Thesis

Practical and fundamental issues on quantum correlations

BRANCIARD, Cyril

Abstract

The role that quantum correlations play in Quantum Information Science and the prospects of new developments and newe applications encourage physicists to search for a deeper understanding of these correlations, and of their non-locality. This thesis follows this line of research. After illustrating their practical applications in the field of Quantum Key Distribution, we present more fundamental studies. We thus analyze two different alternative models for non-local correlations : Leggett's model, and a model that attempt to explain the correlations with some hypothetical superluminal "spooky action at a distance". We also tackle the problem of quantifying the non-locality of quantum correlations, with two different approaches. Finally, we address the intriguing question, wheter the quantum world could somehow be brought closer to our direct perception, and if quantum correlations could be revealed with the naked eye.

Reference

BRANCIARD, Cyril. Practical and fundamental issues on quantum correlations. Thèse de doctorat : Univ. Genève, 2009, no. Sc. 4115

URN : urn:nbn:ch:unige-40413 DOI : 10.13097/archive-ouverte/unige:4041

Available at: http://archive-ouverte.unige.ch/unige:4041

Disclaimer: layout of this document may differ from the published version.

1 / 1 Universite´ de Geneve` Faculte´ des Sciences Groupe de Physique Appliqu´ee Professeur N. Gisin

Practical and Fundamental issues on Quantum Correlations

These` pr´esent´ee`ala Facult´edes sciences de l’Universit´ede Gen`eve pour obtenir le grade de Docteur `essciences, mention physique

par Cyril BRANCIARD de France

Th`eseN° 4115

Gen`eve Atelier d’impression ReproMail 2009

If at first the idea is not absurd, then there is no hope for it.

Albert Einstein

Abstract

Quantum correlations exhibit what is certainly one of the most intriguing and fascinating features of quantum theory: non-locality. Two entangled particles cannot be seen as two separate quantum systems, with individual properties attached to each of them, but need to be described as a single system. In the last 25 years, it has been realized that quantum correlations could have very interesting applications, in particular for communications and information pro- cessing. This has lead to the emergence of a new research field, that of quantum information science. The prospects of new developments and of new applications encourage physicists to search for a deeper understanding of these correlations, and of their non-locality. This thesis is devoted to such a study. We first illustrate the role that quantum correlations play in Quantum Key Distribution (QKD) by analysing some quantum cryptographic protocols: standard qubit-based QKD protocols, as well as a new kind of distributed-phase-reference protocol that is quite promising for rapid and long-distance QKD. Motivated by these practical applications, we then move on to more fundamental studies. We first present the analysis of two different models of non-local corre- lations: Leggett’s model proposes an alternative description for such correlations, which is proven to be incompatible with quantum theory; the second model supposes that the correlations are due to some hypothetical superluminal spooky action at a distance, and we present an experiment that allows one to put a stringent bound on the speed of such a spooky action. As non-locality is the key feature of quantum correlations, the problem of quanti- fying it naturally arises. In this prospect, we describe the Elitzur-Popescu-Rohrlich (EPR2) approach, and derive a new lower bound on the local content of two-qubit non-maximally entangled pure states; for a whole family of such states, this bound coincides with the previously known upper-bound. We also consider n-partite cor- relations, and propose a new approach to quantify their multi-partite non-locality, by comparing them to correlations obtained with classical communication models. We finally consider the intriguing question, whether the quantum world could somehow be brought closer to our direct perception. It appears indeed realistic to perform quantum optics experiment with human-eye detectors, and thus to reveal entanglement with the naked eye!

i R´esum´e

Les corr´elationsquantiques pr´esentent une caract´eristiquequi est certainement un des aspects les plus fascinants et intrigants de la th´eoriequantique : la non- localit´e.Deux particules intriqu´eesne peuvent en effet ˆetreconsid´er´eescomme deux syst`emesquantiques distincts, dot´esde propri´et´esindividuelles, mais doivent ˆetre d´ecritescomme un seul et mˆemesyst`eme,formant un tout. Au cours des 25 derni`eresann´ees,il a ´et´er´ealis´eque les corr´elationsquan- tiques pouvaient avoir des applications particuli`erement int´eressantes, notamment en mati`erede communications et de traitement de l’information. Un nouveau do- maine de recherche a ´emerg´e,celui de l’information quantique. La perspective de nouveaux d´eveloppements et de nouvelles applications encourage les physiciens `a ´etudierces corr´elationsafin de mieux les comprendre, ainsi que la non-localit´edont elles font preuve. Cette th`eseest consacr´ee`aune telle ´etude.Nous illustrons tout d’abord le rˆoledes corr´elationsquantiques dans le domaine de la Distribution Quantique de Cl´e(QKD : Quantum Key Distribution), au travers de l’analyse de certains protocoles de QKD : des protocoles standards bas´essur l’´echange de qubits, ainsi qu’un nouveau type de protocole `ar´ef´erencede phase distribu´ee,qui semble prometteur pour faire de la QKD rapide et `alongue distance. Motiv´espar ces applications pratiques, nous nous tournons ensuite vers des probl´ematiquesde nature plus fondamentale. Nous pr´esentons tout d’abord l’analyse de deux types de mod`elesde corr´elationsnon-locales : le mod`elede Leggett d’une part, qui propose une description alternative pour de telles corr´elations,et que l’on montre ˆetreincompatible avec la th´eoriequantique ; un second mod`eled’autre part, qui suppose que les corr´elationssont dues `aune action fantˆome`adistance, et pour lequel nous pr´esentons une exp´eriencequi a permis de borner la vitesse de cette hypoth´etique action fantˆome. La non-localit´e´etant la caract´eristiqueessentielle des corr´elationsquantiques, nous nous posons naturellement la question de comment la quantifier. Dans ce but, nous d´ecrivons l’approche d’Elitzur-Popescu-Rohrlich (EPR2), et d´eterminonsune nouvelle borne inf´erieurepour le contenu local des ´etatspurs, non maximalement intriqu´es,de deux qubits ; pour toute une famille d’´etats,cette borne co¨ıncideavec la borne sup´erieureque l’on connaissait. Nous consid´eronsensuite des corr´elations entre n syst`emes,pour lesquelles nous proposons une nouvelle approche permettant de quantifier leur non-localit´emultipartite, en les comparant aux corr´elationsque l’on peut obtenir avec des mod`eles`abase de communication classique. Nous posons enfin la question intrigante de savoir si le monde quantique peut d’une certaine mani`ereˆetrerendu plus accessible `anotre perception directe. Il appa-

ii rait en effet r´ealisted’imaginer des exp´eriencesd’optique quantique o`ul’œil humain serait utilis´ecomme d´etecteurde photons. L’intrication pourrait ainsi ˆetreobserv´ee `al’œil nu !

iii iv Contents / Table des mati`eres

Abstract i

R´esum´e ii

I English version 1

Introduction 3

1 Quantum correlations in Quantum Key Distribution 6 1.1 Security of the BB84 and SARG protocols ...... 6 1.1.1 Single-photon implementations ...... 7 1.1.2 Upper bounds for the security in practical implementations . . 7 1.2 Security of QKD using two-way classical communication or weak co- herent pulses ...... 8 1.2.1 QKD protocols with two-way post-processing ...... 9 1.2.2 QKD protocols using weak coherent pulses ...... 9 1.3 Conclusion ...... 10

2 Upper bounds for the security of the COW protocol 11 2.1 The Coherent-One-Way protocol ...... 11 2.2 Studies of a few specific attacks on the COW protocol ...... 12 2.2.1 Collective Beam-Splitting Attack ...... 12 2.2.2 Zero-error attacks based on Unambiguous State Discrimination 13 2.2.3 Non-zero-error attacks on single or pairs of pulses ...... 14 2.3 Outlook ...... 15

3 Testing Leggett’s model for non-local correlations 17 3.1 Quantum correlations from “simpler” ones ...... 17 3.1.1 Decomposing non-local correlations ...... 18

v 3.1.2 Bell’s locality ...... 18 3.1.3 Leggett’s model ...... 18 3.2 Violation of Leggett’s model by Quantum Mechanics ...... 19 3.2.1 General inequality for non-signaling models ...... 20 3.2.2 Derivation of a simple Leggett-type inequality ...... 20 3.2.3 Experimental falsification of Leggett’s model ...... 21 3.3 On the tolerable amount of individual properties ...... 22 3.3.1 A straightforward generalization of Leggett’s model ...... 23 3.3.2 Any model `ala Leggett must have vanishing marginals . . . . 23 3.4 Conclusion ...... 23

4 Testing the speed of spooky action at a distance 24 4.1 Principle of the experiment ...... 24 4.2 Experimental results ...... 27 4.3 Conclusion ...... 28

5 On the EPR2 approach to quantum non-locality 30 5.1 The EPR2 approach for two-qubit pure states ...... 31 5.1.1 Correlations of two-qubit pure states ...... 31 5.1.2 Previously known results and conjecture ...... 32 5.2 Reformulation of the problem to prove the conjecture ...... 33 5.3 Proposal for a new EPR2 decomposition ...... 33 5.4 Prospects ...... 35

6 Quantifying multipartite non-locality 40 6.1 Definitions ...... 41 6.2 Quantifying multipartite non-locality through communication models 41 6.3 Multipartite non-locality of quantum states...... 43 6.4 Conclusion ...... 44

7 Can one see entanglement ? 45 7.1 Threshold detectors can in principle detect entanglement ...... 45 7.2 Human eye detectors can detect and distinguish clones obtained via stimulated emission ...... 46 7.2.1 Distinguishing the amplified single-photon qubits ...... 47 7.2.2 Bell-type experiment in the micro-macro scenario ...... 48 7.3 Prospects ...... 50

Outlook 51

vi II Version fran¸caise 53

Introduction 55

8 Les correlations quantiques au cœur de la QKD 58

9 Des mod`elesalternatifs de corr´elationsnon-locales 60

10 Quantifier la non-localit´e 62

11 Voir l’intrication 64

Perspectives 66

Bibliography / Bibliographie 67

Publication list / Liste de publications 73

Acknowledgements / Remerciements 75

III Published articles / Articles publi´es 77

vii viii Part I

English version

1 2 Introduction

The discovery of quantum mechanics is a very interesting story. Passionate debates between the greatest physicists of the early 20th century contributed to construct a beautiful theory, with an extraordinary predictive power. However, the theory that emerged contained so counter-intuitive features, that it could not satisfy everyone.

Spooky action at a distance?

In their renowned 1935 paper [1], Einstein, Podolsky and Rosen (EPR) showed in- deed that quantum mechanics predicted very strong correlations to exist between distinct and separated parts of a physical system: by measuring one part of the system, one could instantly attribute definite properties to the distant part; proper- ties which, according to quantum theory, did not exist a priori. These correlations, due to what Schr¨odingerwould soon after call entanglement [2] between the two sub-systems, thus seemed to imply some spooky action at a distance; the father of general relativity and his co-authors considered this physically unacceptable. They concluded that, if quantum mechanics were to respect locality and separability, then it was necessarily incomplete. This question of incompleteness was debated on a purely metaphysical level, though most physicists at the time were happy enough with Bohr’s answer and with the Copenhagen interpretation of quantum mechanics, which essentially ignored the problem. There were more important problems to tackle back then, and only a few people shared Einstein’s philosophical concerns. It took 30 years before Bell showed, with his famous theorem [3], an incom- patibility between the quantum predictions and the predictions of alternative local theories that would somehow complete quantum mechanics. Correlations that can be explained by local hidden variables are bound to satisfy so-called Bell inequalities: under Bell’s locality assumption, a measurable quantity I cannot exceed the local bound I : I I . Quantum correlations can however violate this inequality, and L ≤ L reach a value IQ > IL. Bell’s extraordinary breakthrough allowed one to turn the metaphysical controversy into experimental metaphysics, as termed by Shimony [4]: one could then imagine experiments to test quantum mechanics versus local hidden variable theories. Another 20 years of efforts were necessary before the realization of a sufficiently convincing experiment by Aspect and co-workers [5], whose conclusion was in favor with quantum mechanics: the violation of a Bell inequality had indeed been observed (up to a few minor loopholes), which allowed them to conclude that quantum theory

3 could not be completed in the sense that Einstein wished.

Quantum correlations as a resource

This could have been the end of the story. The existence of entanglement and non- locality had been demonstrated, but this was up to then no more than a laboratory curiosity. In the early 1990s however, it was realized that entanglement could actually be of practical use. Ekert rediscovered and shed a new light on quantum cryptography (invented a few years earlier by Bennett and Brassard [6]), when he realized that one could make use of non-locality to distribute a secret key between two distant partners [7]: the security of the key can be ensured by the violation of a Bell in- equality. Entanglement was also shown to allow for quantum teleportation [8], and to bring a great advantage in computational problems [9]. This new perception of entanglement, now seen as a useful resource for commu- nication and information processing, has revived the study of quantum correlations and of non-locality itself, which has now emerged as a new and very dynamic re- search field. Bell’s sentence “correlations cry out for explanation” [10] is even more relevant today!

Outline of this thesis

This thesis follows on in a similar spirit to the scientific developments of the last 25 or so years, described above. We start with studies on quantum cryptography, which highlight the practical applications that quantum correlations can have. This motivates us to try to get a better understanding of quantum correlations, and leads us to tackle more fundamental questions about their nature, about the possible explanations that can be given for their non-locality, and on how to quantify their non-locality. We finally wonder whether one could somehow bring them closer to our direct perception. The goal we are pursuing is to become more familiar with the often counter-intuitive but all the more fascinating features of the quantum world.

The content of this manuscript is organized as follows: The first two chapters are devoted to the use of quantum correlations in the field of Quantum Key Distribution (QKD). In Chapter 1 we highlight the role of these correlations in standard qubit-based QKD protocols, while in Chapter 2 we describe studies of some attacks on a distributed-phase-reference type of QKD protocol de- veloped in Geneva: the Coherent-One-Way protocol. Moving on to more fundamental issues, Chapter 3 presents a study of Leggett’s model [11]. This model proposes an alternative structure for non-local correlations, but is shown to be incompatible with quantum predictions. We present new inequal- ities for testing Leggett’s model, derived in a very simple way, by only assuming the non-negativity of probability distributions. The simplest of these inequalities has been experimentally violated. We also show that more general models `ala Leggett must have vanishing marginals in order to reproduce the correlations of the singlet

4 state. Chapter 4 challenges another possible explanation for the non-locality of quantum correlations, which could be due to some spooky action at a distance propagating at finite speed. An experiment is performed, which allows us to derive bounds on the speed of this hypothetical spooky action, in any reference frame. The bounds we get are orders of magnitude larger than the speed of light. Chapter 5 investigates the local and non-local contents of bipartite quantum cor- relations using an approach due to Elitzur, Popescu and Rohrlich [12]. We consider correlations stemming from Von Neumann measurements on pure non-maximally entangled two-qubit states; the definite value of their local content is found for a wide range of states. In Chapter 6 we consider n-partite correlations. A method is proposed to quantify the multipartite non-locality of such correlations, by comparing them to correlations obtained with models that allow classical communication between the parties. We apply our method to two families of multipartite quantum states. Chapter 7 finally addresses the intriguing question, whether entanglement could possibly be “seen”, i.e., detected by the naked human eye. We shall see that the realization of Bell-type experiments with human-eye detectors appears indeed realis- tic, using for instance multi-photon states obtained by cloning single-photon qubits via stimulated emission. This would be a fascinating way to experience quantum phenomena more directly!

Each chapter presents a particular line of research, and gives a summary of some results obtained in each direction. The chapters can be read independently from one another. Most of the results presented in this thesis (except for those of Chapter 5) have been published in the papers listed on page 73, and attached to this dissertation. The more interested reader is encouraged to refer to these publications for further details. The reader will be assumed to be familiar with the basics of quantum information theory. If this is not the case, he might find it useful to refer for instance to [13] for a general introduction to the subjects dealt with in this thesis, or to [14, 15] for more technical information.

5 Chapter 1

Quantum correlations in Quantum Key Distribution

The general idea of quantum cryptography is to use the laws of quantum physics to ensure the security of cryptographic protocols. In Quantum Key Distribution (QKD) more specifically [16, 17], one distributes quantum correlations between two partners, traditionally called Alice and Bob, from which they will try to extract a secret key (i.e., a secret random string of bits) via classical post-processing1. If the protocol successfully generates a secure key, the key can then be used in any other cryptographic primitive (e.g., for data encryption or authentication). Inspired by earlier ideas of Wiesner [18], Bennett and Brassard invented in 1984 the first QKD protocol, BB84 [6]. It was proposed as a prepare and measure protocol: Alice encodes classical bits into quantum systems (quantum bits, or qubits) that she sends to Bob, who measures them. Ekert rediscovered QKD a few years later when he realized that the non-locality of quantum correlations could allow the distribution of a secret key [7]: he proposed an entanglement-based protocol, in which Alice and Bob share an entangled pair of qubits, and whose security was precisely based on the violation of a Bell inequality. Ekert’s work thus highlighted the role of quantum correlations in QKD, and more specifically of their non-local characteristics. It is now clear that quantum correlations are at the core of QKD. Here we shall illustrate this by presenting studies that we conducted on the security of standard discrete-variable QKD protocols [A,B].

1.1 Security of the BB84 and SARG protocols

In a first study [A], we investigated the security of the SARG protocol [19, 20], and compared it to the well-known BB84 protocol. The two protocols use the same four states for the encoding of the classical bit (more precisely, two complementary bases), but the information is encoded in two different ways : in the SARG protocol, the

1After the quantum correlations are distributed, Alice and Bob both have a “raw key”. Typ- ically, after a sifting step, they perform error correction and privacy amplification to turn their keys into a pair of identical and secret ones.

6 classical bits are encoded in non-orthogonal states, so that it is more robust against photon-number-splitting attacks [21, 22]. We studied the security of the SARG protocol in two regimes: in single-photon implementations, and in more practical implementations with weak coherent laser pulses.

1.1.1 Single-photon implementations

We first derived a condition on the quantum bit error rate (QBER) for the security of the SARG protocol in a single-photon implementation, against the most general attacks allowed by quantum mechanics (so-called coherent attacks2). For that, we used the results presented in [23, 24]; see section 1.2 below for further details on these results. The SARG protocol was found to be secure against coherent attacks for a QBER smaller than 10.95 %, while the similar bound is 12.4 % for BB84. In order to derive an upper bound for the tolerable QBER, we considered indi- vidual attacks. We found out that although the quantum states sent by Alice are the same, the optimal individual attack on the BB84 is not optimal on the SARG protocol. We proposed a new attack that performs better, and that gives an upper bound of 14.9 %. For BB84, the optimal individual attack gives an upper bound of 14.6 %.

1.1.2 Upper bounds for the security in practical implemen- tations

In practical implementations, it is usually more convenient for Alice to send weak coherent pulses (attenuated laser pulses) instead of single photons. This is the case that we considered next. We let Alice optimize the mean number of photons µ as a function of the distance, and we allowed the eavesdropper, Eve, to choose among a broad class of incoherent attacks that includes various forms of photon-number- splitting attacks. As we nevertheless restricted the class of attacks, we thus obtained upper bounds on the secure key rate that can be reached. The optimizations on the mean number of photons and on Eve’s attack were done numerically. The results were compared to those obtained for BB84 with the same approach [25]. The SARG protocol was found to perform better than BB84 both in secret key rate and in maximal achievable distance. More precisely, we found that the optimal mean number of photons goes as µopt 2√t as a function of the transmission t of the quantum channel, while the much∼ smaller µ t holds for BB84 under identical opt ∼ conditions. As a consequence, the secret key rate (proportional to the detection rate µt) decreases as t3/2 instead of the faster t2 decrease of BB84. The limiting distance

2One usually distinguishes between individual, collective and coherent attacks: in an individual attack, the eavesdropper, Eve, acts independently and identically on each quantum system sent by Alice, and she measures her ancillary system before the classical post-processing; in a collective attack, she still attacks each quantum system independently and identically, but she can act coherently on her ancillae at any time of the protocol; in a coherent attack, she can act coherently on all quantum systems at any time. The coherent attacks are the most general ones: they are so general that they cannot be efficiently parametrized. As we shall see, one can often show that considering collective attacks is actually sufficient.

7 is also increased in SARG with respect to BB84, approximately by 10 km for typical values of the parameters of the detector and of the channel.

Note that in the two cases above, we could show that Alice and Bob can sometimes increase the secret key rate by voluntarily adding some noise to their correlations, before they perform error correction and privacy amplification to their raw keys. This noisy pre-processing can indeed decrease Eve’s information more than Bob’s information on Alice’s key. Our analysis above shows that once quantum correlations have been distributed, different ways of encoding and decoding the classical information can lead to different performances in QKD. It is quite interesting to keep this in mind, in order to make the best possible use of the quantum correlations that are available to Alice and Bob.

1.2 Security of QKD using two-way classical com- munication or weak coherent pulses

In [B] we studied the security against coherent attacks of generic QKD protocols that involve two-way classical post-processing, as well as QKD schemes implemented with weak coherent laser pulses instead of single-photon pulses. We could extend the information-theoretic techniques introduced in [23, 24] to these two cases. Let us first briefly review these techniques. To apply them, we need to consider the entanglement-based version of the QKD protocol under study: instead of having Alice sending qubits to Bob in a definite state, one can assume that Alice sends the second qubit of a 2-qubit entangled state. She can then prepare Bob’s system at a distance by applying an encoding operator to the qubit she kept, and then measuring it in the computational basis. We also assume that Alice and Bob symmetrize the protocol by applying a randomly chosen permutation to rearrange the order of their qubit pairs, and, additionally, by applying at random to each of the qubit pairs either the identity or the correlated bit-flip operation σ σ . x ⊗ x This description of the protocol allows one to derive a lower bound for the secret key rate r that can be extracted with one-way communication from Alice to Bob, in the limit of infinitely long keys. The formula involves only two-qubit systems, and writes [23]

r sup inf S(U E) H(U Y ) , (1.1) ≥ U X σAB ΓQ | − | ← ∈ where ΓQ is the set of all two-qubit Bell-diagonal states σAB which can result from a collective attack3 by Eve and which are compatible with the parameters estimated by Alice and Bob (in particular, the QBER); S and H denote the von Neumann and the Shannon entropies, respectively; X and Y denote the classical outcomes of Alice and Bob’s measurements of σAB in the computational basis, and E is any system

3This proves in particular that coherent attacks are not more powerful than collective attacks. This can also be proven by invoking the powerful exponential quantum De Finetti theorem [26, 27].

8 that purifies σAB; finally, the supremum runs over all classical mappings from X to U (such as the above-mentioned noisy pre-processing, for instance).

1.2.1 QKD protocols with two-way post-processing

We could apply the above techniques to the case of QKD protocols where, before the classical post-processing of the raw key, Alice and Bob additionally perform an advantage distillation procedure [28, 29, 30], which requires two-way communication between Alice and Bob. This sub-protocol consists in Alice publicly announcing to Bob the positions of m bits which have all the same value (without telling which value). Bob checks whether he also has the same values for these positions; if this is the case, they keep the common value of the bits as a new raw-key bit, otherwise they discard all the m bits. This advantage distillation process can be described quantum mechanically. We could show that analyzing its action on two-qubit Bell-diagonal states was actually sufficient, and we could then apply the bound (1.1) to the states thus obtained. For the 6-state protocol [31, 32] for instance, we showed that a positive secret key rate can be extracted as long as the QBER is lower than 27.6 % (for m ). We thus recovered the previously known threshold, that Chau had obtained→ by ∞ considering the advantage distillation procedure, followed by a XOR transformation [30]. Inter- estingly, our analysis shows that the key rate can be much larger when the XOR transformation is replaced by a noisy pre-processing applied to single bits.

1.2.2 QKD protocols using weak coherent pulses

We then considered generic protocols in practical implementations, where Alice does not send single photons to Bob, but weak coherent pulses instead, as in section 1.1.2 above. We described again the protocols as entanglement-based schemes, and the con- cavity of the entropy allowed us to derive bounds of the form (for simplicity, we forget here about the possible pre-processing U X): ←

∞ r inf Rn S(X E, n) Rµ S(X Y ) , (1.2) ≥ σ ΓRµ,Qµ | − | ∈ n=0 X where the set ΓRµ,Qµ contains all states which can result from a collective attack by Eve and are compatible with the average sifting rate Rµ and the average QBER Qµ, where Rn is the sifting rate due to the n-photon pulses only, and where S(X E, n) is the entropy of X conditioned on E and on the fact that the pulse contained| n photons. The average of n is only taken over the terms for the entropy conditioned on Eve’s system, but not on the term for the entropy conditioned on Bob’s system: this is because Eve might be able to measure the photon number, whereas this is not the case for Bob. It is worth mentioning also that since the (conditional) entropy of the classical variable X cannot be negative, the lower bound above can be further lower-bounded by restricting the sum to a finite number of its terms.

9 For BB84 for instance, Eve can have full information on the pulses that contain n 2 photons. Her corresponding uncertainties thus vanish, and we find in par- ticular≥ the same bound as in [33], derived with other techniques. For the SARG protocol on the other hand, Eve does not have full information on the multi-photon pulses, and taking into account the 2-photon contribution allowed us to derive higher bounds than previously known [34]. Comparing the two protocols in the untrusted- device scenario (where Eve is assumed to have some control over Bob’s detectors), we found again a similar relation as in section 1.1.2 above, for the case of a noiseless channel, with a key rate scaling as t2 for BB84 and t3/2 for SARG. For noisy chan- nels however, the bound for SARG diminishes more rapidly than for BB84, and was found to also scale as t2 for a quantum channel with a visibility V = 0.95. Note finally that we could also use the same techniques to study the decoy-states implementations of QKD protocols [35, 36, 37]. The idea of the decoy states is that they allow a direct estimation of the parameters Rn (and the corresponding error rates Qn) in (1.2), which Eve can no longer freely optimize. We estimated again the bounds for BB84 and SARG, and found that SARG was outperformed by BB84 when decoy states are used.

1.3 Conclusion

The examples presented here illustrate the role of quantum correlations in QKD, and the fact that different ways to make use of them can lead to different performances for the QKD protocols. Learning more about quantum correlations will give new insights on QKD and will certainly prove useful with regards to the development of this technology and of other possible applications. It is important to realize that the key feature of quantum correlations that QKD exploits is their non-locality: the fact that the correlations cannot be explained by local hidden variables [3] implies in particular that no spy can have access to this non-existing information! Actually, cryptographic protocols only based on non-local correlations can be devised, and the security can be proven by just restricting the adversary to obey the no-signaling principle [38, 39, 40, 41, 42, 43]. An interest- ing scenario, somehow intermediate between this “no-signaling cryptography” and standard QKD as studied here, is that of device-independent QKD [44, 45]: Eve is still restricted to obey quantum theory, but no assumption is made on the physical systems held by Alice and Bob. In the spirit of Ekert’s protocol [7], the security is based on the violation of a Bell inequality. This again highlights the necessity of sharing non-local correlations to create a secret key.

10 Chapter 2

Upper bounds for the security of the Coherent-One-Way protocol

The first proposals for quantum key distribution protocols, such as the BB84 proto- col [6] and several variations thereof, were based on the use of independent quantum systems (most often, qubits) to encode different classical bits. In practical implemen- tations, one would usually use photons to carry the quantum states, often obtained from weak laser pulses (as we have seen in the previous chapter). However, convenient telecom laser sources emit either a continuous train of pulses (mode-locked lasers), or a continuous wave that can be formatted by an intensity modulator into trains of pulses. This observation lead to devising new protocols for efficient QKD, so called distributed-phase-reference protocols, based on continuous trains of weak coherent pulses, and in which the intervention of an adversary is monitored by measuring the coherence between successive non-empty pulses. These new protocols provide new challenges for theorists to analyze their security against the most general attacks: the tools, which have been developed in the last decade to tackle this problem for more standard QKD protocols, cannot be applied in any straightforward way when the schemes move away from the symbol-per-symbol type of coding. The Coherent-One-Way (COW) protocol is an example of a distributed-phase- reference protocol, proposed in Geneva in 2004 [46, 47] and developed in the last few years [48, 49]. Here we present security analyses for the COW protocol against different kinds of attacks, which give upper bounds on the secure key rates that can be obtained with this protocol.

2.1 The Coherent-One-Way protocol

The idea of the COW protocol is to have a very simple data line in which the raw key is created, protected by the observation of quantum interferences in a monitoring line. We review here its features, and refer to [46, 47, 48, 49] for a more comprehen- sive discussion of motivations and practical issues. The protocol is schematized in Figure 2.1.

11 Alice Bob tB DB Laser IM − 1 tB DM1 bit 0 decoy DM2 bit 1

Figure 2.1: Schematic description of the COW protocol. A continuous, phase- stabilized coherent laser beam is sent through an intensity modulator (IM) that shapes discrete pulses, while preserving the coherence. See text for all other details.

The source, on Alice’s side, produces a train of equally spaced weak coherent pulses. A non-empty pulse is written α , its mean photon number µ = α 2. Each logical bit is encoded in a sequence of| i one non-empty and one empty| pulse:| the bit value 0 is coded in the sequence 0 α , the bit value 1 in the sequence α 0 . These two states are not orthogonal| becausei| i of the vacuum component, and| i| cani be unambiguously discriminated in an optimal way by just measuring the time of arrival in the data line. The quantum bit error rate Q is, as usual, the probability that Bob accepts the wrong value of the bit. To estimate the loss of coherence in the channel (and thence Eve’s information), a fraction 1 tB of the light is sent into the monitoring line, consisting of an unbalanced interferometer.− The phase between the two arms is chosen so that two consecutive non-empty pulses sent by Alice should always interfere constructively in one output port (and be detected with probability p > 0) and destructively in the other one (p = 0). The DM1 DM2 pD pD departure from this ideal situation is measured by the visibility V = M1 − M2 of pD +pD M1 M2 the interference pattern observed for two consecutive non-empty pulses. Note that there is no a priori relation between Q and V . In the original version of the protocol, Alice also sends decoy sequences α α with probability f, in order to prevent a subtle form of photon-number-splitting| i| i attack [21, 22]. These sequences do not code for a bit value.

2.2 Studies of a few specific attacks on the COW protocol

2.2.1 Collective Beam-Splitting Attack

The Beam-Splitting Attack (BSA) translates the fact that all the light that is lost in the channel between Alice and Bob, characterized by its transmission coefficient t, must be given to the eavesdropper, Eve. The attack consists in Eve simulating the losses 1 t by putting a beam-splitter just outside Alice’s laboratory, and then − 12 forwarding the remaining photons to Bob through a lossless line. Since it simulates exactly Bob’s expected optical mode, the BSA introduces no errors (i.e., Q = 0 and V = 1) and is therefore impossible to detect. The information that Eve can extract from her data depends on the way she processes them. For each bit she wants to estimate, she has to distinguish the two states 0, αE and αE, 0 , where αE = √1 t α. The case where Eve performs the same measurement| i | as Bobi was considered in− [46, 47]; in [C,D], we allowed Eve to keep her systems in a quantum memory, and to extract the largest possible information out of them on the final key, after Alice and Bob have run the classical one-way post-processing. This corresponds to a collective attack, for which case Devetak and Winter have shown [50] that Eve’s information is upper bounded by the Holevo quantity 1 1 χAE = S(ρE) S(ρE A=0α) S(ρE A=α0) (2.1) − 2 | − 2 | where S is the von Neumann entropy, ρE A=0α = 0, αE 0, αE is Eve’s state con- | | ih 1| 1 ditioned on what Alice sent (similarly for ρE A=α0), and ρE = ρE A=0α + ρE A=α0. | 2 | 2 | Denoting by h the binary entropy function, we find

µ(1 t) 1 0, α α , 0 1 e− − χ = h − |h E| E i| = h − . (2.2) AE 2 2 ³ ´ ³ ´ The Devetak-Winter bound then reads, for the secret key rate r:

µ(1 t) 1 e− − r = r (I χ ) = r 1 h − , (2.3) sift AB − AE sift − 2 h ³ ´i where rsift is the sifting rate, i.e. the probability that Alice and Bob accept a bit: here, including the detection efficiency η of Bob’s detector DB, the sifting rate per pair of pulses is r = (1 f)µtt η. As there are no errors, Alice and Bob’s mutual sift − B information for each sifted bit is IAB = 1. The key rate (2.3), as a function of the distance between Alice and Bob and after optimizing the mean number of photon µ, will be shown in Figures 2.2 and 2.3 in comparison with the following two classes of attacks.

2.2.2 Zero-error attacks based on Unambiguous State Dis- crimination

Another class of zero-error attacks (Q = 0,V = 1) was introduced and analyzed in [C]. These attacks exploit the fact that in the COW protocol, the coherence is checked only between successive pulses; in particular, no coherence is checked between all that comes before and all that comes after an empty pulse. Therefore, if Eve can be sure that a given pulse was empty, she can make an attack that breaks the coherence at the location of that pulse. More generally, Eve can try to distinguish a sequence of n pulses that begins and ends with an empty pulse: if she succeeds, she can send photons in this n-slot partial mode. These attacks are thus based on the unambiguous state discrimination (USD) of that n-slot sequence.

13 0 10

−1 r(µ ) for the collective BS attack 0 10 opt 10 r(µ ) for our USD attack opt −2 10

−3 10 µ

−4 10 Secret key rate

−1 −5 10 10 µ for the collective BS attack opt −6 10 µ for our USD attack opt

−7 10 0 20 40 60 80 100 120 140 160 0 20 40 60 80 100 120 140 160 Distance (km) Distance (km)

Figure 2.2: Optimal mean photon number µ (left-hand side) and corresponding secret-key rate r per pair of pulses (right-hand side) for the collective BSA and for the combination of 3-pulse and 4-pulse USD attacks, as a function of the distance 1 between Alice and Bob. Parameters: η = 0.1; 0.25 dB km− of losses; f = 0.1; t 1. B ≃

More specifically, we studied such USD attacks on three pulses, in which sequences 0α0 are discriminated, and on four pulses pulses, which discriminate sequences |0ααi0 . We could show that if the fraction of decoy sequences used in the protocol is | i small enough (f . 0.236), Eve could reproduce the detection rates of all individual detectors of Bob by combining these USD attacks. We refer to [C] for all the calculations. The optimal mean number of photon µ and the secret key rate r obtained when considering this attack are shown on Figure 2.2. One can see that this attack outperforms the BSA for distances d & 100 km, giving an optimal µ and a secret key rate that scale, respectively, as √t and t3/2. However, many limitations can be found to these USD attacks. Indeed, they are not entirely undetectable: even though all detection rates are reproduced, one could check other statistical parameters (such as the probabilities of detecting certain specific sequences), which would behave in an unexpected way. Also, Alice and Bob could simply choose f > 0.236, and the attack that we studied would become impossible. Be that as it may, it is important to be aware of these possible attacks, all the more so as there is no claim of optimality in the specific combination of USD attacks that we considered. Our results show that it is important that Alice and Bob include several tests of their statistics in the COW protocol.

2.2.3 Non-zero-error attacks on single or pairs of pulses

Let us now present another class of collective attacks that somehow generalizes the BSA by introducing errors (Q 0,V 1). The idea is that Eve attaches ancillary quantum systems to each pulse≥ or to each≤ pair of pulses, and applies transformations

14 of the form (for the case of a two-pulse attack):

αk 1, αk Ψ(αk 1, αk) (2.4) | − iA ⊗ |EiE → | − iB,E where αk 1, αk 0, α . Errors will be due to the fact that Eve gets entangled − to the system that∈ { goes} to Bob, in order to gain more information. These attacks have been studied in [D], in the long distance regime (for µt 1): this allowed us to neglect multi-photon components on Bob’s side, and to≪ parameterize Eve’s attack in finite dimensional Hilbert spaces. The problem was then to optimize Eve’s choice of states Ψ(αk 1, αk) under the constraint that (2.4) has to be a unitary − B,E transformation,| and so as toi maximize her information for a given amount of errors that she introduces. In the original version of the COW protocol, the pairing of the pulses that defines the logical bits is decided a priori by Alice, and is known to Eve. When performing the above attack on two successive pulses, Eve can therefore choose whether she wants to attack two pulses that together define one bit, or that are across a bit separation. This observation lead us to also consider modified versions of the COW protocol, in which the pairing of the pulses is not known a priori by Bob, nor Eve: in the COWm1 version, Alice still pairs consecutive pulses, while in the COWm2 version, she is allowed to pair any two pulses. In this last case, as Eve has no reason to attack successive pulses together, we considered one-pulse attacks. The resulting secret key rates per pulse1 are illustrated on Figure 2.3, for the case V = 0.98,Q = 0. Again, we refer to [D] for details on the calculations. As expected, the COWm1 and COWm2 versions perform slightly better2 than the original COW protocol. It is also interesting to note that the secret key rates that we get still behave linearly with t, as it was the case for the BSA. This makes the protocol quite efficient, and very suitable for long-distance QKD [48, 49]. Note finally that we also studied in [D] the same attacks on the Differential- Phase-Shift (DPS) [52, 53] protocol, which is another distributed-phase-reference protocol that shares very similar features with the COW protocol. We found indeed a very similar behavior against the attacks under study, with a secret key rate that also scales linearly with t.

2.3 Outlook

By analyzing specific attacks on a protocol, one finds limitations on the secret key rates that can be obtained. The attacks studied here on the COW protocol also allow one to get a feeling on how the protocol should perform. In particular, we expect to find secret key rates that scale linearly with the transmission coefficient t, just like for other protocols robust against photon-number-splitting attacks; however,

1To be consistent with the results presented in [D], we now show the key rate per pulse, contrary to the previous subsection where it was defined per pair of pulses. There is simply a factor of 2 between the two definitions. 2Note however, that there also exists attacks to which COWm2 in particular is more vulnerable. See [51].

15 BSA on COW, V = 1 2PA on COW @ V = 0.98

−2 2PA on COWm1 @ V = 0.98 10 1PA on COWm2 @ V = 0.98

−3 10 Secret key rate −4 10

−5 10 0 20 40 60 80 100 Distance (km)

Figure 2.3: Secret key rate r per pulse, for the BSA and for 2-pulse (2PA) and 1-pulse attacks (1PA) on the three protocols COW, COWm1 and COWm2, for V = 0.98 and Q = 0, as a function of the distance (valid for large distances only). Parameters: 1 η = 0.1; 0.25 dB km− of losses; f 0 (for COW); t 1. ≃ B ≃ the above USD attacks show that a careful analysis of the detection statistics is necessary to get this key rate. Proving the security of the COW protocol against the most general attacks re- mains work in progress. One should certainly get inspiration from the techniques that have been developed to prove the security of more standard protocols (for a review, see [17]), and adapt these tools to the specificities of distributed-phase- reference schemes. Also, it might prove useful to consider modified and more sym- metric versions of the COW protocol, as was done in [D], to which it might be possible to apply a De Finetti kind of argument [27].

16 Chapter 3

Testing Leggett’s model for non-local correlations

Quantum theory predicts that nature can produce non-local correlations, in the sense that they violate Bell inequalities [3]. This fascinating feature has been widely confirmed, up to a few standard loopholes, in many beautiful experiments [54] with entangled photons or ions (see for example [5, 55, 56, 57, 58]). However, while the quantum formalism provides precise rules to calculate these correlations, it doesn’t give any explanation on how they occur, or where they come from. To get a hint on what is essential to quantum correlations, it is interesting to look for alternative non-local models that either reproduce or can be shown to be incompatible with the quantum predictions. In this prospect, Leggett proposed in 2003 such an alternative model [11], and precisely proved its incompatibility with quantum theory: he derived inequalities that are necessarily satisfied by his model, but that can be violated quantum mechanically. Here we present a simple approach to this model, along with new inequalities for testing it. We also go beyond Leggett’s model, and show that one cannot ascribe even partially defined individual properties to the components of a maximally entangled pair.

