Experimental quantum cryptography with qutrits

Simon Gröblacher¹, Thomas Jennewein², Alipasha Vaziri³, Gregor Weihs⁴ and Anton Zeilinger^1,2

¹ Institut für Experimentalphysik, Universität Wien, Boltzmanngasse 5, A-1090 Wien, Austria
² Institut für Quantenoptik und Quanteninformation (IQOQI), Österreichische Akademie der Wissenschaften, Boltzmanngasse 3, A-1090 Wien, Austria
³ Physics Department, University of Maryland, College Park, MD 20742, USA
⁴ Institute for Quantum Computing and Department of Physics, University of Waterloo 200, University Ave. W, Waterloo, ON N2L 3G1, Canada

Email: simon.groeblacher@univie.ac.at

Received 1 February 2006
Published 26 May 2006

The wish to protect information from unauthorized listeners has driven humans from early mankind on to invent all sorts of cryptographic schemes and encryption algorithms. The modern computer age has made the security need as important and the difficulty of breaking classical algorithm-based cryptography as easy as never. In the last decades of the 20th century, cryptography schemes were proposed where the security relies on the laws of quantum mechanics [1]-[4]. An intruder trying to listen in will always be detected. Because these schemes establish identical secret keys in two remote locations they have since become known under the term quantum key distribution (QKD). QKD has been experimentally performed using all sorts of systems, applying various protocols, over distances of up to 120 km [5]-[8]. These experiments are performed in the lab as well as in real-life environments, such as the nightly sky of a metropolitan city [9]-[11]. Even a secure bank transfer has been performed [12] and commercial prototype systems are already available, which underlines the need and usefulness of QKD systems.

All experiments performed so far were based on two-dimensional quantum systems (qubits). Only in recent years noteworthy research efforts have been put into higher-dimensional quantum systems (qudits), in particular multi-dimensional entanglement. Especially their application in tests of quantum nonlocality and quantum information processing have attracted substantial interest [13]-[18]. For quantum cryptography the usage of higher-dimensional systems offers advantages such as an increased level of tolerance to noise at a given level of security and a higher flux of information compared to the qubit cryptography schemes. In general a QKD protocol is considered secure as long as the mutual information of the two parties A and B exchanging the key is greater than the mutual information of A and E (or B and E), where E is an eavesdropper. The possible mutual information of an eavesdropper with one of the observers is strictly related to the noise rate of the protocol and therefore an upper noise bound for a secure key distribution can be found. For the BB84 and the Ekert qubit schemes the limit on the noise ratio is 14.6% [19], which may be slightly improved with alternative qubit schemes, e.g. using the full set of d  +  1 mutually unbiased bases (MUBs) [20]. In contrast, for three-dimensional quantum systems (qutrits) the noise may be as high as 22.5% [21] for the Ekert-based protocol. Furthermore, because a larger alphabet is used, each system contains more information than a two-dimensional one.^Note5  Here we present QKD using entangled qutrits in an extended Ekert scheme [4], similar to the first QKD experiment with entangled qubits, performed by Jennewein et al  [22]. The security of the keys obtained is thereby confirmed by violating a three-dimensional Bell-type inequality.

In the present work, the qutrits are encoded into the orbital angular momentum (OAM) of photons in the Laguerre-Gaussian modes LG_p,l, which are the solution of the paraxial wave equation in its cylindrical coordinate representation. The index p represents the number of radial nodes and the index l is the winding number, with 2πl describing the change in phase on a closed path around the propagation axis. Thus a mode with p  =  l  =  0 is a Gaussian mode. Throughout this paper we only consider photons with p  =  0, which span an infinite-dimensional Hilbert space.

It has been experimentally shown [23, 24], and was later theoretically confirmed [25, 26], that in the process of parametric down-conversion the orbital angular momentum is conserved for each individual pump photon if all beams are collinear. Moreover, it has been demonstrated [23] that the down-converted photons are in an entangled state with respect to the OAM, which can be transformed into the maximally entangled state using local filtering [27]. Therefore, using a pump beam with a Gaussian profile one can obtain the maximally entangled state

with . Here |1 is the LG_0,1 mode, |2 the LG_0, - 1 mode and |0 the Gaussian mode LG_0,0. Such a maximally entangled state can violate a three-dimensional Bell-type inequality [28, 29] and therefore local realism:

with

being the probabilities that the outcomes of observers A and B measuring A_a and B_b differ by k (modulo 3). The observables A₁,A₂ and B₁,B₂ correspond to different local analyser settings. Note, that the local realistic bound for inequality (2) is the same as for the standard CHSH inequality [30]. The maximal violation for the maximally entangled state is . It is interesting to note that for certain non-maximally entangled states quantum mechanics predicts an even higher violation, i.e.  [31]. The violation of (2) has been experimentally shown by Vaziri et al  [32].

