The Quantum Times) in Producing the First in Their List of Guidelines Nor Was It Reported As Operating Laser, Are All Interesting and Enlightening
Total Page:16
File Type:pdf, Size:1020Kb
TThhee QQuuaannttuumm TTiimmeess APS Topical Group on Quantum Information, Concepts, and Computation Summer 2007 Volume 2, Number 2 Advances & Challenges in Quantum Key Distribution Quantum Key Distribution (QKD) is the flagship success of quantum communication. Since Bennett and Brassard’s 1984 publication [2] it has given a new direction to the field. (For a review see e.g. [3].) Up to then in quantum communication, the properties of quantum mechanics were used, for example, to improve on the through-put of optical channels. With the arrival of QKD an application has been created that achieves what Inside… cannot be achieved with classical communication alone: … you will find a little bit of provably secure protocols with no assumption about the everything. We begin with an computational power of an adversary. (This scenario is referred article from Norbert Lütkenhaus on to as unconditional security, a technical term in cryptography. quantum key distribution (QKD) Still, the devices of sender and receiver are assumed to be that grew out of a news article from perfect and out of bound of the adversary, an assumption without our last issue. Norbert speaks from which no cryptography is possible at all.) It is sufficient to the standpoint of someone at the prepare non-orthogonal states as signals and to measure them at forefront of quantum cryptography the receiver’s end. Then, using an authenticated public channel, and his article should be read by both parties can distill a secret key from the data. The procedure anyone interested in the current needs to be kick-started with some secret key in order to state and future direction of QKD. authenticate the first round of key generation. However, the David Guerra and I have resulting key is composable, that is, it can be used in any included an article on some cryptographic application like a perfect random secret key, and overlooked points in the history of so a newly generated key can be used to authenticate the public the laser that grew out of some channel in the next round. research David has been working In a ground-breaking work, Dominic Mayers [9, 10] provided on for a few years. It seemed a first complete security proof for this scheme in its ideal appropriate in light of the recent implementation, and since then proofs have appeared that are passing of Ted Maiman and the either more accessible or work with different levels of importance of laser technology to assumptions on signals and detection devices. The first everything quantum physicists do. experiments used weak laser pulses to prepare the signal states. Günther Greindl, a philosopher This resulted in a wide gap between the experiments and the of science – eek! – brings us a security proofs, which assumed a signal structure as arising from report on the first (and hopefully single photons. However, it was possible to close this gap and to not the last) Vienna Symposium provide security proofs that take the new signal structure into while Ken Wharton reports on this account and deliver unconditional security. year’s Växjo conference. Everything has its price: using weak laser pulses means that Finally, along with the usual some of the signals carry more photons in them, all in the same news and announcements state as the intended single photon. In the BB84 protocol this (including important March enables the adversary to learn perfectly all those multi-photon Meeting information) is an signals. As long as the number of these events is under control, editorial that will probably produce this still leads to a secret key, but it costs secret key rate since an FBI file with my name on it, but controlling the multi-photon pulses means reducing the mean you be the judge. photon number with increasing loss in the overall quantum I sincerely hope everyone had channel. As a result of this mechanism and the brutal reality of a great summer! Oh, and read The life in the form of detector dark counts, the key rate drops to zero, Lighter Side on the last page… typically, at around 30 km. To overcome this problem, one needs to change the -Ian T. Durham, Editor hardware (a software update through the SARG protocol [12] has Department of Physics (continued on next page) Saint Anselm College 1 already given some limited improvement). One typical world of experiments behind. In QKD we option would be to develop single-photon sources, have to assume that the adversary conspires against but they are not readily available and have us and we have to brace for the worst case problems of their own. Another option developed scenario. Additionally, security cannot be proven beginning with the work of Hwang [4], Lo et al. experimentally; one can demonstrate that, to the [7], and Wang [13], who made a small change to best of our knowledge, a given apparatus conforms the BB84 protocol, known as the so-called decoy- to the device assumptions made in a theoretical state QKD protocol: instead of a single intensity security proof. It is an important direction in QKD for the signal, this protocol randomly changes the research to understand how we can make these intensity from pulse to pulse thereby testing the proofs watertight. After all, the general rule is that quantum channel in greater detail. With a refined once one knows the problem and can quantify it analysis of the data from this protocol, the provably (and the hole is not too big), then one can take it secure performance was improved to resemble that into account during the so-called privacy of an ideal single-photon source, simply by amplification step in QKD, in which initial inserting an intensity modulator into existing BB84 correlations to an eavesdropper are cut at the cost set-ups with weak laser pulses, something that is of the resulting key rate. Interestingly, the use of relatively easy to do. As a result, the coverable entangled systems as sources together with active distances grew to more than 100 km. Other choices of measurement bases may open up some protocols emerged, all comparable in performance possibilities for stronger claims of security. The to the ideal BB84 with single-photon sources, approach is similar to those that investigate the which are expected to cover distances of up to 200 violation of Bell’s inequality, though the usual km and use standard optical telecommunication high-loss regime in experiments will be a problem equipment and advanced detector technology (e.g. for these approaches [1]. including superconducting detector technology). These investigations should be distinguished So does this mean that all is well for QKD? from another effort: implementing optimal After all, there are already two companies offering eavesdropping attacks for given scenarios is a neat QKD as a commercial application (IdQuantique experimental accomplishment, but it doesn’t tell us and MagiQ Technologies). The closer one comes anything about the security of our QKD systems. to the market, the more critical one has to be about After all, these attacks are exactly what is covered the devices. It is one thing to have a provably in the security proofs since they manipulate only secure protocol but it is another thing entirely to the signals as they fly from sender to receiver sell a device claiming that it is unconditionally without exploiting any device imperfections. Of secure. Is there a difference between the protocol course, it’s always good to show that these and the implementation and, if so, what is it? The experiments might not be as unfeasible as some QKD protocol with BB84 and the decoy states is people might think! proven to be unconditionally secure, but that does So in what direction is QKD research heading not mean that any implementation of this protocol these days? One is the development of protocols is secure. The list of possible problems is long: better adapted to an optical communication does the device prepare the correct signals, or is infrastructure in order to get the key rate up. Then, there a classical side-channel (e.g. slightly different we need to assess the problem of side-channels and optical frequencies for each of the four possible other security loopholes in implementations of signals, or a slight time lag), is the detection QKD protocols. Finally, we need to be able to efficiency of the devices indeed independent of the adapt QKD to a network structure with multi-user signal basis as required in most security proofs? scenarios. This can be done in the short term via Worldwide, only a few research groups have trusted repeater networks, which are collections of attacked this question. One of them is the point-to-point QKD links connecting trusted Trondheim Group in Norway with Vadim Makarov classical repeater stations. In the long term, we [8]. Other groups include Harald Weinfurter’s would like to see quantum repeater technologies in group in Munich [5], Hoi-Kwong Lo’s group in their place allowing secure routing of QKD without Toronto [11] and Christian Kurtsiefer and Antia having to trust the routing procedure. Lamas-Linares’ group in Singapore [6]. [References in box on next page.] Searching for all possible deviations between device models assumed for proofs and actual –Norbert Lütkenhaus devices used in implementations is, of course, Institute for Quantum Computing fundamental to the success of QKD. After all, in & Department of Physics and Astronomy building up QKD demonstrations we leave the University of Waterloo 2 References (Lütkenhaus) [1] A. Acín, N. Brunner, N. Gisin, S. Massar, S. Pironio, and V. Scarani. Device-independent Bits, Bytes, & Qubits security of quantum cryptography against collective attacks.