3.1 Quantum correlations from “simpler” ones

We shall use here the formal description of a correlation, which can be written as a conditional probability distribution P (α, β ~a,~b), where α, β are the outcomes observed by two partners, Alice and Bob, when| they perform measurements labeled by ~a and ~b, respectively. On the abstract level, ~a and ~b are merely inputs freely and independently chosen by Alice and Bob. On a more physical level, Alice and Bob hold two subsystems described by an entangled quantum state; in the simple case of qubits, the inputs are naturally characterized by vectors on the Bloch sphere, hence the notation ~a,~b.

17 3.1.1 Decomposing non-local correlations

How should one understand nonlocal correlations, in particular those correspond- ing to entangled quantum states? A natural approach consists in decomposing P (α, β ~a,~b) into a statistical mixture of hopefully simpler correlations: | P (α, β ~a,~b) = dλρ(λ) P (α, β ~a,~b) . (3.1) | λ | Z We shall be concerned here with the case of binary outcomes α, β = 1, though generalizations are possible. In the binary case, the correlations can conveniently± be written as 1 P (α, β ~a,~b) = 1 + α M A(~a,~b) + β M B(~a,~b) + αβ C (~a,~b) . (3.2) λ | 4 λ λ λ ³ ´ This expression allows one to clearly distinguish the marginals

M A(~a,~b) = α P (α, β ~a,~b) ,M B(~a,~b) = β P (α, β ~a,~b) , (3.3) λ λ | λ λ | Xα,β Xα,β and the correlation coefficient

C (~a,~b) = αβ P (α, β ~a,~b) . (3.4) λ λ | Xα,β

We shall only be interested in correlations Pλ which, like quantum correlations, do neither allow signaling from Alice to Bob, nor from Bob to Alice, i.e. correlations fulfilling the so-called no-signaling condition. This condition has a simple form here: A A Alice’s marginal is independent of Bob’s input, Mλ = Mλ (~a) and symmetrically for B B ~ Bob’s marginal, Mλ = Mλ (b). Accordingly, in non-signaling correlations, only the correlation coefficient in (3.2), Cλ(~a,~b), can be nonlocal, while the marginals depend only on local variables.

3.1.2 Bell’s locality

~ A B ~ Bell’s locality assumption that Pλ(α, β ~a, b) factorizes into Pλ (α ~a) Pλ (β b) can then be simply expressed as | | · |

C (~a,~b) = M A(~a) M B(~b) . (3.5) λ λ · λ However, it is well known that quantum correlations violate Bell inequalities [3], and therefore they cannot be of that form.

3.1.3 Leggett’s model

In 2003 Leggett proposed another model of the form (3.1) to help us understand quantum correlations [11]. The basic assumption is that locally everything happens as if each single quantum system would always be in a pure state; non-locality can

18 only come from the correlation between the measurement results, expressed by the term Cλ(~a,~b). In our formalism this translates directly to the assumption that the supplementary variables λ describe the hypothetical pure states of Alice and Bob’s qubits, denoted by normalized vectors ~u,~v on the Bloch sphere: λ = ~u ~v , (3.6) | i ⊗ | i and the local marginals have the usual form as predicted by quantum physics: M A(~a) = ~u ~a~σ ~u = ~u ~a, (3.7) λ h | | i · M B(~b) = ~v ~b ~σ ~v = ~v ~b . (3.8) λ h | | i · If the qubits are encoded in the polarization of photons, as in Leggett’s initial idea, then the assumption is that each photon should be perfectly polarized (in the directions ~u and ~v), and the local marginals should fulfil Malus’ law. Let us recall that, in orthodox quantum theory, the singlet state is such that the properties of the pair are sharply defined (the state is pure), but the properties of the individual qubits are not. In this perspective, Leggett’s model is an attempt of keeping the correlations while reintroducing sharp properties at the individual level as well.

3.2 Violation of Leggett’s model by Quantum Me- chanics

As shown by Leggett himself [11], his model cannot reproduce the correlations of the singlet state, and this incompatibility with quantum predictions can be experi- mentally tested. The proof of incompatibility relies on the violation of what we shall call Leggett-type inequalities: these criteria say that, under Leggett’s assumptions (3.7–3.8), a measurable quantity L necessarily satisfies L L , while quantum ≤ max theory predicts that L > Lmax can be observed for suitable measurements. The first experimental test of Leggett’s model was presented in 2007 by Gr¨oblacher et al. [59]. However, in order to reach a conclusion regarding the falsification of the model, they needed an additional assumption. Indeed, Leggett’s original inequali- ties, and in particular the version used in [59], suppose that data are collected from infinitely many measurement settings. To circumvent this problem, Gr¨oblacher et al. assumed the rotation invariancy of the system being measured, and then claimed a violation of their inequality. It was soon realized how one could do without this unnecessary assumption: inspired by the way that inequality was derived, we could indeed come up with a finite version of it, directly testable [E] (see also [60] for a similar derivation). This allowed us to demonstrate the first really conclusive experimental falsification of Leggett’s model. Here we shall derive a new Leggett-type inequality [F], in a much simpler way than it was done for the first inequalities that had been published and tested [11, 59, 60],[E]. Our inequality has been experimentally tested, and allowed a clear refutation of Leggett’s model.

19 3.2.1 General inequality for non-signaling models

In order for the decomposition (3.1) to be a valid mixture of correlations, all distri- butions Pλ should be non-negative. When writing Pλ(~a,~b) in the form of eq. (3.2), one can see that the non-negativity implies the general constraints

1 + M A(~a) + M B(~b) C (~a,~b) 1 M A(~a) M B(~b) (3.9) − | λ λ | ≤ λ ≤ − | λ − λ | or equivalently, in a more compact form:

M A(~a) M B(~b) 1 C (~a,~b) . (3.10) | λ ± λ | ≤ ± λ A B Constraints on the marginals Mλ or Mλ thus imply constraints on the correlation coefficients Cλ, and vice versa. Let us now consider one measurement setting ~a for Alice and two measurement settings ~b,~b′ for Bob, and let’s combine the previous inequalities (3.10) that we get for (~a,~b) and (~a,~b′). Using the triangle inequality, one gets

B B C (~a,~b) C (~a,~b′) 2 M (~b) M (~b′) . (3.11) | λ ± λ | ≤ − | λ ∓ λ |

These constraints must hold for all probability distributions Pλ. After inte- gration over the λ’s, one gets, for the averaged correlation coefficients C(~a,~b) =

dλρ(λ)Cλ(~a,~b): R B B C(~a,~b) C(~a,~b′) 2 dλρ(λ) M (~b) M (~b′) . (3.12) | ± | ≤ − | λ ∓ λ | Z 3.2.2 Derivation of a simple Leggett-type inequality

Now we derive an inequality satisfied by Leggett’s model, which can be experimen- tally tested. Inequality (3.12) implies, for the particular form of eq. (3.8) for Bob’s marginals:

C(~a,~b) + C(~a,~b′) 2 dλρ(λ) ~v (~b ~b′) . (3.13) | | ≤ − | · − | Z 1 ~ ~ Let’s consider three triplets of settings (~ai, bi, bi′ ), with the same angle ϕ between ~ ~ ~ ~ ϕ all pairs (bi, bi′ ), and such that bi bi′ = 2 sin 2 ~ei, where ~e1,~e2,~e3 form an orthogonal basis (see Figure 3.1). After combining− the three corresponding{ } inequalities (3.13), 3 using the fact that i=1 ~v ~ei 1 and the normalization dλρ(λ) = 1, we finally get the Leggett-type inequality| · | ≥ P R 1 3 2 ϕ C(~a ,~b ) + C(~a ,~b′ ) L (ϕ) 2 sin . (3.14) 3 | i i i i | ≡ 3 ≤ − 3| 2 | i=1 X

1Note that other choices of measurement settings can lead to other Leggett-type inequalities, which might be more robust, but would bring more settings into play [F].

20 ~ ~ Figure 3.1: Alice’s and Bob’s settings ~ai, bi and bi′ used to test inequality (3.14). The three directions ~e of ~b ~b′ (thin dotted arrows) must be orthogonal. i i − i

The correlation coefficients C(~a,~b) can be experimentally estimated; for the sin- ~ ~ glet state, quantum mechanics predicts CΨ− (~a, b) = ~a b. Thus, when ~ai is judi- ~ ~ − · ciously chosen to be along the direction of bi +bi′ , the quantum mechanical prediction for L3(ϕ) is ϕ L − (ϕ) = 2 cos , (3.15) Ψ | 2 | which violates inequality (3.14) for a large range of values ϕ. More specifically, 1 for a pure singlet state, the violation occurs for ϕ < 4 arctan 3 73.7◦, and the 1| | ≃ maximal violation is obtained for ϕ = 2 arctan 3 36.9◦. In the case of imperfect | | ϕ ≃ interference visibility V (L˜ − (ϕ) = 2V cos ), a violation can still be observed as Ψ | 2 | long as V > V (3) = 1 ( 1 )2 = 2√2 94.3%. th − 3 3 ≃ An important featureq of Leggett-type inequalities compared to Bell inequalities is that the bound is not a fixed number, independent of quantum physics. Instead, the bound in Leggett-type inequalities, like the model itself, depends on the quantum measurements that are performed. Consequently all experimental data aiming at disproving Leggett’s model should present evidence that the settings used in the experiment have been properly adjusted.

3.2.3 Experimental falsification of Leggett’s model

We tested our Leggett-type inequality (3.14) with pairs of polarization-entangled photons obtained via a non-collinear type-II parametric down conversion process in a Barium-beta-borate crystal. We chose the following Bloch vectors, as shown on Figure 3.1: ϕ ϕ ~a = ~x, ~b ,~b′ = cos , sin , 0 , 1 1 1 2 ± 2 ³ ϕ ϕ´ ~a = ~y, ~b ,~b′ = 0, cos , sin , (3.16) 2 2 2 2 ± 2 ³ ϕ ϕ´ ~a = ~z, ~b ,~b′ = sin , 0, cos , 3 3 3 ± 2 2 ³ ´ 21 2 QM (pure singlet) 1.9

1.8 experiment L3 1.7 upper bound 1.6 for Leggett’s model

1.5

1.4 −90° −60° −30° 0 30° 60° 90° ϕ

Figure 3.2: Experimental values for L3 over a range of separation angles ϕ (points with error bars) violate the bound given by Legget’s model (solid line), and follow qualitatively the expected value for the quantum mechanical prediction (dashed line).

so that ϕ ~b ~b′ = 2 sin ~e , with (~e ,~e ,~e ) = (~y, ~z, ~x). (3.17) i − i 2 i 1 2 3

The x axis in this notation corresponds to 45◦ linear, the y axis to circular, and the z axis to horizontal/vertical polarization,± the latter coinciding with the natural basis of the parametric down conversion process in the nonlinear optical crystal. For given measurement settings, we estimated the correlation coefficients C(~a,~b), and computed the values of L3(ϕ) over a larger range of ϕ with an integration time of T = 15 s per setting. The results are shown on Figure 3.2. The variation of L3 with ϕ is compatible with the quantum mechanical prediction for a singlet with residual colored noise and an orientation uncertainty of the quarter wave plate of 0.2◦ (recall that in Leggett-type inequalities, it is important to adjust the settings accurately). The largest violations of (3.14) are found for ϕ = 25◦ with 40.6 and 38.1 standard deviations, respectively. ± Clearly, the experimental data agree with quantum mechanics and falsify Leggett’s model.

3.3 On the tolerable amount of individual prop- erties

The falsification of Leggett’s model proves that it is impossible to reconstruct quan- tum correlations from hypothetical, more elementary correlations in which individual

22 properties would be sharply defined. We are going to argue that a much stronger statement holds, namely, that individual properties cannot even be partially defined.

3.3.1 A straightforward generalization of Leggett’s model

Let us first consider the following straightforward generalization of Leggett’s model: we now allow the “local states” λ to be mixed states, e.g. photons with a degree of A B ~ ~ polarization η. So, we replace (3.7–3.8) by Mλ (~a) = η ~u ~a, Mλ (b) = η ~v b, with 0 < η 1. For this model one can derive a generalized version· of the Leggett-type· inequality≤ (3.14): 2 ϕ L (ϕ) 2 η sin (3.18) 3 ≤ − 3 | 2 | ϕ which, for any value of η > 0, is violated by L − (ϕ) = 2 cos for angles ϕ small Ψ | 2 | enough. Experimentally, one cannot expect to conduct a meaningful comparison between those two predictions down to η = 0 due to imperfections in the state preparation. From the measurement shown in Figure 3.2, however, we can extract the maximal excess of L3 with respect to the generalized model bound (3.18) for various degrees of purity η. For η = 0.56, we can start to claim experimental evidence of a violation with a statistical significance of 3.65 standard deviations, thus putting a lower bound for this class of models.

3.3.2 Any model `ala Leggett must have vanishing marginals

It is then natural to conjecture that no model of the form (3.1), with non-signaling correlations Pλ, can reproduce the quantum correlations of the singlet state, unless A B ~ Mλ (~a) = Mλ (b) = 0 (3.19) for all measurements ~a and ~b (except perhaps for a few λ’s in a zero-measure set, which could possibly depend on ~a,~b). We have indeed been able to prove this conjecture for models with discrete λ’s: please refer to the Methods section of [F] for the proof. This is in good agreement with the results of Colbeck and Renner [61], who have derived general inequalities to falsify such models with non trivial marginals.

3.4 Conclusion

Our conclusion is that quantum correlations cannot be reconstructed from “simpler” correlations in which the individual properties would be even partially defined: any non-signaling model with non-vanishing marginals for the singlet state is incompat- ible with quantum predictions. Nature is really such that, in some cases, individual properties are completely lost while global properties are sharply defined.

23 Chapter 4

Testing the speed of spooky action at a distance

As shown by Bell [3], and as we stressed in the previous chapter, quantum cor- relations cannot be explained by preexisting local properties of the systems being measured. If the measurements are space-like separated events, the correlations cannot be explained by classical (subluminal) communication neither. It would still be possible, however, that a first event could influence a second one via an unknown influence, which Einstein called spooky action at a distance. Assume this hypothetical influence is indeed a real phenomenon. Although greater than that of light, the speed of this influence, defined in a hypothetically privileged reference frame, should be finite. Thus if the events are simultaneous in the privileged reference frame, the influence cannot arrive on time, and the quantum correlations should disappear. This idea can be experimentally tested [62, 63],[G]. Using a judiciously chosen configuration for the experiment, one can take advantage of the rotation of the Earth to test any hypothetically privileged reference frame. The experiment was performed between two villages in the Geneva region, and two photon interferences above the Bell inequality threshold were continuously observed during more than 24 hours. This allows us to determine, for all reference frames, a lower bound on the speed of this hypothetical influence, that we shall call the speed of spooky action1 (also termed speed of quantum information in [G]).

4.1 Principle of the experiment

In order to obtain bounds on the speed of spooky action in all possible frames, we choose to perform a Bell test between two villages approximately east-west oriented, and with the source located precisely in the middle. If the detection events on both sides are simultaneous in the Earth’s reference frame, then they are simultaneous in all frames moving in a direction perpendicular to the line joining the two events, in

1Let us emphasize that, although we shall use this terminology, this is only the speed of a hypo- thetical non-classical influence, and that our results actually cast serious doubts on its existence.

24 our case the east-west axis: in 12 hours all reference frames will be scanned. Here is how one can obtain quantitative bounds on the speed of spooky action: in an inertial reference frame centered on the Earth, two single-photon detections occur at positions ~rA and ~rB at times tA and tB. Let us consider another inertial reference frame F , the hypothetically privileged frame, relative to which the Earth frame moves at a speed ~v (see Figure 4.1). When correlations violating a Bell inequality are observed, the speed of spooky action Vspooky in frame F that could cause the correlation is lower bounded by

r~′B r~′A Vspooky || − || (4.1) ≥ t′ t′ | B − A| ~ ~ where (r′A, tA′ ) and (r′B, tB′ ) are the coordinates of the two detection events in frame F , obtained from (~rA, tA) and (~rB, tB) after a Lorentz transformation. Writing ( ) ( ) ( ) ( ) ( ) ( ) t ′ = t ′ t ′ and ~r ′ = ~r ′ ~r ′ , the Lorentz transformation gives AB B − A AB B − A

~rAB ~v ct = γ(ct + · ) AB′ AB c (4.2) r~′AB = γ(~r + ~vt) + ~r ½ k ⊥

2 2 ~rAB ~v with γ = 1/ 1 v /c (c being the speed of light), and where ~r = 2· ~v and − k v ~r = ~rAB ~r are the components of ~rAB parallel and orthogonal to ~v. Let us ⊥ k −p v ~rAB ~v also define β = the relative speed of the Earth frame in frame F , β = · its c k crAB component parallel to the A–B axis, and ρ = c tAB the alignment of the two events rAB in the Earth frame. The transformation (4.2) implies, after simplification:

ctAB′ = γrAB(ρ + β ) 2 2 2 k 2 2 2 (4.3) (rAB′ ) = γ rAB (ρ + β ) + (1 β )(1 ρ ) . ½ k − − Coming back to the bound (4.1), one£ gets ¤

V 2 (1 β2)(1 ρ2) spooky 1 + − − . (4.4) c ≥ (ρ + β )2 µ ¶ k In the following, we will consider space-like separated events, for which ρ < 1: the | | bound on Vspooky will then be larger than c. For a given privileged frame F , this bound depends on the orientation of the A–B axis through β and on the alignment k ρ. To obtain a good lower bound for Vspooky, one should upper bound the term (ρ+β )2 by the smallest possible value, during a period of time T needed to observe k a Bell violation (which, in our case, will be the integration time of a 2-photon interference fringe). In our experiment, we want the detection events to be almost simultaneous in the Earth frame, so we shall align them such that ρ ρ¯ 1, whereρ ¯ is our experimental precision on the alignment ρ. Using the| facts| ≤ that≪ (1 ρ2) (1 ρ¯2) and (ρ + β )2 (¯ρ + β )2, we get the bound − ≥ − k ≤ | k| V 2 (1 β2)(1 ρ¯2) spooky 1 + − − . (4.5) c ≥ (¯ρ + β )2 µ ¶ | k| 25 Figure 4.1: The Earth frame moves with respect to a hypothetically privileged reference frame F at a speed ~v. The zenith angle χ between ~v and the z axis can have values between 0◦ and 180◦. The A–B axis forms an angle α with the equatorial (xy) plane. ω is the angular velocity of the Earth.

The problem reduces to bounding β directly. | k| In the configuration of our experiment, the A–B axis is almost, but not perfectly, oriented along the east-west direction. Consequently, the component β (t) has a k 24-hour period, and geometric considerations show that it can be written as

β (t) = β cos χ sin α + β sin χ cos α cos ωt , (4.6) k where χ is the zenith angle of ~v, α is the angle between the A–B axis and the equatorial (xy) plane (see Figure 4.1), and ω is the angular velocity of the Earth. In order to upper bound β during a period of time T , two cases can be consid- k ered, depending whether ~v points| | close to a pole or not:

(i) C tan χ > tan α , (4.7) T | | | | (ii) C tan χ tan α , (4.8) T | | ≤ | | 2 ωT with CT = cos 4 1 when ωT is small. For each case, there exists a time interval of length T , during≃ which β (t) is respectively upper-bounded by (see the k Supplementary Information of [G])| |

ωT (i) β (t) β sin2 χ cos2 α cos2 χ sin2 α , (4.9) | k | ≤ | | − 2 q ωT (ii) β (t) β cos χ sin α sin χ cos α cos . (4.10) | k | ≤ | | | | − | | 2 ³ ´ These bounds, together with equation (4.5), provide the desired lower bound for Vspooky.

26 Figure 4.2: Configuration of the experiment, performed in the Geneva region. See text for details.

4.2 Experimental results

Our experimental setup consisted of a large Franson interferometer [64]. A source situated in our laboratory in Geneva emitted energy-time entangled photon pairs using the standard parametric down-conversion process in a non-linear crystal. One photon was sent via the Swisscom fiber optic network to Satigny, a village west of Geneva, while the other photon was sent to Jussy, another village east of Geneva. The two receiving stations were separated by a direct distance of 18.0 km, see Figure 4.2. At each station, the photons pass through identically unbalanced fiber optic Michelson interferometers. When a photon pair is detected simultaneously in Satigny and Jussy, there is no information about which path the photons took in their interferometer, the long arm or the short arm. But since both photons were also emitted simultaneously, both took the same path: both long or both short. This indistinguishability leads, as always in quantum physics, to interference between the long-long and short-short paths. By scanning continuously the phase in one interferometer, at Jussy, while keeping the other one stable, produces a sinusoidal oscillation of the correlation between the photon detections at Satigny and Jussy. Interference fringes were recorded in many runs, each of them lasting several hours (see Figure 4.3). By juxtaposing these measurement runs, we covered a 24- hour period with interference fringe periods of T = 360 s with visibilities well above the threshold (1/√2) set by the Clauser-Horne-Shimony-Holt Bell inequality [65]. The goal of our experiment being to test the speed of the hypothetical spooky action at a distance, we considered as established the fact that quantum correlations cannot be described by local common causes, and we did not aspire to perform a loophole- free Bell experiment. The observation of two-photon interferences with a visibility high enough to potentially violate Bell’s inequality was thus enough to ascribe it to spooky action.

27 Figure 4.3: Left: Interference fringes with a period T =900 s obtained during a 4-hour measurement fitted with a sinusoidal function yielding a visibility of V = (87.6 1.1)%. Right: Visibility fits for several uninterrupted runs obtained at different± times of the day, with a period T =360 s. Together these runs cover each moment of the day at least twice. Visibility values remain above the threshold (thick black line, V = 1/√2) set by the CHSH Bell inequality at all times.

As explained before, such an observation at all times of the day makes it possible to calculate the lower bound for the speed of spooky action in any reference frame, using inequality (4.5) together with (4.9–4.10). For a given reference frame, this bound depends on the period of time T = 360 s needed to observe a Bell violation (corresponding to the interference fringe period), on the angle α = 5.8◦ formed by the A–B axis and the equatorial plane, and on the precision of the alignment of the 2 6 detection events, estimated in our case to be ρ ρ¯ = 5.4 10− 1. | | ≤ × ≪ The results are shown in Figure 4.4, for certain frames. In Figure 4.4 (left), we scan all possible directions χ of the tested hypothetically privileged frame, but set 3 the Earth’s relative speed at β = 10− . A lower bound for Vspooky greater than 10.000 times the speed of light is found for any such reference frame. The non- perfect east-west orientation (α = 0) is responsible for the minimum values of the 6 bound at angles χ near 0◦ and 180◦. For smaller Earth speeds, the bound on Vspooky is even larger. Note however that if β is very large, then the corresponding bound on Vspooky is less stringent. To illustrate this, in Figure 4.4 (right) we set χ = 90◦, i.e. ~v in the equatorial plane, and scan the velocity β. For small values of β, our bound is limited by the inverse of our precision of alignmentρ ¯.

4.3 Conclusion

From our observations, we conclude that the quantum correlations observed here and in previous experiments are truly and fundamentally nonlocal. The hypothetical spooky action at a distance considered in this work would indeed have to propagate

2To calculateρ ¯, we estimated the overall uncertainty on the difference in the arrival times of the single photons to be ∆tAB = 323 ps. Together with rAB = 18 km, one gets ρ c∆tAB/rAB = ρ¯ = 5.4 10−6. | | ≤ × 28 6 10

5 @ β=10−3 10 5 10 @ χ =90° 4 /c /c 10 spooky spooky V V 3 10

2 10 Bound on Bound on

4 1 10 10

0 10 −5 −4 −3 −2 −1 0 0° 30° 60° 90° 120° 150° 180° 10 10 10 10 10 10 χ β

Figure 4.4: Lower bounds for the speed of spooky action. Left: Bound obtained 3 for Vspooky/c as a function of the angle χ, when β = 10− . For angles χ . α or χ & 180◦ α, the bound is obtained by considering case (ii) (see text), while for − angles α . χ . 180◦ α, the bound is obtained by considering case (i). The bound − at χ = 90◦ is V 54000c. Right: Bound obtained for V /c as a function of spooky ≥ spooky the speed β, when χ = 90◦. When β 0, our bound on V /c 1/ρ¯. → spooky → at speeds even greater than the bounds obtained in our experiment; the idea, that there exists such a spooky influence propagating at finite speed looks very difficult to maintain. Quantum correlations seem to somehow come from outside space-time.

29 Chapter 5

On the Elitzur-Popescu-Rohrlich approach to quantum non-locality

The incompatibility of quantum mechanics with local variable theories, as shown by Bell [3], lies at the statistical level: local variable theories cannot reproduce all statistical predictions of quantum theory. In a typical Bell experiment, one observes correlations between the measurement results of two partners (Alice and Bob), and averages them over measurements on many pairs of particles. One may then con- clude that non-locality was observed if the average correlations thus obtained violate a Bell inequality. However, if the statistics of the observations exhibit non-locality, it does not imply that all individual pairs behave non-locally. This observation lead Elitzur, Popescu and Rohrlich [12], hereafter referred to as EPR2, to wonder whether one could consider that a fraction of the pairs still behaves locally, while another fraction would behave non-locally (and possibly more non-locally than quantum mechanics allows).

More explicitly, writing PQ the quantum mechanical probability distribution for Alice and Bob’s results, the EPR2 approach consists in decomposing PQ as a convex sum of a local part, PL, and of a non-local part, PNL, in the form

P = p P + (1 p )P , with p [0, 1]. (5.1) Q L L − L NL L ∈

The maximal weightp ¯L = max pL that can be attributed to the local part can be regarded as a measure of (non-)locality of the quantum distribution PQ. Finding this maximal possible local weight is not a trivial problem; we only know how to calculate lower and upper bounds onp ¯L. In this chapter, we shall concentrate on the simplest case of a quantum probability distribution originating from Von Neumann measurements on two-qubit pure states. After recalling previously known results for this case, we shall propose a new EPR2 decomposition and derive a new lower bound onp ¯L, which reaches the previously known upper bound [66] for a wide class of states. This gives for the first time a definite value for the exact local contentp ¯L of those states.

30 5.1 The EPR2 approach for two-qubit pure states

5.1.1 Correlations of two-qubit pure states

Without loss of generality, any two-qubit pure state can be written in the form ψ(θ) = cos θ 00 + sin θ 11 (5.2) | i | i | i π with θ [0, 4 ]. In the following, we shall use the notation c = cos 2θ, s = sin 2θ (with c,∈ s [0, 1]). ∈ Each qubit is subjected to a Von Neumann measurement, labeled by unit vectors 2 ~a and ~b on the Bloch sphere S . Let us denote by az and bz the z components of ~ 2 2 ~a and b, by a = 1 az and b = 1 bz the amplitudes of the components of ~ ⊥ − ⊥ − ~a and b in the xypplane, and by χ p] π, π] the difference between the azimuthal ∈ − 1 angles of ~a and ~b′, with ~b′ defined as the reflection of ~b with respect to the xz plane . With these notations, and for binary results α, β = 1, quantum mechanics predicts the following conditional probability distribution:± P (α, β ~a,~b) = 1 (1 + α M (~a) + β M (~b) + αβ E (~a,~b)) (5.3) Q | 4 Q Q Q

with MQ(~a) = c az,MQ(~b) = c bz, (5.4)

EQ(~a,~b) = azbz + s (axbx ayby) = azbz + s a b cos χ . (5.5) − ⊥ ⊥

As explained before, the EPR2 problem is to find a decomposition of PQ(α, β ~a,~b) as a convex sum of a local and a non-local probability distribution, in the form (5.1).| For a given state (i.e., a given value of θ), the equality is required to hold for all possible measurements ~a,~b and for all results α, β. The weight pL [0, 1] of the local distribution should be independent of the measurements and of∈ the outcomes.

The probability distribution PL(α, β ~a,~b) is required to be local, in the sense that it can be explained by local variables λ|, i.e. it can be decomposed in the form

P (α, β ~a,~b) = dλ ρ(λ) P A(α ~a)P B(β ~b). (5.6) L | λ | λ | Z On the other hand, no restriction is imposed on PNL, except that it must be non- negative for all inputs and outputs: 1 P (α, β ~a,~b) = (P (α, β ~a,~b) p P (α, β ~a,~b)) 0 . (5.7) NL | 1 p Q | − L L | ≥ − L In particular, PNL is allowed to be even more non-local than quantum mechanical correlations2. The goal is to find, for a given state, a decomposition with the largest possi- ble value for pL, denotedp ¯L(θ), which characterizes the locality of the probability distribution PQ as defined by (5.3–5.5). 1The axes x, y, z of the Bloch sphere are defined as usual: 0 and 1 are identified with the north and south poles (i.e., along the z axis), while the state ( 0| +i 1 )/√| 2i defines the x direction. ′ | i | i We introduce ~b to account for the minus sign in front of ayby in (5.5). 2 1 Note however, that PNL = (PQ pLPL) is by construction non-signaling. 1−pL − 31 5.1.2 Previously known results and conjecture

In their original paper [12], Elitzur, Popescu and Rohrlich proposed an explicit local 1 s probability distribution PL, which lead to an EPR2 decomposition with pL = −4 . This was the first known lower bound onp ¯L(θ). Clearly, this was not optimal, at least when approaching the product state (θ = 0, i.e., s = 0) which is fully local, and therefore satisfiesp ¯L(0) = 1.

They also argued that for the maximally entangled state (θ = π/4), PQ contains π no local part:p ¯L( 4 ) = 0, i.e. no EPR2 decomposition with pL > 0 exists for this state. This is in fact a much more general result, as shown later by Barrett et al [67]: the maximally entangled state of two d-dimensional quantum systems, for any dimension d, has no local component.

In [66], Scarani could improve on the first lower bound forp ¯L(θ), as he gave an explicit decomposition that achieves p = 1 s. Interestingly, it can be noted L − that if PL depends only on the z components az and bz of ~a and ~b, one can not hope to find an EPR2 decomposition with a local weight larger than p = 1 s. L − Suppose indeed that PL(α, β ~a,~b) = PL(α, β az, bz); for ~a = α~x and ~b = β~x, one ~ | | ~ 1 s − has PL(α, β ~a, b) = PL(α, β 0, 0) and PQ(α, β ~a, b) = −4 , and therefore, according 1 s| | | to (5.7), − p P (α, β 0, 0) 0. By summing over (α, β), one finds p 1 s. 4 − L L | ≥ L ≤ −

On the other hand, an upper bound onp ¯L(θ) can be obtained with the help of Bell inequalities [67]. Let I I be a Bell inequality (defined by a linear combination ≤ L of conditional probabilities), IQ the quantum value obtainable with the probability distribution PQ, and INS(> IL) the maximum value obtainable with non-signaling distributions. Then from (5.1) it follows that I p I + (1 p )I , i.e., Q ≤ L L − L NS I I p NS − Q . (5.8) L ≤ I I NS − L Using the family of “chained Bell inequalities” [68, 69], Scarani could also derive (numerically) an upper bound forp ¯ (θ), namelyp ¯ (θ) cos 2θ [66]. L L ≤

So far, the gap was still open between the two bounds

1 sin 2θ p¯ (θ) cos 2θ . (5.9) − ≤ L ≤

It has been conjectured [70] that there should exist an EPR2 decomposition that reaches the upper bound, i.e. with pL = c. If this could be proven to be true, then the lower and upper bounds would coincide, and one could conclude that the value ofp ¯L(θ) is exactly cos 2θ. In the following we describe our (partially successful) attempts to prove this conjecture.

32 5.2 Reformulation of the problem to prove the conjecture

Our goal is now to see whether it is indeed possible to attribute a weight pL = c in the EPR2 decomposition of the 2-qubit probability distribution PQ (5.3), and write

P = cP + (1 c)P . (5.10) Q L − NL

For that, we want to find an explicit local probability distribution PL, such that 1 PNL = 1 c (PQ cPL) is a valid probability distribution, i.e. PNL must be non- negative.− The problem− thus translates into

Problem : find P , such that P cP 0 . (5.11) L Q − L ≥

At this point, we shall impose an additional (and possibly questionable) constraint on the EPR2 decomposition we are looking for: we want the non-local part to have 3 random marginals , i.e., with obvious notations, MNL(~a) = MNL(~b) = 0. The intuition is that the marginals are local properties, which should be concentrated on the local component only. As equality (5.10) should also hold individually for the marginals on Alice’s and

Bob’s sides, one should then have MQ(~a) = cML(~a) and MQ(~b) = cML(~b), i.e.

ML(~a) = az ,ML(~b) = bz . (5.12)

With these constraints, the condition P cP 0 reads: Q − L ≥ for all α, β,~a,~b, 1 c + αβ(E (~a,~b) cE (~a,~b)) 0 . (5.13) − Q − L ≥ Thus, the problem now translates into:

ML(~a) = az Problem : find P , such that M (~b) = b (5.14) L  L z E (~a,~b) cE (~a,~b) 1 c  | Q − L | ≤ −  5.3 Proposal for a new EPR2 decomposition

As we are dealing with qubits, the natural geometry of the problem involves unit vectors on the Bloch sphere; we shall propose a local component PL that makes the most of this geometry. Inspired also by models that Bell devised to reproduce the measurement statistics on a single qubit in the state 0 [71] (which gives precisely the marginals we want), or to approximate the statistics| i of the singlet state [3], we introduce the following model to define PL:

3 Note that this constraint precisely justifies the choice pL = c. Indeed, if one can find an EPR2 decomposition with random non-local marginals, then for the setting ~z, MQ(~z) = c = pLML(~z), which implies p c. Now, c is known to be an upper bound for p , and therefore p = c. L ≥ L L 33 Local model: Alice and Bob share a random local variable ~λ, uniformly dis- tributed on the Bloch sphere. When Alice receives the measurement direction ~a, she outputs α(~a,~λ) = sign(a ~a ~λ). Similarly, when Bob receives the measurement z − · direction ~b, he outputs β(~b, ~λ) = sign(bz ~b′ ~λ), where ~b′ is the reflection of ~b with respect to the xz plane. − ·

Let us check whether the constraints (5.14) are satisfied.

Marginals. Alice’s and Bob’s marginals corresponding to our local probability distribution PL are, as required in (5.14): dλ ML(~a) = sign(az ~a ~λ) = az (5.15) 2 4π − · ZZS dλ ML(~b) = sign(bz ~b′ ~λ) = bz . (5.16) 2 4π − · ZZS Correlation term. The details for the calculation of the local correlation coeffi- cient EL(~a,~b) are given in Appendix A on page 37. We find dλ EL(~a,~b) = sign(az ~a ~λ) sign(bz ~b′ ~λ) (5.17) 2 4π − · − · ZZS 1 a b if χ = 0 , − | z − z|  az + bz 1 if χ = π , = | | − (5.18)  2 χ 2 a⊥bz azb⊥ cos χ  1 | | + az arctan( − )  π π b⊥ sin χ − 2 azb⊥ a⊥bz cos χ| | if 0 < χ < π . + π bz arctan( a− sin χ ) | |  ⊥ | |   One can then check4 that for all settings ~a and ~b,

E (~a,~b) cE (~a,~b) max(1 c, c s) . (5.19) | Q − L | ≤ − − The last constraint in (5.14) is thus satisfied when c s 1 c, i.e. when c 4 : − ≤ − ≤ 5 For all c 0.8, for all ~a,~b, E (~a,~b) cE (~a,~b) 1 c . (5.20) ≤ | Q − L | ≤ −

Conclusion regarding our EPR2 decomposition

When c 0.8, since our local probability distribution P satisfies the three con- ≤ L straints (5.14), it defines a valid EPR2 decomposition for PQ, with a local weight that can take the value pL = c. This gives the lower boundp ¯L(θ) cos 2θ for all pure two-qubit states (5.2) such that cos 2θ 0.8 (or θ & 0.1π). As≥ cos 2θ was also ≤ 4This can be proven analytically for the cases when χ = 0 or π: for a given c, one gets the result by looking at the maximum of the function EQ cEL for all az, bz. For 0 < χ < π on the other hand, we checked the bound (5.19) numerically;| for− each| value of c, it was only| 3| parameters to vary, so we are confident that the numerics are trustworthy.

34 Upper bound: p ≤ c 1 L

Our new lower bound: 0.8 p ≥ c for c ≤ 0.8 ? L

0.6 L p

0.4 Previously known lower bound: p ≥ 1−s L 0.2

EPR2: p ≥ (1−s)/4 L 0 0 0.05 0.1 0.15 0.2 0.25 θ/π

Figure 5.1: Bounds onp ¯L(θ) in the EPR2 decomposition for two-qubit pure states, as a function of the state parameter θ. Our new lower boundp ¯L(θ) cos 2θ, valid for all states such that cos 2θ 0.8, coincides with the upper bound obtained≥ in [66]. There is still a gap between the≤ lower and upper bound when cos 2θ > 0.8.

known to be an upper bound forp ¯L(θ) [66], we can conclude that this is actually its definite value: when cos 2θ 0.8, p¯ (θ) = cos 2θ . (5.21) ≤ L When cos 2θ > 0.8 however, there exists measurement settings ~a,~b for which the 5 third constraint in (5.14) is not satisfied by PL . Our local probability distribution cannot be attributed a weight pL = c in that case.

Still, our decomposition gives a non-trivial lower bound on pL even when c > 0.8, 6 12 namely pL c + s 1 + 2(1 c)(1 s). As long as c 13 (or θ & 0.06π), this lower bound≥ is larger− than the previously− − known bound 1 ≤s [66], but when c 12 p 13 our new decomposition gives a smaller bound. − ≥

Figure 5.1 summarizes all the bounds we now know onp ¯L(θ).

5.4 Prospects

We thus could prove the conjecture thatp ¯L(θ) = cos 2θ for all states such that cos 2θ 0.8. This reinforces our opinion, that the result should indeed hold for all pure two-qubit≤ states.

5 Take ~a = ~b = ~x for instance: EQ(~x, ~x) cEL(~x, ~x) = c s > 1 c if c > 0.8. 6 − −PQ − − − − The lower bound is given by min ~ . As for the case c 0.8, the bound can be obtained α,β,~a,b PL ≤ analytically for χ = 0 or π, and was checked numerically for 0 < χ < π. | | 35 Unfortunately, we could not find so far an EPR2 decomposition with pL = cos 2θ for the very partially entangled states (such that cos 2θ > 0.8). Let us however share a few reflections on how one could possibly look for a suitable local component PL, which would allow one to prove the conjecture in full generality.

We realize that our local distribution PL above fails to satisfy the constraints (5.14) when the state under consideration becomes less and less entangled. In our local model, it might be that we correlated the two parties too strongly, by imposing that they share the same local variable ~λ.

One idea would be to provide the two parties with two local variables ~λa and ~λb S2, while still considering response functions of the form α(~a, ~λ ) = sign(a ~a ~λ ∈) a z − · a and β(~b, ~λ ) = sign(b ~b′ ~λ ). Instead of imposing ~λ = ~λ as in our previous b z − · b a b model, we would correlate ~λa and ~λb in a smoother way, depending on the state we 7 consider . In the extreme cases, we would still impose ~λa = ~λb for the maximally π ~ entangled state (θ = 4 ), while the two λ’s would be completely decorrelated for the product state (θ = 0). The problem is now to find the proper way to correlate the two ~λ’s for each state, i.e. determine the distribution functions ρθ(~λa, ~λb). Here are a few properties that we might want to impose on ρθ(~λa, ~λb):

ˆ Forgetting about ~λb, ~λa should be uniformly distributed, and vice versa. This will ensure in particular that the marginals are those expected: ML(~a) = az,ML(~b) = bz. One should thus have: 1 1 for all ~λa, dλbρθ(~λa, ~λb) = ; for all ~λb, dλaρθ(~λa, ~λb) = .(5.22) 2 4π 2 4π ZZS ZZS ~ ˆ Let us denote by (ϑa(b),ϕa(b)) the spherical coordinates of λa(b). It looks very natural to impose that ρ (~λ , ~λ ) should only depend on ϑ , ϑ and ϕ = ϕ ϕ , θ a b a b b− a that it should be symmetrical when exchanging ~λa and ~λb, and that it should have an even dependence on ϕ:

ρ (~λ , ~λ ) = ρ (ϑ , ϑ , ϕ) = ρ (ϑ , ϑ , ϕ) = ρ (ϑ , ϑ , ϕ) . (5.23) θ a b θ a b θ b a θ a b − ˆ According to an argument presented in Appendix B on page 38, not all pairs ~ ~ ϑa ϑa (λa, λb) should be allowed. More precisely, writing ca = cos 2 , sa = sin 2 , cb = ϑb ϑb cos 2 , sb = sin 2 and cϕ = cos ϕ, one should have s s ρ (~λ , ~λ ) = 0 if a b < s . (5.24) θ a b 1 c c c − a b ϕ

We therefore suggest the following research program, to prove the above conjec- ture for all states: find candidate functions ρθ(~λa, ~λb) that have the previous desired

7To prove the conjecture for θ 0, it is actually necessary to have a local part that depends on the state, contrary to our first→ proposal. Indeed, in the first order in θ (or s), the constraint E cE 1 c implies that E = E + o(θ) = a b + sa b cos χ + o(s). | Q − L| ≤ − L Q z z ⊥ ⊥ 36 properties (5.22–5.24), and then check whether the induced local probability distri- butions PL satisfy the constraints (5.14). If one can find such solutions, then this will prove thatp ¯L(θ) = cos 2θ indeed holds for all two-qubit pure states. On the other hand, if it turned out to be impossible to find such a function, then we might need to change our local model, and maybe relax the assumption that the non-local part should have random marginals.