To realize QKD based on an extended three-dimensional Ekert scheme, the observers A and B randomly switch between three settings of their transformation holograms. A₁,A₂ (B₁,B₂) are the settings to maximally violate inequality (2) (and therefore check the security of the protocol) and A₃, B₃ are settings leading to perfect correlations and therefore are used for key production. A and B choose their settings independently and at random and also record their photon detections independently. After sufficiently many measurement runs A and B compare their hologram settings. One-ninth of the produced data can be used for the key, while 4/9 of the data are for the violation of the Bell inequality and the remaining 4/9 have to be discarded. After this basis reconciliation B publicly announces his data for the Bell inequality check, and A computes the value of S₃. In the case that S₃  >  2, the key is secure and an eavesdropper will not have gained any useful information on the key.^Note6 

In our experimental setup (figure 1) we pump a type-I 1.5 mm thick β-barium-borate (BBO) crystal with an Ar ⁺  laser at 351 nm. The optical pump power is approximately 95 mW and the pump laser is vertically polarized. Via spontaneous parametric down-conversion (SPDC) pairs of photons entangled in orbital angular momentum are produced. To ensure indistinguishability, only the energy-degenerate photons are selected via narrow band filters in fibre-coupled air gaps. The produced state is almost maximally entangled, with effective coefficients α  =  0.642 ± 0.009, β  =  0.546±0.009 and γ  =  0.539±0.009, which are calculated from the observed coincidence count rates for A₃ and B₃.

In order to produce and control the LG modes we use transmission phase holograms - diffraction gratings which are interference patterns of an LG_0,1 mode with a plane wave [33, 34]. The holograms etched into quartz glass are 3 mm×3 mm, have a periodicity of 30 μm, and their first-order diffraction efficiency at 702 nm is approximately 80%. If a beam passes such a hologram, an LG_0,0 is, in the first diffraction order, transformed into an LG_0,1 mode.^Note7  If the hologram is slightly horizontally displaced, a superposition of the two modes is obtained, with the respective amplitudes being a function of the displacement [23]. By inverting the beam direction the transformation process of the hologram is also inverted and an LG_0,1 is transformed into an LG_0,0. With these holograms it is possible to create different superpositions of LG modes necessary for a test of Bell's inequality and for our cryptographic scheme [35].

To transform the state of the entangled photons, a pair of holograms is placed in each down-conversion arm (see figure 1). These transformations approximate ladder-operations, i.e. one is a  + 1 and the other a  - 1 operation. Superpositions of the three LG modes (LG_0,0, LG_0,1 and LG_0, - 1) with different relative amplitudes and phases can be produced by displacing the individual holograms with step motors. Observers A and B now choose the right positions of their holograms and can then violate inequality (2).

For the analysis of the different LG modes the beams first pass a 2:1 and then a 1:1 beam splitter, hence equally splitting them into three parts. Each one of the resulting beams passes a hologram and is then coupled into a single-mode fibre. Two of the holograms are aligned such that they transform an LG_0,1 (LG_0, - 1) mode into an LG_0,0 mode. The third hologram is off-centred, and therefore leaves the modes untransformed. Since only the LG_0,0 has substantial overlap with the fibre mode this arrangement acts as a probabilistic mode analyser with 1/3 probability of success. The probabilistic nature of the analysers is equivalent to a reduced detection efficiency but otherwise leads to no additional security loopholes.

In order to find the optimal settings for the violation of the Bell inequality each of the analyser holograms was displaced by ±1.2 mm from the beam centre in 16 equal steps. For every one of the 83521 (17⁴) combinations of analyser settings all nine coincidences and the single count rates were integrated over 5 s and written to a file. The data was finally analysed to check for any violation of inequality (2). The maximal value we found for S₃ was 2.825±0.052, which is a violation by approximately 16 standard deviations. The respective settings in millimeters from the beam centre were 1.05, 0.75 (hologram 1), 1.2, 0.3 (hologram 2) for A and 0.45, 1.05 (hologram 3), 0.15, 0.0 (hologram 4) for B's side. The single count rates were around 19 000 s ^- 1 and the coincidences of the perfect correlations about 250 s ^- 1, with a background of about 7.4%, i.e. the sum over all coincidence counts in the unwanted channels. In table 1 some violations of (2) and the corresponding hologram positions are shown.

The communication partners A and B had two different, completely independent, computers and logics measuring their respective count rates. They only identified coincidences with the help of synchronization signals. If they registered both, the signal from the other side and a local detection, one entry, 0, 1 or 2 depending on the result of the local detectors, was stored locally in a computer file (see figure 1). Furthermore, the current setting of the transformation holograms was also written to the data file. Each measurement lasted 1 s and the step motors needed about 5 s to align. After many runs the data were analysed by comparing the bases.

The Bell parameter was S₃  =  2.688±0.171, which represents a clear violation of local realism. This ascertained the security of the protocol. We extracted keys of a length of 150 trits for A and B separately (the keys are shown in figure 2). Out of the 150 trits 14 were errors, which corresponds to a quantum trit error rate (QTER) of 9.3%. This demonstrates the successful key distribution, since Bell's inequality (2) is violated and additionally the error rate is well below the maximal allowed noise ratio of 22.5%. Table 2 shows a possible communication between A and B using the key generated with the presented QKD.

We have, for the first time, realized an experimental qutrit QKD. The completely independent parties A and B produce keys secured by the violation of a three-dimensional Bell inequality by more than 4 standard deviations. The sifted keys had an error rate of approximately 10%. The effective key rate was rather low due to the slow motorized base change. This could be improved by implementing the base transformation with fast devices such as a spatial light modulator or electro-optical switches. In addition, with a biased choice of the positions of the transformation holograms, the key production rate could be further increased. An additional challenge is the distortion-free transmission of OAM-encoded photons over large distances. The possibilities of free-space and fibre links are still under investigation, since atmospheric turbulences and mode crosstalk in fibres have to be overcome. Gibson et al  [36] already demonstrated a free-space link of photons with OAM over a distance of 15 m. Alternatively, encoding higher dimensions into other degrees of freedom of photons, such as time bins [37], or as suggested by Chen et al  [38] using the four-dimensional entangled states recently realized by [14, 18], might also be considered, as they can be transported in fibre or free-space over long distances. For cryptography schemes based on single qutrits, similar to the BB84 scheme, transformations between MUBs are required. With our holographic OAM scheme it is certainly possible to do such transformations and a protocol of this type is currently under investigation. In contrast to the polarization degree of freedom, in principle there is no limitation on the dimension of the two photon entanglement and therefore an extension of the qutrit to a more general qudit case seems feasible.

Acknowledgments

We thank Jay Lawrence, Johannes Kofler and Martin Stütz for discussions and comments on the manuscript. This work has been supported by the Austrian Science Fund (FWF) within project SFB F15, and by the European Comission project RamboQ.

References

[1]

Wiesner S 1983 SIGACT News 15 78 
CrossRef

[2]

Bennett C H and Brassard G 1984 Proc. IEEE Int. Conf. on Computers Systems and Signal Processing (Bangalore)  pp 175-9 

[3]

Bennett C H and Brassard G 1985 IBM Tech. Discl. Bull. 28 3153 

[4]

Ekert A K 1991 Phys. Rev. Lett. 67 661 
CrossRefPubMed

[5]

Gobby C, Yuan Z L and Shields A J 2004 Appl. Phys. Lett. 84 3762 
CrossRef

[6]

Takesue H, Diamanti E, Honjo T, Langrock C, Fejer M M, Inoue K and Yamamoto Y 2005 New J. Phys. 7 232 
IOPscience

[7]

Stucki D, Gisin N, Guinnard O, Ribordy G and Zbinden H 2002 New J. Phys. 4 41
IOPscience

[8]

Gobby C, Yuan Z L and Shields A J 2004 Electron. Lett. 40 1603 
CrossRef

[9]

Kurtsiefer C, Zarda P, Halder M, Weinfurter H, Gorman P M, Tapster P R and Rarity J G 2002 Nature 419 450 
CrossRefPubMed

[10]

Resch K J et al 2005 Opt. Express 13 202 
CrossRefPubMed

[11]

Peng C-Z et al 2005 Phys. Rev. Lett. 94 150501 
CrossRefPubMed

[12]

Poppe A et al 2004 Opt. Express 12 3865 
CrossRefPubMed

[13]

Barreiro J T, Langford N K, Peters N A and Kwiat P G 2005 Phys. Rev. Lett. 95 260501 
CrossRefPubMed

[14]

Cinelli C, Barbieri M, Perris R, Mataloni P and Martini F D 2005 Phys. Rev. Lett. 95 240405 
CrossRefPubMed

[15]

Fitzi M, Gisin N and Maurer U 2001 Phys. Rev. Lett. 87 217901 
CrossRefPubMed

[16]

Molina-Terriza G, Vaziri A, Ursin R and Zeilinger A 2005 Phys. Rev. Lett. 94 040501 
CrossRefPubMed

[17]

Walborn S P, Lemelle D S, Almeida M P and Ribeiro P H S 2006 Phys. Rev. Lett. 96 090501 
CrossRefPubMed

[18]

Yang T, Zhang Q, Zhang J, Yin J, Zhao Z, Żukowski M, Chen Z-B and Pan J-W 2005 Phys. Rev. Lett. 95 240406 
CrossRefPubMed

[19]

Fuchs C A, Gisin N, Griffiths R B, Niu C-S and Peres A 1997 Phys. Rev. A 56 1163 
CrossRef

[20]

Bruß D 1998 Phys. Rev. Lett. 81 3018 
CrossRef

[21]

Durt T, Cerf N J, Gisin N and Żukowski M 2003 Phys. Rev. A 67 012311 
CrossRef

[22]

Jennewein T, Simon C, Weihs G, Weinfurter H and Zeilinger A 2000 Phys. Rev. Lett. 84 4729 
CrossRefPubMed

[23]

Mair A, Vaziri A, Weihs G and Zeilinger A 2001 Nature 412 313 
CrossRefPubMed

[24]

Caetano D P, Almeida M P, Ribeiro P H S, Huguenin J A O, dos Santos B C and Khoury A Z 2002 Phys. Rev. A 66 041801 (R) 
CrossRef

[25]

Franke-Arnold S, Barnett S M, Padgett M J and Allen L 2002 Phys. Rev. A 65 033823 
CrossRef

[26]

Torres J P, Molina-Terriza G and Torner L 2005 J. Opt. B: Quantum Semiclass. Opt. 7 235 
IOPscience

[27]

Vaziri A, Pan J-W, Jennewein T, Weihs G and Zeilinger A 2003 Phys. Rev. Lett. 91 227902 
CrossRefPubMed

[28]

Collins D, Gisin N, Linden N, Massar S and Popescu S 2002 Phys. Rev. Lett. 88 040404 
CrossRefPubMed

[29]

Kaszlikowski D, Kwek L C, Chen J-L, Zukowski M and Oh C H 2002 Phys. Rev. A 65 032118 
CrossRef

[30]

Clauser J F, Horne M A, Shimony A and Holt R A 1969 Phys. Rev. Lett. 23 880 
CrossRef

[31]

Acín A, Durt T, Gisin N and Latorre J I 2002 Phys. Rev. A 65 052325 
CrossRef

[32]

Vaziri A, Weihs G and Zeilinger A 2002 Phys. Rev. Lett. 89 240401 
CrossRefPubMed

[33]

Arlt J, Dholakia K, Allen L and Padgett M J 1998 J. Mod. Opt. 45 1231 
CrossRef

[34]

Bazhenov V Y, Vasnetsov M V and Soskin M S 1990 JETP Lett. 52 429 

[35]

Vaziri A, Weihs G and Zeilinger A 2002 J. Opt. B: Quantum Semiclass. Opt. 4 S47 
IOPscience

[36]

Gibson G, Courtial J, Padgett M J, Vasnetsov M, Pas'ko V, Barnett S M and Franke-Arnold S 2004 Opt. Express 12 5448 
CrossRefPubMed

[37]

Thew R T, Acín A, Zbinden H and Gisin N 2004 Phys. Rev. Lett. 93 010503 
CrossRef

[38]

Chen Z-B, Zhang Q, Bao X-H, Schmiedmayer J and Pan J-W 2005 Preprint quant-ph p. 0501171
Preprint

Notes

Note5  This can easily be seen, as for binary systems one needs 8 bits (1 byte) to encode the standard ASCII characters, whereas using trinary systems 5.048 trits are sufficient.

Note6  Of course A and B can still apply all standard QKD procedures like privacy amplification, etc.

Note7  If the beam impinging on the hologram is an LG_0,1 mode, it is likewise transformed into an LG_0,2 mode. Therefore, the holograms can be seen as approximate  + 1 ladder-operations for LG modes.