Free-space quantum key distribution

Quantum cryptography was introduced in the mid1980s [1] as a new method for generating the shared, secret random number sequences, or cryptographic keys, that are used in crypto-systems to provide communications security. The appeal of quantum cryptography is that its security is based on laws of Nature, in contrast to existing methods of key distribution that derive their security from the perceived intractability of certain problems in number theory, or from the physical security of the distribution process. Since the introduction of quantum cryptography, several groups have demonstrated that quantum key distribution (QKD) can be performed over multi-kilometer distances of optical fiber [2][9], but the utility of the method would be greatly enhanced if it could also be performed over free-space paths, such as are used in laser communications systems. Indeed there are certain key distribution problems in this category for which QKD would have definite practical advantages (for example, it is impractical to send a courier to a satellite). We are developing QKD for use over line-ofsight paths, including surface to satellite, and here we report our first results on key generation over indoor paths of up to 205 m. The feasibility of QKD over free-space paths might be considered problematic because it requires the transmission of single photons through a medium with varying properties and detection of these photons against a high background. However, others have shown that the combination of sub-nanosecond timing, narrow filters [10,11], and spatial filtering can render both of these problems tractable. Furthermore, the atmosphere is essentially non-birefringent at optical wavelengths, allowing faithful transmission of the single-photon polarization states used in QKD. A QKD procedure starts with the sender, “Alice,” generating a secret random binary number sequence. For each bit in the sequence, Alice prepares and transmits a single photon to the recipient, “Bob,” who measures each arriving photon and attempts to identify the bit value Alice has transmitted. Alice’s photon state preparations and Bob’s measurements are chosen from sets of non-orthogonal possibilities. For example, in the B92 protocol [12] Alice agrees with Bob (through public discussion) that she will transmit a horizontally-polarized photon, |h〉, for each “0” in her sequence, and a rightcircular-polarized photon, |rcp〉, for each “1” in her sequence. Bob agrees with Alice to randomly test the polarization of each arriving photon in one of two ways: he either tests with vertical polarization, |v〉, to reveal “1s,” or left-circular polarization, |lcp〉, to reveal “0s.” Note that Bob will never detect a photon for which he and Alice have used a preparation/measurement pair that corresponds to different bit values, such as |h〉 and |v〉, which happens for 50% of the bits in Alice’s sequence. However, for the other 50% of Alice’s bits where the preparation and measurement protocols agree, such as |h〉 and |lcp〉, there is a 50% probability that Bob detects the photon, as shown in TABLE I. So, by detecting photons Bob is able to identify a random 25% portion of the bits in Alice’s sequence, assuming no bit loss in transmission or detection. (This 25% efficiency factor is the price that Alice and Bob must pay for secrecy.) Bob then communicates to Alice over a public channel the locations, but not the bit values, in the sequence where he detected photons, and Alice retains only these detected bits from her initial sequence. The resulting detected bit sequences are the raw key material from which a pure key is distilled using classical error detection techniques. An eavesdropper, “Eve,” can neither “tap” the key transmissions, owing to the indivisibility of a photon [13,14], nor copy them owing to the quantum “no-cloning” [15][18] theorem. Furthermore, the non-orthogonal nature of the quantum states ensures that if Eve makes her own measurements she will be detected through the elevated error rate she causes by the irreversible “collapse of the wavefunction” [19]. The prototype QKD transmitter (FIG. 1) consisted of a temperature controlled diode laser, a collimating lens,