Appendix A: Calculation of EL(~a,~b)

Here we calculate the correlation coefficient EL(~a,~b) for our local probability distribution PL:

dλ ′ EL(~a,~b) = sign(az ~a ~λ) sign(bz ~b ~λ) (5.25) 2 4π − · − · ZZS dλ ′ = 1 2[~a ~λ az] 1 2[~b ~λ bz] (5.26) S2 4π − · ≥ − · ≥ ZZ ³ ´ ³ ´ 1 ′ = az + bz 1 + dλ [~a ~λ az][~b ~λ bz] , (5.27) − π 2 · ≥ · ≥ ZZS where [ ] is the logical value of what is inside the brakets. The integral represents the area of the · intersection of two spherical caps centered around ~a and ~b′, and tangent to the north pole of the Bloch sphere. Let us parameterize ~λ S2 by its zenithal and azimuthal angles (ϑ, ϕ), where ϕ is defined (for ∈ simplicity) with respect to the vertical half-plane that contains ~a. As EL(~a,~b) should not depend on the sign of χ (the difference between the azimuthal angles of ~a and ~b′), it is sufficient to calculate it for χ 0, and simply replace χ by χ in the final expression. Also, we assume for now that ~a ≥ | | and ~b are both in the north hemisphere of the sphere. The two spherical caps can then be defined as π π ~λ ~a ~λ a = (ϑ, ϕ) ϕ [ , ] and ϑ [0, ϑA (ϕ)] (5.28) { | · ≥ z} { | ∈ − 2 2 ∈ m } π π ~λ ~b′ ~λ b = (ϑ, ϕ) ϕ [χ , χ + ] and ϑ [0, ϑB (ϕ)] (5.29) { | · ≥ z} { | ∈ − 2 2 ∈ m } with ϑA (ϕ), ϑB (ϕ) [0, π] such that m m ∈ a2 a2 cos2 ϕ b2 b2 cos2(ϕ χ) cos ϑA (ϕ) = z − ⊥ , cos ϑB (ϕ) = z − ⊥ − . (5.30) m a2 + a2 cos2 ϕ m b2 + b2 cos2(ϕ χ) z ⊥ z ⊥ − A B Let us define ϕ0 as the azimuthal angle for which ϑm(ϕ0) = ϑm(ϕ0). The integral in (5.27) can then be calculated as follows:

A B π/2 min(ϑm(ϕ),ϑm(ϕ)) ′ dλ [~a ~λ az][~b ~λ bz] = dϕ sin ϑdϑ (5.31) 2 · ≥ · ≥ ZZS Zχ−π/2 Z0 ϕ0 π/2 = dϕ 1 cos ϑB (ϕ) + dϕ 1 cos ϑA (ϕ) . (5.32) − m − m Zχ−π/2 Zϕ0 £ ¤ £ ¤ 2 2 2 az −a⊥ cos ϕ Using the antiderivative dϕ 2 2 2 = 2az arctan(az tan ϕ) ϕ, we find: az +a⊥ cos ϕ − R ′ dλ [~a ~λ az][~b ~λ bz] = 2π 2χ + 2az arctan(az tan ϕ0) πaz 2 · ≥ · ≥ − − ZZS +2b arctan(b tan(χ ϕ )) πb . (5.33) z z − 0 − z 37 A B We note that ϑm(ϕ0) = ϑm(ϕ0) implies azb⊥ cos(χ ϕ0) = a⊥bz cos ϕ0, which in turn implies a tan ϕ = a⊥bz −az b⊥ cos χ and b tan(χ ϕ ) = az b⊥−−a⊥bz cos χ . Inserting these values in (5.33), z 0 b⊥ sin χ z − 0 a⊥ sin χ then inserting the integral in (5.27) and writing χ instead of χ, we get the correlation coefficient: | | 2 χ 2 a b a b cos χ E (~a,~b) = 1 | | + a arctan( ⊥ z − z ⊥ ) L − π π z b sin χ ⊥ | | 2 a b a b cos χ + b arctan( z ⊥ − ⊥ z ) . (5.34) π z a sin χ ⊥ | | So far we have calculated this coefficient for settings in the north hemisphere of the Bloch sphere. If the settings are in the south hemisphere, one can use the fact that E (~a,~b) = E (~a, ~b) = L − L − EL( ~a,~b) = EL( ~a, ~b). One can check that the above expression is actually still valid for all −cases.− − − Note finally that in the above calculation, we didn’t pay attention to particular cases, when the denominators in the fractions would be zero. For χ = 0 or π, EL (as in eq (5.18)) can be obtained by taking the corresponding limit in the previous expression, or can be obtained directly in a much simpler way.

Appendix B: Allowed pairs (~λa, ~λb) in our last proposal

Here we will argue that in our last proposal with two different local variables ~λa and ~λb for Alice and Bob, not all pairs (~λa, ~λb) should be allowed. The argument is based on the following observation: suppose that Alice measures along direction ~a = (a⊥ cos ϕa, a⊥ sin ϕa, az), and finds the outcome α = +1; this projects Bob’s state onto

1+caz sa⊥ sa⊥ c+az +~a 1 ψ(θ) = ~b~a , with~b~a = ( cos ϕa, sin ϕa, ). If Bob then measures h |⊗ | i 2 | i 1+caz − 1+caz 1+caz the setting ~b~a, heq will necessarily get the result β = +1, and therefore P (+ ~a,~b ) = 0. (5.35) Q − | ~a This in turn implies, for the EPR2 decomposition P = p P + (1 p )P (with p = 0), that Q L L − L NL L 6 P (+ ~a,~b ) = 0. (5.36) L − | ~a

This constraint must be satisfied by any setting ~a (which defines the setting ~b~a). To ensure this, we shall not allow pairs (~λ , ~λ ) that may give the results (α = +1, β = 1), for some choice a b − of settings of the form (~a,~b~a).

To make this more explicit, let us fix the first local variable ~λa. For simplicity, we assume that ~λa is in the xz plane. If this is not the case, the analysis below would be slightly more tedious, but the final result would be the same. The settings ~a that give the result α(~a,~λ ) = +1 span the half-sphere above the bisector a A plane between ~z and ~λ ; see Figure 5.2 (left) for a 2D representation. can be defined as a A = ~a ~u ~a 0 , where ~u = ( c , 0, s ). (5.37) A { | · ≥ } − a a ~ (Let us recall the notations: (ϑa(b),ϕa(b)) are the spherical coordinates of λa(b), and we write c = cos ϑa , s = sin ϑa , c = cos ϑb , s = sin ϑb and c = cos(ϕ ϕ ).) a 2 a 2 b 2 b 2 ϕ b − a The settings ~b~a, corresponding to these settings ~a , then also span a spherical cap, , 8 (b~a)z −c ∈ A s(b~a)⊥ B included in . Using the fact that az = and a⊥ = , can in turn be defined as A 1−c(b~a)z 1−c(b~a)z B = ~b ~u ~a 0 = ~b ~v ~b cs , where ~v = (sc , 0, s ). (5.38) B { ~a| · ≥ } { | − · ≥ a} a − a 8 ′ Note: in particular, if ~λa is not assumed to be in the xz plane, one would have instead, where ′ is the reflection of with respect to the xz plane. B ⊂ A B B 38 Figure 5.2: Construction of the set Λb(~λa, c) of allowed local variables ~λb, given the first variable

~λa. Left: 2D cut in the vertical plane that contains ~λa. Right: 3D representation of Λb(~λa, c). For π both figures, ϑa = 3 , c = 0.5.

According to the above observation, the allowed local variables ~λb must be such that for all ~ ~ ~ ~ ~′ ~ those settings b~a in , β(b~a, λb) = 1, i.e., (λb ~z) b~a 0. This implies that λb ~z should be in B 6 − − · ≤ csa − a cone centered around ~v, and with a half-angle ξ = arcsin ||~v|| . This writes

~λ ~z ~v b − ~v cos ξ = s . (5.39) · ~λ ~z ≥ || || || b − ||

For the fixed ~λa considered here, the set of allowed local variables ~λb is then the intersection of this ~ 2 cone, translated by ~z, and the Bloch sphere; see Figure 5.2. Writing λb = (2cbsbcϕ, 2cbsbsϕ, 1 2sb ), the previous condition implies, that: − s s the pair (~λ , ~λ ) should be allowed only if a b s . (5.40) a b 1 c c c ≥ − a b ϕ This justifies the constraint (5.24).

Acknowledgements

The idea of our new EPR2 decomposition came up during a discussion with Nicolas Brunner, Nicolas Gisin and Valerio Scarani. I warmly thank them for the fruitful interactions that lead to the results presented in this chapter. I am also grateful to Jean-Daniel Bancal, Loren Coquille, Marc-Andr´eDupertuis and Alexandre Fˆetefor stimulating discussions and for their perseverance in testing many kinds of conceivable local models in our EPR2 problem.

39 Chapter 6

Quantifying multipartite non-locality

So far we have focused our interest onto the non-locality of bi-partite correlations only; this is indeed the simplest and most widely studied case. Moving on to a larger number of parties, the situation becomes more complex and even more in- triguing. Svetlichny [72] was the first one to highlight for instance the difference between arbitrary (fully non-local) multipartite correlations and correlations whose non-locality can be reduced to non-locality between pairs of parties only. He could show in particular that there exists n-partite entangled quantum states that exhibit fully multipartite non-locality, and whose correlations can be reproduced only if all parties are somehow connected (see also [73, 74, 75]). As the number of parties is increased, non-locality thus reveals a richer structure. In order to get a better understanding of the non-local characteristics of mul- tipartite correlations, we propose in this chapter a possible approach to quantify multipartite non-locality, based on communication models. This approach is quite different from the EPR2 approach to non-locality, presented in the previous chapter: it consists now in comparing the multipartite non-local correlations under study to the correlations that can be achieved with other non-local resources. The general idea here is to ask whether the correlations can be reproduced when some part- ners communicate their measurement input to others, and to estimate how much communication is needed [H]. More precisely, we shall look at two different communication schemes: either some parties are allowed to join together, so that m distinct groups are formed out of the n parties, and within each group the parties can freely collaborate; or a number k of parties broadcast their measurement input to all other parties. The maximal number m of groups and the minimal number k of broadcasting parties that allow for the reproduction of a given set of correlations quantify their multipartite nonlocal content. We shall compute the maximal value of the Mermin-Svetlichny (MS) [72, 76, 77] polynomials attainable by such communication models. From the violation of the different bounds we shall derive, one gets upper-bounds on m and lower-bounds on k. We will then apply our method to two families of quantum states: while n-partite

40 GHZ states reach the quantum maximal value of the MS polynomials, the values obtainable with the W states are found to be upper-bounded by a small constant for all n.

6.1 Definitions

We consider a Bell-type experiment involving n parties which can each perform one out of two measurements. The outcomes of these measurements are written aj and aj′ and can take the values 1. Letting M1 = a1, we define recursively the MS polynomials as ± 1 1 Mn = (an + an′ )Mn 1 + (an an′ )Mn′ 1 , (6.1) 2 − 2 − − 1 M ± = (Mn M ′ ) , (6.2) n √2 ± n where Mn′ is obtained from Mn by exchanging all primed and non-primed aj’s. We interpret these polynomials as sums of expectation values by identifying each term of the form a . . . a with the correlation coefficient a . . . a , which is the 1 n h 1 ni expectation value of the product of the outputs a1 . . . an. The above polynomials can thus be interpreted as Bell inequalities, whose local, quantum and algebraic bounds are known (see, e.g., [74]) or easily found to be Local: M 1 , M + √2 | n| ≤ | n | ≤ n−1 + n−1 Quantum: M 2 2 , M 2 2 (6.3) | n| ≤ | n | ≤ n + n−1 + 1 Algebraic: M 2⌊ 2 ⌋ , M 2⌊ 2 ⌋ 2 | n| ≤ | n | ≤ m In the following, we shall be interested in the polynomials Sn , defined as:

M for n m even Sm = n − (6.4) n M + for n m odd . ( n − 6.2 Quantifying multipartite non-locality through communication models

As mentioned before, we shall estimate bounds on the MS polynomials for two classical communication models, namely the grouping and the broadcasting models. In the two models, the n parties have access to shared randomness and are allowed to communicate their inputs to some subset of the other parties. Given the information available to them, each party then produces a local output. The two models depend on a parameter m (or k = n m) which quantifies the extent of multipartite non- locality. − Grouping: The n parties are grouped into m subsets. Within each group, the parties• are free to collaborate and communicate to each other, but are not allowed to do so between distinct groups.

41 Figure 6.1: The grouping (left) and the broadcasting (right) models for n = 4 parties. Grouping: Within each group, every party can communicate its input to any other party, as indicated by the arrows. a) If all parties join into one group (m = 1), they can achieve any correlation. b) and c) If they split into m = 2 groups they can realize some non-local correlations but not all; our tests do not distinguish between these two ways of forming 2 groups. d) If they are all separated (m = n), they can only reproduce local correlations. Broadcasting: The broadcasting parties communicate their input to all other parties (small arrows). e) Only one party broadcasts its input; the n parties can realize some non-local correlations but not all. f) If k = 3 = n 1 parties broadcast their input, they can also achieve any correlation (recall that− we restrict our analysis to correlation functions).

Broadcasting: Out of the n parties, k = n m of them can broadcast their input• to all other parties. The remaining m parties− cannot communicate their input to any other party. The two models are illustrated in Figure 6.1, for the case n = 4. In the measurement scenario that we consider in this work, restricted to correla- tion functions, a model with k = n m broadcasting parties is more powerful than a communication model with m disjoint− groups. Indeed, consider the grouping model; since in the correlation coefficients a1 . . . an it is only the product of all outputs that matters and not each output individually,h i we can assume that within each of the m groups, all parties send their input to one singled-out party, who can then produce the correct output for the entire group. The m parties thus singled-out (one for each group) do not need to send any input, but receive inputs from other parties. This situation clearly involves less communication than the broadcasting model. Yet, we find that the bounds on the MS expressions are identical for both models. Let us indeed state our main result:

42 Theorem. For both the grouping and the broadcasting models,

m (n m)/2 S 2 − . (6.5) | n | ≤ Moreover this bound is tight, i.e., for each model there exists a strategy that yields m (n m)/2 Sn = 2 − (in the case of the grouping model, this is true for any possible |grouping| of the n parties into m groups).

We refer to [H] for the proof. Note that a third model, the restrained-subset model, was also identified in [H]; this is the strongest model that satisfies the theo- rem. However, it is less natural than the two considered here. The fact that the same bounds hold for the two (or the three) models, and for any possible grouping of the n parties into m groups, is not trivial. Actually, it is possible to construct inequalities that distinguish between these models. It thus appears to be a special property of the MS expressions. Note also that the fact that the above bounds are tight for the two (or three) models implies that the bounds for any intermediary model, in which for instance two parties join to form a group and another one broadcasts its input, can be readily computed; in this case it would correspond to k = 2 or m = n 2. −

m (n m)/2 Suppose that one observes a violation of the inequality S 2 − . One can | n | ≤ then conclude that in order to reproduce the corresponding nonlocal correlations in the framework of our communication models, the n parties need to join together and form strictly fewer than m groups, or strictly more than k = n m parties must m − broadcast their input. Thus, the above bounds on Sn allow us to give a bound on the multipartite character of the observed nonlocal correlations (an upper bound on m, or a lower bound on k).

6.3 Multipartite non-locality of quantum states.

Here we discuss the violation of the inequalities (6.5) for n-partite GHZ-like and W states. Partially entangled GHZ states are defined as

GHZ = cos θ 00...0 + sin θ 11...1 . (6.6) | θi | i | i

It was conjectured in [78] that when the values of Mn exceed the local bounds, (n 1)/2 their maximal violations are given by 2 − sin 2θ (see FIG. 2 in [H]). Numerical + optimizations induce us to conjecture that the same holds for Mn . For maximally entangled GHZ states (θ = π/4), this is known to be the maximal violation allowed by quantum mechanics. Upon comparison with the bound (6.5), we conclude that all n-partite GHZ states with θ > π/8 are maximally non-local according to our criterion (i.e., all parties must be grouped together or n 1 parties must broadcast their input to reproduce their correlations). Less entangled− GHZ states, on the other hand, cannot be simulated if the parties are separated in more than m 1 groups − 43 or if fewer than k + 1 = n m + 1 parties broadcast their inputs whenever θ > θc with − m−1 sin 2θc = 2− 2 . (6.7)

Interestingly, θc is the same for all n. Consider now the W state 1 W = ( 10 ... 0 + 01 ... 0 + ... + 0 ... 01 ) . | ni √n | i | i | i Numerical optimizations suggest that the maximal values of the MS polynomials for these states are upper-bounded by a small constant for all n (see FIG. 3 in [H]). A semi-analytical argument [H] leads us to believe that the asymptotic maximal values of the MS polynomials are indeed

2 M 1.62, M + = 2 1.72 . (6.8) | ∞| ≃ | ∞| re ≃ n 1 + Since Sn− = Mn > 1 for n 3, letting one party broacast his input is not sufficient to reproduce the correlations≥ of the W state. However, we cannot reach the same conclusion for k = n m 2 broadcasting parties since the criterion (6.5) is not − ≥ violated in this case. Similarly, for the grouping model it is not sufficient that two parties join together (so that the n parties form n 1 groups) to simulate a W state, but we find no violation if they are separated in less− than n 1 groups. −

6.4 Conclusion

We have thus shown how one can quantify multipartite non-locality, by comparing quantum multipartite correlations to correlations that can be obtained in commu- nication models such as the grouping or the broadcasting scenarios. A series of tests to evaluate bounds on multipartite non-locality has been in- troduced. While GHZ states exhibit a strong form of multipartite non-locality ac- cording to our criterion, we have found that W states violate our inequalities only for small values of k, giving a small lower bound for its non-locality. As our ap- proach only gives bounds, it could be that other inequalities would be more adapted to estimate the non-locality of W states. Or, it might also be that there exists a communication model with only a few parties broadcasting their inputs or join- ing together, which is sufficient to reproduce the correlations of W states. Finding which one of these possibilities is the correct one is an interesting problem for future research. Finally, let us stress that the criterions we presented here can be tested exper- imentally. It would thus be worth (re-)considering experiments on multipartite non-locality in view of our results.

44 Chapter 7

Can one see entanglement ?

This is a tautology: quantum correlations appear in quantum systems. Now, the quantum world is often thought of as the world of the infinitely small, the invisible. A world that reasonably seems to be unaccessible to our direct experience. Is it really so ? Couldn’t we experience quantum correlations more directly than through the whole machinery usually involved in quantum experiments? Couldn’t we for instance replace man-made detectors in Bell-type experiments by human eyes, and see directly the entangled photon pairs? Interestingly, the answer to that intriguing question appears to be optimistic: the human eye is an extraordinary light-sensitive detector, and quantum optics experiments with human eye detectors seem indeed realistic! We could show first that the main characteristic of the human eye, namely a detection threshold, is no limitation to demonstrate entanglement [I]. We have then refined our analysis [J], and showed, more precisely, that naked human eyes could be used in Bell-type experiments to detect multi-photon states obtained by cloning single-photon qubits via simulated emission.

7.1 Threshold detectors can in principle detect entanglement

Studies on the photon detection characteristics of the human eye (see [79] and ref- erences therein) show that it is characterized by a threshold number of incident photons, below which no neural signal is sent to the brain. This is in contrast to standard man-made detectors, whose response to very low intensities is usually linear. The first question one might ask is whether this characteristics could be problematic with a view to demonstrating entanglement or non-locality. We thus considered in a preliminary theoretical study [I] the very simple toy model of a detector with a perfect threshold occurring at Nth photons: the detector does not detect fewer than Nth incoming photons, but it always clicks when at least Nth photons arrive. We could calculate the violation obtained for the CHSH Bell inequality [65], first when exactly N = Nth independent pairs of entangled photons arrive on the detectors. Surprisingly, although the probabilities of detection can

45 become very low, a violation of the Bell inequality can still be observed, without post-selection, for any value of the threshold Nth. However, the resistance to noise of the violation decreases when Nth gets larger.

Interestingly, when more than exactly Nth are sent to the detectors, or even when the number of photons follow a poissonian distribution, non-locality (and therefore entanglement) can still be demonstrated with perfect threshold detectors, without any further assumption.

Of course, the response function of the eye is not a perfect step function, with a perfect threshold at Nth photons, but is a typical S-shaped curve rather. We have found that, for smooth thresholds, the demonstration of quantum non-locality in the strict sense is compromised. It is still possible however to demonstrate entanglement with N independent pairs in the same state, by performing post-selection. We refer to [I] for a detailed discussion.

It is interesting at this point to establish a link with the study presented in [K]. In that paper, the violation of the CHSH inequality was studied in multi- pair scenarios, for both independent and indistinguishable pairs, and for different detection schemes, by invoking voting strategies (e.g., majority, 3/4 or unanimous votes). This is closely related to the threshold detection scheme considered here: for instance, if N = Nth as in the first case above, the threshold detection corresponds to an unanimous vote. Let us just mention that the study of [K] provides an interesting insight into the complex relation between entanglement and non-locality. In particular, although independent pairs contain less entanglement than indistinguishable photons (for the same number of photon pairs), they allow a larger violation of CHSH, and the violation is more resistant to noise. In this sense, independent pairs are more non- local than indistinguishable photons.

7.2 Human eye detectors can detect and distin- guish clones obtained via stimulated emission

While the previous preliminary study allows one to conclude that entanglement can in principle be demonstrated with threshold detectors, an important project is now to estimate the practical feasibility of an experiment with human eye detectors, and to suggest possible ways to conceive such an experiment. This is not trivial: for instance, the above approach with large numbers of independent entangled photon pairs does actually not allow a Bell inequality violation when the realistic response function of the eye is considered. Inspired by a recent experiment [80], we chose to focus on a micro-macro situation, where one photon from an original entangled pair is detected directly, whereas the other one is greatly amplified via stimulated emission [J]. Considering qubits realized by the polarization states of single photons in a spatial mode a, a phase-covariant cloner can be realized based on stimulated collinear type- II parametric down-conversion process [81], characterized by a Hamiltonian of the

46 form H = iχaH† aV† + h.c.. Identifying the horizontal and vertical polarization modes aH and aV with the north and south poles of the Bloch sphere, one can introduce a 1 iφ basis of equatorial modes aφ and aφ via the relations aH = e (aφ + iaφ ), aV = ⊥ √2 ⊥ 1 iφ iχ 2 2 e− (aφ iaφ ), so that H = (aφ† + aφ† ) + h.c.; H has the same form for any √2 ⊥ 2 choice of equatorial− basis. For compactness⊥ of notation, we suppose that a choice of basis has been made, and we denote by a and a the corresponding equatorial ⊥ iHt modes. The time evolution operator for the cloning process is e− = UU with g † 2 2 ⊥ 2 (a(⊥) a(⊥)) U( ) = e − , where we have defined the amplification gain g = χt, with t the ⊥ interaction time for the down conversion process.

7.2.1 Distinguishing the amplified single-photon qubits

First, we notice that the multi-photon states thus obtained by cloning single-photon qubits can be distinguished with the naked human eye with high efficiency and fidelity. Consider the two orthogonal single-photon qubit states a† 0, 0 = 1, 0 and | i | i a† 0, 0 = 0, 1 . After the amplification, the qubit states become ⊥| i | i

Φ = UU 1, 0 = A1 A0 and Φ = UU 0, 1 = A0 A1 (7.1) | i ⊥| i | i| i⊥ | ⊥i ⊥| i | i| i⊥ where we have introduced the notation Aj ( ) = U( ) j for j = 0, 1. One can | i ⊥ ⊥ | i show that U †a†U = cosh(g) a† + sinh(g) a, which allows one to calculate the mean 2 photon numbers in the two states A0 and A1 , A0 a†a A0 = sinh (g), and 2 | i | i h | | i A1 a†a A1 = 3 sinh (g) + 1. For large g, stimulating the down-conversion process hwith| a| singlei photon thus leads to an approximate tripling of the output photon number, compared to a vaccuum input. Our proposal for distinguishing the two states Φ and Φ with human-eye ⊥ detectors is precisely based on this difference in typical| i photon| numbersi in the states A and A , together with the fact that the eye is a (smooth) threshold detector. | 0i | 1i Indeed, the amplification gain g can be adjusted so that A1 will be detected with high probability (i.e., it is “above the threshold”), whereas| Ai will not (it is “below | 0i the threshold”). Separating the two modes a and a and directing each of them to ⊥ one eye, Φ will mostly give rise to detections in one eye, whereas Φ will mostly ⊥ give rise| toi detections in the other eye. | i This distinction of the two states is not perfect, however. There will be events where both eyes detect something, where none of the eyes sees anything, or even where only the “wrong” eye responds. Using the notation p(X, ∅ Φ) for the prob- ability of a detection (X) in mode a and no detection (∅) in mode| a , given the ⊥ state Φ , and analogously for the other cases, the probability for a conclusive event | i (i.e., a detection in only one eye) is

ǫ = p(X, ∅ Φ) + p(∅, X Φ) = p(∅, X Φ ) + p(X, ∅ Φ ) , (7.2) | | | ⊥ | ⊥ and the accuracy of the measurement can be quantified by the visibility V , defined as p(X, ∅ Φ) p(∅, X Φ) p(∅, X Φ ) p(X, ∅ Φ ) V = | − | = | ⊥ − | ⊥ . (7.3) p(X, ∅ Φ) + p(∅, X Φ) p(∅, X Φ ) + p(X, ∅ Φ ) | | | ⊥ | ⊥ 47 Figure 7.1: Efficiency ǫ and visibility V of the human-eye detection method for amplified single-photon qubits, as a function of the total mean photon number Na after amplification (thick lines). The visibility never drops below 1 (horizontalh i √2 line), which is significant for Bell experiments in the micro-macro scenario. ǫ and V are also shown for the case of additional losses after the amplification (thin, resp. dashed, lines: 50%, resp. 75%, of additional losses).

We refer to [J] for the calculation of the probabilities p(X, ∅ Φ) etc., based on the realistic model of the eye as an ideal threshold detector preceded| by significant losses. One can then calculate the efficiency ǫ and the visibility V , as a function of the gain g, or of the total mean photon number in both modes after amplification, 2 Na = 4 sinh (g) + 1. h i The results are shown in Figure 7.1. One sees that ǫ has a maximum for ca. 300 photons. Despite a dip in the region of high efficiency, V is always greater than 1 , √2 an important bound for Bell-type experiments. The states Φ and Φ can thus ⊥ be distinguished with high efficiency and accuracy at the same| time.i Figure| i 7.1 also shows the effect of losses after the amplification process (in addition to the losses in the eye); one sees that the effect of losses can be completely compensated by increasing the gain.

7.2.2 Bell-type experiment in the micro-macro scenario

Let us come back to the micro-macro scenario, depicted in Figure 7.2, where one photon (in spatial mode b) of a polarization-entangled singlet state is detected directly by standard single-photon detectors, while the other photon (in spatial mode a) is greatly amplified with the phase-covariant cloning process described above, leading to the micro-macro entangled state 1 Ψ− = ( Φ a 0, 1 b Φ a 1, 0 b) . (7.4) | i √2 | i | i − | ⊥i | i

Measurements in two different equatorial bases for both modes a and b are suf- ficient for testing the CHSH Bell inequality. The capability of the human eye to

48 Figure 7.2: Bell-type experiment in the micro-macro scenario, with human-eye de- tectors for the macro system. distinguish the two states Φ and Φ , in any equatorial basis, with high visibil- ⊥ ity V > 1 implies the possibility| i of| observingi a violation of the CHSH inequality √2 with the same visibility (provided the detection of the unamplified photon does not introduce additional errors). The robustness of the visibility with respect to losses means that a strong Bell inequality violation could be achieved for arbitrarily high losses, provided that the amplification is sufficiently strong. This is paradoxical at first sight, since informa- tion about the macro-state ( Φ or Φ ) leaks into the environment: the remaining ⊥ micro-macro entanglement must| i be| quitei small. So how can the visibility of the Bell violation remain so high? This apparent paradox can be resolved by realizing that the detection method, despite its quite good efficiency, is nevertheless post-selective. Moreover, in the presence of loss the macro-system does no longer live in the two-dimensional Hilbert space spanned by Φ and Φ , but in a much larger space. These two facts open up | i | ⊥i an important loophole: conclusive results for different equatorial bases correspond to different, almost orthogonal, subspaces of the high-dimensional Hilbert space. The experimental observation of a CHSH inequality violation therefore allows no conclusion about the existence of micro-macro entanglement1. Nevertheless, the same measurements do allow one to prove the entanglement of the original entangled pair before amplification. From this perspective, the am- plification and losses can be simply seen as part of the detection process for the original single photon, whose Hilbert space is only two-dimensional. Moreover, the detection efficiency is independent of the choice of equatorial basis thanks to the phase covariance of the amplification. For proving non-locality (as opposed to just entanglement), there is still the usual detection loophole due to the limited mea- surement efficiency, but it is no more severe than for any other detection method that has comparable efficiency. Let us note that the detection scheme proposed here is different from conventional photon detection in one interesting way: the choice of detection basis can be made after the amplification process, while in standard detection processes the amplification only occurs after the choice of basis.

Coming back to the micro-macro system, we have derived in [J] a criterion, which shows that genuine micro-macro entanglement actually persists even for high losses. However, as expected, this criterion is now quite sensitive to photon loss, and it

1One can even find separable multi-photon states that exploit this loophole to achieve the same visibility as in Figure 7.1, see footnote [17] in [J].

49 would require counting large photon numbers with single-photon accuracy to be experimentally tested. We are not aware of a way of demonstrating genuine micro- macro entanglement in the presence of losses with human eye detectors.

7.3 Prospects

More work is still to be done before really setting up a quantum optics experiment with human eyes as detectors: quantum amplifiers that operate at visible wave- lengths need to be developed, pulse durations that are adapted to the timescales of the human eye will be required, etc. Nonetheless, our study shows that quantum experiments with human-eye detec- tors appear possible. We have focused here on a micro-macro entanglement scenario, but human eyes could also possibly replace other standard detectors in various ex- periments, such as bunching of amplified single photons, macro-macro experiments, and so on. This might not lead to a better understanding of fundamental concepts such as quantum non-locality, but it would certainly be a fascinating way to bring the quantum world closer to our direct perception!

50 Outlook

We have presented in this thesis a survey of some practical and more fundamental issues concerning quantum correlations. These are in particular the core of quantum cryptography (Chapters 1 and 2), a technology that is undergoing a rapid and very dynamic development in recent years. The nature of quantum correlations is becoming better understood as people continue to study their intriguing features (Chapters 3 to 6), and they might become more directly accessible to our perception if one can indeed set up quantum optics experiments in which human eyes would be used as photon detectors (Chapter 7).

While the 20th century was marked by the discovery of quantum physics, of the fascinating features of quantum correlations, and of the first ideas on how to make use of them, the 21st century might well be the time for quantum correlations to become more familiar and even enter our everyday life. Quantum correlations still possess many mysteries to study and discover, but enough is already known to really start taming the quantum world!

51 52 Deuxi`emepartie

Version fran¸caise

53 54 Introduction

L’histoire de l’av`enement de la m´ecaniquequantique est particuli`erement int´eres- sante. Les d´ebatspassionn´esqui ont oppos´eles plus grands physiciens du d´ebutdu xxe si`ecleont contribu´e`aconstruire une ´el´egante th´eorie,au pouvoir de pr´ediction incontest´e.N´eanmoins,la th´eoriequi ´emergeacontenait de tels aspects contre- intuitifs qu’elle ne pouvait satisfaire tout le monde.

Une action fantˆome `adistance ?

Dans leur c´el`ebrearticle de 1935 [1], Einstein, Podolsky et Rosen (EPR) ont en ef- fet montr´eque la m´ecaniquequantique pr´edisaitl’existence de tr`esfortes corr´elations entre des parties distinctes et s´epar´eesd’un syst`emephysique : en mesurant une partie du syst`eme,on pouvait instantan´ement attribuer `ala deuxi`emepartie de nouvelles propri´et´esbien d´efinies; des propri´et´esqui, d’apr`esla th´eoriequantique, n’existaient pas a priori. Ces corr´elations,dues `ace que Schr¨odingern’allait pas tarder `aappeler entanglement [2] ou Verschr¨ankung (en fran¸cais: intrication) entre les deux sous-syst`emes,semblaient donc impliquer une certaine action fantˆome`a distance ; le p`erede la relativit´eg´en´eraleet ses co-auteurs consid´eraient cela comme inacceptable. Ils conclurent que, si la m´ecaniquequantique se devait de respecter les principes de localit´eet de s´eparabilit´e,alors elle ´etaitforc´ement incompl`ete. Le d´ebatautour de l’incompl´etudede la th´eoriequantique relevait alors du do- maine de la m´etaphysique, et la plupart des physiciens se sont content´es`al’´epoque de la r´eponse de Bohr et de l’interpr´etationde Copenhague de la m´ecaniquequan- tique, pour lesquels l’argument d’Einstein ne posait pas r´eellement de probl`eme.Il y avait alors des questions bien plus importantes `aconsid´erer,et tr`espeu de personnes ont partag´eles pr´eoccupations d’Einstein. Il fallut attendre 30 ans avant que Bell ne montre, avec son fameux th´eor`eme[3], qu’il y avait une incompatibilit´eentre les pr´edictionsquantiques et les pr´edictionsde th´eorieslocales alternatives, qui compl`eteraient d’une certaine mani`erela m´ecanique quantique. Les corr´elationspouvant s’expliquer par des variables cach´eeslocales doivent en effet satisfaire ce que l’on appelle des in´egalit´esde Bell : sous l’hypoth`ese de localit´ede Bell, une certaine quantit´emesurable I ne peut d´epasserla borne locale I : I I . Les corr´elationsquantiques peuvent par contre violer cette in´egalit´e, L ≤ L et atteindre une valeur IQ > IL. Cette d´ecouverte extraordinaire de Bell a per- mis de changer la controverse m´etaphysique en ce que Shimony appellerait de la m´etaphysiqueexp´erimentale [4] : on pouvait alors imaginer des exp´eriencespour confronter la m´ecaniquequantique aux th´eories`avariables cach´eeslocales.

55 Une vingtaine d’ann´eesd’efforts ont encore ´et´en´ecessaires,avant la r´ealisation d’une exp´eriencesuffisamment convaincante par Aspect et ses coll`egues[5], dont la conclusion ´etaiten faveur de la m´ecaniquequantique : ils ont en effet observ´ela violation d’une in´egalit´ede Bell (`aquelques ´echappatoires encore possibles pr`es),ce qui a permis de conclure que la th´eoriequantique ne pouvait ˆetrecompl´et´eede la mani`eresouhait´eepar Einstein.

Les corr´elationsquantiques vues comme une ressource

L’histoire aurait pu s’arrˆeterl`a.La r´ealit´edes ph´enom`enesd’intrication et de non-localit´eavait ´et´eprouv´ee,mais cela ne restait jusque-l`aqu’une curiosit´ede laboratoire. Or, au d´ebutdes ann´ees1990, il a ´et´er´ealis´eque l’intrication pouvait avoir tout un champ d’applications pratiques. Ekert a en effet red´ecouvert, et apport´e un nouveau point de vue sur la cryptographie quantique (invent´eequelques ann´ees auparavant par Bennett et Brassard [6]), en r´ealisant que la non-localit´epouvait ˆetre exploit´eepour distribuer une cl´esecr`eteentre deux partenaires se tenant `adistance l’un de l’autre [7] : la s´ecurit´ede la cl´epeut ˆetreassur´eepar la violation d’une in´egalit´ede Bell. Il a ensuite ´et´emontr´eque l’intrication permet la t´el´eportation quantique [8], et peut pr´esenter de nets avantages pour r´esoudrede mani`ereefficace certains probl`emescomputationnels [9]. Ce nouveau regard port´esur l’intrication, d´esormaisconsid´er´eecomme une res- source utile pour les communications et le traitement de l’information, a relanc´e l’´etudedes corr´elationsquantiques et de la non-localit´eelle-mˆeme,qui est deve- nue `apart enti`ereun champ de recherche tr`esdynamique. La phrase de Bell “les corr´elationsr´eclamentdes explications” [10] est d’autant plus pertinente aujour- d’hui !

Contenu de cette th`ese

La th`esepr´esent´eeici participe de la d´emarche scientifique entam´eeces 25 der- ni`eresann´ees,en s’int´eressant `adiff´erents aspects des corr´elationsquantiques. On commence par des ´etudesen cryptographie quantique, qui mettent en ´evidenceles applications pratiques que celles-ci peuvent avoir (Chapitre 8). Ceci nous motive `a chercher `aobtenir une meilleure compr´ehensionde ces corr´elations.Nous sommes ainsi pouss´es`anous poser des questions plus fondamentales sur leur nature et sur les explications possibles que l’on peut donner `aleur non-localit´e(Chapitre 9), ainsi que sur la mani`erede quantifier cette non-localit´e(Chapitre 10). Finalement, nous nous interrogeons sur la possibilit´epour l’homme de percevoir plus “directement” ces corr´elations,`al’œil nu (Chapitre 11). Le but constamment poursuivi est de nous familiariser avec les aspects souvent contre-intuitifs mais d’autant plus fascinants du monde quantique.

Nous pr´esentons dans cette courte version en fran¸caisun aper¸cutr`essynth´etique des sujets abord´esau cours de cette th`ese.Le lecteur qui souhaiterait avoir davantage de d´etailsest invit´e`aconsulter la version anglaise, plus compl`ete,ou directement les

56 publications dont les r´esultatspr´esent´esici ont fait l’objet, et qui sont rassembl´ees `ala fin de ce manuscrit.

57 Chapitre 8

Les correlations quantiques au cœur de la Distribution Quantique de Cl´e

L’id´eeg´en´eralede la cryptographie quantique est de tirer profit des lois de la physique quantique pour assurer la s´ecurit´ede protocoles cryptographiques. Dans le cas de la Distribution Quantique de Cl´e(QKD : Quantum Key Distribution) plus particuli`erement, des corr´elationsquantiques sont distribu´eesentre deux partenaires, Alice et Bob, `apartir desquelles ils vont chercher `aextraire une cl´esecr`ete (c.-`a-d. une suite al´eatoirede bits). Le premier protocole de QKD a ´et´einvent´epar Bennett et Brassard en 1984 [6], et proposait qu’Alice envoie des syst`emesquantiques (des bits quantiques, ou qubits) codant des bits classiques, que Bob mesure d`esqu’il les re¸coit.Quelques ann´eesplus tard, Ekert a red´ecouvert la QKD en r´ealisant que l’intrication pouvait ˆetreutilis´ee pour distribuer des cl´essecr`etes[7] : il a propos´eun protocole bas´esur le partage d’une paire de qubits intriqu´esentre Alice et Bob, et dont la s´ecurit´erepose sur la violation d’une in´egalit´ede Bell. La proposition d’Ekert met bien en ´evidencele rˆole des corr´elationsquantiques au cœur de la QKD.

Nous avons pu illustrer ce rˆoleessentiel des corr´elationsquantiques au travers de diff´erentes ´etudesen cryptographie quantique. Dans un premier temps, nous nous sommes int´eress´es`ades protocoles standards de QKD [A,B], en particulier les protocoles BB84 et SARG [19, 20]. Leur s´ecurit´ea ´et´e´etudi´eeface `ades attaques agissant sur chaque qubit individuellement, de mˆemeque face `ades attaques tout `a fait g´en´erales; et nous avons consid´er´ediff´erentes impl´ementations de ces protocoles, `abase de photons uniques ou de pulses lasers att´enu´es.Dans les deux protocoles mentionn´es,les mˆemes´etatsquantiques sont envoy´esd’Alice `aBob, qui proc`ede aux mˆemesmesures. Par contre, la fa¸condont les bits classiques sont encod´esest diff´erente. Il est int´eressant de voir qu’une fois les corr´elationsquantiques ´etablies, diff´erentes fa¸consde les exploiter peuvent mener `ades protocoles aux performances vari´ees.

Nous nous sommes ´egalement int´eress´es`aun nouveau type de protocole, le

58 Coherent-One-Way protocol (COW) [46, 47], dont nous avons ´etudi´ela s´ecurit´e face `aun certain nombre d’attaques sp´ecifiques[C,D]. Du fait des taux de cl´eob- tenus, ce protocole semble particuli`erement prometteur pour la QKD rapide et `a longue distance. Par contre, sa s´ecurit´eface aux attaques les plus g´en´eralesreste `a prouver, puisque les m´ethodes standard permettant d’aborder ce genre de probl`eme ne peuvent s’appliquer directement `ace type de protocole, `ar´ef´erencede phase distribu´ee.

59 Chapitre 9

Des mod`elesalternatifs de corr´elations non-locales

La th´eoriequantique pr´editque la nature peut produire des corr´elationsnon- locales, c’est-`a-direqui violent des in´egalit´esde Bell [3]. Cette caract´eristiquefas- cinante a ´et´elargement observ´ee,dans de nombreuses exp´eriences[54]. Mais, si le formalisme quantique fournit des r`eglespr´ecisespour calculer ces corr´elations,il n’explique cependant en rien comment celles-ci apparaissent, ni d’o`uelles viennent. Pour se faire une id´eede ce qui est essentiel dans les corr´elationsquantiques, il est int´eressant de chercher des mod`elesalternatifs de corr´elationsnon-locales, qui, soit reproduisent pr´ecis´ement les corr´elationsquantiques, soit s’av`erent ˆetre incompatibles avec les pr´edictionsquantiques.

Dans cette perspective, nous avons tout d’abord consid´er´e[E,F] un mod`elepro- pos´epar Leggett en 2003 [11], et qui est justement en conflit avec la m´ecanique quantique. L’hypoth`esefaite par Leggett est que localement, les deux particules d’une paire intriqu´eer´eagissent aux mesures auxquelles elles sont soumises comme si elles ´etaient dans un ´etatbien d´efini.La non-localit´ene peut alors s’exprimer que dans la corr´elationentre les r´esultatsdes mesures sur chacune des particules. Nous avons propos´eune nouvelle approche permettant de montrer de mani`erepar- ticuli`erement simple l’incompatibilit´ede ce mod`eleavec les pr´edictionsquantiques, et qui nous a permis de d´eterminerde nouvelles in´egalit´esde Leggett (des in´egalit´es satisfaites par les corr´elationsdu mod`elede Leggett, mais pouvant ˆetreviol´eespar la m´ecaniquequantique). Il restait `atester exp´erimentalement ces in´egalit´es: nous avons effectivement pu observer une violation, et donc conclure `aune r´efutationdu mod`elede Leggett. Nous nous sommes ensuite int´eress´es`ag´en´eraliserle mod`elede Leggett. Nous sommes arriv´es`ala conclusion que tout mod`elenon-local satisfaisant la contrainte de no-signaling (c.-`a-d.ne permettant pas de communication entre Alice et Bob) doit n´ecessairement pr´ediredes ´ev`enements compl`etement al´eatoiresau niveau local pour ˆetrecompatible avec la m´ecaniquequantique. La nature est vraiment faite de telle sorte, que dans certains cas les propri´et´esindividuelles sont inexistantes, alors que les propri´et´esglobales sont parfaitement d´efinies.

60 Une deuxi`emeexplication possible pour l’observation de corr´elationsnon-locales est qu’elles seraient dues `aune hypoth´etique action fantˆome`adistance, qui se propa- gerait plus rapidement que la lumi`ere,mais n´eanmoins`avitesse finie. Cette vitesse devrait ˆetred´efiniedans un r´ef´erentiel d´etermin´e; si, dans ce r´ef´erentiel, les me- sures sur les deux syst`emesconsid´er´esdans une exp´eriencede Bell sont r´ealis´ees simultan´ement, alors l’action fantˆomen’aurait pas le temps de se propager de l’un `al’autre, et les corr´elationsdevraient disparaˆıtre. Cette id´eepeut ˆetretest´eeexp´erimentalement [62],[G]. Pour cela, un test de Bell a ´et´eeffectu´edurant plus de 24 heures entre deux villages dans la campagne genevoise, distants de 18 km l’un de l’autre et orient´esapproximativement Est-Ouest, avec la source pr´ecis´ement au milieu. Des interf´erences`adeux photons ont ´et´eobserv´eesde mani`erecontinue, avec une visibilit´esuffisante pour violer une in´egalit´ede Bell. Avec la rotation de la Terre, la configuration de l’exp´eriencea permis de d´eterminer,pour tout r´ef´erentiel, une borne inf´erieurepour la vitesse de cette hypoth´etiqueaction fantˆome.Par exemple, pour un r´ef´erentiel dans lequel la Terre se d´eplacerait`aune 3 vitesse inf´erieure`a10− fois celle de la lumi`ere,la vitesse de cette action fantˆome devrait d´epassercelle de la lumi`ered’au moins 4 ordres de grandeur ! Ces r´esultatsnous poussent `acroire que les corr´elationsobserv´eessont r´eellement et fondamentalement non-locales, et qu’elles ne peuvent en r´ealit´epas s’expliquer par une telle action fantˆomese propageant `avitesse supraluminique mais finie. Les corr´elationsquantiques semblent en quelque sorte provenir d’en-dehors de l’espace- temps.

61 Chapitre 10

Quantifier la non-localit´e

La non-localit´es’av´erant ˆetreune caract´eristiquefondamentale des corr´elations quantiques, il est int´eressant de pouvoir la quantifier. Nous avons abord´edeux ap- proches pour cela, l’une concernant la non-localit´ede corr´elationsbi-partites, la deuxi`emetraitant de la non-localit´emulti-partite.

La premi`ereapproche est due `aElitzur, Popescu et Rohrlich [12] (EPR2). Elle repose sur le fait qu’exp´erimentalement, la violation d’une in´egalit´ede Bell est cal- cul´ee`apartir des statistiques de mesures sur des paires de particules intriqu´ees: or, ce n’est pas parce qu’on observe de la non-localit´eau niveau statistique que toutes les paires de particules se sont n´ecessairement comport´eesde mani`erenon-locale. Elitzur, Popescu et Rohrlich se sont donc demand´ess’il ´etaitpossible qu’une frac- tion seulement de paires intriqu´eesait fait preuve de non-localit´e,les autres paires s’´etant comport´eesde mani`erelocale.

Plus formellement, en notant PQ la distribution conditionnelle de probabilit´edes r´esultatsde mesures pr´editepar la m´ecaniquequantique, on se pose la question de savoir si on peut la d´ecomposer comme une somme convexe d’une distribution locale, PL, et d’une distribution non-locale, PNL (´eventuellement davantage non-locale que ce que la m´ecaniquequantique permet), sous la forme P = p P + (1 p )P , avec p [0, 1]. (10.1) Q L L − L NL L ∈ Le poids maximalp ¯L = max pL que l’on puisse attribuer `ala partie locale quantifie ainsi le contenu local de PQ. Nous nous sommes concentr´essur le cas de la distribution de probabilit´eobtenue en effectuant des mesures de Von Neumann sur des ´etatspurs de deux qubits, de la forme ψ = cos θ 00 + sin θ 11 , avec θ [0, π ]. Pour ce cas, on savait d´ej`a | i | i | i ∈ 4 que 1 sin 2θ p¯L(θ) cos 2θ [66], et il avait ´et´econjectur´equ’il devait exister une d´ecomposition− ≤ EPR2≤ avec un poids local de cos 2θ, et donc que pr´ecis´ement p¯L(θ) = cos 2θ. Nous avons pu trouver une telle d´ecomposition pour toute une gamme d’´etats (pr´ecis´ement, les ´etatstels que cos 2θ 0.8). Cela prouve en partie la conjecture ≤ ´enonc´eeci-dessus, et nous renforce dans l’id´eequ’elle doit en effet ˆetrevraie pour tous les ´etatsconsid´er´es.Il nous faudrait arriver `ag´en´eralisernotre d´ecomposition pour pouvoir la justifier en toute g´en´eralit´e.

62 Nous nous sommes ´egalement int´eress´es`ala non-localit´emulti-partite, et avons propos´eune toute autre approche pour la quantifier [H]. Le principe ici est de compa- rer les corr´elationsquantiques entre n parties aux corr´elationsque l’on peut obtenir dans le cadre de mod`elesautorisant de la communication entre les parties. La quan- tit´eminimale de communication n´ecessaire`areproduire les corr´elationsquantiques quantifie alors leur non-localit´e. Plus pr´ecis´ement, nous avons consid´er´edeux types de mod`elesde communication. Dans le premier, certaines parties sont autoris´ees`ase regrouper, de sorte `aformer au total m groupes distincts. Au sein d’un mˆemegroupe, les parties peuvent collaborer en toute libert´e.Par contre, elles ne peuvent pas communiquer entre deux groupes diff´erents. Dans le second mod`ele,un certain nombre k de parties sont autoris´ees`a d´evoiler la mesure `alaquelle elles sont soumises `atoutes les autres parties. Nous avons calcul´eles valeurs maximales que peuvent atteindre les polynˆomesde Mermin-Svetlichny (MS) [72, 76, 77] dans le cadre de ces mod`elesde communication. Nous en d´eduisonsune s´eriede tests permettant de d´eterminerdes bornes sur la non-localit´edes corr´elationsmulti-partites : si les corr´elationsconsid´er´eesviolent une borne correspondant par exemple `aun mod`eleo`u k parties d´evoilent leur mesure, on sait alors que ces corr´elationsne peuvent ˆetrereproduites qu’`ala condition que strictement plus que k parties annoncent leur mesure. En appliquant nos crit`eresaux ´etats n-partites de type GHZ et W, nous avons montr´eque les ´etatsGHZ ´etaient maximalement non-locaux, tandis que la valeur des polynˆomesMS atteignable avec les ´etatsW ´etaitborn´ee,pour tout n, par une valeur constante relativement faible.

63 Chapitre 11

Voir l’intrication

C’est une tautologie : les corr´elationsquantiques apparaissent dans les syst`emes quantiques. Or, le monde quantique est souvent per¸cucomme le monde de l’in- finiment petit, de l’invisible. Un monde qui semble a priori inaccessible `anotre perception directe. Mais en est-il vraiment ainsi ? Ne serait-il pas envisageable d’observer les corr´ela- tions quantiques de mani`ereplus directe qu’`atravers tous les appareillages utilis´es dans les exp´eriencesusuelles ? Ne pourrait-on pas par exemple remplacer dans des exp´eriencesde Bell les d´etecteursstandard par des yeux humains, et ainsi voir plus directement les paires de photons intriqu´es?

Les ´etudessur les performances de l’œil montrent qu’il est un d´etecteurde photons particuli`erement efficace, caract´eris´epar un seuil de d´etection,c’est-`a-direun certain nombre de photons en-dessous duquel aucun signal neural n’est envoy´eau cerveau. Ceci contraste avec le cas des d´etecteursg´en´eralement utilis´esdans les exp´eriences d’optique quantique qui ont typiquement, aux faibles intensit´es,une r´eponse lin´eaire en termes d’efficacit´ede d´etection. Nous nous sommes dans un premier temps demand´essi ce seuil de d´etection risquait d’ˆetreun obstacle fondamental qui empˆecherait de r´ealiserdes exp´eriencesde Bell [I]. La r´eponse a ´et´en´egative : il est apparu en consid´erant le cas d’un d´etecteur `aseuil id´eal,que l’intrication et la non-localit´epouvait en effet ˆetred´emontr´es,et ce mˆemeavec des taux de d´etectiontr`esfaibles. En raffinant l’analyse [J], et en consid´erant non pas un seuil parfait mais une fonction de r´eponse r´ealistepour l’œil (une typique courbe en S), nous avons pu montrer qu’il ´etaitpossible de distinguer `al’œil nu, avec une bonne efficacit´eet une bonne visibilit´e(toujours sup´erieure`a1/√2), des ´etatsmulti-photons obtenus en amplifiant un photon unique par un processus de clonage bas´esur l’´emission stimul´ee.Cela permet d’envisager des exp´eriencesde Bell de type micro-macro, dans lesquelles l’un des photons issus d’une paire intriqu´eeserait d´etect´ede mani`ere standard, tandis que le deuxi`emeserait amplifi´epour ˆetred´etect´e`al’œil nu ; la visibilit´epourrait ˆetresuffisante pour violer une in´egalit´ede Bell, ce qui permettrait de prouver l’intrication entre les deux photons de la paire initiale. Notons une particularit´eint´eressante de la m´ethode de d´etectionpropos´ee:

64 contrairement aux processus de d´etectionplus conventionnels, notre m´ethode per- met de choisir la direction de mesure apr`es l’amplification du photon observ´e.

Il y a encore beaucoup `afaire avant de v´eritablement r´ealiserune exp´erienced’op- tique quantique avec des yeux humains en guise de d´etecteursde photons : il faudra pour cela d´evelopper des amplificateurs qui op`erent aux longueurs d’ondes visibles, pouvoir g´en´ererdes pulses dont la dur´eesoit adapt´eeaux temps caract´eristiquesde l’œil, etc. N´eanmoins,notre ´etudemontre que de telles exp´eriencessemblent envisageables. Il serait fascinant de pouvoir ainsi rapprocher le monde quantique de notre percep- tion directe !

65 Perspectives

Nous avons pr´esent´edans cette th`eseune ´etudede certaines questions pratiques ou plus fondamentales portant sur les corr´elationsquantiques. Celles-ci sont au cœur de la cryptographie quantique, une technologie au d´eveloppement rapide et parti- culi`erement dynamique ces derni`eresann´ees.La nature des corr´elationsquantiques est de mieux en mieux comprise `amesure que sont ´etudi´esleurs aspects si contre- intuitifs a priori. Elles pourraient mˆemedevenir plus accessibles `anotre perception directe si l’on parvenait, comme propos´e,`ar´ealiserdes exp´eriencesd’optique quan- tique dans lesquelles les photons seraient d´etect´es`al’œil nu.

Alors que le xxe si`eclea ´et´emarqu´epar la d´ecouverte de la physique quantique, des caract´eristiquesfascinantes des corr´elationsquantiques, et de leurs possibilit´es d’exploitation, le xxie si`eclepourrait bien ˆetrecelui au cours duquel celles-ci nous sembleront de plus en plus famili`ereset pourraient entrer dans notre vie quotidienne. Les corr´elationsquantiques restent pleines de myst`eres`a´elucider,mais on en sait d´ej`asuffisamment pour commencer `av´eritablement apprivoiser le monde quantique !

66 Bibliography / Bibliographie

[1] A. Einstein, B. Podolsky, and N. Rosen, Can Quantum-Mechanical Description of Physical Reality Be Considered Complete?, Physical Review 47, 777 (1935).

[2] E. Schr¨odinger, Discussion of Probability Relations Between Separated Systems, Proceedings of the Cambridge Philosophical Society 31, 555 (1935).

[3] J. S. Bell, On the Einstein-Podolsky-Rosen Paradox, Physics 1, 195 (1964).

[4] A. Shimony, Search for a Worldview Which Can Accomodate Our Knowledge of Microphysics, in Philosophical Consequences of Quantum Theory: Reflections on Bell’s Theory, edited by J.T. Cushing and E. McMullin (University of Notre Dame Press, Notre Dame, Indiana, 1989).

[5] A. Aspect, J. Dalibard, and G. Roger, Experimental Test of Bell’s Inequalities Using Time-Varying Analyzers, Physical Review Letters 49, 1804 (1982).

[6] C. Bennett and G. Brassard, in Proceedings of the IEEE International Confer- ence on Computers, Systems and Signal Processing, Bangalore, India (IEEE, New York, 1984), pp. 175–179.

[7] A. K. Ekert, Quantum cryptography based on Bell’s theorem, Physical Review Letters 67, 661 (1991).

[8] C. H. Bennett et al., Teleporting an unknown quantum state via dual classi- cal and Einstein-Podolsky-Rosen channels, Physical Review Letters 70, 1895 (1993).

[9] P. W. Shor, in SFCS ’94: Proceedings of the 35th Annual Symposium on Foun- dations of Computer Science (IEEE Computer Society, Washington, DC, USA, 1994), pp. 124–134.

[10] J. S. Bell, Bertlmann’s socks and the nature of reality, Journal de Physique, Colloque C2, suppl. au numero 3, Tome 42, C2.41 (1981).

[11] A. J. Leggett, Nonlocal Hidden-Variable Theories and Quantum Mechanics: An Incompatibility Theorem, Foundations of Physics 33, 1469 (2003).

[12] A. C. Elitzur, S. Popescu, and D. Rohrlich, Quantum nonlocality for each pair in an ensemble, Physics Letters A 162, 25 (1992).

67 [13] V. Scarani, Quantum Physics: A First Encounter: Interference, Entanglement, and Reality (Oxford University Press, New York, 2006).

[14] J. Preskill, Lecture Notes on Quantum Information and Computation, http://www.theory.caltech.edu/people/preskill/ph219/#lecture.

[15] M. A. Nielsen and I. L. Chuang, Quantum Computation and Quantum Infor- mation (Cambridge University Press, Cambridge, 2000).

[16] N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Quantum cryptography, Re- views of Modern Physics 74, 145 (2002).

[17] V. Scarani et al., The Security of Practical Quantum Key Distribution, arXiv:0802.4155 (2008), to be published in Reviews of Modern Physics.

[18] S. Wiesner, Conjugate coding, Sigact News 15, 78 (1983).

[19] V. Scarani, A. Ac´ın,G. Ribordy, and N. Gisin, Quantum Cryptography Pro- tocols Robust against Photon Number Splitting Attacks for Weak Laser Pulse Implementations, Physical Review Letters 92, 057901 (2004).

[20] A. Ac´ın,N. Gisin, and V. Scarani, Coherent-pulse implementations of quan- tum cryptography protocols resistant to photon-number-splitting attacks, Physi- cal Review A 69, 012309 (2004).

[21] N. L¨utkenhaus, Security against individual attacks for realistic quantum key distribution, Physical Review A 61, 052304 (2000).

[22] G. Brassard, N. L¨utkenhaus, T. Mor, and B. C. Sanders, Limitations on Prac- tical Quantum Cryptography, Physical Review Letters 85, 1330 (2000).

[23] B. Kraus, N. Gisin, and R. Renner, Lower and Upper Bounds on the Secret- Key Rate for Quantum Key Distribution Protocols Using One-Way Classical Communication, Physical Review Letters 95, 080501 (2005).

[24] R. Renner, N. Gisin, and B. Kraus, Information-theoretic security proof for quantum-key-distribution protocols, Physical Review A 72, 012332 (2005).

[25] A. Niederberger, V. Scarani, and N. Gisin, Photon-number-splitting versus cloning attacks in practical implementations of the Bennett-Brassard 1984 pro- tocol for quantum cryptography, Physical Review A 71, 042316 (2005).

[26] R. Renner, Security of Quantum Key Distribution, Ph.D. thesis, ETH Zurich (2005), preprint arXiv:quant-ph/0512258.

[27] R. Renner, Symmetry of large physical systems implies independence of subsys- tems, Nature Physics 3, 645 (2007).

[28] U. Maurer, Secret key agreement by public discussion from common informa- tion, Information Theory, IEEE Transactions on 39, 733 (1993).

68 [29] D. Gottesman and H.-K. Lo, Proof of security of quantum key distribution with two-way classical communications, Information Theory, IEEE Transactions on 49, 457 (2003).

[30] H. F. Chau, Practical scheme to share a secret key through a quantum channel with a 27.6% bit error rate, Physical Review A 66, 060302 (2002).

[31] D. Bruss, Optimal Eavesdropping in Quantum Cryptography with Six States, Physical Review Letters 81, 3018 (1998).

[32] H. Bechmann-Pasquinucci and N. Gisin, Incoherent and coherent eavesdropping in the six-state protocol of quantum cryptography, Physical Review A 59, 4238 (1999).

[33] D. Gottesman, H. Lo, N. L¨utkenhaus, and J. Preskill, Security of quantum key distribution with imperfect devices, Quantum Information & Computation 4, 325 (2004).

[34] C. F. Fung, K. Tamaki, and H. Lo, Performance of two quantum-key- distribution protocols, Physical Review A 73, 012337 (2006).

[35] W. Hwang, Quantum Key Distribution with High Loss: Toward Global Secure Communication, Physical Review Letters 91, 057901 (2003).

[36] X. Wang, Beating the Photon-Number-Splitting Attack in Practical Quantum Cryptography, Physical Review Letters 94, 230503 (2005).

[37] H. Lo, X. Ma, and K. Chen, Decoy State Quantum Key Distribution, Physical Review Letters 94, 230504 (2005).

[38] J. Barrett, L. Hardy, and A. Kent, No Signaling and Quantum Key Distribution, Physical Review Letters 95, 010503 (2005).

[39] A. Acin, N. Gisin, and L. Masanes, From Bell’s Theorem to Secure Quantum Key Distribution, Physical Review Letters 97, 120405 (2006).

[40] A. Acin, S. Massar, and S. Pironio, Efficient quantum key distribution secure against no-signalling eavesdroppers, New Journal of Physics 8, 126 (2006).

[41] V. Scarani et al., Secrecy extraction from no-signaling correlations, Physical Review A 74, 042339 (2006).

[42] L. Masanes et al., Security of key distribution from causality constraints, arXiv:quant-ph/0606049 (2006).

[43] L. Masanes, Universally Composable Privacy Amplification from Causality Con- straints, Physical Review Letters 102, 140501 (2009).

[44] A. Acin et al., Device-Independent Security of Quantum Cryptography against Collective Attacks, Physical Review Letters 98, 230501 (2007).

69 [45] S. Pironio et al., Device-independent quantum key distribution secure against collective attacks, New Journal of Physics 11, 045021 (2009).

[46] N. Gisin et al., Towards practical and fast Quantum Cryptography, arXiv:quant- ph/0411022 (2004).

[47] D. Stucki et al., Fast and simple one-way quantum key distribution, Applied Physics Letters 87, 194108 (2005).

[48] D. Stucki et al., High speed coherent one-way quantum key distribution proto- type, arXiv:0809.5264 (2008).

[49] D. Stucki et al., High rate, long-distance quantum key distribution over 250km of ultra low loss fibres, arXiv:0903.3907 (2009).

[50] I. Devetak and A. Winter, Distillation of secret key and entanglement from quantum states, Proceedings of the Royal Society A: Mathematical, Physical and Engineering Science 461, 207 (2005).

[51] P. Labouch`ere, Quantum Cryptography Coherent One-Way Protocol, Study of possible variants, Master’s thesis, ETH Zurich (2009).

[52] K. Inoue, E. Waks, and Y. Yamamoto, Differential Phase Shift Quantum Key Distribution, Physical Review Letters 89, 037902 (2002).

[53] K. Inoue, E. Waks, and Y. Yamamoto, Differential-phase-shift quantum key distribution using coherent light, Physical Review A 68, 022317 (2003).

[54] A. Aspect, Bell’s inequality test: more ideal than ever, Nature 398, 189 (1999).

[55] W. Tittel, J. Brendel, H. Zbinden, and N. Gisin, Violation of Bell Inequalities by Photons More Than 10 km Apart, Physical Review Letters 81, 3563 (1998).

[56] G. Weihs et al., Violation of Bell’s Inequality under Strict Einstein Locality Conditions, Physical Review Letters 81, 5039 (1998).

[57] M. A. Rowe et al., Experimental violation of a Bell’s inequality with efficient detection, Nature 409, 791 (2001).

[58] D. N. Matsukevich et al., Bell Inequality Violation with Two Remote Atomic Qubits, Physical Review Letters 100, 150404 (2008).

[59] S. Groblacher et al., An experimental test of non-local realism, Nature 446, 871 (2007).

[60] T. Paterek et al., Experimental Test of Nonlocal Realistic Theories Without the Rotational Symmetry Assumption, Physical Review Letters 99, 210406 (2007).

[61] R. Colbeck and R. Renner, Hidden Variable Models for Quantum Theory Can- not Have Any Local Part, Physical Review Letters 101, 050403 (2008).

70 [62] P. H. Eberhard, A realistic model for quantum theory with a locality property, in Quantum theory and pictures of reality: foundations, interpretations, and new aspects, edited by W. Shommers (Springer-Verlag, Berlin, 2000).

[63] V. Scarani, W. Tittel, H. Zbinden, and N. Gisin, The speed of quantum infor- mation and the preferred frame: analysis of experimental data, Physics Letters A 276, 1 (2000).

[64] J. D. Franson, Bell inequality for position and time, Physical Review Letters 62, 2205 (1989).

[65] J. F. Clauser, M. A. Horne, A. Shimony, and R. A. Holt, Proposed Experiment to Test Local Hidden-Variable Theories, Physical Review Letters 23, 880 (1969).

[66] V. Scarani, Local and nonlocal content of bipartite qubit and qutrit correlations, Physical Review A 77, 042112 (2008).

[67] J. Barrett, A. Kent, and S. Pironio, Maximally Nonlocal and Monogamous Quantum Correlations, Physical Review Letters 97, 170409 (2006).

[68] P. M. Pearle, Hidden-Variable Example Based upon Data Rejection, Physical Review D 2, 1418 (1970).

[69] S. L. Braunstein and C. M. Caves, Wringing out better Bell inequalities, Annals of Physics 202, 22 (1990).

[70] V. Scarani, The Elitzur-Popescu-Rohrlich approach to quantum non-locality, arXiv:0712.2307v1 (2007), early version of [66].

[71] J. S. Bell, On the Problem of Hidden Variables in Quantum Mechanics, Reviews of Modern Physics 38, 447 (1966).

[72] G. Svetlichny, Distinguishing three-body from two-body nonseparability by a Bell-type inequality, Physical Review D 35, 3066 (1987).

[73] M. Seevinck and G. Svetlichny, Bell-Type Inequalities for Partial Separability in N-Particle Systems and Quantum Mechanical Violations, Physical Review Letters 89, 060401 (2002).

[74] D. Collins et al., Bell-Type Inequalities to Detect True n-Body Nonseparability, Physical Review Letters 88, 170405 (2002).

[75] N. S. Jones, N. Linden, and S. Massar, Extent of multiparticle quantum nonlo- cality, Physical Review A 71, 042329 (2005).

[76] N. D. Mermin, Extreme quantum entanglement in a superposition of macro- scopically distinct states, Physical Review Letters 65, 1838 (1990).

[77] A. V. Belinskii and D. N. Klyshko, Interference of light and Bell’s theorem, Physics-Uspekhi 36, 653 (1993).

71 [78] V. Scarani and N. Gisin, Spectral decomposition of Bell’s operators for qubits, Journal of Physics A: Mathematical and General 34, 6043 (2001).

[79] F. Rieke and D. A. Baylor, Single-photon detection by rod cells of the retina, Reviews of Modern Physics 70, 1027 (1998).

[80] F. D. Martini, F. Sciarrino, and C. Vitelli, Entanglement Test on a Microscopic- Macroscopic System, Physical Review Letters 100, 253601 (2008).

[81] E. Nagali, T. D. Angelis, F. Sciarrino, and F. D. Martini, Experimental real- ization of macroscopic coherence by phase-covariant cloning of a single photon, Physical Review A 76, 042126 (2007).

72 Publication list / Liste de publications

[A] C. Branciard, N. Gisin, B. Kraus, and V. Scarani, Security of two quantum cryptography protocols using the same four qubit states, Physical Review A 72, 032301 (2005).

[B] B. Kraus, C. Branciard, and R. Renner, Security of quantum-key-distribution protocols using two-way classical communication or weak coherent pulses, Phys- ical Review A 75, 012316 (2007).

[C] C. Branciard, N. Gisin, N. L¨utkenhaus, and V. Scarani, Zero-error attacks and detection statistics in the Coherent One-Way protocol for quantum cryptogra- phy, Quantum Information & Computation 7, 639 (2007).

[D] C. Branciard, N. Gisin, and V. Scarani, Upper bounds for the security of two distributed-phase reference protocols of quantum cryptography, New Journal of Physics 10, 013031 (2008).

[E] C. Branciard, A. Ling, N. Gisin, C. Kurtsiefer, A. Lamas-Linares, and V. Scarani, Experimental Falsification of Leggett’s Nonlocal Variable Model, Phys- ical Review Letters 99, 210407 (2007).

[F] C. Branciard, N. Brunner, N. Gisin, C. Kurtsiefer, A. Lamas-Linares, A. Ling, and V. Scarani, Testing quantum correlations versus single-particle properties within Leggett’s model and beyond, Nature Physics 4, 681 (2008).

[G] D. Salart, A. Baas, C. Branciard, N. Gisin, and H. Zbinden, Testing the speed of ‘spooky action at a distance’, Nature 454, 861 (2008).

[H] J.-D. Bancal, C. Branciard, N. Gisin, and S. Pironio, Quantifying multipar- tite nonlocality, preprint arXiv:0903.2715 (2009), to be published in Physical Review Letters.

[I] N. Brunner, C. Branciard, and N. Gisin, Possible entanglement detection with the naked eye, Physical Review A 78, 052110 (2008).

[J] P. Sekatski, N. Brunner, C. Branciard, N. Gisin, and C. Simon, Quantum ex- periments with human eyes as detectors based on cloning via stimulated emis- sion, preprint arXiv:0902.2896 (2009), to be published in Physical Review Letters.

73 [K] J.-D. Bancal, C. Branciard, N. Brunner, N. Gisin, S. Popescu, and C. Simon, Testing a Bell inequality in multipair scenarios, Phys. Rev. A 78, 062110 (2008).

74 Remerciements

Mes remerciements vont tout d’abord au Prof. Nicolas Gisin pour la confiance qu’il m’a accord´eeen me permettant de r´ealisercette th`eseau sein de son groupe de recherche, pour sa disponibilit´e,les pr´ecieuxconseils prodigu´eset les nombreuses id´eespartag´ees. Je suis infiniment redevable au Prof. Valerio Scarani qui m’a essentiellement tout appris dans le domaine de l’information quantique. Merci pour les discussions de physique ou plus philosophiques, pour ton agr´eablecompagnie quand on partageait le mˆemebureau, pour tes invitations `ate rendre visite `aSingapour lorsque tu t’es exil´eun peu plus loin... Je remercie ´egalement le Prof. Serge Haroche, qui a accept´eavec enthousiasme d’ˆetremembre du jury de cette th`ese. Un grand merci `atous les membres et anciens membres du Groupe de Physique Appliqu´ee,qui font r´egnerune si bonne ambiance au sein du GAP comme au- dehors. Merci en particulier aux (ex-)membres du groupe th´eorique,parmi lesquels Jean-Daniel Bancal, Nicolas Brunner, Barbara Kraus, Stefano Pironio (´egalement remerci´epour sa participation `amon jury de th`ese),Pavel Sekatski et Christoph Simon, pour les moments partag´esface `aun tableau blanc. Merci `ames coll`eguesde bureau Bj¨ornLauritzen et Imam Usmani pour m’avoir garanti un contact quotidien avec les exp´erimentateurs du GAP. I also wish to thank all the people whom I had the opportunity and the chance to work with during this thesis, more or less closely. I learnt a lot from all of you! Merci encore `ames amis, ainsi qu’`atoute ma famille pour leur soutien sans faille depuis toujours, pour leurs encouragements, pour l’int´erˆetqu’ils ont port´e`ames pr´eoccupations au cours de cette th`ese.Merci enfin `aAnne pour tout, et pour tout le reste ´egalement.

75 76 Part III

Published articles / Articles publi´es

77 78 PHYSICAL REVIEW A 72, 032301 ͑2005͒

Security of two quantum cryptography protocols using the same four qubit states

Cyril Branciard,1,2 Nicolas Gisin,1 Barbara Kraus,1 and Valerio Scarani1 1Group of Applied Physics, University of Geneva, 20, rue de l’Ecole-de-Médecine, 1211 Geneva 4, Switzerland 2Ecole Nationale Supérieure des Télécommunications, 46, rue Barrault, 75013 Paris, France ͑Received 10 May 2005; published 1 September 2005͒

The first quantum cryptography protocol, proposed by Bennett and Brassard in 1984 ͑BB84͒, has been widely studied in recent years. This protocol uses four states ͑more precisely, two complementary bases͒ for the encoding of the classical bit. Recently, it has been noticed that by using the same four states, but a different encoding of information, one can define a protocol which is more robust in practical implementations, specifi- cally when attenuated laser pulses are used instead of single-photon sources ͓V. Scarani et al., Phys. Rev. Lett. 92, 057901 ͑2004͒, referred to as the SARG04 protocol͔. We present a detailed study of SARG04 in two different regimes. In the first part, we consider an implementation with a single-photon source: we derive bounds on the error rate Q for security against all possible attacks by the eavesdropper. The lower and the upper bound obtained for SARG04 ͑QՇ10.95% and Qտ14.9%, respectively͒ are close to those obtained for BB84 ͑QՇ12.4% and Qտ14.6%, respectively͒. In the second part, we consider a realistic source consisting of an attenuated laser and improve on previous analysis by allowing Alice to optimize the mean number of photons as a function of the distance. The SARG04 protocol is found to perform better than BB84, both in secret-key rate and in maximal achievable distance, for a wide class of Eve’s attacks.

DOI: 10.1103/PhysRevA.72.032301 PACS number͑s͒: 03.67.Dd

I. INTRODUCTION sometimes more than one photon; thus, if losses are expected Quantum cryptography ͓1͔, or quantum key distribution in the quantum channel ͑as they always are͒, the eavesdrop- ͑QKD͒, is the most mature field in quantum information, per Eve may take advantage of the multiphoton pulses by both in theoretical and in experimental advances. From the keeping some photons without introducing errors on those very beginning of quantum information, it was clear that that she lets pass. These attacks are known as photon- QKD should be secure because of the no-cloning theorem, number-splitting ͑PNS͒ attacks. Since then, several ways and also that it should be implementable with available tech- have been found to counter PNS attacks. An especially nology. However, both rigorous proofs of security and truly strong protection is obtained by introducing decoy states ͓6͔; this requires some modification of the experimental devices. practical implementations turned out to be serious chal- The idea behind the Scarani-Acín-Ribordy-Gisin 2004 lenges: one had to start from the situations which are easiest ͑SARG04͒ protocol ͓7,8͔ is different and complementary: to handle. But what is easy for a theorist ͑small number of one can keep the hardware exactly as it is, but modify the parameters, idealized components͒ is not what is easy for an classical communication between Alice and Bob ͑the so- experimentalist ͑practical, real components͒. Thence, re- called sifting phase͒. Note that one can implement both the search in QKD mostly split into two fields: proving security sifting of SARG04 and a monitoring using decoy states: this in theoretically idealized situations on the one hand, and re- is the protocol for which Tamaki and Lo have proved secu- alizing practical prototypes on the other. Important advances rity for one- and two-photon pulses ͓9͔. have been made in both directions; at present, while many The goal of this paper is to improve the comparison be- open problems remain in both fields, an urgent task consists tween SARG04 and the original protocol of quantum cryp- in bringing theory and application together again. Indeed, the tography which uses four states, the one devised by Bennett theoretical tools have recently been applied to study the se- and Brassard in 1984 ͑BB84͓͒10͔. The structure of the paper curity of practical implementations ͓2͔. This paper aims at is as follows. the same goal, on a different protocol and with a different ͑1͒ The protocol. In Sec. II, we recall the basics of the approach. SARG04 protocol and present its entanglement-based ver- In any implementation of QKD, there is a large number of sion. components which do not behave according to the simplest ͑2͒ Single-photon implementation. This is the content of theoretical model. Such is the source: QKD protocols based Sec. III. We compute a lower bound for security against all on photon counting are most easily studied by assuming that possible attacks of the eavesdropper ͑in particular, the most a single-photon source or a source of entangled photons is general coherent attacks͒ under one-way classical processing used, but by far the most practical source is an attenuated by Alice and Bob—a study usually called unconditional se- laser ͓3͔. This practical implementation can lead to secure curity. The bound we obtain is QՇ10.95% where Q is the QKD: the analysis of the security parameters, while more quantum bit error rate ͑QBER͒. This bound is QՇ12.4% for complex than in the case of single photons, is definitely im- the BB84 protocol ͓11,12͔. An upper bound for security can portant. A drawback of the practical implementation was no- also be computed by giving an explicit attack by Eve. We ticed by some authors ͓4͔ and explicitly stated in 2000 by identify an incoherent attack which performs better than the Lütkenhaus and co-workers ͓5͔: weak laser pulses contain one which uses the phase-covariant cloning machine ͓13͔.

1050-2947/2005/72͑3͒/032301͑18͒/$23.00 032301-1 ©2005 The American Physical Society BRANCIARD et al. PHYSICAL REVIEW A 72, 032301 ͑2005͒

The SARG04 protocol is found to be certainly insecure in a ͉+z͘ϵ͉0͘, ͉−z͘ϵ͉1͘, ͉+x͘=͑1/ͱ2͉͒͑0͘+͉1͒͘, and ͉−x͘ single-photon implementation as soon as Qտ14.9%, the cor- =͑1/ͱ2͉͒͑0͘−͉1͒͘. She sends the state to Bob, who measures responding upper bounds for BB84 being Qտ14.64%. either ␴z or ␴x. The difference from BB84 appears in the Thus, the lower and upper bounds for security under one- encoding and decoding of classical information. way classical postprocessing are similar for both protocols. The classical bit is encoded in the basis: ͉+z͘ and ͉−z͘ code However, suppose that the channel Alice-Bob is a depolariz- for 0, ͉+x͘ and ͉−x͘ code for 1. Since each basis codes for a ing channel, as is the case in all experiments performed to bit, it is natural in SARG04 to admit that the two bases are date: chosen randomly with equal probability ͓16͔. Ќ Ќ In the sifting phase, Alice does not reveal the basis this E͓͉␺͔͘ = F͉␺͗͘␺͉ + D͉␺ ͗͘␺ ͉͑1͒ ͑ would reveal the bit͒: she discloses the state she has sent and where F+D=1. The channel is then characterized by the one of the states that code for the other value of the bit, disturbance D, or equivalently, by the visibility V of the which are not orthogonal to the first one. There are thus a fringes one can observe in an interferometric setup defined priori four sifting sets: S++=͕͉+z͘,͉+x͖͘, S−−=͕͉−z͘,͉−x͖͘, by S+−=͕͉+z͘,͉−x͖͘, and S−+=͕͉−z͘,͉+x͖͘. For definiteness, suppose ͉sent͘=͉+z͘ and ͉declared͘=͉+x͘: Bob guesses cor- 1+V 1−V F = , D = . ͑2͒ rectly the bit if he measured ␴x and found ͉right͘=͉−x͘; he 2 2 guesses wrongly the bit if he measured ␴z and found Now, the link between the QBER and the visibility is differ- ͉wrong͘=͉−z͘. As usual, an error can happen only if the state ent for the two protocols: V=1−2Q for BB84, while V=͑1 has been modified by an eavesdropper, or in the presence of dark counts. In the absence of errors, the length of the sifted −2Q͒/͑1−Q͒ for SARG04. The comparison of the bound for 1 the visibility is unfavorable for SARG04. key is 4 of the length of the raw key; in the presence of an ͑3͒ Attenuated laser pulses (Poissonian source), imper- error rate Q, this length increases. fect detectors. In Sec. IV, we consider the more realistic situ- This encoding is better to protect secrecy against incoher- ation for which SARG04 was devised. Alice’s source is an ent PNS attacks when the source is not a single-photon attenuated laser, producing weak pulses, that is, pulses with a source. In fact, suppose that a pulse contained two photons mean number of photons ␮Շ1. A first comparison between and Eve has kept one of them in a quantum memory. In SARG04 and BB84 in this implementation can be found in BB84, by listening to the sifting, Eve learns the basis: she the original references ͓7,8͔. Here we improve significantly can measure the photon she has kept and learn the bit with on this analysis, although the study of ultimate security is certainty. In SARG04, in the sifting Eve learns that the state still beyond reach. Anyway, for a broad class of incoherent is either of two nonorthogonal states: she cannot learn the bit attacks by Eve including various forms of PNS ͓14͔, we can with certainty. In order to learn the bit with certainty without compute the optimal secret key rate by optimizing over the introducing errors, Eve has to implement an unambiguous state discrimination on the three-photon pulses, which suc- mean number of photons ␮ describing the Poissonian statis- 1 tics. We work in the trusted-device scenario: Eve cannot take ceeds with probability 2 . This suggests that SARG04 should advantage of the limited efficiency or of the dark counts of be more robust than BB84 against incoherent PNS attacks. In Bob’s detectors. We find that the optimal mean number of Refs. ͓7,8͔ it was shown that this intuitive reasoning is cor- photon goes as ␮ ϳ2ͱt as a function of the transmission t rect and gives a real advantage over BB84; we shall confirm opt this conclusion with a significantly improved analysis in Sec. of the quantum channel, while the much smaller value ␮opt ϳt holds for BB84 under identical conditions ͓15͔. As a IV. consequence, the secret-key rate ͑proportional to the detec- tion rate ␮t͒ decreases as t3/2 instead of the faster t2 decrease B. SARG04: Entanglement-based version of BB84. The limiting distance is also increased in SARG04 In order to determine a lower bound on the secret-key rate with respect to BB84, approximately by 10 km using typical we will consider the equivalent entanglement-based version values of the parameters of the detector and the channel. of the SARG04 protocol ͓9,17͔. To this end we define the Thus, SARG04 compares favorably with BB84 in practical encoding operators implementations for this class of attacks.

The conclusions of both Secs. III and IV strongly suggest A␴␻ = ͉0͗͘␴z͉ + ͉1͗͘␻x͉͑3͒ that the same quantum correlations can be exploited differ- ently according to the physical realization, by adapting the where ␴, ␻= ±1. Instead of preparing a state and sending the classical encoding and decoding procedures. qubit to Bob, Alice prepares randomly one of the states 1 1 + A␴␻  ͉⌽ ͘ = ͉͑0͉͘␴z͘ + ͉1͉͘␻x͒͘ ͑4͒ II. SARG04 PROTOCOL ͱ2 A. SARG04: Prepare-and-measure version and sends the second qubit to Bob. Measuring Alice’s qubit The SARG04 protocol was introduced in Ref. ͓7͔ in a then in the computational basis ͕͉0͘,͉1͖͘ prepares Bob’s qubit prepare-and-measure version. At the level of quantum pro- in one of the four states used by the protocol. In order to cessing, it is exactly equivalent to BB84. Alice prepares one decode the information sent by Alice, Bob applies one of the of the four states belonging to two conjugated bases, e.g., four operators

032301-2 SECURITY OF TWO QUANTUM CRYPTOGRAPHY … PHYSICAL REVIEW A 72, 032301 ͑2005͒

1 of the state describing Alice’s and Bob’s system is Bell di- B␴␻ = ͓␴͉0͗͘− ␻x͉ + ␻͉1͗͘− ␴z͉͔. ͑5͒ agonal, independently of the protocol. Its eigenbasis is given ͱ2 + n1 − n2 + n3 − n4 by ͕͉⌽ ͘ ͉⌽ ͘ ͉⌿ ͘ ͉⌿ ͘ ͖, where n1 +n2 +n3 +n4 After that, Bob measures his qubit in the computational ba- =n and the states ͉⌽±͘,͉⌿±͘ denote the Bell basis. Apart sis. from that the state is symmetric with respect to exchanging Let us show that this description is indeed equivalent to the different qubit pairs. The only free parameters are the the prepare-and-measure protocol described above. The eigenvalues of the density operator. Those depend on the preparation by Alice is equivalent since a measurement in the distribution of the quantum information, i.e., on the QKD z basis performed on the first qubit described by one of the protocol. It is important to note that when assuming that Eve  1 + states A␴␻ ͉⌽ ͘ leads with equal probability to one of the has a purification of this state, i.e., ␳ABE=͉⌿͘ABE͗⌿͉, for states ͉␴z͘,͉␻x͘. On the other hand, Bob’s measurement is some state ͉⌿͘ABE, then her power is never underestimated. It has then been shown in ͓11,12͔ that a lower bound on the 1 † secret-key rate can then be determined considering only two- B␴␻͉0͗͘0͉B␴␻ = ͉− ␻x͗͘− ␻x͉, 2 qubit density operators. In particular, for a given QBER Q,a lower bound on the secret-key rate ͑assuming that Alice and 1 Bob apply optimal error correction and privacy amplifica- B† ͉1͗͘1͉B = ͉− ␴z͗͘− ␴z͉, ͑6͒ ␴␻ ␴␻ 2 tion͒ is given by

r ജ r1 = sup inf R͑␴AЈBE͒͑7͒ where ␴, ␻=±. Thus, his measurement corresponds to mea- ෈ AЈ←A␴AB ⌫Q suring his qubit in either the z or x basis ͓18͔. We dispose now of all the tools to tackle the security with studies on the SARG04 protocol. As announced, we consider R͑␴ ͒ = ͓S͑␴ ͒ − S͑␴ ͔͒ − H͑AЈ͉B͒. ͑8͒ first the case of single-photon sources and will tackle the AЈBE AЈE E more realistic case of attenuated lasers in Sec. IV. Here, S͑H͒ denotes the von Neumann ͑Shannon͒ entropy. It is important to take some space to describe these objects in III. SINGLE-PHOTON SOURCES detail. ͑1͒ The first apparent thing is that Alice does something A. Generalities: The scenario for security proofs to her bit string A which transforms it to AЈ. This is called In this section we investigate the security of the SARG04 preprocessing. It is a classical operation, known only to her protocol, assuming that Alice is sending out single photons ͓just note that in the original formula, Eq. ͑2͒ in ͓11͔, there encoding the bit values. First of all, we compute a lower appears also the possibility, denoted V there, that Alice dis- bound on the secret-key rate using the results presented in closes something of her preprocessing publicly: neglecting ͓11,12͔. Then we compare those bounds to the bounds de- this possibility here, we can nevertheless obtain a lower rived with proofs based on entanglement distillation ͓9͔. Af- bound͔. We consider here that Alice applies this preprocess- ter that we determine an upper bound on the secret-key rate ing to each bit value independently. Thus, she can only flip for the SARG04 protocol. To this aim we explicitly construct her bit values with a certain probability. Note that this trans- an attack by Eve. This attack is incoherent, i.e., acting on formation reduces the information Bob has about Alice’s bit each qubit individually and measuring each qubit right after string, but it turns out that it penalizes Eve more than Bob, the basis reconciliation. which implies that this preprocessing increases the secret- key rate. Obviously, Alice will choose the preprocessing B. Lower bound on the secret key rate which maximizes the rate, whence the supremum in Eq. ͑7͒. ͑2͒ The set ⌫Q can be assumed to contain only two-qubit 1. Review of the approach Bell-diagonal density operators which are compatible with Let us start by summarizing the results presented in the measured QBER Q. In order to be more precise we have ͓11,12͔, where a computable lower bound on the secret-key to introduce the following notation. We denote by ␳0 + + rate for a general class of QKD protocols using one-way =trE͓E͉͑⌽ ͘AB͗⌽ ͉  ͉0͘E͗0͉͔͒, where E denotes a general classical postprocessing has been derived. We use the map applied by Eve ͑we do not impose that this map is entanglement-based description of the protocol. Alice pre- unitary, since we are going to consider in the following the pares n qubit pairs at random in one of the states defined in state shared by Alice and Bob after sifting͒. Let us denote Eq. ͑4͒ and sends the second qubit of each pair to Bob. Eve now by Aj and Bj the decoding and encoding operators de- might now apply the most general attack on all the qubits fined by the considered protocol. For the SARG04 protocol, sent to Bob. Bob applies at random one of the operators these are the operators defined in Eqs. ͑3͒ and ͑5͒, respec- defined in Eq. ͑5͒ on the qubits he received. After that Alice tively. The state describing Alice’s and Bob’s qubit pairs af- and Bob symmetrize their qubit pairs by applying a random ter sifting can be considered to be permutation on them. On the other hand, Alice and Bob ran- D  †  † domly choose for each qubit pair to apply the bit-flip opera- ␳1 = 1͑␳0͒ = C͚ Aj Bj␳0Aj Bj ͑9͒ j tion ͑␴x  ␴x͒. Both of those transformations commute with their measurement in the z basis. It has been shown in ͓11͔ where C is a normalization constant which may depend on ␳0 that after randomly applying these transformation the form ͑recall that, e.g., in SARG04, the length of the sifted key

032301-3 BRANCIARD et al. PHYSICAL REVIEW A 72, 032301 ͑2005͒

varies with the amount of errors͒. Recall that this state is 2. Lower bound for SARG04 measured by Alice and Bob in the z basis. Using this nota- The SARG04 protocol uses all the four sifting sets S␴␻ ͑a tion we can now define the set ⌫Q. It contains any state of the different bound is found if one considers a modified protocol form which uses only two sets; see Appendix B͒. One finds after some algebra ␳2 = ␭1P⌽+ + ␭2P⌽− + ␭3P⌿+ + ␭4P⌿− ͑10͒ ␭ = C͗⌽+͉␳ ͉⌽+͘, with 1 0

+ + − − − − + + ␭1 = ͗⌽ ͉␳1͉⌽ ͘, ␭2 = C͑͗⌿ ͉␳0͉⌿ ͘ + ͗⌽ ͉␳0͉⌽ ͘ + ͗⌿ ͉␳0͉⌿ ͒͘,

− − C ␭2 = ͗⌽ ͉␳1͉⌽ ͘, ␭ = ͑͗⌽−͉␳ ͉⌽−͘ + ͗⌿+͉␳ ͉⌿+͒͘, 3 2 0 0 + + ␭3 = ͗⌿ ͉␳1͉⌿ ͘, C − − − − + + ␭4 = ͑4͗⌿ ͉␳0͉⌿ ͘ + ͗⌽ ͉␳0͉⌽ ͘ + ͗⌿ ͉␳0͉⌿ ͒͘. ͑13͒ − − 2 ␭4 = ͗⌿ ͉␳1͉⌿ ͘. ͑11͒ Those coefficients have to satisfy the normalization condi- The following relations then hold: tion and the fact that the state ␳ has to be compatible with 2 ␭4 +3␭3 =2␭2, ͑14͒ the estimated error, Q. Since the state is measured in the computational basis this implies ␭4 ജ␭3. ͑15͒

␭1 + ␭2 =1−Q, Supposing that we leave ␭2 =x free, we obtain ␭1 =1−Q−x from Eq. ͑12͒, ␭3 =x−Q/2 and ␭4 =3Q/2−x from Eq. ͑14͒; the positivity of ␭ and Eq. 15 restrain x to lie in the range ␭3 + ␭4 = Q. ͑12͒ 3 ͑ ͒ ͓Q/2,Q͔. We optimize r1 and find it positive provided Q The considered protocol, i.e., the map D1 confines the ␭’s ഛ10.95%. If we had neglected the preprocessing, we would ෈ further. Let us denote now by ␴AB ⌫Q the state describing have found Qഛ9.68%, the same value obtained by Tamaki Alice’s and Bob’s qubit. Eve is supposed to hold a purifica- and Lo ͓9,20͔. tion of this state, i.e., ␴ABE is pure. Obviously, one must suppose that Eve has made the best attack, whence the infi- mum in Eq. ͑7͒. C. Single photon: Upper bound—an incoherent attack ͑3͒ The density matrix ␴AЈE is the state of the joint sys- As we noticed at the end of Sec. III B 1, the bounds we tem of Alice and Eve, after Alice has performed the prepro- have just obtained may be subject to some future improve- cessing. ment when more complex preprocessing strategies are taken ͑4͒ As for R͑␴AЈBE͒: if one replaces the von Neumann into account. In the meantime, we can easily derive an upper entropy S by the Shannon entropy H, this boils down to bound by computing explicitly a possible attack by Eve. We H͑AЈ͉E͒−H͑AЈ͉B͒=I͑AЈ:B͒−I͑AЈ:E͒, giving the usual consider an incoherent attack, that is an attack consisting of Csiszár-Körner bound ͓19͔͓see Eq. ͑29͒ below͔. What ap- ͑i͒ a unitary operation U coupling the qubit flying to Bob to pears in Eq. ͑7͒ is thus its quantum analog, given that Eve is Eve’s systems; ͑ii͒ a suitable measurement on Eve’s systems, allowed to keep her systems quantum. after hearing the result of the sifting but before any other Now, we have announced that one can compute a lower classical processing ͑this is the difference with collective at- bound on the secret-key rate considering only two-qubit tacks͒. Bell-diagonal states. Precisely, this is true if Alice’s prepro- Even within the class of incoherent attacks, the full opti- cessing is bitwise. In general, it holds that if Alice’s prepro- mization is a hard task. The problem is not really at the level cessing is applied to strings of n bits, then one can restrict of the unitary U. In fact, since both Alice’s and Bob’s system attention to Eve’s collective attacks on n pairs. If we denote are qubits, Eve’s ancilla may be taken without restriction to by rn the corresponding bound for the secret-key rate r, one be four dimensional. Thus, the action of the unitary on states has rജrn ജr1; it is an open problem whether strict inequali- of the form ͉␺͘A͉R͘E can be specified by only 16 parameters, ties hold. not all independent—apart from the requirement of unitarity, In summary, we are going to compute the lower bound on we have imposed a symmetry on the set of states, namely, the secret-key rate if Alice applies a bitwise preprocessing, that U realizes a depolarizing channel ͑1͒ between Alice and i.e., Eq. ͑7͒. The quantity R͑␴AЈBE͒ is given in Appendix A as Bob with the same D for ͉␺͘ belonging to the x or to the z an explicit function of the ␭i. This expression is independent basis. In summary, the unitary is defined by a number of of the protocol: as mentioned above, only the constraints on parameters which is small ͑at least for numerical optimiza- the ␭i, that is, the set ⌫Q, depend on the protocol. Possible tion͒. What is not known at all a priori, is the kind of mea- improvements on the bound may come from more-than-one- surement Eve has to perform on her system, which would bit preprocessing, and/or from revealing a part of the prepro- give her the best information on Alice’s and Bob’s bits. Here, cessing publicly. we choose a specific kind of measurement that can be de-

032301-4 SECURITY OF TWO QUANTUM CRYPTOGRAPHY … PHYSICAL REVIEW A 72, 032301 ͑2005͒

fined for any U Helstrom measurement, see below and op- z ͑ ͒ pacc D timize the parameters of U in order to maximize Eve’s infor- Q = = . ͑19͒ pz + px 1/2 + D mation in such a measurement. The best U found with this acc acc method is not the phase-covariant cloning machine, i.e., the Note that, contrary to the case of BB84, Q
D; for small cloner which copies all the states of the x and the z bases values of D we have actually QӍ2D. We shall come back to with the same fidelity ͓13͔. this point in the comparison with BB84, Sec. III D below. This result is interesting in itself because it shows that Eve’s states. After sifting, Eve has to distinguish between cryptography and cloning are clearly different tasks. In fact, four states, corresponding to the two possible states an- the “states to be copied” are the same ones in SARG04 as in nounced by Alice and the two cases in which Bob accepts the BB84, so the optimal cloner is the phase-covariant cloning ˜ ab ෈ item. We write these states as ͉␺E ͘, where a͑b͒ ͕0,1͖ de- machine in both cases. It turns out this cloner enters also the notes Alice’s ͑Bob’s͒ classical bit: construction of the optimal incoherent eavesdropping for 1 BB84; for SARG04, however, it is not the case. The cause of ˜ 00 U − ͉␺E ͘ = B͗− x͉ ͉ + z͉͘R͘ = ͑ͱ1−2D͉00͘ + ͱ2D͉⌿ ͒͘, the difference is clear: in optimal cloning, one wants to op- ͱ2 timize the fidelity of the output states to the input state; in optimal incoherent eavesdropping, one wants to optimize ͑20͒ Eve’s information, and this is a priori a completely different ˜ 01 U problem. ͉␺E ͘ = B͗− z͉ ͉ + z͉͘R͘ = ͱD͉10͘, ͑21͒

1. Eve’s unitary operation ˜ 10 U ͉␺E ͘ = B͗− x͉ ͉ + x͉͘R͘ = ͱD͉01͘, ͑22͒ We start by describing the unitary U which we have found. It is defined by its action on the z basis of the qubit 1 ˜ 11 U − ͉␺E ͘ = B͗− z͉ ͉ + x͉͘R͘ = ͑ͱ1−2D͉00͘ − ͱ2D͉⌿ ͒͘, flying from Alice to Bob and on a reference state used by ͱ2 Eve as ͑23͒ U͉␴z͘ ͉R͘ = ͱF͉␴z͘ ͉0͘ ͉␺ ͑D͒͘ + ͱD͉− ␴z͘ ͉1͘ ͉0͘ − A E B E1 ␴ E2 B E1 E2 with ͉⌿ ͘=͑1/ͱ2͉͒͑01͘−͉10͒͘. Note that these states are not ͑16͒ normalized, but the square of their norms corresponds to the probabilities with which they appear. Eve should now distin- guish at best between these four states. with ␴=± and ͉␺␴͑D͒͘=ͱ1−D/F͉0͘+␴ͱD/F͉1͘. Here, D ෈ 1 ͓0,2 ͔ is the only free parameter of the transformation. 2. Eve’s measurement: Helstrom strategy Note that Eve’s system is only three dimensional; we used a We suppose that Eve uses the Helstrom strategy to guess two-qubit notation for convenience. In fact, with this nota- Alice’s bit ͓21͔. This strategy, which may not be the optimal tion, the action of the unitary in the x basis is similar to its one for the present problem, consists in measuring the ob- action on the z basis, but the roles of E and E are reversed: 1 2 servable writing with ␻=±, one has A=0 A=1 MA = ␳E − ␳E ͑24͒ U͉␻x͘ ͉R͘ = ͱF͉␻x͘ ͉␺ ͑D͒͘ ͉0͘ + ͱD͉− ␻x͘ ͉0͘ ͉1͘ . A E B ␻ E1 E2 B E1 E2 where ͑17͒ A=j 1 ˜ j0 ˜ j0 ˜ j1 ˜ j1 ␳E = 1 ͉͑␺E ͗͘␺E ͉ + ͉␺E ͗͘␺E ͉͒. ͑25͒ We suppose in the following that Alice publicly announces 2 + D the set ͕͉+z͘,͉+x͖͘ ͑i.e., Alice actually sends one of these Some analytical results, which provide also a different per- two states͒, and that Bob accepts the bit. It has been verified spective on Helstrom’s strategy, are given in Appendix C. that thanks to the symmetries of the attack, all the following Here we just sketch the calculation that can also be imple- still holds if Alice sends another state and/or announces an- mented numerically from the beginning. There are three pos- other set. sible outcomes e for Eve’s variable E. The probability of Bob’s states. Suppose for definiteness that Alice sends the each outcome is state ͉+z͘. If we trace over Eve’s system, we get Bob’s state pE=e = ͗me͉␳E͉me͑͘26͒ +z ␳B = F͉ + z͗͘+ z͉ + D͉ − z͗͘− z͉. ͑18͒ 1 A=0 1 A=1 with ␳E = 2 ␳E + 2 ␳E . The information Eve gets on Alice’s bit is Thus the effective channel induced on Alice-Bob by Eve’s attack is a depolarizing channel ͑1͒ with disturbance D. If I͑A:E͒ = H͑A͒ − H͑A͉E͒ =1−͚ pE=eH͑A͉E=e͒ Bob measures his qubit in the z basis, then he will accept the e z ͑wrong͒ conclusive result ͉−z͘ with probability pacc=D. If Bob now measures his qubit in the x basis, he will accept the =1−͚ pE=eh͑pA=0͉E=e͒͑27͒ x e ͑right͒ conclusive result ͉−x͘ with probability pacc=͗−x͉␳B͉ −x͘=1/2. The quantum bit error rate after sifting is therefore where h is binary entropy and where

032301-5 BRANCIARD et al. PHYSICAL REVIEW A 72, 032301 ͑2005͒

FIG. 1. Bob’s and Eve’s information on Alice’s bit ͑before her possible preprocessing͒ for our individual attack and the attack us- ing the phase-covariant ͑PC͒ cloning machine.

pE=e͉A=0 1 pE=e͉A=0 pA=0͉E=e = pA=0 = ͑28͒ pE=e 2 pE=e

A=0 with pE=e͉A=0=͗me͉␳E ͉me͘. This information is plotted to- gether with Bob’s information I͑A:B͒=1−h͑Q͒ as a function of the QBER, Eq. ͑19͒, in Fig. 1. The curve of I͑A:E͒ for the attack using the phase-covariant cloning machine, taken from Ref. ͓8͔, is included for comparison. Our attack is slightly more efficient in the interesting region. Actually, if Eve performs the measurement of MA, she has a good guess on Alice’s bit but very poor information on Bob’s bit ͑the only thing she knows is that Bob’s bit is equal to Alice’s with probability 1−D͒. Similarly, with reversed B=0 B=1 roles, if Eve measured MB =␳E −␳E : numerically, the FIG. 2. Top: upper bound Rsk on the secret-key rate obtained I͑B:E͒ so found is equal to I͑A:E͒ found when measuring with the attack under study with ͑solid lines͒ and without ͑dotted MA; but now, Eve has poor information on Alice’s bit. For lines͒ Alice’s optimal preprocessing, as a function of the QBER. BB84 and the six-state protocols, measurements have been Bottom: corresponding value of the optimal q. The preprocessing explicitly found which attain the optimal value for both Al- slightly increases the bound where the achievable secret-key rate ice’s and Bob’s bits. We did not find such a measurement becomes 0 ͑which we find to be 14.9%͒. here. However, this is not important: before starting error correction and privacy amplification, Alice and Bob must cess A→AЈ consists in Alice’s flipping her bit with some choose whether to perform the direct or the reverse recon- probability q. Bob’s information is now ciliation; thus Eve can simply choose the suitable measure- I͑AЈ:B͒ =1−h͑QЈ͒͑30͒ ment. where 3. Bound on the secret-key rate QЈ = ͑1−q͒Q + q͑1−Q͒. ͑31͒ An upper bound on the attainable secret-key rate using one-way communication and single-bit preprocessing is As for Eve’s information, it can be calculated with Eq. ͑27͒ upon changing p to given by the Csiszar-Körner bound ͓19͔ which reads A=0͉E=e pAЈ=0͉E=e = ͑1−q͒pA=0͉E=e + qpA=1͉E=e. ͑32͒ r ഛ Rsk = max͕I͑AЈ:B͒ − I͑AЈ:E͖͒ ͑29͒ AЈ←A Figure 2 displays the upper bound on the secret-key rate Eq. ͑29͒, with and without Alice’s bit flipping ͑top͒ and the where AЈ is the result of a local processing of Alice’s vari- corresponding optimal value of q ͑bottom͒ as a function of ables. The need for this maximization went unnoticed in the the QBER. We can see that this preprocessing allows Alice field of QKD until very recently ͓11͔, but is indeed present in and Bob to slightly increase the bound on the QBER where the original paper. Here, we consider the case when the pro- the achievable secret-key rate becomes zero. In the case

032301-6 SECURITY OF TWO QUANTUM CRYPTOGRAPHY … PHYSICAL REVIEW A 72, 032301 ͑2005͒ where Alice performs bitwise preprocessing as we consider p 1−V Q = wrong = Ϸ 1−V ͑SARG04͒. ͑36͒ here, this bound is 14.9%. Alice will do this preprocessing p + p 2−V only for a QBER close to the bound of 14.9%, with q in- right wrong creasing as the QBER increases. At the bound, q=0.5: Alice Note that we have already derived this formula above, Eq. flips half of her bits, so that both Bob’s and Eve’s informa- ͑19͒ with D=͑1−V͒/2. For a fixed visibility, the QBER of tion on her bits is completely randomized. After this optimal SARG04 is almost twice the QBER of BB84. In this sense, preprocessing, Fig. 1 would look as follows: both I͑A:B͒ and the bounds of SARG04 compare unfavorably to those of I͑A:E͒ stay the same up to QϷ14.6%; then suddenly both BB84 in a single-photon implementation ͓22͔. drop rapidly to zero, with their difference given in the left graph of Fig. 2. IV. PRACTICAL IMPLEMENTATION No preprocessing was taken into account in Ref. ͓8͔ for As we stressed in the Introduction, it has not yet been the attack using the phase-covariant cloner. When one in- possible to give the most general security criteria without cludes bitwise preprocessing, the bound for that attack adding assumptions about some simplified components. moves from 15.03% to 15.12%. Consequently, the attack While theory progresses, experimentalists need realistic fig- presented here is still more efficient from Eve’s standpoint. ures to design their experiments and to evaluate their results. These figures must take into account all the meaningful pa- D. Single photon: Comparison with BB84 protocol rameters characterizing Alice’s source, the line ͑“quantum channel”͒ linking Alice to Bob and Bob’s detectors. In the previous paragraphs, we have provided lower and To compute these figures, we have to make several as- upper bounds for the security of SARG04 in a single-photon sumptions, which will be stated precisely in what follows, implementation, under the assumptions of one-way classical but in general fall into two categories. processing and bitwise preprocessing on Alice’s side. The ͑1͒ We restrict the class of Eve’s attacks, taking into ac- corresponding bounds for BB84 are known from Refs. count only incoherent attacks, among which the PNS and its ͓11,12͔. The results are for the lower bound, variants play the most important role. This assumption leads to an underestimate of Eve’s power. BB84 Q Շ 12.4 % , ͑2͒ We also have to specify the kind of check that Alice extract a key if ͑33͒ ͭSARG04 Q Շ 10.95 % ; ͮ and Bob perform on their data. Apart from the estimate of the QBER, Alice and Bob can check the transmission of the line and more precisely the statistics of the number of and for the upper bound photons. The section is structured as follows. First, we describe the BB84 Q տ 14.6 % , source, the line, and the detectors Sec. IV A , the expected abort if ͑34͒ ͑ ͒ ͭSARG04 Q տ 14.9 % . ͮ parameters in the absence of Eve ͑Sec. IV B͒, and the hy- potheses on Eve’s attack ͑Sec. IV C͒. Then we present the Looked at that way, SARG04 compares almost on equal results of numerical optimizations ͑Sec. IV D͒; in the case of grounds with BB84 in a single-photon implementation. perfect optical visibility V=1, we provide also approximate Experimentalists would, however, have a different look. analytical formulas. The last subsection ͑Sec. IV E͒ is de- Consider for a moment a detector with no dark counts, or voted to a balance of the results obtained for SARG04, in more realistically, a situation in which the number of dark comparison with BB84. counts is negligible compared with the detection rate. In all A. Description of the source, the line, and the detectors practical experiments to date, the noise is such that the ef- fective channel E between Alice and Bob becomes a depo- 1. Alice’s source larizing channel ͑1͒ characterized by its visibility V. Alice encodes her classical bits in light pulses; since a In BB84, for such a channel, the error rate on the sifted reference for the phase is not available to Eve and to Bob, key is independent of the state ͉␺͘: in fact, when the good the effective state prepared by Alice is a mixture which is basis has been chosen, one has simply p =͑1+V͒/2 and right diagonal in the photon-number basis: pwrong=͑1−V͒/2. Consequently ϱ

␳A = pA͑n͉͒n␺͗͘n␺͉͑37͒ pwrong 1−V ͚ Q = = ͑BB84͒. ͑35͒ n=0 pright + pwrong 2 where ͉n␺͘ represents the state in which n photons are In SARG04, the situation is different. If Bob chooses the present in the state ͉␺͘. In most practical QKD setups, Al- good decoding basis ͑which is not the basis in which the ice’s source is an attenuated laser pulse, so qubit was encoded͒, then whenever he accepts, he guesses n 1 −␮ ␮ always right, and this happens with probability p = in- pA͑n͒ = p͑n͉␮͒ = e , ͑38͒ right 2 n! dependently of V. If Bob chooses the wrong decoding basis and accepts, then he always guesses wrongly; and this hap- the Poissonian distribution of mean photon number ␮. In this pens with probability pwrong=͑1−V͒/2. Thus paper, the formulas where the notation pA͑n͓͒or pB͑n͒, see

032301-7 BRANCIARD et al. PHYSICAL REVIEW A 72, 032301 ͑2005͒ below͔ appears explicitly are general; all the others suppose precisely that the basis chosen by Bob is not the one chosen Eq. ͑38͒ to hold. by Alice, and this gives the information on the bit. But the dark count case is still there, and introduces errors. In this 2. Alice-Bob quantum channel paper, for simplicity we suppose that items with double clicks are discarded from the key, as in BB84; however, their The quantum channel which connects Alice and Bob is rate is monitored, to prevent Eve from achieving an effective characterized by the losses ␣, usually given in dB/km ͑for modification of ␩ optical fibers at the telecom wavelength 1550 nm, the typical ͑see Sec. IV C͒. value is ␣Ӎ0.25 dB/km͒. The transmission of the line at a 1. Zero-click rate distance d is therefore When n photons arrive, the probability of not having any −␣d/10 t = 10 . ͑39͒ click is independent of the basis chosen by Bob and is given The probability that Bob receives n photons is by 2 n n n m−n p0͑n͒ = ͑1−pd͒ ͑1−␩͒ . ͑43͒ pB͑n͒ = ͚ pA͑m͒Cmt ͑1−t͒ = p͑n͉␮t͒͑40͒ mജn The corresponding zero-click rate is C0 =⌺nജ0pB͑n͒p0͑n͒ 2 n =͑1−pd͒ p͑0͉␮t␩͒, i.e., there are no dark counts and no pho- through Eq. ͑38͒, where Cm =m!/n!͑m−n͒!. The other meaningful parameter of the channel is the fidelity of the ton is detected. transmission F or the disturbance D=1−F . We assume a ͑ ͒ 2. Sifted key and QBER depolarizing channel ͑1͒: The accepted-click rate on Bob’s side is the sum of two E͓͉ + z͔͘ = F͉ + z͗͘+ z͉ + D͉ − z͗͘− z͉͑41͒ terms. When Bob measures in the z basis, he accepts the ͑wrong͒ bit if there is one click in the ͉−z͘ detector ͑whether 1 1 it is due to a photon or to a dark count , and no click in the = 2 ͉ + x͗͘+ x͉ + 2 ͉ − x͗͘− x͉ + ͑off-diagonal terms͒. ͒ ͉+z͘ detector. When n photons arrive, the probability of hav- ͑42͒ ing a click only on the ͉−z͘ detector is and recall the link ͑2͒ between the parameters F and D, and n the visibility V. z k k n−k k n−k pacc͑n,V͒ = ͚ CnF D ͑¯pd¯␩ ͒͑1−¯pd¯␩ ͒ k=0 3. Bob’s detectors n n = ͑1−pd͓͒͑1−F␩͒ − ͑1−pd͒͑1−␩͒ ͔, Bob uses single-photon counters with a limited quantum ͑44͒ efficiency ␩ and a probability of dark count per gate pd. For simplicity of writing, in some intermediate formulas we shall k with Cn =n!/k!͑n−k͒!. The accepted-click rate in the z basis write ¯␩=1−␩ and ¯p =1−p . The gate here means that Bob z z d d is then Cacc͑V͒=⌺nജ0pB͑n͒pacc͑n,V͒; using some standard knows when a pulse sent by Alice is supposed to arrive, and calculation ͓23͔, we obtain for a Poissonian distribution opens his detectors only at those times; so here, “per ͑Bob’s͒ z gate” and “per ͑Alice’s͒ pulse” are equivalent. Typical values Cacc͑V͒ = ͑1−pd͓͒p͑0͉F␮t␩͒ − ͑1−pd͒p͑0͉␮t␩͔͒. −5 −6 nowadays are ␩Ӎ0.1 and pd ϳ10 –10 for the detection of ͑45͒ photons at telecom wavelengths. In the limit ␮t␩Ӷ1 ͑and pd Ӷ1, which is always the case͒, one finds Cz ͑V͒ϷD␮t␩+p . We highlighted the depen- B. Bob’s detection and error rates acc d dence of these quantities on V because it will be important Bob receives n photons with probability pB͑n͒ given in for what follows. Eq. ͑40͒. We want to compute his detection and his error When Bob now measures in the x basis, he accepts the rate. For definiteness, we suppose from now on that Alice ͑right͒ bit if he gets a click on the ͉−x͘ detector, and no click sends ͉sent͘=͉+z͘, and publicly declares this state and on the ͉+x͘ detector. Because of Eq. ͑42͒, we just have to ͉declared͘=͉+x͘. Bob guesses correctly if he measures in the 1 change F to 2 in the previous formulas: x basis and finds ͉ok͘=͉−x͘; he guesses wrongly if he mea- x n n sures in the z basis and finds ͉wrong͘=͉−z͘. pacc͑n͒ = ͑1−pd͓͒͑1−␩/2͒ − ͑1−pd͒͑1−␩͒ ͔, ͑46͒ Among the peculiarities of SARG04 which must be dis- x so that for Poissonian sources C =͑1−p ͓͒p͑0͉␮t␩/2͒−͑1 cussed, is the role of double clicks. In BB84, when both acc d −p p 0 ␮t␩ 1 ␮t␩+p . Since the two bases are ran- detectors click, the item is discarded: in fact, a double click d͒ ͑ ͉ ͔͒Ϸ 2 d domly chosen, the global probability for Bob to accept a can appear only if ͑i͒ Bob has received and detected two click is photons, in the wrong basis, or ͑ii͒ Bob has detected just one photon but has had a dark count in the other detector; in both 1 x 1 z cases, there is no way to tell the value of the bit sent by pacc͑n,V͒ = p ͑n͒ + p ͑n,V͒, ͑47͒ 2 acc 2 acc Alice. In SARG04, things are different because Bob guesses correctly the bit when he measures in the “physically wrong” and the accepted-click rate on Bob’s side ͑i.e., the length of basis ͑basis x with our convention͒. A double click may mean the sifted key͒ is

032301-8 SECURITY OF TWO QUANTUM CRYPTOGRAPHY … PHYSICAL REVIEW A 72, 032301 ͑2005͒

1 1 Hypothesis 1. Eve performs incoherent attacks: she at- C ͑V͒ = Cx + Cz ͑V͒. ͑48͒ acc 2 acc 2 acc tacks each pulse individually, and measures her quantum sys- tems just after the sifting phase. This hypothesis allows us to x z All the items Cacc being correct and all the items Cacc͑V͒ perform explicit calculations of an upper bound for the being wrong, the QBER is secret-key rate. We shall say more on these attacks in the 1 z next section ͑Sec. IV C 2͒. The hypothesis of incoherent at- Cacc͑V͒ Q = 2 . ͑49͒ tacks implies in particular that after sifting, Alice, Bob and Cacc͑V͒ Eve share several independent realizations of a random vari- able distributed according to a classical probability law. Un- For p Ӷ␮t␩Ӷ1 and DӶ 1 , we find d 2 der this assumption and the assumption of one-way error p correction and privacy amplification, the Csiszár-Körner Q Ϸ 2D +2 d ϵ Q + Q , ͑50͒ ␮t␩ opt det bound applies ͓19͔ and the achievable secret-key rate is given by Eq. ͑29͓͒24͔. 1 Hypothesis 2. Eve can replace the actual channel with a Cacc͑V͒Ϸ ␮t␩͑1+Qopt +2Qdet͒. ͑51͒ lossless channel. This allows her to take advantage of the 4 losses: she can block pulses on which she has poor or no As expected, the sifted-key rate increases in the presence of information, keep some photons out of multiphoton pulses, errors. Note also that the QBER is twice the one expected for etc. Because of Eve’s intervention, the pulses that reach Bob BB84, for the same parameters: now, ␮ is going to be larger obey the statistics pB͉E͑n͒, a priori different from the ex- for SARG04 than it is for BB84, so that Qdet is not really pected one ͑40͒. The most general assumption would consist larger; however, D is fixed by the visibility: SARG04 is thus in leaving pB͉E͑n͒ completely free, and estimate Eve’s infor- more sensitive to losses of visibility than BB84 is. mation from it. The most conservative assumption consists in Finally, allowing for Alice’s preprocessing, the mutual in- requiring pB͉E͑n͒=pB͑n͒ for all n, and aborting the protocol if formation between Alice and Bob is this requirement is not satisfied; this is the spirit of decoy- state protocols ͓6͔. In this paper, we choose an intermediate I AЈ:B = C V 1−h QЈ 52 ͑ ͒ acc͑ ͓͒ ͑ ͔͒ ͑ ͒ requirement: we constrain Eve to reproduce the expected x x with QЈ related to Q ͓Eq. ͑49͔͒ as in Eq. ͑31͒. count rates Cacc,C2, and the rate of no detection ͑note that the rate of inconclusive detections will be reproduced as 3. Double-click rate well͒. This assumption is consistent with the idea of intro- x,z The calculation of the double-click rates C2 is similar ducing no modification in the hardware: without allowing for x,z x,z to the one of Cacc. For each basis, it holds that C2 decoy states and/or more detectors, these rates are the only x,z x,z =⌺nജ2pB͑n͒p2 ͑n͒ where p2 ͑n͒ is the probability of a parameters that can be measured. Eve has also a constraint z z double click conditioned on the fact that exactly n photons on Cacc and C2, though of a different nature: these two quan- reach Bob. Consider first the z basis: one has to modify Eq. tities must depend on a single parameter V according to Eqs. ͑44͒ in order to describe a click in both detectors, so we have ͑45͒ and ͑55͒. k k to replace ͑¯pd¯␩ ͒ with ͑1−¯pd¯␩ ͒. Thence Hypothesis 3. We work in the trusted-device scenario. z n n While the optical error D in the quantum channel ͑the imper- p2͑n,V͒ =1−͑1−pd͓͒͑1−F␩͒ + ͑1−D␩͒ ͔ fect visibility͒ is entirely attributed to Eve’s intervention, we 2 n + ͑1−pd͒ ͑1−␩͒ . ͑53͒ assume that Eve has no access to Bob’s detector: ␩ and pd are given parameters for both Bob and Eve. Eve will of The double-click probability in the x basis is obtained by 1 course adapt her strategy to the value of these parameters, replacing both F and D by 2 ; by comparison with Eqs. ͑43͒ but she cannot modify them ͓25͔. and ͑46͒, one finds x x p2͑n͒ =1−p0͑n͒ −2pacc͑n͒. ͑54͒ 2. More on the class of attacks For Poissonian sources, this yields ͓23͔ In Hypothesis 1, we have explained that we restrict our z attention to incoherent attacks. Here is a detailed description C2͑V͒ =1−͑1−pd͓͒p͑0͉␮t␩F͒ + p͑0͉␮t␩D͔͒ of Eve’s strategy. Eve, located immediately outside Alice’s 2 station, makes a nondemolition measurement of the number + ͑1−pd͒ p͑0͉␮t␩͒, ͑55͒ of photons n in each pulse. This does not introduce any error and Cx = 1− 1−p p 0 ␮t␩/2 2. Having written down all 2 ͓ ͑ d͒ ͑ ͉ ͔͒ because ␳A ͓Eq. ͑37͔͒ is diagonal in the Fock basis. Based on Bob’s parameters, we can move on to present the class of this information, Eve implements an attack K with probabil- attacks by Eve that we consider. ity pK͑n͒, so that the channel Alice-Bob is of the form C. Eve’s attacks: Hypotheses, information, and constraints E E ␳B = ͓␳A͔ = ͚ pA͑n͚͒ pK͑n͒ K͓͉n␺͗͘n␺͉͔. ͑56͒ 1. Overview of the hypotheses n Kn Some of the hypotheses on Eve’s attacks have been rap- These are the attacks that we investigate. idly introduced in the previous sections. Here we make the Storage attack S. Ifn ജ2, Eve can choose to store kϽn exhaustive list of the assumptions. photons, while forwarding the remaining n-k photons to Bob

032301-9 BRANCIARD et al. PHYSICAL REVIEW A 72, 032301 ͑2005͒ on the lossless line. When Alice reveals the states, Eve the case of a dark count. On the one hand, Eve is willing to makes the measurement that maximizes her information, block a pulse only when she has little or no information on it thus guessing Alice’s bit correctly with probability pk =1/2 ͑typically, one- and two-photon pulses͒. On the other hand, +͑1/2͒ͱ1−1/2k. This is the original type of PNS attack ͓5͔. Alice and Bob will always choose ␮ such that Eve will not After Alice’s possible preprocessing ͑bit flip with probability be able to block all single- and two-photon pulses without Ј q͒, Eve’s guess is correct with probability pk =͑1−q͒pk changing Bob’s expected detection rate. Therefore, we set +q͑1−pk͒; whence Eve’s information becomes Ј pB͑n͒ = 0 for n ജ 3. ͑61͒ IS͑k͒ =1−h͑pk͒͑57͒ Letting the photons pass L. Finally, Eve may be forced to conditioned on Bob’s accepting the item. We denote by let all the photons in the pulse go to Bob in order to preserve s͑k͉n͒ the probability that Eve, having chosen to perform a the counting rates. In this case, Bob may accept the item but storage attack, stores exactly k photons. Eve does not get any information on Alice’s bit. However, Intercept-resend attack I. Ifn ജ3, the four states ␺ n, ͉ ͘ we shall consider with ͉␺͘=͉±z͘ or ͉±x͘, become linearly independent. Eve can then perform an unambiguous discrimination of the sent state, whose probability of success is pL͑n͒ = 0 for all n. ͑62͒ 1 ⌊͑n−1͒/2⌋ p ͑n͒ =1− ͑58͒ The reason is as follows. For n=1, Eve applies the U strat- OK ͩ 2ͪ egy which does not reduce the counting rates and gives her some information ͓for V=1, the U strategy with a distur- for nϾ3, this is a numerical result 8 . In case of success, ͑ ͓ ͔͒ ˜ Eve has full information about the bit and she forwards m bance D=0 is equivalent to pL͑1͔͒. For nϾ1, when losses new photons to Bob prepared in the state ͉␺͓͘any value m is are large enough, that is at not too short distances, condition chosen with probability r͑m͉n͔͒. Otherwise, she blocks the ͑62͒ is obviously part of the best strategy for Eve. So the item. Note that this strategy, contrary to the storage attack, only effect of this condition is to prevent us from studying requires neither a quantum memory ͑obviously͒ nor a loss- SARG04 at short distances ͑for the values of the parameters less line: having succeeded in unambiguous discrimination, used below, in particular for ␩=0.1, the shortest distance at Eve has the new photons prepared by an accomplice of hers which constraints can be satisfied is found to be ϳ24 km͒. who is close to Bob’s laboratory. This form of PNS attack Note that, for the qubit encoding, the channel ͑56͒ be- was first discussed by Dušek and coworkers ͓26͔. After Al- haves as a depolarizing channel. In fact, attacks S and I do ice’s preprocessing, Eve’s information in case of success be- not introduce any error, and attack U was shown in Sec. III C comes to induce a depolarizing channel between Alice and Bob. A comment is needed about the exhaustiveness of our list II͑n͒ϵII =1−h͑q͒, ͑59͒ of attacks. We have stressed enough that U is not optimized. again conditioned on Bob’s accepting the item. The list of zero-error attacks, on the contrary, is fairly com- Unitary interaction U. Both the S and the I attacks pro- plete among the incoherent PNS attacks for the analysis of vide Eve with information only thanks to the losses, and do SARG04 ͓28͔. One may well construct more general strate- not introduce any error in Alice-Bob correlations ͑V=1͒. If gies: e.g., for n=5, Eve may try I on three photons, and if there is a reduced visibility V=1−␧, Eve can also take ad- she does not succeed, she performs S on the remaining two. vantage of it by performing an attack which introduces some However, the mean number of photons ␮ will be chosen errors ͑and no losses͒. Noting that information on pulses small enough so that the meaningful items are those with n with nജ2 can be obtained using S or ͑for nജ3͒ I, we sup- ഛ3, n=4 items playing the role of a small correction, and all pose that errors will be introduced only to gain information the higher-number items being completely negligible. about n=1 items. Moreover, as mentioned above, ␧ is typi- cally quite small: instead of tackling the very hard problem 3. Eve’s information and constraints of optimizing this family of attack, for simplicity we choose We are now able to write down formulas for I͑AЈ:E͒ and a representative, namely the attack developed in Sec. III C. for the constraints that Eve must satisfy. For each n, Eve uses As described there, she obtains an information strategy X with probability pX͑n͒, so that we have ˜ IU͑D͒ =1−͚ pE=eh͑pAЈ=0͉E=e͒. ͑60͒ e pB͑1͒ + pU͑1͒ =1, n =1, ͑63͒ The important point to stress is that in the unitary operation U one must insert a value D˜ = 1 ͑1−˜V͒ which is in general 2 pB͑2͒ + pS͑2͒ =1, n =2, ͑64͒ larger than the average error D ͑in other words, ˜VഛV͒. This is because Eve introduces only errors in a fraction of the pulses, so in those items she can introduce more perturbation pS͑n͒ + pI͑n͒ =1, n ജ 3. ͑65͒ than the average ͓27͔. Blocking B. Eve blocks all the n photons. In this case of Under this family of attacks, Eve’s information on Alice’s course, Bob receives nothing and can accept the item only in bits after sifting and preprocessing is

032301-10 SECURITY OF TWO QUANTUM CRYPTOGRAPHY … PHYSICAL REVIEW A 72, 032301 ͑2005͒

˜ ˜ ˜ ជ ជ ជ I͑AЈ:E͒ = pA͑1͒pU͑1͒IU͑D͒pacc͑1,V͒ pA͑1͒pU͑1͒␩D = PB · ͓⌫͑F͒ − ⌫͑1͔͒, ͑76͒ n−1 where we have stored the probabilities pB͑n͒ and pB͉E͑n͒ in + ͚ pA͑n͒ pS͑n͚͒ s͑k͉n͒IS͑k͒pacc͑n − k,1͒ ជ ជ ជ ͩ the vectors PB and PB͉E and where the vectors ⌫͑x͒ depend nജ2 k=1 only on the detector’s efficiency ␩, their respective compo- n + pI͑n͒pOK͑n͒II ͚ r͑m͉n͒pacc͑m,1͒ ͑66͒ nents being ␥n͑x͒=͑1−x␩͒ for all nജ0. In particular, the ͩmജ1 ͪ last condition ͑76͒ together with ͑63͒ determines the error D˜ where the pacc͑n,V͒ are given in Eq. ͑47͒. that Eve can introduce on all the one-photon pulses that she Eve is going to choose her parameters in order to maxi- does not block. As expected, this relation reduces to D˜ =0 in mize I͑AЈ:E͒, under the constraints described in Hypothesis the case V=1. 2. To write down these constraints, one first notes that the In the case where Alice holds a Poissonian source with number of photons that reach Bob is distributed according to ជ ជ mean photon number ␮, we have PB ·⌫͑x͒=p͑0͉x ␮t␩͒, whence Eqs. ͑74͒–͑76͒ read explicitly pBE͑n Ͼ 0͒ = ␦n,1pA͑1͒pU͑1͒ + ͚ pA͑m͒pS͑m͒s͑m − n͉m͒ mϾn ជ ជ PBE · ⌫͑1͒ = p͑0͉␮t␩͒, ͑77͒ + ͚ pA͑m͒pI͑m͒pOK͑m͒r͑n͉m͒, ͑67͒ mജ3 ជ ជ PBE · ⌫͑1/2͒ = p͑0͉␮t␩/2͒, ͑78͒

pBE͑n =0͒ =1− ͚ pBE͑n͒. ͑68͒ ˜ nϾ0 p͑1͉␮͒pU͑1͒␩D = p͑0͉␮t␩F͒ − p͑0͉␮t␩͒. ͑79͒

Of course, there is no reason for pB͉E͑n͒ to be Poissonian, even if pA͑n͒ is. Now, according to Hypothesis 2, Eve is D. Optimization over Eve’s strategy and Alice’s constrained to satisfy parameters We have at present collected all the pieces that are needed ͚ pBE͑n͒p0͑n͒ϵ͚ pB͑n͒p0͑n͒, ͑69͒ n n for our study. For any fixed value of ␮ and q, Eve is going to choose her parameters pX͑n͒, s͑k͉n͒, and r͑m͉n͒ in order to maximize I͑AЈ:E͓͒Eq. ͑66͔͒ under the constraints ͑77͒–͑79͒. p ͑n͒px ͑n͒ϵ p ͑n͒px ͑n͒, ͑70͒ ͚ BE acc ͚ B acc Alice and Bob must choose ␮ and q in order to maximize Rsk n n ͓Eq. ͑29͔͒, with I͑AЈ:B͒ given in Eq. ͑52͒ and with I͑AЈ:E͒ computed as just described. This double optimization will be x x ͚ pBE͑n͒p2͑n͒ϵ͚ pB͑n͒p2͑n͒, ͑71͒ done numerically; for the case V=1, we shall also provide n n some analytical approximations, both as a consistency check for the numerics and as a tool for practical estimates. z z ˜ z ͚ pBE͑n͒pacc͑n,1͒ + q͑1͓͒pacc͑1,V͒ − pacc͑1,1͔͒ n 1. Restricting the number of free parameters z Even in the perspective of using a computer, we have to ϵ ͚ pB͑n͒pacc͑n,V͒, ͑72͒ n simplify the problem further: the number of free parameters is a priori infinite. In particular, we have to discuss the prob- abilities s͑k͉n͒ and r͑m͉n͒ associated, respectively, with the S z z ˜ z ͚ pBE͑n͒p2͑n,1͒ + q͑1͓͒p2͑1,V͒ − p2͑1,1͔͒ and I attacks. These are related to the number of photons that n Eve forwards to Bob. We first notice that the constraints ͑77͒ z and ͑78͒ can be satisfied up to the order O͑␮t␩͒3 by setting ϵ ͚ pB͑n͒p2͑n,V͒͑73͒ n 2 pBE͑1͒ = ␮t − ͑␮t͒ , ͑80͒ with V the average visibility that Eve chooses to introduce and q͑1͒=pA͑1͒pU͑1͒ the only cases where Eve introduces 1 ˜ p ͑2͒ = ͑␮t͒2, ͑81͒ errors. Note that the value of V is defined by Eqs. ͑72͒ and BE 2 ͑73͒. The five constraints ͑69͒–͑73͒ are actually not indepen- and all the others pB͉E͑nϾ2͒=0; that is, for each item, Eve dent and can be reduced to the following set ͑derivation in forwards either one or two photons to Bob. We consider that Appendix D͒: Eve forwards two photons only after some I attacks, because this does not cost her any information; whereas, were she to ជ ជ ជ ជ PBE · ⌫͑1͒ = PB · ⌫͑1͒, ͑74͒ forward two photons in an S attack, fewer photons would be left in her quantum memory to estimate the state. When Eve ជ ជ ជ ជ performs the I attack on a three-photon pulse, she can for- PBE · ⌫͑1/2͒ = PB · ⌫͑1/2͒, ͑75͒ ward either one or two photons; when she performs it on a

032301-11 BRANCIARD et al. PHYSICAL REVIEW A 72, 032301 ͑2005͒ higher-n pulse, she always forwards two photons. In conclu- Remarkably, most of the features of Eve’s optimal attack sion, we assume can be rederived analytically and the derivation is indepen- dent of the form of the pA͑n͒. This is expected, because Eve s͑k͉n͒ = ␦k,n−1 for all n, ͑82͒ first measures the number of photons n, then adapts her strat- egy to her result; thus, the frequency of occurrence of any r͑2͉3͒ =1−r͑1͉3͒, ͑83͒ value of n does not play any role in defining her best attack for each n—although it will of course determine the fraction r͑m͉n͒ = ␦2,m for all n ജ 4. ͑84͒ of information that each attack provides her. The price to pay for the analytical approach is that, to avoid getting lost, one Summarizing, the free parameters for Eve’s attack are had better neglect the constraint ͑81͒ on two photons. We present this analytical derivation in Appendix E. In summary, ͕pU͑1͒,pS͑2͒,pS͑3͒,pI͑3,2͒,pS͑4͒,…,pS͑nmax͖͒ ͑85͒ a numerical approach, which assumes a Poissonian distribu- where pI͑3,2͒=pI͑3͒r͑2͉3͒ and nmax is a cutoff in the number tion for Alice’s source and can deal with the full set of con- of photons allowed in a pulse—we have chosen nmax=7 in straints, and an analytical one, in which the independence of what follows, although a posteriori we verified that nmax=5 the source’s statistics is explicit but the constraints must be would have given the same results except for the shortest simplified, converge to the same result: we have indeed distances that we considered. This choice of free parameters, found Eve’s optimal attacks within the class which we are in particular the choice of pI͑3,2͒ instead of r͑2͉3͒, is useful considering, independently of the statistics of Alice’s because all the constraints ͑79͒–͑81͒ become linear in the source—our assumptions on Eve’s attacks are reasonable parameters; of course, one must add a fourth linear con- provided the source is such that pA͑1͒ϾpA͑2͒ϾpA͑3͒... straint, namely, 3. Results, part 2: ␮ and Rsk pS͑2͒ + pI͑3,2͒ ഛ 1. ͑86͒ Having Eve’s best attack, we can compute for any dis- Maximization of a function ͑here, Eve’s information͒ under a tance the optimal value of ␮ and the corresponding upper set of linear constraints is achieved in MATLAB with the pre- bound Rsk on the secret-key rate. The results of numerical defined function “fmincon.” At this point, we can run our optimization are shown in Fig. 3. Several points are worth numerical optimization of ␮ as a function of the distance. stressing. ͑1͒ We recall first that these results are valid for a large 2. Results, part 1: Eve’s parameters but still restricted class of attacks by the eavesdropper, ac- cording to the hypotheses described in Secs. IV C and We have run our software with the following parameters: IV D 1. Moreover, the curve for V=0.95 depends also on our ␣=0.25, ␩=0.1, p =10−5. These are not the very best values d choice of introducing a U attack only on the n=1 pulses. that we can achieve in the laboratory, but we have already Thus, R is an upper bound on the achievable secret-key used them many times and it will be useful for comparison, sk rate, which remains to be computed. especially with Ref. ͓15͔. The numerical simulation achieves ͑2͒ The optimal value of ␮ is above 0.1 for all the range a faithful result only for dտ24 km, because of Eq. 62 , and ͑ ͒ that we considered, both for V=1 and for V=0.95; for d for Vտ0.92 recall that for VՇ0.825 the secret-key rate be- ͑ =24 km and V=1 we have ␮ =1.55. In contrast to the case comes zero even in a single-photon implementation; it is opt of BB84 ͓15͔, ␮ does not decrease faster to zero as the criti- then not astonishing that the visibility becomes more critical cal distance approaches. when Eve can take advantage also of multiphoton pulses͒. ͑3͒ Alice’s preprocessing is nontrivial ͑qϾ0͒ only in the Here is what is observed for the optimal parameters of Eve’s critical region where the presence of dark counts bends the attack. curve below the linear ͑in logarithmic scale͒ regime. In prin- ͑1͒ n=1. p ͑1͒ is always zero for V=1. This means that U ciple, one tends to avoid working in that region. in this case Eve blocks all the single-photon pulses. For V As in the case of Eve’s parameter, we complement the ˜ ˜ Ͻ1, it turns out that D is constant at the value D0 =0.191 numerical optimization with some analytical studies, even at over all the distances ͑more precisely, over all the distances the price of some approximations: this is useful both to le- for which the best preprocessing by Alice consists in doing gitimate the numerical result and to provide formulas for nothing, which are all the region of interest as will be ex- rapid estimates. We consider ␮t␩Ӷ1 and obviously pd Ӷ1. plained later͒. The value of pU͑1͒ is thus determined by Eq. We suppose that Eve forwards always one photon to Bob, ͑79͒. thus taking the one-photon constraint ͑80͒ at the leading or- ͑2͒ n=2. pS͑2͒ is between zero and one. This means that der and neglecting the two-photon constraint ͑81͒; in addi- Eve cannot block all the two-photon items. tion, we restrict to the case V=1, whence constraint ͑79͒ is ͑3͒ n=3. pS͑3͒ is zero, pI͑3,2͒ is between zero and one. automatically satisfied, and we neglect Alice’s preprocessing That is, when the pulse contains three photons, Eve always by setting q=0. From the study of Eve’s attack we know that performs the I attack; sometimes she sends out one photon we can set pU͑1͒=0, pS͑3͒=0, and pS͑nജ4͒=1. For a Pois- and sometimes two. Actually, this rate of forwarding two sonian source then photons is already enough to reproduce the constraint ͑81͒, as is implied by the following item. ␮t␩ I͑A:B͒Ӎͩ + pd͓ͪ1−h„Q͑␮͒…͔, ͑87͒ ͑4͒ nജ4. pS͑n͒=1: Eve performs always the S attack. 4

032301-12 SECURITY OF TWO QUANTUM CRYPTOGRAPHY … PHYSICAL REVIEW A 72, 032301 ͑2005͒

Thus, in practice, one can use these two equations to esti- mate the optimal parameters and to keep away from the lim- iting distance. In order to reach analytical approximate solutions to the maximization problem, we further neglect the correction 1 −h͑Q͒ in the expression of I͑A:B͒͑i.e., we suppose ␮t␩ ӷpd͒, the contribution of the pulses with nജ4 photons in the expression of I͑A:E͒, and the factor e−␮ in p͑3͉␮͒—this last assumption is the worst one, because we are dealing with ␮տ1 at short distance. That leads to ␩ ␮3 R Ϸ ͓1−I ͑1͔͒ ␮t − . ͑90͒ sk 4 S ͩ 12ͪ The optimum is ␩ R Ϸ ͓1−I ͑1͔͒t3/2 for ␮ =2ͱt. ͑91͒ sk 3 S opt These values are plotted in Fig. 3 together with the result of the exact numerical optimization. We see that the approxima- tions are rough as expected but grasp the correct order of magnitude. Finally note that, contrary to the case of BB84 ͓15͔, we have not been able to find a closed analytical ex- pression for the limiting distance, the difference here being that ␮ does not fall rapidly to zero when approaching this distance.

E. Attenuated laser: Comparison with BB84 protocol Finally, we compare the performances of the SARG04 and those of the BB84 under identical conditions, from Ref. ͓15͔. Since Alice’s preprocessing was not taken into account in that work, for coherence we compare the results for q=0—it is not difficult to see that the contribution of this preprocessing in BB84 is numerically negligible, as it is for FIG. 3. ͑Color online͒ Optimal ␮ and upper bound Rsk on the secret-key rate per pulse ͑logarithmic scale͒ for Poissonian sources SARG04 ͓29͔. −5 The optimal ␮ and the upper bound R on the secret-key as a function of the distance, for ␣=0.25, ␩=0.1, and pd =10 , and sk for V=1 and 0.95. The full thick lines are the result of the numerical rate are plotted in Fig. 4. We see that SARG04 allows an optimization, considering also Alice’s preprocessing; the dashed increase of the secret-key rate at moderately large distance, thick lines are the same, without Alice’s preprocessing ͑q=0͒. The and of the limiting distance. It seems that BB84 achieves a full thin lines are the analytical approximations for V=1, Eq. ͑91͒; better secret-key rate at short distance. Although we cannot the dashed thin line in the upper figure is the critical value ␮ make any final commitment because we have made hypoth- =2ͱ3t at which Rsk=0 according to the approximate formula ͑90͒. eses that prevent us from studying that regime, one might understand it from the following argument: at short distance, Eve can do essentially no PNS attack for inefficient detec- ␩ 1 I͑A:E͒Ӎ ␮tIS͑1͒ + 2 p͑3͉␮͓͒1−IS͑1͔͒ tors; therefore, the sifting ratio becomes the important 4 ͩ parameter—now, in SARG04 only one-quarter of the items are kept, while in BB84 half of the items are kept. + ͚ p͑n͉␮͓͒IS͑n −1͒ − IS͑1͔͒ , ͑88͒ nജ4 ͪ The present analysis supersedes the one made in Refs. ͓7,8͔, which supposed a fixed value of ␮ for all distances. with

1 V. CONCLUSION Q͑␮͒ = . ͑89͒ 2+␮t␩/2p d In conclusion, we have studied the SARG04 protocol for These are nonalgebraic functions, so the analytical maximi- two different types of source of light on Alice’s side. zation of Rsk is still impossible; but it is easily done numeri- For the implementation using single-photon sources, we cally. It yields a careful estimate of both ␮ and Rsk in the have obtained a lower and an upper bound for security typical working regime ͑40–70 km in Fig. 3͒, diverges for against all possible attacks by the eavesdropper. These shorter distances, and underestimates the limiting distance. bounds are close to those obtained for the BB84 protocol.

032301-13 BRANCIARD et al. PHYSICAL REVIEW A 72, 032301 ͑2005͒

ACKNOWLEDGMENTS We thank Antonio Acín and the members of the QIT workgroup in the SECOQC network for discussions, and Ar- mand Niederberger for help with the software. We acknowl- edge financial support from the European Project SECOQC and from the Swiss NCCR “Quantum Photonics.”

APPENDIX A In this appendix we give more details about the calcula- tion of the lower bound. The following is not specific to the SARG04 protocol, but can be applied to any protocol. As discussed in Sec. III B, in order to compute a lower bound on the secret-key rate, we can consider the state that Alice and Bob share before the preprocessing to be of the form ͑10͒, which we rewrite here:

␳2 = ␭1P⌽+ + ␭2P⌽− + ␭3P⌿+ + ␭4P⌿−. ͑A1͒

Eve holds a system which makes a purification of ␳2:

+ − + ͉␹͘ABE = ͱ␭1͉⌽ ͘AB͉00͘E + ͱ␭2͉⌽ ͘AB͉01͘E + ͱ␭3͉⌿ ͘AB͉10͘E − + ͱ␭4͉⌿ ͘AB͉11͘E. ͑A2͒ Eve’s and Bob’s partial states are, respectively,

1 ␳ = diag͑␭ ,␭ ,␭ ,␭ ͒, ␳ = 1 ͑A3͒ E 1 2 3 4 B 2

whence S͑␳E͒=−⌺i␭iln ␭i and S͑␳B͒=1. When Alice has measured ͉0͘ or ͉1͘, Bob and Eve share one of the states

͉␹0͘BE ϰ A͗0͉␹͘ABE = ͉0͘B͑ͱ␭1͉00͘ + ͱ␭2͉01͒͘E + ͉1͘B͑ͱ␭3͉10͘

+ ͱ␭ ͉11͒͘E, ͑A4͒ FIG. 4. ͑Color online͒ Optimal ␮ and upper bound Rsk on the 4 secret-key rate per pulse ͑logarithmic scale͒ for Poissonian sources as a function of the distance, for ␣=0.25, ␩=0.1, and p =10−5, and d ͉␹1͘BE ϰ A͗1͉␹͘ABE = ͉0͘B͑ͱ␭3͉10͘ − ͱ␭4͉11͒͘E + ͉1͘B͑ͱ␭1͉00͘ for V=1,0.95. Thick lines, SARG04 ͑identical to Fig. 3, with q =0͒; thin lines, BB84, under the same conditions. − ͱ␭2͉01͒͘E, ͑A5͒ which give in the computational bases However, if a channel of a given visibility is available, then ␭ ͱ␭ ␭ the QBER of SARG04 is twice the QBER of BB84. Inter- 1 1 2 estingly, the upper bound for SARG04 was obtained for an ͱ␭ ␭ ␭2 ␳0 = 1 2 , A6 incoherent attack based on a unitary which is not the phase- E ͑ ͒ ␭3 ͱ␭3␭4 covariant quantum cloner. ΂ ͱ␭3␭4 ␭4 ΃ For the realistic implementation using an attenuated laser ͑Poissonian source͒, we have restricted the class of Eve’s attacks to incoherent attacks, in particular the most studied ␭1 − ͱ␭1␭2 forms of PNS attacks. In this case, SARG04 performs better ͱ 1 − ␭1␭2 ␭2 than BB84, both in the achievable secret-key rate and in the ␳E = , ͑A7͒ limiting distance. ␭3 − ͱ␭3␭4 These results strengthen the conclusion of Refs. 7,8,30 : ͓ ͔ ΂ − ͱ␭3␭4 ␭4 ΃ once quantum correlations have been distributed, different ways of encoding and decoding the classical information and lead to different performances according to the physical characteristics of the setup. The full potentialities of this in- 0 ␭1 + ␭2 1−Q ␳B = ͩ ͪ = ͩ ͪ, ͑A8͒ sight have still to be developed. ␭3 + ␭4 Q

032301-14 SECURITY OF TWO QUANTUM CRYPTOGRAPHY … PHYSICAL REVIEW A 72, 032301 ͑2005͒

␭ + ␭ Q ˜ + + 1 3 4 ␭1 = C͗⌽ ͉␳0͉⌽ ͘, ␳B = ͩ ͪ = ͩ ͪ. ͑A9͒ ␭1 + ␭2 1−Q ˜ − − − − If q=pAЈ
A denotes the probability for Alice to flip her bit ␭2 = C͓͗⌿ ͉␳0͉⌿ ͘ +2͗␹ ͉␳0͉␹ ͔͘, ͑preprocessing͒, the state of Alice and Eve is ˜ + + ␭3 = C͗␹ ͉␳0͉␹ ͘, 1 0 ␳AЈE = ͓͑͑1−q͉͒0͗͘0͉ + q͉1͗͘1͉͒  ␳ + ͑q͉0͗͘0͉ + ͑1−q͉͒1͘ 2 E ␭ = C˜ ͓2͗⌿−͉␳ ͉⌿−͘ + ͗␹−͉␳ ͉␹−͔͘ ͑B1͒ 1 1 4 0 0 ϫ͗1͉͒  ␳1 ͔ = ͉0͗͘0͉  ␴0 + ͉1͗͘1͉  ␴1 , ͑A10͒ E 2 E 2 E where ͉␹±͘=͑1/ͱ2͉͒͑⌽−͘±͉⌿+͒͘ and C˜ =C/2 with C defined 0 0 1 1 0 1 in Eq. ͑9͒. Note that C is not the same as in Eq. ͑13͒; also, where ␴ =͑1−q͒␳ +q␳ and ␴ =q␳ +͑1−q͒␳ . Then, E E E E E E the structure of Eq. ͑13͒ would be recovered if we replaced ± 1 − − 1 +͘ 1 0 1 1 the states ͉␹ ͘ by the incoherent mixture 2 ͉⌽ ͗͘⌽ ͉+ 2 ͉⌿ S͑␳AЈE͒ =1+ S͑␴ ͒ + S͑␴ ͒. ͑A11͒ + 2 E 2 E ϫ͗⌿ ͉. The constraints imposed by ͑B1͒ are less tight than those With similar notations, imposed by Eq. ͑13͒: actually, ␭1 and ␭3 are unconstrained but for Eq. ͑12͒. For ␭2 and ␭4, it is easy to see that ␭2 1 0 1 1 S͑␳AЈB͒ =1+ S͑␴ ͒ + S͑␴ ͒. ͑A12͒ ˜ − − 2 B 2 B −2␭4 =−3C͗⌿ ͉␳0͉⌿ ͘ഛ0 and symmetrically ␭4 −2␭2 = −3C˜ ͗␹−͉␳ ͉␹−͘ഛ0, whence Finally, 0 ␭2 1 0 ഛ␭4 ഛ min͑2␭2,Q͒. ͑B2͒ R͑␴AЈBE͒ = S͑␳AЈE͒ − S͑␳E͒ − ͓S͑␳AЈB͒ − S͑␳B͔͒ = ͓S͑␴ ͒ 2 2 E Using this constraint, the optimization of r gives a lower + S͑␴1 ͒ − S͑␴0 ͒ − S͑␴1 ͔͒ +1−S͑␳ ͒. ͑A13͒ 1 E B B E bound Qഛ8.90% ͑Qഛ7.74% if we had neglected prepro- This is the function which must be optimized over the ␭i cessing͒. Thus, the lower bound obtained for the two-set pro- compatible with the constraints ͑which define the protocol͒ tocol is worse than the one found for the original four-set and over the bitwise preprocessing: protocol. This is not a conclusive proof of inequivalence, in so far as we do not know whether each bound is tight. r1 = sup infR͑␴AЈBE͒. ͑A14͒ ෈ q ͓0,0.5͓␭Јs APPENDIX C APPENDIX B The calculations leading to the expression of Eve’s infor- In the main text, we have computed the lower bound for mation ͑27͒ plotted in Fig. 1 can be done analytically up to the SARG04 protocol implemented with single-photon some extent. The three eigenvalues of MA are ␭± sources. One might ask what happens if the SARG04 proto- =±2ͱD͑2−3D͒/͑1+2D͒ and ␭0 =0, whence the natural la- beling for the index e of the main text is col is modified if only two “opposite” sifting sets, say S++ S and −−, are used instead of all the four. e ෈ ͕0, +,− ͖. ͑C1͒ The interest in the two-set protocol is a practical one. The sifting of the four-set protocol requires Alice to use a random In the basis where ͉00͘ϵeˆ1, ͉01͘ϵeˆ2, and ͉10͘ϵeˆ3, and with bit for each item ͑for instance, if she has sent ͉+z͘, she must ␣± =͑ͱD±ͱ2−3D͒/ͱ1−2D, the corresponding normalized still decide whether to announce S++ or S+−͒. In a true imple- eigenvectors are mentation, the production of local random bits is one of the ␣± most time-consuming tasks. In the two-set protocol, an easier 1 sifting procedure can be implemented: for instance, Bob re- ͉m±͘ = 1 , 1+ 1 ␣2 veals whether he has got a detection in the + or in the − 2 ± ΂− 1 ␣2 ΃ 2 ± detector. If Alice has sent a state in S++͑S−−͒, the detection in −͑+͒ is conclusive: then, Alice tells Bob whether the bit is ͱD accepted or discarded. Obviously, no random bit is needed 1 for such a sifting. ͉m0͘ = ͱ1−2D . ͱ2−3D The intuition based on incoherent attacks suggests that the ΂ͱ1−2D ΃ two- and the four-set protocols are equivalent: after all, Eve has to distinguish among the same four states before sifting One sees that the calculation is heavy, and since the function takes place; and after sifting, her knowledge is the same in ͑27͒ is not algebraic, ultimately one must make use of the both protocols. While this equivalence probably holds in- computer; that is why these analytical results are of limited deed, the lower bound computed with our method is slightly utility. Still, we can use them to obtain more insight on Hel- less favorable in the two-set case. In fact, one finds after strom’s strategy. In fact, the general calculation scheme de- some algebra scribed in the main text can be described as follows.

032301-15 BRANCIARD et al. PHYSICAL REVIEW A 72, 032301 ͑2005͒

͑1͒ When Eve finds the positive eigenvalue ␭+, she ជ ជ 2 ជ ជ 1−͑1−pd͓͒1+PB͉E · ⌫͑1͔͒ + ͑1−pd͒ PBE · ⌫͑1͒, guesses Alice’s bit to be 0 ͑see the definition of MA͒; when she finds the negative eigenvalue ␭−, she guesses Alice’s bit to be 1. These two cases appear with the same probability which is entirely determined by Eq. ͑74͒ and is independent ˜ ͑pE=+=pE=−͒ and Eve’s guess is correct with the same prob- of V. However, the RHS of Eq. ͑73͒ does depend on V. Consequently, for the strategies that we have considered, ability pguess=pA=0͉E=+=pA=1͉E=−. constraint 73 is automatically satisfied by Eq. 74 if V=1 ͑2͒ With probability pE=0, Eve finds the eigenvalue ␭0, ͑ ͒ ͑ ͒ from which she cannot draw any conclusion. Indeed, it is the and cannot be satisfied exactly if VϽ1. In this last case, A=0 A=1 however, the discrepancy is rather small. In fact case: ͗m0͉MA͉m0͘=0 implies ͗m0͉␳E ͉m0͘=͗m0͉␳E ͉m0͘, whence pE=0͉A=0=pE=0͉A=1=pE=0. Consequently, using Bayes’ 1 pz ͑n,V͒ = pz ͑n,1͒ + n␩D͓1−͑1−␩͒n−1͔ + O͑␩D͒2 rule ͑28͒, we find pA=0͉E=0= 2 . 2 2 Following these remarks, Eve’s information ͑27͒ can be re- written as and the leading term in the discrepancy will be the one as- sociated with n=2, that is, I͑A:E͒ = ͑1−pE=0͓͒1−h͑pguess͔͒. ͑C2͒ z z 2 pBE͑2͉͒p2͑2,V͒ − p2͑2,1͉͒Ϸ pBE͑2͒2␩ D. ͑D5͒

APPENDIX D Specifically, for a Poissonian source the discrepancy is z z In this appendix we show how the five constraints ͉C2͑V͒−C2͑1͉͒, i.e., using Eq. ͑55͒ ͑69͒–͑73͒ reduce to the three conditions ͑74͒–͑76͒, as claimed in Sec. IV C 3. ͓p͑0͉x͒ +1͔ − ͓p͑0͉xF͒ + p͑0͉xD͔͒ = FDx2 + O͑x3͒ Using the expression ͑43͒ for p0͑n͒, we can rewrite the first constraint ͑69͒ as with x=␮t␩, consistent with Eq. ͑D5͒ using Eq. ͑81͒. Since

n n typical values are ␩Ϸ0.1 and DՇ1%, this discrepancy is ͚ pBE͑n͒͑1−␩͒ ϵ ͚ pB͑n͒͑1−␩͒ ͑D1͒ small. Thus, we can assume that Eq. ͑73͒ is satisfied as well, n n and we have proved that the constraints ͑69͒–͑73͒ reduce to which is Eq. ͑74͒. By replacing the expression ͑46͒ for ͑74͒–͑76͒claimed. x pacc͑n͒ into Eq. ͑70͒, we find that this second constraint is satisfied by adding to Eq. ͑D1͒ the condition APPENDIX E p ͑n͒͑1−␩/2͒n ϵ p ͑n͒͑1−␩/2͒n ͑D2͒ ͚ BE ͚ B In this appendix, we rederive the results on the optimal n n parameters for Eve’s attack that have been obtained by nu- which is Eq. ͑75͒. Finally, because of Eq. ͑54͒, the third merical optimization ͑see sec. IV D 2. As we said there, we constraint ͑71͒ is automatically satisfied if the first two are. work in a more restricted setting, by neglecting the possibil- In summary, the first three constraints ͑69͒–͑71͒ are equiva- ity of double counts: Eve forwards always one photon ͑if lent to the two conditions ͑74͒ and ͑75͒. any͒ to Bob, that is, s͑m͉n͒=r͑m͉n͒=␦m,1 for all n. We also Consider now constraint ͑72͒. From Eq. ͑44͒, we have neglect Alice’s preprocessing, which makes very minor modifications in the end ͑i.e., q=0͒. However, we do not pz n,1 = p 1−p 1−␩ n for all n, D3 acc͑ ͒ d͑ d͒͑ ͒ ͑ ͒ assume that Alice’s source is Poissonian. We study the constraints first. Since Eve forwards only z ˜ ˜ z pacc͑1,V͒ = ͑1−pd͒␩D + pacc͑1,1͒, ͑D4͒ one photon to Bob, pB͉E͑nϾ1͒=0 and pB͉E͑0͒=1−pB͉E͑1͒. Constraint ͑75͒ cannot be satisfied, but at long distance this whence the left-hand side ͑LHS͒ of Eq. ͑72͒, up to the factor is supposed to be a very small contribution. Constraint ͑74͒ ͑1−pd͒, reads ជ ជ reads pB͉E͑1͒=C where C=͓PB ·⌫͑1͒−1͔/␩ depends only on ˜ ជ ជ parameters that are outside Eve’s control; and pA͑1͒pU͑1͒␩D + pdPBE · ⌫͑1͒. Using again Eq. ͑44͒, the RHS of Eq. ͑72͒, up to the factor p 1 = p 1 p 1 + p 2 p 2 + p n p n 1−p , reads BE͑ ͒ A͑ ͒ U͑ ͒ A͑ ͒ S͑ ͒ ͚ A͑ ͓͒ S͑ ͒ ͑ d͒ nജ3 n n Pជ ជ + p n p n . ͚ pB͑n͓͒͑1−F␩͒ − ͑1−␩͒ ͔ + pd B · ⌫͑1͒. I͑ ͒ OK͑ ͔͒ n ˜ Since we have already imposed ͑74͒, equality of these two The constraint ͑76͒ is of the form pA͑1͒pU͑1͒=͑1/D͒CЈ expressions is obtained if and only if 76 holds. ជ ជ ជ ͑ ͒ where CЈ=PB ·͓⌫͑F͒−⌫͑1͔͒/␩ depends only on parameters Finally, we have to discuss Eq. ͑73͒. From Eq. ͑53͒ we that are outside Eve’s control. Using these two constraints, note that pz ͑1,V͒ is actually independent of V because this 2 we can express pA͑1͒pU͑1͒ and pA͑2͒pS͑2͒ as a function of parameter appears in the combination F+D=1. In particular, the other parameters. The quantity that Eve must optimize z ˜ z p2͑1,V͒=p2͑1,1͒ whence the LHS of Eq. ͑73͒ becomes ͓Eq. ͑66͔͒ reads now

032301-16 SECURITY OF TWO QUANTUM CRYPTOGRAPHY … PHYSICAL REVIEW A 72, 032301 ͑2005͒

˜ ˜ Eve’s best attack is thus reduced to the study of K͑D˜ ͒ and of I͑A:E͒ = pA͑1͒pU͑1͒IU͑D͒␰ + pA͑2͒pS͑2͒IS͑1͒␰ + ͚ pA͑n͒ nജ3 L͑n͒ for all n. These functions are independent of the statis- ˜ tics pA͑n͒ of Alice’s source. ϫ͓pS͑n͒IS͑n −1͒ + pI͑n͒pOK͑n͔͒␰ = ␰ CЈK͑D͒ ͩ The function K͑D˜ ͒ depends only on one free parameter D˜ and is independent of the distance. Therefore, Eve will maxi- + p n p n L n + CI 1 + p n p n ͚ A͑ ͒ S͑ ͒ ͑ ͒ S͑ ͒ ͚ A͑ ͒ OK͑ ͒ mize her information by introducing always the same nജ3 nജ3 ˜ ˜ amount of error D0, the one that maximizes K͑D͒. If we ϫ͓1−IS͑1͔͒ ͑E1͒ −5 ˜ ͪ insert ␩=0.1 and pd =10 in ␰/␰, the maximum is obtained for D˜ Ӎ0.191, which is exactly the value found by the nu- ˜ ˜ 0 where we have defined ␰=pacc͑1,V͒, ␰=pacc͑1,1͒ and merical optimization. The study of the L͑n͒ is just as easy. In fact, by using the 1 ˜␰ K͑D˜ ͒ = I ͑D˜ ͒ − I ͑1͒ , ͑E2͒ explicit expressions ͑57͒ for I ͑n͒ and ͑58͒ for p ͑n͒, one ˜ ͩ ␰ U S ͪ S OK D sees that L͑3͒Ӎ−0.054 while L͑n͒Ͼ0 for nജ4. Thence Eve’s information ͑E1͒ is maximized by the choice pS͑3͒ L͑n͒ = IS͑n −1͒ − IS͑1͒ − pOK͑n͓͒1−IS͑1͔͒. ͑E3͒ =0 and pS͑nജ4͒=1: Eve performs always the I attack when In writing Eq. ͑E1͒ we made explicit use of the constraints n=3 and the S attack when nജ4. Again, this is exactly what and of pI͑n͒=1−pS͑n͒ for nജ3. The problem of finding has been found in the numerical optimization.

͓1͔ N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Rev. Mod. ͓14͔ Here we study only individual PNS attacks, as in all the works Phys. 74, 145 ͑2002͒. devoted to PNS attacks we are aware of. In principle, one can ͓2͔ D. Gottesman, H.-K. Lo, N. Lütkenhaus, and J. Preskill, Quan- define a general PNS attack, in which Eve starts by counting tum Inf. Comput. 4, 325 ͑2004͒; see references therein for the number of photons in each pulse, but may then adopt a previous works. coherent strategy. ͓3͔ We do not consider here QKD with continuous variables, ͓15͔ A. Niederberger, V. Scarani, and N. Gisin, Phys. Rev. A 71, which uses homodyne measurements instead of photon count- 042316 ͑2005͒. ing. A protocol with photon counting which needs intrinsically ͓16͔ For a BB84-like encoding, one can modify the protocol in a weak laser source has been proposed recently: N. Gisin, G. order to use almost always one basis, and use the other just for Ribordy, H. Zbinden, D. Stucki, N. Brunner, and V. Scarani, monitoring the presence of the eavesdropper. The analog here e-print quant-ph/0411022. would consist in Alice sending almost always either ͉+z͘ or ͓4͔ B. Huttner, N. Imoto, N. Gisin, and T. Mor, Phys. Rev. A 51, ͉+x͘: this makes SARG04 similar to the Bennett 1992 protocol 1863 ͑1995͒;H. P. Yuen, Quantum Semiclassic. Opt. 8, 939 ͓C. H. Bennett, Phys. Rev. Lett. 68, 3121 ͑1992͔͒, where the ͑1996͒. monitoring is not made by a strong pulse but by some decoy ͓5͔ N. Lütkenhaus, Phys. Rev. A 61, 052304 ͑2000͒;G. Brassard, states. N. Lütkenhaus, T. Mor, and B. C. Sanders, Phys. Rev. Lett. ͓17͔ P. W. Shor and J. Preskill, Phys. Rev. Lett. 85, 441 ͑2000͒. 85, 1330 ͑2000͒. ͓18͔ In fact, any definition of Bob’s operators B␴␻ that would lead ͓6͔ W.-Y. Hwang, Phys. Rev. Lett. 91, 057901 ͑2003͒;X.-B. to Eq. ͑6͒is valid. The one we have chosen is such that A␴␻ + + Wang, ibid. 94, 230503 ͑2005͒;H.-K. Lo, X. Ma, and K. Chen,  B␴␻͉⌽ ͘=͑1/2͉͒⌽ ͑͘up to a global phase͒: if the state ar- ibid. 94, 230504 ͑2005͒. rives unperturbed at Alice and Bob, the sifting operators sim- ͓7͔ V. Scarani, A. Acín, G. Ribordy, and N. Gisin, Phys. Rev. Lett. ply introduce losses ͑the factor 1/2, which leads to the ex- 92, 057901 ͑2004͒. pected sifting rate of SARG04͒. ͓8͔ A. Acín, N. Gisin, and V. Scarani, Phys. Rev. A 69, 012309 ͓19͔ I. Csiszár and J. Körner, IEEE Trans. Inf. Theory IT-24, 339 ͑2004͒. ͑1978͒. ͓9͔ K. Tamaki and H.-K. Lo, e-print quant-ph/0412035. ͓20͔ In the first version of their work ͓9͔, still available on the ͓10͔ C. H. Bennett and G. Brassard, in Proceedings of the IEEE ArXiV, Tamaki and Lo found a worse bound as follows: they 1 1 1 International Conference on Computers, Systems and Signal found ephase=͑3/2͒ebit, where ebit is the same as our Q. This is 1 1 Processing, Bangalore, India ͑IEEE, New York, 1984͒, pp. plugged into 1−h͑ebit͒−h͑ephase͒ജ0, h being binary entropy, 1 175–179. and gives ebitՇ8.90%. ͓11͔ B. Kraus, N. Gisin, and R. Renner, e-print quant-ph/0410215. ͓21͔ C. W. Helstrom, Quantum Detection and Estimation Theory ͓12͔ R. Renner, N. Gisin, and B. Kraus, e-print quant-ph/0502064. ͑Academic Press, New York, 1976͒. ͓13͔ R. B. Griffiths and C.-S. Niu, Phys. Rev. A 56, 1173 ͑1997͒;D. ͓22͔ One can easily translate the lower and upper bounds for Q in Bruß, M. Cinchetti, G. M. D’Ariano, and C. Macchiavello, terms of V, but this translation is not really meaningful: the ibid. 62, 012302 ͑2000͒;N. J. Cerf, J. Mod. Opt. 47, 187 bounds have been obtained, as they should be, without any ͑2000͒. hypothesis on Eve’s attack; while a visibility can be defined

032301-17 BRANCIARD et al. PHYSICAL REVIEW A 72, 032301 ͑2005͒

only if we assume that Eve’s attack is such that the channel p͑D˜ ͓͒in which case, if p͑0͒
0, she would still sometimes Alice-Bob becomes depolarizing. apply the L strategy͔. However, due to the convexity of the ͓23͔ For a Poissonian distribution ⌺ p͑n͉␯͒͑1−␰͒n =e−␯⌺ ͓␯͑1 ˜ n n function IU͑D͒, she gets more information if she always ap- −␰ n /n! =e−␯e␯͑1−␰͒ =e−␯␰=p 0 ␯␰ . ͒ ͔ ͑ ͉ ͒ plies the attack for the same disturbance D˜ . ͓24͔ To be precise, one should replace I͑AЈ:E͒ with I͑BЈ:E͒, be- ͓28͔ Note that we do not consider here “realistic attacks” which cause I A:E ϾI B:E in the presence of imperfect detectors. ͑ ͒ ͑ ͒ depend on the details of the implementation, like the Trojan- The reason is the following. Eve interacts with photons sent by horse or faked-state attacks: A. Vakhitov, V. Makarov and D. Alice, and forwards some to Bob; but she cannot ensure that R. Hjelme, J. Mod. Opt. 48, 2023 ͑2001͒;V. Makarov, and D. Bob detects a photon: Bob may have missed the photon but R. Hjelme, ibid. 52, 691 ͑2005͒. have got a dark count. Now, since Eve forwards photons to ͓29͔ The effect of qϾ0 on BB84 can easily be estimated referring Bob on a lossless line, the correction to her information is of to Sec. V of Ref. ͓15͔. Letus consider just the case V=1. Eve’s the order of 1−h͑x͒ with x=p /␩Ӎ10−4. Therefore, we ne- d information becomes I͑A:E͒=͑1/4͒␩␮2͓1−h͑q͔͒; in Bob’s in- glect this correction. formation, one has to replace Q with QЈ=Q͑1−q͒+q͑1−Q͒. ͓25͔ If Eve could modify p , she could take advantage of these d Two regimes can be distinguished. ͑I͒ At relatively short dis- errors as well to obtain information, but dark counts can not be tance, ␮t␩ӷp whence QϷ0 and QЈϷq; therefore Bob’s in- modified unless by changing the detector—and if Eve has ac- d formation is reduced by a factor 1−h͑q͒, exactly like Eve’s. So cess to Bob’s laboratory, it is certainly easier to put an antenna q
0 does not help, and would actually decrease the secret key in the computer. The case of ␩ is different, because there is a rate. ͑II͒ Close to the limiting distance, one can repeat the way for Eve to increase ␩ from outside: in an intercept-resend argument of Sec. V D of Ref. ͓15͔: if Q=1/2−␧ then QЈ kind of strategy, Eve may resend a much stronger pulse, thus =1/2−␧Ј with ␧Ј=␧͑1−2q͒; and I͑A:E͒ is still the same. Thus forcing the detection. However, this procedure would signifi- for any given q, the condition for the limiting distance is found 2 cantly increase the double-click rate. Our assumption, that ␩ is to be tlim͑q͒=tlim͑q=0͒f͑q͒ with f͑q͒=ͱ1−h͑q͒/͑1−2q͒ . The not modified, is thus consistent with the requirement that minimum of f is attained for q=1/2, and it can be calculated double-click rates should be monitored. analytically by setting q=1/2−␦ and letting ␦→0. One finds ͓26͔ M. Dušek, M. Jahma, and N. Lütkenhaus, Phys. Rev. A 62, f͑1/2͒=ͱ1/2 ln 2. This small decrease in tlim corresponds to 022306 ͑2000͒ an increase in the distance of ϳ3 km. ͓27͔ Actually, we could imagine that Eve applies this attack for ͓30͔ M. Curty, M. Lewenstein, and N. Lütkenhaus, Phys. Rev. Lett. various disturbances D˜ , according to some probability law 92, 217903 ͑2004͒.

032301-18 PHYSICAL REVIEW A 75, 012316 ͑2007͒

Security of quantum-key-distribution protocols using two-way classical communication or weak coherent pulses

Barbara Kraus,1 Cyril Branciard,2 and Renato Renner3 1Institute for Theoretical Physics, University of Innsbruck, Austria 2Group of Applied Physics, University of Geneva, 1211 Geneva 4, Switzerland 3Department of Applied Mathematics and Theoretical Physics, University of Cambridge, Cambridge CB3 OWA, United Kingdom ͑Received 20 October 2006; published 16 January 2007͒ We apply the techniques introduced by Kraus et al. ͓Phys. Rev. Lett. 95, 080501 ͑2005͔͒ to prove security of quantum-key-distribution ͑QKD͒ schemes using two-way classical post-processing as well as QKD schemes based on weak coherent pulses instead of single-photon pulses. As a result, we obtain improved bounds on the secret-key rate of these schemes. For instance, for the six-state protocol using two-way classical post- processing we recover the known threshold for the maximum tolerated bit error rate of the channel, 0.276, but demonstrate that the secret-key rate can be substantially higher than previously shown. Moreover, we provide a detailed analysis of the Bennett-Brassard 1984 ͑BB84͒ and the SARG protocol using weak coherent pulses ͑with and without decoy states͒ in the so-called untrusted-device scenario, where the adversary might influence the detector efficiencies. We evaluate lower bounds on the secret-key rate for realistic channel parameters and show that, for channels with low noise level, the bounds for the SARG protocol are superior to those for the BB84 protocol, whereas this advantage disappears with increasing noise level.

DOI: 10.1103/PhysRevA.75.012316 PACS number͑s͒: 03.67.Dd

I. INTRODUCTION Bob do not coincide. A fundamental principle of QKD is that this error rate also imposes a bound on the amount of infor- A fundamental problem in cryptography is to enable two mation an adversary can have on the raw key: The smaller distant parties, traditionally called Alice and Bob, to commu- the QBER, the more secret-key bits can be extracted from nicate in absolute privacy, even in presence of an eavesdrop- the raw key. If the QBER is above a certain threshold, then per Eve. It is a well-known fact that a secret key, i.e., a no secret key can be generated at all, and Alice and Bob must randomly chosen bit string held by both Alice and Bob, but abort the protocol ͓6͔. unknown to Eve, is sufficient to perform this task ͑one-time The purpose of the remaining part of the protocol, called pad encryption͒. Thus, the problem of secret communication classical post-processing, is to transform the raw key pair reduces to the problem of distributing a secret key. into a pair of identical and secret keys. In this paper, we Classical key distribution protocols are typically based on consider classical post-processing which consists of the fol- unproven computational assumptions, e.g., that the task of lowing three subprotocols: ͑i͒ local randomization ͑also decomposing a large number into its prime factors is intrac- called preprocessing͒, where Alice randomly flips each of table. In contrast to that, the security of quantum-key- her bits with some given probability q, ͑ii͒ error correction, distribution (QKD) protocols merely relies on the laws of where Alice and Bob equalize their strings, and ͑iii͒ privacy physics, or, more specifically, quantum mechanics. This ulti- amplification, where Alice and Bob apply some compression mate security is certainly one of the main reasons why so function to their bit string with the aim to reduce Eve’s in- much theoretical and experimental effort is undertaken to- formation on the outcome. Steps ͑i͒–͑iii͒ described above wards the implementation of secure QKD protocols ͓1,2͔. only require ͑classical͒ one-way communication from Alice Typically ͓3–5͔, in the first step of a QKD protocol, Alice to Bob. However, in practical implementations, the error cor- chooses a random bit string and encodes each bit into the rection is sometimes done with two-way protocols ͑e.g., the state of a quantum system, which she then sends to Bob cascade protocol ͓7͔͒. ͑using a quantum channel͒. Bob applies a certain measure- In Refs. ͓8,9͔, an information-theoretic technique to ana- ment on the received quantum system to decode the bit lyze QKD protocols of the type described above has been value. In a second step, called sifting, Alice and Bob publicly presented. In contrast to most previously known methods exchange some information about the encoding and decoding ͑e.g., Ref. ͓10͔͒, the technique does not require a transforma- of each of the bits which allows them to discard bit pairs tion of the key distillation protocol into an entanglement pu- which are not ͑or only weakly͒ correlated. rification scheme, which makes it very general. It has been After this sifting process, Alice and Bob hold a pair of applied to prove the security of various schemes such as the classical correlated bit strings, in the following called raw Bennett-Brassard 1984 ͑BB84͒, the six-state, the Bennett key pair. Alice and Bob can determine the quality of the raw 1992 ͑B92͒, and the SARG protocol ͓11–14͔͑see Refs. ͓8,9͔ key pair by comparing the values of some randomly chosen for an analysis of the first three protocols and Ref. ͓15͔ for an bit pairs ͑using an authenticated classical communication analysis of the latter͒. In particular, it has been shown that channel͒. This so-called parameter estimation gives an esti- the local randomization, i.e., step ͑i͒ described above, in- mate for the quantum bit error rate (QBER), i.e., the ratio of creases the bounds on the maximum tolerated QBER by positions for which the values of the bits held by Alice and roughly 10%–15%.

1050-2947/2007/75͑1͒/012316͑14͒ 012316-1 ©2007 The American Physical Society KRAUS, BRANCIARD, AND RENNER PHYSICAL REVIEW A 75, 012316 ͑2007͒

In this paper, we extend the technique of Refs. ͓8,9͔͑Sec. Bob’s measurement is described in the same way as in the II͒ and apply it to two classes of QKD protocols which have prepare-and-measure scheme. not been covered in Refs. ͓8,9͔. The first ͑Sec. III͒ is the Note that, in an experimental realization of a QKD proto- class of so-called two-way protocols. These use an additional col, one might prefer to implement a prepare-and-measure subprotocol, called advantage distillation, which is invoked scheme. However, when analyzing the security of a protocol, between the parameter estimation and the classical post- it is usually more convenient to consider its entanglement- processing step described above. In contrast to the classical based version. post-processing considered in Refs. ͓8,9͔, advantage distilla- As an illustration, consider the BB84 protocol, which uses tion uses two-way communication between Alice and Bob. the z basis and the x basis for the encoding. Using the above i i Second, we study protocols which use weak coherent pulses notation, we have ͉␾0͘=͉iz͘ and ͉␾1͘=͉ix͘, for i=0,1. Hence, 1 instead of single-photon pulses ͑Sec. IV͒. For both scenarios, the operators applied by Alice are A0 = and A1 =H, where H we show that local randomization increases the secret-key denotes the Hadamard transformation. Because the bases are rates. orthonormal, the same operators describe Bob’s measure- ment as well. For the following, we assume that Alice and Bob apply a II. INFORMATION-THEORETIC ANALYSIS randomly chosen permutation to rearrange the order of their OF QKD SCHEMES qubit pairs, in the following denoted by PS, and, additionally, apply to each of the qubit pairs at random either the identity In this section we first review the results presented in or the operation ␴  ␴ . ͑Note that the symmetrization op- Refs. ͓8,9͔ and then show how they can be generalized. x x erations commute with the measurement and can therefore Throughout this paper we use subscripts to indicate the sub- be applied to the classical bit strings.͒ Then, as shown in Ref. systems on which a state is defined. Alice’s and Bob’s quan- ͓8͔, the state ␳ describing the N qubit pairs shared by Alice tum systems are labeled by A and B, respectively. Similarly, AB and Bob can generally ͑after the most general attack by Eve, the classical values obtained by measuring their quantum a so-called coherent attack͒ be considered to be of a simple systems are denoted by X and Y, respectively. Typically, we form, namely write ␳AB, or␳ n, to denote the state of all the qubits held by n n n n Alice and Bob, whereas ␴AB is a two-qubit state. We will ␳ = ␭ P ͑P 1  P 2  P 3  P 4 ͒. AB ͚ n1,n2,n3,n4 S ͉⌽00͘ ͉⌽01͘ ͉⌽10͘ ͉⌽11͘ often consider two-qubit Bell-diagonal states, i.e., states that n1,...,n4 are diagonal in the Bell basis, ͉⌽ ͘=͓͉0,0+i͘+͑−1͒j͉1,1 ij ͑1͒ +i͔͘/ͱ2. P͉⌽͘ denotes the projector onto the state ͉⌽͘. Fur- thermore, we denote by h͑x͒=−x log2͑x͒−͑1−x͒log2͑1−x͒ The sum runs over all non-negative n1 ,...,n4 such that n1 the binary entropy function. +n2 +n3 +n4 =N. The set of possible values of the coefficients ␭ depends on the specific protocol and the param- n1,n2,n3,n4 eters estimated by Alice and Bob ͑e.g., the QBER of the raw A. Review of the technique key͒. Furthermore, one can assume without loss of generality The information-theoretic technique proposed in Refs. that Eve has a purification of this state, i.e., the situation is ͓8,9͔ directly applies to a general class of quantum-key- fully described by a pure state ͉⌿͘ABE such that ␳AB distribution protocols using one-way classical communica- =trE͑P͉⌿͘ABE͒. ͑However, as we shall see, dropping this as- tion. However, it is required that the protocol can be repre- sumption might lead to better estimates of the key rate.͒ Af- sented as a so-called entanglement-based scheme, as ter this distribution of quantum information Alice and Bob described below. measure their systems. Thus they are left with classical bit Generally, a QKD protocol uses a set of so-called encod- strings. ing bases. We consider the special case where each basis j is Consider now any situation where Alice and Bob have a 0 1 classical pair of raw keys Xn and Yn consisting of n bits defined by two states ͉␾j ͘ and ͉␾j ͘, which are used to encode the bit values 0 and 1, respectively. In a prepare-and- whereas Eve controls a quantum system E. The secret-key measure scheme, Alice repeatedly chooses at random a bit i rate, i.e., the rate at which secret-key bits can be generated i per bit of the raw key, for any one-way protocol with com- and a basis j, prepares the state ͉␾j͘, and sends the state to ͑ Bob. Bob then measures the state in a randomly chosen basis munication from Alice to Bob͒, is given by k. This measuring process can be seen as some filtering op- Ќ Ќ Ќ 1 ␧ n n ␧ n ␧ n n eration Bk =͉0͗͘␾1,k͉+͉1͗͘␾0,k͉, where ͉␾i,k͘ is some state or- r = lim lim sup S2͑U E ͒ − S0͑E ͒ − H0͑U ͉Y ͒. ͑2͒ i ␧→0 n→ϱ n Un←Xn thogonal to ͉␾k͘, followed by a measurement in the compu- tational basis. ␧ ␧ Here, S␣ ,H␣ denote the smooth Rényi entropies ͑also called In an entanglement-based view, the above can equiva- min-entropy if ␣=ϱ and max-entropy if ␣=0͓͒16͔. More- lently be described as follows: Alice prepares the two-qubit over, the supremum runs over all classical values Un that can states Aj͉⌽00͘, where ͉⌽00͘ denotes the Bell state be computed from ͑the classical value͒ Xn. 1/ͱ2͉͑0,0͘+͉1,1͒͘ and Aj is an encoding operator ͑for de- For a QKD protocol as described above ͓where the dis- i tails see Ref. ͓8͔͒ such that ͗i͉Aj͉⌽00͘=͉␾j͘. She then sends tributed state is of the form of Eq. ͑1͔͒, formula ͑2͒ can be the second qubit to Bob and prepares Bob’s system at a lower bounded by an expression which only involves two- distance by measuring her system in the computational basis. qubit systems. More precisely ͓8͔,

012316-2 SECURITY OF QUANTUM-KEY-DISTRIBUTION… PHYSICAL REVIEW A 75, 012316 ͑2007͒

r ജ sup inf S͑U͉E͒ − H͑U͉Y͒, ͑3͒ bounds on the one-way secret-key rate derived in previous ← U X ␴AB෈⌫Q works ͓10,21͔. where ⌫Q is the set of all two-qubit states ␴AB ͑after the D. Generalization of the lower bound filtering operation͒ which can result from a collective attack ͓17͔ and which are compatible with the parameters estimated Because we assume above that Eve controls a system that by Alice and Bob ͑in particular, the QBER͒. Here, S and H purifies the state ␳AB held by Alice and Bob, the bound ͑3͒ is denote the von Neumann entropy and its classical counter- fully determined by ␳AB. However, this assumption on Eve part, the Shannon entropy, respectively. Moreover, X and Y might overestimate her possibilities, in which case the bound is not optimal. In the following we drop this assumption to denote the classical outcomes of measurements of ␴AB ͑on A and B, respectively͒ in the computational basis, and E is any derive better lower bounds on the secret-key rate. Suppose that the state distributed in an entanglement- system that purifies ␴AB. Similarly to the above formula, the P D  1 n 0 supremum runs over all mappings from X to U ͓18͔. based scheme is of the form S͓͑ AB ͒ ͑␳ABE͔͒, where PS again denotes the map that randomly permutes the order of the qubit pairs, DAB is some completely positive map on 0 B. Local randomization two-qubit states, and ␳ABE is some tripartite state. Then, it is The local randomization step described above has been an immediate consequence of Lemma A.4 in Ref. ͓9͔ that the considered in Refs. ͓8,9͔ and later been improved in Ref. bound ͑3͒ on the secret-key rate can be generalized to ͓19͔. In Ref. ͓20͔, the local randomization is nicely explained r ജ sup inf S͑U͉E͒ − H͑U͉Y͒. ͑4͒ in the context of entanglement purification. U←X ˜ ␴˜ ABE෈⌫Q To get an intuition why the local randomization can help ˜ to increase the secret-key rate, it is useful to describe the Here, the infimum ranges over the set ⌫Q of all states ˜␴ABE process as a quantum operation ͑as in ͓20͔͒. Let ␴AB be the which can result from a collective attack and are compatible state of a qubit pair held by Alice and Bob and let ͉⌿͘ABE be with the parameters estimated by Alice and Bob ͑e.g., the a purification of ␴AB. The state after Alice randomly flips her QBER͒. bit value A with probability q can be described by We refer to Appendix C for an application of this result to A Ј ͉⌿͘AAЈBE=ͱ1−q͉⌿͘ABE͉0͘AЈ+ͱq␴x ͉⌿͘ABE͉1͘AЈ, where A is improve the analysis of the one-way SARG protocol for an auxiliary system on Alice’s side. The measurement of single-photon pulses. system A gives the raw key. Note that ͉⌿͘AAЈBE results from Consider now the general situation where the state de- the application of a controlled-NOT operation on system AAЈ, scribing the Alice, Bob, and Eve system is the reduced den- where system AЈ is prepared in the state ͱ1−q͉0͘AЈ sity operator of a state ͉⌿͘ABER=͚n␣n͉⌿n͘ABE͉n͘R, where +ͱq͉1͘AЈ. The randomization of Alice thus entangles her sys- ͕͉n͖͘ forms an orthonormal basis of the Hilbert space of an tem to some auxiliary system ͑which is not under Eve’s con- auxiliary system R, i.e., none of the three parties has the trol͒. This, in turn, reduces the entanglement between Alice’s auxiliary system at their disposal. Starting from ͑4͒ and using relevant system ͑A͒ and Eve’s systems ͑monogamy of en- the concavity of the entropy, we find that the secret-key rate tanglement͒, as Eve does not have a purification of the state is bounded by on the systems A and B, since now she only has the purifi- ϱ cation of the state ␳AAЈB. Note that Bob’s information on A is 2 r ജ sup inf ͚ ͉␣n͉ S͑U͉E,n͒ − H͑U͉Y͒, ͑5͒ also reduced by the randomization process, but—for certain U←X ˜ ͩ ͪ ˜␴ ෈⌫ n=0 values of the parameter q—he is less penalized than Eve. ABE Q From this point of view, it can be easily understood that the where S͑U͉E,n͒=S͑UE͉n͒−S͑E͉n͒ is the entropy of U con- local randomization can help to increase the secret-key rate. ditioned on E and the event that the measurement of the auxiliary system R in the basis ͕͉n͖͘ yields n. One might also improve the bound using the following C. Comparison to known bounds observation which has also been used to derive the bound For protocols based on qubit pairs, where the raw key pair given in Eq. ͑3͒. Let us consider the situation where some is obtained by orthogonal measurements of Alice and Bob on auxiliary system is at Alice’s and/or Bob’s disposal, but not some Bell-diagonal state ␴ =͚ ␭ P ͑e.g., the BB84 or at Eve’s ͑this could be for instance some additional qubits͒. AB i,j ij ⌽ij the six-state protocol͒, it follows from ͑3͒ that the secret-key Suppose that the state shared by ABE and some auxiliary rate r ͑even without the local randomization͒ is bounded by system R ͑which is not under Eve’s control͒ is given by ͉⌿͘ABER=͚n␣n͉⌿n͘ABE͉n͘R, where ͕͉n͖͘ is an orthonormal ba- r ജ 1−S ␴ ജ 1−h e − h e . ͑ AB͒ ͑ b͒ ͑ p͒ sis of HR, the Hilbert space corresponding to system R. The ˜ AB AB Here, eb =␭10+␭11 is the QBER and ep =␭01+␭11 the phase state ͉⌿͘ABER=͚n␣nUn ͉⌿n͘ABE͉n͘R, with Un unitary opera- error rate, i.e., the probability that Alice and Bob get differ- tors diagonal in the z basis leads to the same measurement ent bits when measuring in the z and the x basis, respectively. outcome for any measurement by Alice and Bob in the com- Because the QBER and the phase error rate are not changed putational basis as ͉⌿͘ABER, that is by applying at random ␴x or ␴z, which makes any state Bell ͉k,l͘AB͗k,l͉␳ABE͉k,l͘AB͗k,l͉ = ͉k,l͘AB͗k,l͉˜␳ABE͉k,l͘AB͗k,l͉, diagonal, the bound 1−h͑eb͒−h͑ep͒ holds for arbitrary states ␴AB. Note that the above bound implies any of the lower where

012316-3 KRAUS, BRANCIARD, AND RENNER PHYSICAL REVIEW A 75, 012316 ͑2007͒

 ␳ = tr ͑P ͒ ¯␴ªE͑␴ m͒. Then, for any ␧ജ0, ABE R ͉⌿͘ABER 2 and ␮¯ ജ 1−2−⌰͑¯n␧ ͒+O͑log2 n͒, ͚ ¯n1,¯n2,¯n3,¯n4 ͑¯n ,...,¯n ͒෈B␧͑¯␭ ,...,¯␭ ͒ ˜␳ = tr ͑P ˜ ͒. 1 4 1 4 ABE R ͉⌿͘ABER ␧ ¯ ¯ where B ͑␭1 ,...,␭4͒ denotes the set of all tuples ͑¯n1 ,...,¯n4͒ Assuming that Eve has a purification of the state ˜␳AB can ¯ ¯ n1 n4 ¯ ¯ 2 only provide her with more power compared to the situation such that ͑ n ,..., n ͒ is ␧-close to ͑␭1 ,...,␭4͒ and ⌰͑¯n␧ ͒ is 2 where she has a purification of the state ␳ABR, since this is asymptotically the same as¯ n␧ , up to a constant factor. equivalent to giving her the system R, which she could sim- The lemma is a direct consequence of the exponential ply measure, leading to the same result as before ͑for details quantum de Finetti theorem ͓16͔. It states that, for any see also Ref. ͓8͔͒. Thus, we can consider the situation where n-partite quantum state ␳n which is invariant under permuta- Alice and Bob share the state ˜␳AB and Eve has a purification tions of the subsystems, any part ␳m =trn−m͑␳n͒ consisting of of it. This can only increase Eve’s power. We will use this m subsystems is exponentially ͑in n−m͒ close to a convex observation in Appendix B, in order to determine a good combination of states that virtually are of the form ␴m. For lower bound on the secret-key rate for a QKD protocol using completeness, we give a direct proof of Lemma 1 ͑without the so-called XOR process. referring to de Finetti’s theorem͒ in Appendix A. In order to analyze protocols with advantage distillation III. QKD PROTOCOLS WITH TWO-WAY using Lemma 1, we use the following quantum mechanical POST-PROCESSING description of the advantage-distillation subprotocol: m Alice and Bob both apply the operation Xad=͉0͗͘0,...,0͉ In the following, we will consider QKD protocols where, +͉1͗͘1,...,1͉ on m qubits. It is straightforward to check that before the post-processing of the raw key as described above, Alice and Bob additionally invoke a so-called advantage- 2 2 1 distillation subprotocol, which requires two-way communi- ͑Xad͒ ͉͑⌽i,j͉͘⌽k,l͒͘ = ␦i,k͉⌽i,j+l͘, ͑6͒ ͱ2 cation between Alice and Bob. The notion of advantage dis- tillation has been investigated in the context of classical key where the sum j+l of indices is understood to be modulo 2. agreement ͓22͔ and later been generalized to QKD ͓23,24͔. Hence, applying advantage distillation to m identical Bell- The advantage-distillation protocol we consider here has diagonal qubit pairs with eigenvalues ␭ ͓25͔ leads to a Bell- the following form: Alice publicly announces to Bob the diagonal state with eigenvalues ␭Ј given by position of a block of m bits which have all the same value of course, she does not tell him which value . Then Bob 1 ͑ ͒ ␭Ј = ͓͑␭ + ␭ ͒m + ͑−1͒j͑␭ − ␭ ͒m͔, ͑7͒ tells Alice whether for the given position, his corresponding i,j T i,0 i,1 i,0 i,1 bits are all identical as well. If this is the case, they both m m continue using the first bit of the block as a new raw-key bit, where T=2͓͑1−Q͒ +Q ͔ and where Q=␭10+␭11 is the otherwise they discard the whole block. We emphasize here QBER before the advantage distillation. The QBER QЈ after Ј Ј Ј the advantage distillation is thus given by Q =␭10+␭11 that our analysis below works for any fixed value of the m = Q and 1−Q m +Qm is the probability that the ad- block size m ͑not only asymptotically for large m͒. This is ͑1−Q͒m+Qm ͑ ͒ important for realistic protocols, where m is usually small vantage distillation is successful ͑i.e., Alice and Bob end up ͑e.g., m=3͒. with a new raw-key bit͒. If Alice and Bob apply, after the To simplify the study of such protocols, we first show that advantage distillation, the one-way classical post-processing it suffices to analyze the action of the advantage distillation described above, the lower bound on the secret-key rate is process on two-qubit Bell-diagonal states. More precisely, given by Eq. ͑3͒, where the eigenvalues of ␴AB are given by Lemma 1 below implies that the state ¯␳¯n obtained by apply- the ␭’s in ͑7͓͒26͔. For instance for the six-state protocol one ing a blockwise operation E ͑for blocks of size m͒ to a sym- obtains a positive key rate for any QBERϽ0.276 ͑for m metric state ␳n ͓see Eq. ͑1͔͒ has virtually the same statistics →ϱ͒. Note that for the six-state protocol it has been shown m as if E was applied to a state ␴ . that the tolerable QBER cannot be larger than 0.276, if the Lemma 1. Let ␳n be a state on n particle pairs of the form first step in the post-processing is advantage distillation ͓27͔.

n1 n2 n3 n4 As mentioned before, the bound on the secret-key rate is not ␳n = PS͑P  P  P  P ͒ ͉⌽00͘ ͉⌽01͘ ͉⌽10͘ ͉⌽11͘ only valid, for m→ϱ, but for any value of the block size on and let ␴ be a two-qubit Bell-diagonal state with eigenvalues which advantage distillation is applied. n1 n4 In Ref. ͓24͔, Chau considered the secret-key rate obtained ,..., . Moreover, let E be an operation which maps Bell n n when applying the above-described advantage distillation states of blocks of m particle pairs to Bell states of one single followed by the XOR transformation, where Alice and Bob particle pair. Finally, let locally compute new raw-key bits by taking the XOR of a ¯n1 ¯n2 ¯n3 ¯n4 block of given bits. ͑For the sake of completeness we dem- ¯␳¯n = ␮¯¯n ,¯n ,¯n ,¯n PS͑P  P  P  P ͒ ͚ 1 2 3 4 ͉⌽00͘ ͉⌽01͘ ͉⌽10͘ ͉⌽11͘ onstrate in Appendix B how the XOR protocol can be in- ¯n1,...,¯n4 cluded in our analysis.͒ Both procedures were analyzed in n be the state describing¯ n= m particle pairs defined by the asymptotic limit for infinitely large block sizes. The re- ª ¯n ¯ ¯ ¯␳¯n E ͑␳n͒ and let ␭1 ,...,␭4 be the eigenvalues of sult found there is that the six-state protocol tolerates a

012316-4 SECURITY OF QUANTUM-KEY-DISTRIBUTION… PHYSICAL REVIEW A 75, 012316 ͑2007͒

QBER of up to 0.276. Surprisingly, the same threshold for In the described scenario, we can without loss of general- the QBER can be obtained, as shown above, by a simpler ity assume that Eve only sends single photons to Bob. This protocol where the XOR transformation is replaced by a lo- follows directly from the fact that the situation obtained by cal randomization on single bits on Alice’s side. Moreover, sending a multiphoton pulse is the same as if Eve randomly the rate of this modified protocol is much larger than that of selected one photon from the pulse and sent this single pho- Chau’s protocol, as local randomization consumes less bits ton to Bob. Bob’s measurement can therefore simply be de- Ќ Ќ than the XOR transformation. Note that, as shown recently scribed by the operators Bj =͉0͗͘␾1,j͉+͉1͗͘␾0,j͉ as defined by Bae and Acin ͓28͔, if one omits the local randomization previously. completely, the protocol still tolerates a QBER of up to Alice and Bob can estimate the following parameters re- ª 0.276, but the secret-key rate for large values of the QBER lated to their raw key: ͑i͒ the total sifting rate R␮ ͚nRn, for ª might be smaller. Rn pnYn where Yn is the probability for Bob to find a con- clusive result in case Alice sent n photons; ͑ii͒ the average IV. PROTOCOLS USING WEAK COHERENT PULSES R QBER Q =͚ n Q , where Q denotes the QBER for the ␮ n R␮ n n A. Preliminaries pairs where Alice sent an n-photon pulse. These two param- We now consider protocols where Alice does not send eters will determine the amount of key that can be extracted single photons to Bob, but uses weak coherent pulses in- from the particular raw key. stead. This scenario is practically motivated by the fact that, We use similar techniques as in Refs. ͓8,9͔ to describe the with current technologies, it is difficult to create single- same protocol in the entanglement-based scheme. The states photon pulses. In fact, many of today’s implementations of prepared by Alice are QKD rely on weak coherent pulses. ͉⌿ ͘ = ͱp ͉⌿n͘ ͉n͘ , ͑8͒ We start with a description of a prepare-and-measure j ABR1 ͚ n j AB R1 nജ0 scheme and then translate it to an equivalent entanglement- n 0 n 1 n based scheme, for which we will prove security. where ͉⌿j ͘AB=1/ͱ2͉͑0͘A͉␾j ͘B +͉1͘A͉␾j ͘B ͒. Here, we have In the prepare-and-measure scheme, Alice encodes the bit introduced an auxiliary system R1 containing the photon values into phase randomized coherent states ͓29͔. More pre- number ͑which is neither controlled by Alice nor Bob͒. If cisely, she randomly chooses a basis j and encodes the bit Alice measures her qubit in the computational basis and re- k k k n k k 0 value k into the state ␳j =͚nജ0pn͉␾j͗͘␾j͉ , where ͉␾j͗͘␾j͉ ceives outcome k, the state Bob is left with in the noiseless denotes the vacuum for any value of j and k and pn case ͑without interaction of Eve͒ is ␳ =2 tr ͑P ͒ B R ͗k ͉ ⌿j͘ABR =e−␮␮n /n!, with ␮ the mean photon number ͑for a Poisso- 1 1 =͚nജ0pnP͉␾k͘n, which corresponds to the coherent state nian source ͓30͔͒. j with randomized phase sent by Alice in the prepare-and- The description of Bob’s measurement depends on the ͑ ͒ measure scheme 33 . The operation on Bob’s side is given experimental setup. We focus on the situation where Bob’s ͓ ͔ by the operators B , as described above. detectors do not distinguish between the cases where they j The state describing the situation after Bob’s operation is receive one or more than one photon, since with current tech- given by nology, it is difficult to count the number of photons. The POVM describing the photon detector is thus given by the ͉␹͘ = B U ͉͑⌿ ͘ ͉͒j͘ , † † ABER1R2 ͚ j EB j ABR1 R2 operators ͕D0D0 ,D1D1͖, with D0 =͚nജ0ͱpn.d.͑n͒P͉n͘ and D1 j =͚ ͱ1−p ͑n͒P , where p ͑n͒ is the probability of not nജ0 nd ͉n͘ nd where j corresponds to the basis chosen by Alice and U is detecting any photon in case n photons arrived at the detec- EB a unitary describing the attack of Eve. Note that this state is tor. This probability is given by p ͑n͒=͑1−p ͒͑1−␩͒n, nd d not necessarily normalized, but its weight tr͉͑␹͗͘␹͉͒ corre- where pd is the probability of a dark count, and ␩ is the detection efficiency, i.e., overall transmission factor. The sponds to the sifting rate. Restricted to Alice’s and Bob’s systems, ͉␹͘ABER R is a POVM element D0 corresponds to the case where no photon is 1 2 two-qubit state. We can thus apply the techniques presented detected, whereas D1 corresponds to the detection of one or more photons. In the prepare-and-measure scheme Bob in Sec. II to analyze the security of the protocol. More pre- would randomly choose a basis j and measure the arriving cisely, we need to evaluate the rhs of ͑5͒ to get a lower bound photons in that basis. on the secret-key rate. First we do not take the local random- In the following, we consider the so-called untrusted- ization into account; i.e., we choose U=X. The case includ- device scenario, where it is assumed that Eve exchanges ing local randomization will be treated in the next section. Bob’s detectors with perfect ones ͑having perfect efficiency We thus obtain for the key rate and no dark counts͒ and introduces all errors herself ͓31͔. ϱ Clearly, security under this assumption implies security in a r ജ inf ͚ RnS͑X͉E,n͒ − R␮S͑X͉Y͒. ͑9͒ situation where Eve might not be able to corrupt Bob’s de- ␴෈⌫ R␮,Q␮ n=0 tectors. Additionally, we assume that Bob’s detector is con- The set ⌫ contains all states which can result from a structed in such a way that, whenever a pulse consisting of R␮,Q␮ more than one photon arrives, then the detector output cor- collective attack by Eve and are compatible with the average responds to the measurement of one of the photons in the sifting rate R␮ and the QBER Q␮, as estimated by Alice and pulse chosen at random ͓32͔. Bob.

012316-5 KRAUS, BRANCIARD, AND RENNER PHYSICAL REVIEW A 75, 012316 ͑2007͒

Because the ͑conditional͒ entropy of a classical variable cannot be negative, the right-hand side ͑rhs͒ of ͑9͒ can be −3 lower bounded by restricting to any of the terms in the sum 10 over n. Note that, in ͑9͒, the average over n is only taken over the term for the entropy conditioned on Eve’s system, SARG but not on the term for the entropy conditioned on Bob’s −4 system. This is because Eve might be able to measure the 10 photon number, whereas this is not the case for Bob.

−5 BB84 10

B. Protocols with local randomization Secret Key Rate [bits/pulse] So far we did not consider the possibility for Alice to apply some local randomization on her classical bits. The −6 10 randomization can easily be included in the analysis: if the randomization is acting on single bits, U←X ͑bit flip with 0 10 20 30 40 50 probability q͒, ͑9͒ simply writes (a) distance [km]

ϱ 0 10 r ജ inf RnS͑U͉E,n͒ − R␮S͑U͉Y͒. ͑10͒ ␴෈⌫ ͚ R␮,Q␮ n=0 q Bob’s uncertainty is now given by S͑U͉Y͒=h͑Q␮͒, where q SARG Q␮ =͑1−q͒Q␮ +q͑1−Q␮͒. Since R␮ =͚nRn, ͑10͒ can also be written as µ −1 ϱ 10 q r ജ inf Rn͓S͑U͉E,n͒ − h͑q͔͒ − R␮͓h͑Q␮͒ − h͑q͔͒. optimal ␴෈⌫ ͚ R␮,Q␮ n=0 11 ͑ ͒ BB84 Note that, for any nജ0, the term S͑U͉E,n͒ on the rhs of this −2 inequality can be bounded by S͑U͉E,n͒ജS͑U͉X͒=h͑q͒ 10 ͑since U is only computed from X͒, and therefore the rhs of ͑11͒ can again be lower bounded by restricting the sum to 0 10 20 30 40 50 any of its terms. (b) distance [km] As we will see, the local randomization allows us to get better lower bounds for the secret-key rate as well as better FIG. 1. ͑Color online͒ Lower bound on the secret-key rate per lower bounds for the maximum distance for which the rate is pulse and optimal ␮ for Poissonian sources as a function of the positive. distance, for the BB84 and SARG protocols, when Alice and Bob share a quantum channel with perfect visibility V=1. The other experimental parameters are ␣=0.25 dB/km, ␩det=0.1, and pd −5 C. Examples: the BB84 and the SARG protocols =10 . The thick lines are the results we obtain when Alice per- forms an optimal bitwise local randomization; the thin lines are the Using the results above, in particular ͑9͒, we now com- same, without randomization ͑q=0͒. pute the lower bound on the secret-key rate of the BB84 as well as the SARG protocols. In Section IV E we compare the n-photon pulse causing a QBER of Qn. In a second step, we results we derive here with previous results, in particular compute the infimum with the ones presented in Refs. ͓34,35͔. In contrast to the single-photon case, where the lower ϱ bound on the secret-key rate was a function of the QBER, we inf ͚ RnSn͑Qn͒, ͑12͒ are aiming here for a lower bound that depends on the only ͕R ,Q ͖෈˜⌫ n=0 n n R␮,Q␮ two measurable quantities R␮ ͑the total sifting rate͒ and Q␮ ͑the total QBER͒. For simplicity, we will in the following not where ˜⌫ denotes the set of all parameters ͕R ,Q ͖ which explicitly include the local randomization, except in the final R␮,Q␮ n n are compatible with R and Q . All the technical details can results see Figs. 1 and 2 . We remind the reader that, in ␮ ␮ ͑ ͒ be found in Appendix D. order to include the local randomization, ͑9͒ simply must be replaced by ͑11͒. Our computation of the bound given by ͑9͒ is subdivided 1. BB84 into two steps: First, for any nജ0 and for any Qn, we com- For the BB84 protocol, it is easy to verify that for ª pute Sn͑Qn͒ inf␴ ෈⌫ S͑X͉E,n͒, where ⌫Q is the set of all n Qn n any pulse consisting of nജ2 photons, Eve has full in- states ␴n which can result from a collective attack on a formation on Alice’s measurement outcome X, i.e.,

012316-6 SECURITY OF QUANTUM-KEY-DISTRIBUTION… PHYSICAL REVIEW A 75, 012316 ͑2007͒

ation coefficient͒. Furthermore, we consider the situation −3 10 where Bob’s detectors have an efficiency ␩det and a probabil- ity of dark counts pd. An explicit calculation ͑see Appendix D͒ shows that under these assumptions, the rates that Alice and Bob would get are −4 10 1 2 −␮␩ R␮ = 2 ͑1−¯pde ͒,

1 −␮F␩ −␮D␩ 2 −␮␩ SARG BB84 R␮Q␮ = ͑1+¯pde − ¯pde − ¯pde ͒, −5 4 10 where ␩=t␩ , ¯p =1−p . When we insert these values in Secret Key Rate [bits/pulse] det d d ͑15͒ for experimentally reasonable values of ␣, pd, and ␩det, and optimize for different distances over the mean photon −6 10 number ␮ ͑which Alice is free to choose͒, we get the results illustrated in Fig. 1 for ͑for V=1͒ and Fig. 2 ͑for V=0.95͒. 0 5 10 15 20 25 30 35 distance [km] We find that the optimal ␮ is proportional to the transmission factor t, and our bound on the secret-key rate is proportional FIG. 2. ͑Color online͒ Same plot as in Fig. 1 ͑top͒, but for a to t2 ͑at least for short distances, i.e., in the regime where quantum channel with nonperfect visibility, V=0.95. dark counts are not dominant͒; this was already observed in Refs. ͓38,37͔. inf␴ ෈⌫ S͑X͉E,n͒=0 ∀nജ2. The lower bound is thus given n Qn 2. SARG by ͓36͔͑see also Ref. ͓46͔͒ A major difference between the SARG protocol and the BB84 r ജ inf R1S1 ͑Q1͒ − R␮h͑Q␮͒, ͑13͒ BB84 protocols is that Eve cannot get full information on ͕R ,Q ͖෈˜⌫ Alice’s value even if the pulse contains two photons. In order 1 1 R␮,Q␮ to take this into account, we include the contribution of the BB84 ª where S1 ͑Q1͒ 1−h͑Q1͒͑see Appendix D or Refs. ͓8,9͔͒. two-photon components in our formula for the secret-key As shown in Appendix D, the conditions in the untrusted- rate; i.e., we compute ͓39͔: device scenario for R1 and Q1 to be compatible with R␮ and r ജ inf R SSARG͑Q ͒ + R SSARG͑Q ͒ − R h͑Q ͒. Q␮ are the following: ͕R1,Q1,R2,Q2͖ 1 1 1 2 2 2 ␮ ␮ 1 ͑16͒ R1 ഛ 2 p1, SARG In Appendix D we describe how to compute S1 ͑Q1͒ and 1 SSARG͑Q ͒͑see also Appendix C and Ref. ͓35͔͒, and we de- R ജ R − p , 2 2 1 ␮ ͚ n rive the following conditions for R , Q , R , and Q to be 2 nജ2 1 1 2 2 compatible with R␮ and Q␮: R Q ഛ R Q . ͑14͒ 1 1 1 ␮ ␮ R1͑1−Q1͒ ഛ 4 p1, Let Rmin=R − 1 p . IfR minഛ0, then R can be set equal 1 ␮ 2 ͚nജ2 n 1 1 1 to zero, and the lower bound on r is negative; i.e., Alice and R2͑1−Q2͒ ഛ 4 p2, min max Bob must abort the protocol. If R1 Ͼ0, let Q1 min 1 BB84 =min͑R␮Q␮ /R1 , 2 ͒. Due to the decreasing of S1 ͑Q1͒ for 1 Q ഛ1/2, we then get R1͑1−Q1͒ + R2͑1−Q2͒ ജ R␮͑1−Q␮͒ − ͚ pn, 1 4 nജ3 min max r ജ R1 ͓1−h͑Q1 ͔͒ − R␮h͑Q␮͒. ͑15͒ R Q + R Q ഛ R␮Q␮. ͑17͒ Note that this bound has been derived in Ref. ͓37͔ using a 1 1 2 2 1 different technique. This bound can be interpreted as follows: If R␮͑1−Q␮͒− 4 ͚nജ3pn Ͼ0, one can see in ͑16͒ that Eve’s For an optimal attack, Eve should make R1 as small as pos- optimal choice is to set R1 and R2 as small as possible, and SARG SARG sible ͑i.e., block as many single-photon pulses as possible͒ Q1 and Q2 as large as possible ͓S1 ͑Q1͒ and S1 ͑Q2͒ are and, at the same time, make Q1 as large as possible ͑i.e., decreasing͔: she should therefore set the equality in the third introduce as many errors as possible on the single-photon constraint. pulses that she forwards, which reduces her uncertainty on However, contrary to BB84, we have not been able to Alice’s system as much as possible͒. give a simpler analytical expression for the infimum in ͑16͒; To get an idea of how good this bound is, we evaluate the we therefore resort to numerical computations. rate for the situation where there is no Eve present, instead, Again, in order to estimate the previous bound in a prac- the errors are introduced due to a realistic channel. The chan- tical implementation of the protocol, we compute the typical nel we consider is a lossy depolarizing channel with visibil- values of the parameters R␮ and Q␮ when Alice and Bob use 1+V 1−V ity V ͑or fidelity F= 2 and disturbance D= 2 ͒, and a a Poisson source and a lossy depolarizing channel ͑see Ap- transmission factor t=10−␣ᐉ/10 at distance ᐉ ͑␣ is the attenu- pendix D͒:

012316-7 KRAUS, BRANCIARD, AND RENNER PHYSICAL REVIEW A 75, 012316 ͑2007͒

1 ¯p ¯p 2 −␮␩ d −␮F␩ d −␮D␩ −2 R = 1−¯p e + e − e , 10 ␮ 2ͩ d 2 2 ͪ

−3 1 10 R Q = ͑1−¯p2e−␮␩ + ¯p e−␮F␩ − ¯p e−␮D␩͒. ␮ ␮ 4 d d d −4 BB84 Similarly to the BB84 protocol, inserting these values in 10 Eq. ͑16͒, and optimizing for different distances over the mean photon number ␮, provides the results illustrated in −5 SARG Figs. 1 and 2. 10 For V=1, we find an optimal ␮ proportional to t1/2, and Secret Key Rate [bits/pulse] 3/2 therefore our bound on the secret-key rate scales like t see −6 ͑ 10 also Ref. ͓40͔͒, which is more efficient than for BB84 ͑where we had rϰt2͒. For V=0.95 however, we find that the SARG protocol is less efficient than the BB84, and our lower bound 0 20 40 60 80 100 120 (a) distance [km] for the secret-key rate of SARG also scales like t2, the same as for BB84. However, it should be noted that we determine here only lower bounds on the rates. 1.3 SARG 1.2 µ 1.1 D. Decoy states 1

optimal BB84 The relevant set ⌫ in ͑9͒ over which the infimum 0.9 R␮,Q␮ must be taken to obtain the lower bound on the secret-key 0.8 rate is quite big, since Alice and Bob can only estimate the 0.7 0 20 40 60 80 100 120 total sifting and total error rate. They do neither have a good (b) distance [km] estimation of the error rates, Qn, nor of the corresponding yields, Yn. Hwang, Lo, and co-workers pointed out a method FIG. 3. ͑Color online͒ Lower bound on the secret-key rate per to improve the lower bound on the secret-key rate by making pulse and optimal ␮ for Poissonian sources as a function of the some additional measurements ͑Refs. ͓34,41͔, see also Ref. distance, for the BB84 and SARG protocols using decoy states, ͓42͔͒. The idea of the so-called decoy states is to change the when Alice and Bob share a quantum channel with perfect visibility intensity of the pulses sent by Alice in order to be able to V=1. The other parameters are the same as in Fig. 1. The thick lines estimate more quantities. This allows them to deduce more are the results we obtain when Alice performs an optimal bitwise information about the possible attack of an eavesdropper local randomization; the thin lines correspond to the protocol with- out randomization q=0 . ͑like the estimate of the QBER does͒. For practical purpose ͑ ͒ one assumes that Alice is always sending weak coherent −␮ n ent values of ␮ ͑recall pn =e ␮ /n!͒, i.e., they can measure pulses, varying only the mean photon number. We will show the values R ,Q and R ,Q . We can again use ͑9͒ to ␮0 ␮0 ␮1 ␮1 here how this particular idea can be included in our analysis. compute a lower bound on the secret-key rate. In this case, Let us first of all consider the case where Alice uses two the infimum is taken over the set ⌫ of all Bell- ͕R␮ , Q␮ ͖i different intensities, i.e., one with mean photon number ␮0 i i ͑we call it signal pulse in the following͒ and the other ͑decoy diagonal two-qubit states of the form ps␴s +pc␴c, with ␴s ͑␴c͒ denoting the Bell-diagonal states corresponding to the pulse͒ with mean photon number ␮1. Using more decoy states is a straightforward generalization of this case. We signal ͑decoy͒ bits, which are compatible with all estimated total sifting rates R and total error rates Q . describe the states sent by Alice by ͉␺͘ABR R =͉␺s͘ABR ͉0͘R ␮i ␮i 1 2 1 2 Let us now consider the case where Alice uses many dif- +͉␺c͘ABR ͉1͘R , where ͉␺s͘ABR ͉͑␺c͘ABR ͒ denotes the ͑unnor- 1 2 1 1 ferent intensities for her decoy states. Due to the definition of malized͒ signal ͑decoy͒ pulse ͓see Eq. ͑8͔͒. System R2 is again some auxiliary system, introduced to keep track of the R␮ it is clear that, by varying ␮, one can obtain information signal and decoy pulses. In this case this system is in Alice’s about the quantities Yn. Knowing Yn and ͕Q␮͖ one can then hands, as she chooses the intensity of the signals. Since Alice determine Qn. Note that in order to determine Yn and Qn one needs infinitely many decoy intensities; however, already a is going to measure the auxiliary system R2 in the computa-  small number of such decoy intensities suffices to restrict the tional basis, we can consider the state ␴=ps␴s P͉0͘ +͑1 R2 values of Y and Q ͑see for instance Ref. ͓42͔͒. The results  n n −ps͒␴c P͉1͘ , where ␴s ͑␴c͒ are Alice’s and Bob’s signal R2 of the analysis above are illustrated in Figs. 3 and 4. In order ͑decoy͒ systems after Eve’s intervention, respectively. Bob’s to evaluate the lower bounds we consider the situation where measurement is described in the same way as before. Again, Alice and Bob share a lossy depolarizing channel with vis- Alice and Bob can only measure the total sifting rate R␮ ibilities V=1, V=0.95, respectively. =͚nRn =͚npnYn and estimate the total error rate Q␮ E. Related work =͚nRnQn /R␮ =͚npnYnQn /R␮. However, now they are in the position to obtain more information about their qubit pairs, In Ref. ͓35͔, a similar comparison between the BB84 and as they are capable of measuring these quantities for differ- SARG protocols has been done, and lower bounds on the

012316-8 SECURITY OF QUANTUM-KEY-DISTRIBUTION… PHYSICAL REVIEW A 75, 012316 ͑2007͒

QKD protocols, one might try to find the conditions on the −2 10 encoding ͑and decoding͒ operations which would lead to a properly restricted set ⌫Q, such that a high QBER can be −3 tolerated. 10 In a protocol based on weak coherent pulses, it might be advantageous to take the detected double clicks into account. BB84 10 −4 As mentioned above, this would ͑most likely͒ impose further restrictions on the set of possible attacks and thus result in an improvement of the secret-key rate. In addition, it would be SARG 10 −5 interesting to generalize the ideas developed in this paper to

Secret Key Rate [bits/pulse] a scenario, where not only the intensity of light is used but where also the coherence of the light is checked similar to −6 ͑ 10 the decoy states͒. One protocol taking this into account has for instance been proposed in Ref. ͓3͔. Another possibility is 0 20 40 60 80 100 120 to consider protocols based on weak coherent pulses that use (a) distance [km] two-way post-processing, as studied by Lo ͓44͔. We also note here that the techniques presented here can also be ap- BB84 plied to protocols based on squeezed states. 0.65 In this work, we considered the so-called untrusted-device 0.6 µ scenario, where the adversary might arbitrarily modify the 0.55 efficiency of Bob’s detector. If one considers the reasonable

optimal 0.5 situation, where Eve cannot influence Bob’s device, one SARG 0.45 might obtain larger values for the key rate. 0.4 0 20 40 60 80 100 120 ACKNOWLEDGMENTS (b) distance [km] The authors would like to thank Nicolas Gisin, Antonio FIG. 4. ͑Color online͒ Same plots as in Fig. 3, but for a quantum Acin, and Valerio Scarani for helpful discussions. This channel with nonperfect visibility, V=0.95. project is partly supported by SECOQC and by the FWF. One of the authors ͑R.R.͒ acknowledges support by HP Labs, secret-key rates were computed. For BB84, our results are Bristol and one of the authors ͑B.K.͒ by the FWF through the Elise-Richter project. very similar to those of Ref. ͓35͔͑see also Ref. ͓34͔͒, but we could slightly increase the rates and the limiting distances APPENDIX A: PROOF OF LEMMA 1 with using the local randomization process ͓43͔. For the SARG protocol, taking into account the two- In this appendix we prove the lemma presented in Sec. III. n photon contribution in the lower bound allows one to in- The operator ␴ is symmetric and can thus be written as crease the lower bound. In the case of SARG without decoy n ␴ = ␮nЈ,nЈ,nЈ,nЈ states, we could thus improve significantly the bound of Ref. ͚ 1 2 3 4 nЈ,...,nЈ ͓35͔. Our conclusion is therefore different: we find that the 1 4  Ј  Ј  Ј  Ј SARG protocol performs better than BB84 for high visibility n1 n2 n3 n4 ϫPS͑P  P  P  P ͒, VӍ1 ͑see Fig. 1͒. However, the SARG is more sensitive to ͉⌽00͘ ͉⌽01͘ ͉⌽10͘ ͉⌽11͘ the loss of the channel, and for V=0.95 for instance, BB84 is for appropriate coefficients ␮nЈ,nЈ,nЈ,nЈ. Hence, with the defi- more efficient ͑Fig. 2͒. ª 1 2 3 4 nition p ␮n ,n ,n ,n , we have In the case of SARG with decoy states, the two-photon 1 2 3 4 n contribution had already been taken into account in Ref. ␴ = p␳n + ͑1−p͒˜␳n, ͓35͔, and we again get similar results. However, we could where ˜␳ is a symmetric quantum state on n subsystems. slightly improve the rate with the improved calculation of n Moreover, it is easy to see that the coefficient p cannot be SSARG͑Q ͒͑see Appendix C͒, and with the local randomiza- 1 1 smaller than 1 . tion process. Nevertheless, our conclusion is the same as in n By linearity, we get the following expression for the state Ref. ͓35͔, namely that when decoy states are used, the SARG   after the operation E ¯n has been applied to ␴ n: is outperformed by the BB84 protocol. ¯n ¯n n ¯n ¯n ¯␴ = E ͑␴ ͒ = pE ͑␳n͒ + ͑1−p͒E ͑˜␳n͒. ͑A1͒ ¯n V. FURTHER APPLICATIONS, AND OPEN PROBLEMS Because ¯␴ is symmetric, it can be written as ¯␴¯n = ␮¯ Ј There are still several possibilities to improve the lower ͚ ¯n1,¯n2,¯n3,¯n4 bounds on the secret-key rate of QKD protocols. One way to ¯n1,...,¯n4 look at this problem is to analyze the properties of the set ⌫ ¯n1 ¯n2 ¯n3 ¯n4 ϫPS͑P  P  P  P ͒, over which one must optimize in order to obtain the lower ͉⌽00͘ ͉⌽01͘ ͉⌽10͘ ͉⌽11͘ bound ͓see, e.g., Eq. ͑3͔͒. Concerning the single photon for some coefficients ␮¯ Ј . Furthermore, by the law of ¯n1,¯n2,¯n3,¯n4

012316-9 KRAUS, BRANCIARD, AND RENNER PHYSICAL REVIEW A 75, 012316 ͑2007͒

Ј A1 large numbers, the sum of the coefficients ␮¯¯n ,¯n ,¯n ,¯n for =␴z for l+ j=n+ j=1 and the identity otherwise. It can be 1 2 3 4 easily verified that the state describing Alice’s and Bob’s first tuples ¯n ,¯n ,¯n ,¯n which are not contained in B␧͑¯␭ ,...,¯␭ ͒ 1 2 3 4 1 4 system is then the partial trace over E,R of the state is exponentially small, i.e., ˜ −⌰͑¯n␧2͒ ͉⌿͘ = ͱ␭ ␭ ␭ ͉⌽ ͘ ␮¯ Ј ഛ 2 . ͑A2͒ A1B1RE ͚i,j,k,l,m,n ij kl mn i+k+m,j+␦l+j,1␦n+j,1 A1B1 ͚ ¯n1,¯n2,¯n3,¯n4 ͑¯n ,...,¯n ͒B␧͑¯␭ ,...,¯␭ ͒ 1 4 1 4 ϫ͉␾j,k,l,m,n͘R͉␹i,j,k,l,m,n͘E, Finally, because of ͑A1͒, where ͉␾ ͘ denotes the state ͉⌽ ͘ ͉⌽ ͘ . As j,k,l,m,n R k,l+j A2B2 m,n+j A3B3 Ј explained in Sec. II D, providing Eve with a purification of ␮¯ ജ p␮¯¯n ,¯n ,¯n ,¯n , ¯n1,¯n2,¯n3,¯n4 1 2 3 4 the state that describes the systems A1,B1 never underesti- 1 mates her power. The eigenvalues of the two-qubit Bell- where ␮¯¯n ,¯n ,¯n ,¯n are the coefficients of ¯␳n. Since pജ n , 1 2 3 4 diagonal state describing Alice’s and Bob’s remaining sys- Ј ␮¯¯n ,¯n ,¯n ,¯n ഛ n␮¯¯ ¯ ¯ ¯ . ˜ 1 2 3 4 n1,n2,n3,n4 tems, denoted by ␭i,j, are Combining this with ͑A2͒, we conclude ˜ 2 2 ␭i,j = ␭i,j͑␭i,j +3␭i,j+1͒ +3␭i+1,j͑␭i,j + ␭i,j+1͒ 2 ␮¯ ഛ n2−⌰͑¯n␧ ͒. +6␭ ␭ ␭ . B2 ͚ ¯n1,¯n2,¯n3,¯n4 i,j i+1,j i+1,j+1 ͑ ͒ ¯n ¯n B␧ ¯␭ ¯␭ ͑ 1,..., 4͒ ͑ 1,..., 4͒ The intuition for this choice of unitary transformations is ᭿ the following. The state ͉⌿͘ABE under consideration is sup- posed to lead to a secret bit. Thus, the coefficients ␭i,j are such that it is very likely that if both l+ j=1 and n+ j=1 then APPENDIX B: ADVANTAGE DISTILLATION USING j=1, which means that within the remaining qubit pair there THE XOR PROCESS is a phase-flip error. The unitaries are chosen such that this error is corrected. In this appendix we explain how the XOR process applied Using the new eigenvalues of the state describing Alice’s to many qubit pairs can be easily included within this for- and Bob’s remaining bits, it is straightforward to compute malism. Alice selects randomly a set of bits and informs Bob the lower bound on the secret-key rate ͓Eq. ͑3͔͒. about this set. Then, Alice and Bob compute both the XOR of those bits and keep only the result, discarding all the oth- ers. Our goal is to find a simple description of the remaining APPENDIX C: AN IMPROVED ANALYSIS OF THE SARG logical bits, Eve’s system, and the classical information sent PROTOCOL WITH SINGLE PHOTONS from Alice to Bob ͑note that Eve knows the randomly chosen In the SARG protocol the bit value 0 ͑1͒ is encoded in the set which is used by Alice and Bob͒. We demonstrate here z basis ͑x basis͒, respectively. During the sifting phase Alice how this can be achieved with the example of three qubit announces a set containing two states, the one which she sent pairs. The idea can be easily generalized to any number of and one in the other basis. There are four different encoding pairs. and decoding operators. For instance A1 =͉0͗͘0z͉+͉1͗͘0x͉ and Quantum mechanically the XOR operation can be de- B1 =͉0͗͘1x͉+͉1͗͘1z͉ describe the situation where Alice sends scribed by a controlled-NOT operation, denoted by Uc. Three one of the two states ͕͉0 ͘,͉0 ͖͘ and tells Bob that the sent copies of the state ⌿ = ͱ␭ ⌽ ⌽ transform, z x ͉ ͘ABE ͚i,j i,j͉ i,j͘AB͉ i,j͘E state is within this set. Let us for the moment consider a under the transformation Uc3→1Uc2→1  Uc3→1Uc2→1 to the A A B B single qubit sent by Alice ͑for more details see Ref. ͓15͔͒. state The state shared by Alice, Bob, and Eve after the sifting is given by ͉␹͘ =͚ A  B ͉⌿͘ ͉j͘ , where ͉⌿͘ is the ͱ␭ ␭ ␭ ͉⌽ ͘ ABER1 j j j ABE R1 ABE ͚ i,j k,l m,n i+k+m,j A1B1 i,j,k,l,m,n state shared by Alice, Bob, and Eve after Eve’s intervention. Now, we apply some symmetrization to the state, which does ϫ͉⌽ ͘ ͉⌽ ͘ ͉␹ ͘ , ͑B1͒ k,l+j A2B2 m,n+j A3B3 i,j,k,l,m,n E not change any security consideration, as explained in Sec. A II. Let us consider the state ͉˜␹͘ABER R =͉␹͘ABER ͉0͘R +␴ where ͉␹i,j,k,l,m,n͘E =͉⌽i,j͉͘⌽k,l͉͘⌽m,n͘. Since Alice and Bob 1 2 1 2 z  ␴B͉␹͘ ͉1͘ . It is straightforward to show that the re- are not going to use the systems 2 and 3 anymore, we want z ABER1 R2 to consider a state that describes only Alice’s and Bob’s first duced state describing Alice’s and Bob’s system is equal to ˜ ˜ systems. More importantly, we want to give Eve a purifica- D2D1͓D2͑␳0͔͒, with ␳0 =trE͑P⌿͒. Here, D2͑␳͒=1/2͑␳+␴z tion of this state. If we would assume that Eve has a purifi-   D  †  † ␴z␳␴z ␴z͒, 1͑␳͒=͚jAj Bj␳Aj Bj is given by the pro- cation of the state describing systems A and B , this would 1 1 tocol and D2 denotes the depolarizing map, i.e., be equivalent to assume that Eve has Alice’s and Bob’s sec-   ond and third pair after this transformation. It is evident that D2͑␳͒ = 1/4͑␳ + ␴x ␴x␳␴x ␴x we assume then that she has more power than she actually + ␴  ␴ ␳␴  ␴ + ␴  ␴ ␳␴  ␴ ͒. has. In order to avoid to give her too much power we use the y y y y z z z z idea mentioned in Sec. II D ͑see also Ref. ͓8͔͒, by consider- Furthermore, the action of D1 on a Bell-diagonal state is the  ing the systems A2 ,B2 ,A3 ,B3 as auxiliary system R ͓45͔. For same as A1 B1 on that state. Thus, we only need to consider the unitary transformations, Uk,l,m,n, we choose Ui,j,k,l,m,n the situation where Eve has a purification of the state D2͑␳0͒,

012316-10 SECURITY OF QUANTUM-KEY-DISTRIBUTION… PHYSICAL REVIEW A 75, 012316 ͑2007͒

˜ an efficiency ␩ and a probability of dark counts p . We i.e., the state before the action of D1 and D2. Using det d the results of Refs. ͓8,9͔ this implies that the state we will use the notations ␩=t␩det for the overall transmission must to use in order to compute the lower bound on the factor and ¯pd =1−pd. ˜ AB secret-key rate is ␳ =D ͑P  ͘ ͒, where ͉⌽͘ ABE 2 A1 B1͉⌽ ABE ABE 1. BB84 protocol =ͱ␭00͉⌽00͘AB͉⌽00͘E +ͱ␭01͉⌽01͘AB͉⌽01͘E +ͱ␭10͉⌽10͘AB͉⌽10͘E +ͱ␭11͉⌽11͘AB͉⌽11͘E, i.e., a purification of the Bell-diagonal a. Eve’s uncertainty on the one-photon pulses state D ͑␳ ͒. 2 0 For BB84, the set ⌫ contains all states with diagonal Using this description it is straightforward to compute the Q1 state describing Alice’s and Bob’s system, which is, in con- entries ͑in the Bell basis͒ ␭00=1−2Q1 +␭11 and ␭01=␭10 ෈ trast to former considerations, no longer Bell diagonal. In the =Q1 −␭11, for any ␭11 ͓0,Q1͔͓8,9͔. One can easily prove that S͑X͉E,n=1͒ takes its minimum following we consider the situation where Bob accepts only 2 if the probability for him to obtain the bit values 0 is the when ␭1,1=Q1. Then, a straightforward calculation shows that SBB84͑Q ͒=inf S͑X͉E,n=1͒=1−h͑Q ͒. Note that same as detecting 1. This is a first step in the parameter 1 1 ␴1෈⌫Q 1 BB84 1 estimation. Note that this condition imposes ␭01=␭10. The S1 ͑Q1͒ is decreasing for 0ഛQ1 ഛ1/2: as expected, the QBER, Q, can be easily determined and one finds Q=͑␭01 higher the error Eve introduces, the more she reduces her +␭11͒/͑1/2+␭01+␭11͒. Using the normalization condition uncertainty. we find that the coefficients in the state ͉⌽͘ABE are given by ␭00=1−Q/͑1−Q͒+␭11, ␭01=Q/͓2͑1−Q͔͒−␭11, ␭10=␭01. b. Constraints on the yields and error rates Thus, for a fixed QBER there is only one parameter, In the BB84 protocol, the probability that Alice and Bob ␭ ෈[0,Q/͓2͑1−Q͔͒], over which one needs to minimize to 11 choose the same basis for their preparation and measure- obtain the lower bound on the secret-key rate given by for- ment, respectively, is 1/2 ͑this is the sifting factor͒. There- mula ͑4͒. Without the local randomization one finds that the fore we have Y ഛ 1 for all n, which implies the following lower bound on the secret-key rate is positive as long as Q n 2 bounds: ഛ0.1167. Including the local randomization allows one to increase the tolerable QBER to 0.1308 compared to the pre- 1 R1 = p1Y1 ഛ p1, ͑D1͒ viously known bounds of 0.0968 without and 0.1095 with 2 local randomization, respectively ͓15͔. 1 R = R − p Y ജ R − p . ͑D2͒ 1 ␮ ͚ n n ␮ 2 ͚ n APPENDIX D: CALCULATIONS RELATED nജ2 nജ2 TO THE ANALYSIS OF PROTOCOLS These are the first two constraints announced in ͑14͒. The BASED ON COHERENT PULSES third constraint follows from the definition of Q␮, R␮Q␮ This appendix contains some calculations related to the =͚nRnQn. evaluation of the lower bound ͑9͒ on the secret-key rate for the BB84 and SARG protocols with weak coherent pulses c. Yields and error rates for depolarizing channels ͑see Sec. IV͒. When implementing the BB84 protocol, Alice and Bob For this purpose, we first compute the infimum Sn͑Qn͒ would estimate the quantities Q␮, R␮ and then compute the ª inf␴ ෈⌫ S͑X͉E,n͒ for any given Qn, and then optimize rate as explained above. In order to get an idea how good the n Qn ͑from Eve’s point of view͒ over the parameters Rn, Qn. These obtained bounds on the rate are we evaluate here these quan- parameters must be compatible with the measurable quanti- tities for the situation where there is no Eve present and ties R␮, Q␮: in the case of protocols which do not use decoy Alice and Bob share a lossy depolarizing channel. states, this leads to particular constraints for each protocol, In BB84, when Alice sends n photons, the probability that which we derive here. ͑Note that for protocols with decoy Bob chooses the same basis as Alice and gets a single or a states, Alice and Bob can estimate all rates Rn ,Qn: Eve can double click is no longer optimize over these parameters.͒ Y = 1 1−¯p2 1−␩ n . Recall that we work in the untrusted-device scenario, n 2 ͓ d͑ ͒ ͔ where Eve has full control over Bob’s detectors. Dark counts Bob gets a wrong bit if only the wrong detector clicks, or do not occur, and therefore R0 =0, as Eve should obviously if the two detectors click, but he randomly chooses a wrong not send any photon to Bob when she receives an empty bit. This happens with probability pulse from Alice. Moreover, we consider protocols where n Bob treats all double clicks as if only one randomly chosen 1 Y Q = CkFkDn−k ͓¯p ͑1−␩͒k͔͓1−¯p ͑1−␩͒n−k͔ detector clicked. n n 2 ͚ n ͩ d d In a second step, in order to give estimations of our k=0 bounds, we compute the typical values of the yields and error 1 + ͓1−¯p ͑1−␩͒k͔͓1−¯p ͑1−␩͒n−k͔ rates if no adversary is present, i.e., if the channel between 2 d d ͪ Alice and Bob is a depolarizing channel with fidelity F ͑or D F t 1 n n 2 n disturbance =1− ͒ and with a transmission factor . In = ͓1+¯p ͑1−F␩͒ − ¯p ͑1−D␩͒ − ¯p ͑1−␩͒ ͔. addition, we suppose in that case that Bob’s detectors have 4 d d d

012316-11 KRAUS, BRANCIARD, AND RENNER PHYSICAL REVIEW A 75, 012316 ͑2007͒

␮n −␮ Bob gets a right conclusive result͒, i.e., on p =Y ͑1−Q ͒ When Alice uses a Poissonian source ͑i.e., pn = n! e ͒, the right n n overall yield and error rate are then ͑for any n෈N͒. To this aim, let us suppose in a first step that Alice sends 1 2 −␮␩ photons in the state ͉+z͘, that Eve attacks the pulse and R␮ = ͑1−¯pde ͒, 2 decides either to forward one photon to Bob in the state ␳B, or to block the pulse. In this case, Bob gets a right conclusive 1 result if ͑i͒ Alice announces the set ͕͉+z͘,͉+x͖͘ ͑which she R Q = ͑1+¯p e−␮F␩ − ¯p e−␮D␩ − ¯p2e−␮␩͒. ␮ ␮ 4 d d d does with probability 1/2͒, Bob chooses to measure ␴x ͑probability 1/2͒ and ͑only͒ the detector corresponding to ͉−x͘ clicks; or ͑ii͒ Alice announces the set ͕͉+z͘,͉−x͖͘, Bob chooses to measure ␴ , and the detector corresponding to 2. SARG protocol x ͉+x͘ clicks. Therefore, Bob’s probability to get a right con- a. Eve’s uncertainty on the one-photon pulses clusive result when Alice sends ͉+z͘ is bounded by In order to compute Eve’s uncertainty on the one-photon 1 1 pright͉+z ഛ 4 ͗− x͉␳B͉ − x͘ + 4 ͗+ x͉␳B͉ + x͑͘D5͒ pulses, we use the method presented in Appendix C. We do not have an analytical expression for SSARG͑Q ͒ 1 1 ഛ 1 Tr͑␳ ͒ = 1 . ͑D6͒ =inf S͑X͉E,n=1͒, but we compute it numerically. 4 B 4 ␴1෈⌫Q 1 SARG This result actually does not depend on the state sent by Note that we find S1 ͑Q1͒ is decreasing only for 0ഛQ1 Շ0.338, and does not reach zero. Alice, and we therefore have 1 pright = Yn͑1−Qn͒ ഛ 4 . ͑D7͒ b. Eve’s uncertainty on the two-photon pulses The first three constraints announced in ͑17͒ then follow We follow the calculations of Ref. ͓35͔ to compute Eve’s uncertainty on the two-photon pulses. The set ⌫ contains 1 Q2 R1͑1−Q1͒ ഛ 4 p1, ͑D8͒ all states with the following diagonal entries ͑in the Bell basis͒: 1 R2͑1−Q2͒ ഛ 4 p2, ͑D9͒

␭00 =1−Q2 − ␭01, R1͑1−Q1͒ + R2͑1−Q2͒ ജ R␮͑1−Q␮͒͑D10͒

␭10 = Q2 − ␭11, 1 − ͚ pn. ͑D11͒ ␭01 + ␭11 ഛ xQ2 + g͑x͒, ∀ x, ͑D3͒ 4 nജ3 1 ͱ ͱ 2 As before, the last constraint follows from the definition of where g͑x͒= 6 ͑3−2x+ 6−6 2x+4x ͓͒35͔. When minimiz- ing xQ2 +g͑x͒ over x, we get Q␮.

␭00 =1−Q2 − ␭01, d. Yields and error rates for depolarizing channels As for the BB84 protocol, we evaluate here the lower ␭10 = Q2 − ␭11, bound on the secret-key rate for the situation where there is no Eve present and Alice and Bob share a lossy depolarizing ␭01 + ␭11 ഛ B͑Q2͒, ͑D4͒ channel, in order to get an idea of how good the obtained bounds on the rate are. 1 1 3Q2 ͱ2 where B͑Q2͒= 2 + 2 ͱQ2͑1− 2 ͒− 4 ͑1−3Q2͒. In order to calculate the yields and error rates for the 1 1 One can show that for Q2 ഛ 6 , B͑Q2͒ഛ 2 and the optimal SARG protocol, let us suppose that Alice sends n photons in choice of the parameters ␭ij for Eve is ␭01+␭11=B͑Q2͒͑i.e., the state ͉+z͘, and announces ͕͉+z͘,͉+x͖͘. By symmetry, the Eve should make the phase error as high as possible, up to following still holds for any state sent by Alice, and any 1 2 ͒, and ␭11=Q2B͑Q2͒. Then, a straightforward calculation announcement. Similar calculations can be found in Ref. SARG 15 . gives S2 ͑Q2͒=inf␴ ෈⌫ S͑X͉E,n=2͒=1−h͓B͑Q2͔͒. Note ͓ ͔ 2 Q2 1 1 If Bob measures ␴ , he gets a ͑wrong͒ conclusive click on that SSARG͑Q ͒ is decreasing for 0ഛQ ഛ , and SSARG͑ ͒ z 2 2 2 6 2 6 the detector corresponding to ͉−z͘, or a double click with =0. probabilities

n c. Constraints on the yields and error rates k k n−k k n−k p͉−z͉͘z = ͚ CnF D ͓¯pd͑1−␩͒ ͔͓1−¯pd͑1−␩͒ ͔ In the case of SARG, because of the nonorthogonality of k=0 the quantum states that are used to encode the classical bit ¯ n ¯2 n values, it is a little bit more tricky to find the constraints that = pd͑1−F␩͒ − pd͑1−␩͒ , the yields and error rates must satisfy. Here, we will derive a n n 2 n constraint on the yields without errors ͑or probability that p2 clicks͉z =1−¯pd͑1−F␩͒ − ¯pd͑1−D␩͒ + ¯pd͑1−␩͒ .

012316-12 SECURITY OF QUANTUM-KEY-DISTRIBUTION… PHYSICAL REVIEW A 75, 012316 ͑2007͒

Similarly, if Bob now measures ␴ , he gets a ͑right͒ con- 1 1 x YnQn = 2 ͑p͉−z͉͘z + 2 p2 clicks͉z͒. clusive click on the detector corresponding to ͉−x͘, or a double click with probabilities We find n 1 ¯p ¯p ␩ 2 n d n d n 2 n p = ