrelated accidental coincidences from background light and intrinsic detector dark counts. In addition, imperfections and misalignment in the setup (source, polarization analysis, etc) introduce systematic errors. In the following, the errors from uncorrelated detection events are characterized by the accidentals visibility V_acc and the systematic errors by the system visibility V_sys. The total correlation visibility is given by V_tot = V_sys·V_acc.

The effects of these error sources on the secure key rate are analyzed analytically within a model devised by Ma et al  [1], which assumes pulsed operation of the entangled photon source (SPDC source). The input parameters for the model are the photon-pair generation rate at the source, the ratio between the coincidence and single rates at Alice and Bob including detector efficiencies and the system visibility V_sys. The model yields an error probability and a secure key gain per pump pulse as a function of total two-photon attenuation in a QKD experiment. A lower bound for the final secure bit rate per pulse R is then calculated using Koashi and Preskill's security analysis [30] via

Here, P_c is the coincidence detection probability between Alice and Bob per pump pulse, is the basis reconciliation factor and H₂ is the binary entropy function

The correction factor f (q) accounts for the fact that practical error-reconciliation protocols, in general, do not perform ideally at the Shannon limit. Instead of assuming f(q)≈1, we used realistic values for the applied bidirectional error correction protocol CASCADE [31]. Furthermore, for our case of a cw-type SPDC source, the model was adapted to yield a probability per coincidence time window instead of a probability per pump pulse. We want to remark that other error-reconciliation protocols (e.g. WINNOW [32]) promise to perform more efficiently, and it will be the subject of future investigation whether it might carry advantages also for our specific experimental environment.

Note that equation (4) gives the final secure key rate in the limit of infinite key lengths. However, in a practical implementation, the secure key is obtained via error correction and privacy amplification on a finite key, which will further reduce the secure key rate to some extent (see [1, 33] for more details). For simplicity, we will restrict the analysis of our experiments to the infinite bounds.

2. Description of the experiments and results

We implemented three different experimental QKD scenarios (see figure 1). In all three experiments, one photon of an entangled pair was sent to Bob via a 144 km free-space link, established between the islands of La Palma and Tenerife. The first and the second experiments were both asymmetrical with respect to the different channel losses for Alice and Bob. In the first experiment, the SPDC source was placed at Alice (source at Alice) and one photon of an entangled pair was measured directly at the source. In the second experiment (source asymmetric in between Alice and Bob), Alice's photon was sent through a 6 km single-mode fiber before it was analyzed. In the third scenario, both photons were sent via the 144 km free-space link to a common receiver where they were split up and analyzed separately. This can be seen as an effective realization of the source in the middle scheme, since the channel losses for Alice and Bob were identical.

To get an overview about the different scenarios and the corresponding results, please refer to table 1. A detailed discussion will be given in the next sections.

2.1. Source at Alice

The experimental situation is depicted in figure 1(a). The SPDC source [34] was located in La Palma and generated photon pairs in the entangled state (1). The photons in modes a and b were coupled into single-mode fibers, Alice's photon in mode a was analyzed and detected locally after only 1 m of single-mode fiber, while the photon in mode b was sent through a 144 km free-space channel to Tenerife. There it was collected by the 1 m diameter telescope of the Optical Ground Station (OGS) which is operated by the European Space Agency (ESA), and analyzed by Bob.

Each polarization analyzer consisted of an electro-optical modulator (EOM), a polarizing beam splitter (PBS) and two single-photon avalanche diodes. Triggering the EOMs by independent quantum random number generators (QRNGs), the analyzer modules randomly switched between the complementary bases |H,V and |P,M as required for the BBM92 protocol [12]. At Alice and Bob, every detection event (including arrival time, detector channel and EOM setting information) was recorded onto local computer hard disks, using time-tagging units disciplined by the global positioning system (GPS) time standard. Note that using active analyzers that are triggered by a quantum random number generator represents a security advantage over passive QKD systems, because it prevents an eavesdropper from applying certain side-channel attacks, such as faked states attacks [1, 35].

In the first implemented scenario, the free-space channel attenuation for photons in mode b was measured to be approximately 32 dB on average (including all optical elements), while only half of the locally measured photons (3 dB) in mode a were lost in Alice's analyzer module. The total two-photon attenuation was therefore 35 dB.

The SPDC source generated entangled photon pairs at an estimated rate of 7 MHz, limited by the peak count rate of Alice's detector system. After single-mode fiber coupling, 550 000 coincidences were observed locally, corresponding to a combined coupling and detection efficiency of 28%. The darkcount rate at Alice was 500 Hz, while Bob's detectors showed an average of 1200 Hz. For these parameters and a coincidence window of τ_c = 1.5 ns, theory predicts an upper bound of V_th = 94.1% for the total visibility, which includes the initially measured system visibility V_sys = 96% as well as the background and multi-pair emission limited visibility of V_acc = 98%. However, the actual visibility of the transmitted entangled state was measured to be V_tot = 86.2% on average. The discrepancy in V_th was most probably caused by a polarization drift in the fiber connecting the source with the transmitter telescope during the measurements.

The result of a typical measurement is shown in figure 2. In total, three measurements were performed and sifted keys containing 11 024 bits (130 s integration time), 13 642 bits (190 s integration time) and 16 851 bits (190 s integration time), respectively, were obtained. During a measurement run, the free-space link usually undergoes strong atmospheric turbulence, resulting in a time-dependent two-photon attenuation. This is reflected by the time-resolved sifted key rates (see figure 2). The QBERs for these measurement runs of 6.6, 7.3 and 6.9%, respectively, were obtained by comparing the sifted keys and are in good agreement with the measured overall visibility. Finally, applying equation (4) with f(q)≈1.18 yields an averaged secure key rate of approximately 24 bits s^–1. A comparison of all experimental data points to the theoretically calculated secure key rate as a function of overall link attenuation is shown in figure 4.

2.2. Source asymmetric in between Alice and Bob

The second scenario extends the source at Alice scheme (see section 2.1), such that the photons in mode a were delayed by 29.6 μs in a 6 km long single-mode fiber (see figure 1(b)). The attenuation of the fiber was measured to be 17 dB and during this particular measurement series, the free-space link attenuation was 38 dB. Combined with the 3 dB loss in Alice's analyzer, the overall two-photon attenuation was 58 dB. For this experiment, we increased the output of the SPDC source to a pair generation rate of 32 MHz by operating at the maximum available pump laser power of 50 mW. Due to detector saturation, the fiber coupled and locally detectable pair rate could only be extrapolated to be 2.5 MHz. In this situation, the initial system visibility was V_sys = 94%, a slight reduction compared to the 35 dB scenario, caused by the delay fiber. With the same coincidence window (τ_c = 1.5 ns) and darkcount rates as in the first experiment (500 Hz at Alice and 1200 Hz at Bob), the theoretical upper bound for this scheme turns out to be V_th = 88% and the measured total visibility of the entangled state at the receiver was V_tot = 86.2%, coincidentally the same as in the first scenario.

A typical measurement result is depicted in figure 3. In total, two sifted keys were obtained, containing 1107 bits (580 s integration time) and 1684 bits (870 s integration time). The corresponding QBERs were 6.9 and 6.8%, respectively, and a secure key rate of 0.6 bits s^–1 could be obtained from equation (4) with f(q)≈1.18. For this scenario, both the expected visibility and the key rate agree very well with the model (see figure 4).

2.3. Source in the middle

The experimental situation for the third, the source in the middle scenario, is depicted in figure 1(c). The entangled photons in modes a and b were coupled into single mode fibers, guided to two separate transmitter telescopes and sent through a 144 km free-space channel to one common receiver in Tenerife. The total two-photon attenuation was measured to be about 71 dB (including all optical components). For a detailed description of the setup please refer to [36].

The source produced photon pairs at a rate of 10 MHz from which 3.3 MHz single photons and 1 MHz photon pairs were detected locally. Both photons were sent via two telescopes over the 144 km free-space links to Tenerife. On average, 0.071 transmitted photon pairs/s could be detected, using a coincidence window of 1.25 ns. Each detector registered a background count rate of 400 Hz. Accumulating data for a total amount of 10 800 s, we measured an averaged visibility of the transmitted entangled state of V_tot = 92% (with V_sys = 99% and V_acc = 94%), which is very close to the theoretical upper bound of V_th = 93%. Based on these measurements we inferred that a QKD experiment employing a similar setup would have yielded a QBER of approximately 4%. From the coincidence rate and the QBER-dependent performance of the classical key distillation protocols (f(0.04)≈1.16), we estimate that our experiment would have yielded a final secure bit rate of approximately 0.02 bits s^–1 (see figure 4). However, the implementation of a full QKD experiment was not possible, because only one receiver station and module was available in Tenerife.

2.4. Clock synchronization

As an additional feature, our coincidence search algorithm used during the first two experiments could be utilized to synchronize the individual time bases at Alice and Bob within 0.5 ns. For the third experiment, such a synchronization was not necessary, because one and the same time-tagging system was used for the measurements.

Coincidence events between Alice and Bob were identified by calculating the cross-correlation function of the individual time-tagging data sets. A peak in the cross-correlation function indicated the current time offset Δt between the timescales of the receiver units. Initially, Alice's and Bob's time bases were both disciplined by the GPS time standard. However, the two individual GPS receivers exhibited a relative drift during a measurement run. By analyzing the data in blocks of adjustable length, our software measured and compensated for this relative drift with 0.5 ns resolution by temporal alignment of the data blocks. The data of the first experiment described were analyzed in blocks of 5 s length, while the data obtained in the second experiment were analyzed in blocks of 30 s length. The corresponding results concerning the relative drift of Alice's and Bob's time bases are depicted in figure 5.

3. Conclusion

We experimentally studied entanglement-based QKD in three different high-attenuation scenarios on a 144 km free-space link between the two Canary Islands La Palma and Tenerife to verify the symmetry advantage of such an implementation. This involved placing the source directly at Alice, asymmetrically between Alice and Bob, and finally, symmetrically between the two parties. Our results demonstrate that in the symmetric case (source in the middle) secure keys can be generated up to a channel attenuation of 70 dB, a regime in which asymmetric schemes fail. We conclude that entanglement-based QKD systems are the systems of choice for long distance quantum communication. Compared to the expected link attenuations in a low earth orbit (LEO) satellite to ground scenario of 30 dB, our results show that entanglement-based systems are suitable for use in either a single-link (source at Alice) or a two-link (source in the middle) scenario. Our results imply that, using similar technology as in our experiment, it should readily be possible to implement QKD over distances of 300 km. This also holds true for fiber-based QKD, as there the attenuation is typically of the order of 0.2 dB km^–1, resulting in similar total attenuations.

Acknowledgments

We thank F Sanchez (Director IAC) and A Alonso (IAC), T Augusteijn, C Perez and the staff of the Nordic Optical Telescope (NOT), J Kuusela, Z Sodnik and J Perdigues of the OGS as well as J Carlos and the staff of the Residence of the Observatorio del Roque de Los Muchachos for their support at the trial sites. This work was supported by ESA (contract number 18805/04/NL/HE), the Austrian Science Foundation (FWF) under project number SFB1520, the Doctoral Program CoQuS, the European project QAP, the Austrian Research Promotion Agency (FFG) through the Austrian Space Program ASAP, and the DTO-funded US Army Research Office within the QCCM program. We also thank N Lütkenhaus for his valuable input.

References

[1]

Ma X, Fung C-H F and Lo H-K 2007 Quantum key distribution with entangled photon sources Phys. Rev. A 76 012307 
CrossRef

[2]

Hwang W-Y 2003 Quantum key distribution with high loss: toward global secure communication Phys. Rev. Lett. 91 057901 
CrossRefPubMed

[3]

Peng C-Z, Zhang J., Yang D, Gao W-B, Ma H-X, Yin H, Zeng H-P, Yang T, Wang X-B and Pan J-W 2007 Experimental long-distance decoy-state quantum key distribution based on polarization encoding Phys. Rev. Lett. 98 010505 
CrossRefPubMed

[4]

Hasegawa J, Hayashi M, Hiroshima T, Tanaka A and Tomita A A 2007 Experimental decoy state quantum key distribution with unconditional security incorporating finite statistics arXiv:0705.3081
Preprint

[5]

Schmitt-Manderbach T et al 2007 Experimental demonstration of free-space decoy-state quantum key distribution over 144 km Phys. Rev. Lett. 98 010504 
CrossRefPubMed

[6]

Ralph T C 1999 Continuous variable quantum cryptography Phys. Rev. A 61 010303 
CrossRef

[7]

Hillery M 2000 Quantum cryptography with squeezed states Phys. Rev. A 61 022309 
CrossRef

[8]

Ralph T C 2000 Security of continuous-variable quantum cryptography Phys. Rev. A 62 062306 
CrossRef

[9]

Lodewyck J et al 2007 Quantum key distribution over 25 km with an all-fiber continuous-variable system Phys. Rev. A 76 042305 
CrossRef

[10]

Qi B, Huang L-L, Qian L and Lo H-K 2007 Experimental study on the Gaussian-modulated coherent-state quantum key distribution over standard telecommunication fibers Phys. Rev. A 76 052323 
CrossRef

[11]

Ekert A K 1991 Quantum cryptography based on Bell's theorem Phys. Rev. Lett. 67 661–3 
CrossRefPubMed

[12]

Bennett C H, Brassard G and Mermin N D 1992 Quantum cryptography without Bell's theorem Phys. Rev. Lett. 68 557–9 
CrossRefPubMed

[13]

Honjo T et al 2008 Long-distance entanglement-based quantum key distribution over optical fiber Opt. Express 16 19118–26 
CrossRefPubMed

[14]

Magic Q, Somerville, Massachusetts, USA http://www.magiqtech.com/

[15]

`Cerberis' and `Clavis2' by Quantique ID, Geneva, Switzerland http://www.idquantique.com

[16]

Peev M et al 2009 The SECOQC quantum key distribution network in Vienna New J. Phys. 11 075001 
IOPscience

[17]

Treiber A, Poppe A, Hentschel M, Ferrini D, Lorunser T, Querasser E, Matyus T, Hubel H and Zeilinger A 2009 Fully automated entanglement-based quantum cryptography system for telecom fiber networks arXiv:0901.2725v1
Preprint

[18]

Ursin R et al 2007 Entanglement-based quantrum communication over 144 km Nat. Phys. 3 481–6 
CrossRef

[19]

Bennett C H, Bessette F, Brassard G, Savail L and Smolin J 1992 J. Cryptology 5 3 
CrossRef

[20]

Jacobs B C and Franson J D 1996 Quantum cryptography in free space Opt. Lett. 21 1854–6 
CrossRefPubMed

[21]

Buttler W T, Hughes R J, Kwiat P G, Luther G G, Morgan G L, Nordholt J E, Peterson C G and Simmons C M 1998 Free-space quantum-key distribution Phys. Rev. A 57 2379–82 
CrossRef

[22]

Buttler W T, Hughes R J, Lamoreaux S K, Morgan G L, Nordholt J E and Peterson C G 2000 Daylight quantum key distrbution over 1.6 km Phys. Rev. Lett. 84 5652–5 
CrossRefPubMed

[23]

Kurtsiefer C, Zarda P, Halder M, Weinfurter H, Gorman P M, Tapster P R and Rarity J G 2002 A step towards global key distribution Nature 419 450 
CrossRefPubMed

[24]

Kurtsiefer C, Zarda P, Halder M, Gorman Ph M, Tapster P R, Rarity J G and Weinfurter H 2002 Long-distance free-space quantum cryptography Proc. SPIE 4917 25–31 
CrossRef

[25]

Erven C, Couteau C, Laflamme R and Weihs G 2008 Entangled quantum key distribution over two free-space optical links Opt. Express 16 16840–53 
CrossRefPubMed

[26]

Peloso M P, Gerhardt I, Ho C, Lamas-Linares A and Kurtsiefer C 2009 Daylight operation of a free space, entanglement-based quantum key distribution system New J. Phys. 11 045007 
IOPscience

[27]

Buttler W T, Hughes R J, Kwiat P G, Lamoreaux S K, Luther G G, Morgan G L, Nordholt J E, Peterson C G and Simmons C M 1998 Practical free-space quantum key distribution over 1 km Phys. Rev. Lett. 81 3283–6 
CrossRef

[28]

Ursin R et al 2008 Space-quest: experiments with quantum entanglement in space Int. Aeronautical Congress Proc. A2.1.3 arXiv:0806.0945
Preprint

[29]

Bennett C H and Brassard G 1984 Quantum cryptography Proc. IEEE Int. Conf. on Computers, Systems and Signal Processing, Bangalore, India  IEEE, New York p 175 

[30]

Koashi M and Preskill J 2003 Secure quantum key distribution with an uncharacterized source Phys. Rev. Lett. 90 057902 
CrossRefPubMed

[31]

Brassard G and Salvail L 1994 Eurocrypt `93: Workshop on the theory and application of cryptographic techniques on advances in cryptology Lecture Notes in Computer Science vol 765  (New York: Springer) pp  410–23 

[32]

Buttler W T, Lamoreaux S K, Torgerson J R, Nickel G H, Donahue C H and Peterson C G 2003 Fast, efficient error reconciliation for quantum cryptography Phys. Rev. A 67 052303 
CrossRef

[33]

Scarani V, Bechmann-Pasquinucci H, Cerf N J, Dusek M, Luetkenhaus N and Peev M 2008 The security of practical quantum key distribution arXiv:0802.4155v2 [quant-ph]
Preprint

[34]

Fedrizzi A, Herbst T, Poppe A, Jennewein T and Zeilinger A 2007 A wavelength-tunable, fiber-coupled source of narrowband entangled photons Opt. Express 15 15377–86 
CrossRefPubMed

[35]

Makarov V and Hjelme D R 2005 Faked states attack on quantum cryptosystems J. Mod. Opt. 52 691–705 
CrossRef

[36]

Fedrizzi A, Ursin R, Herbst T, Nespoli M, Prevedel R, Scheidl T, Tiefenbacher F, Jennewein T and Zeilinger A 2009 High-fidelity transmission of entanglement over a high-loss freespace channel Nat. Phys. 5 389–92 
CrossRef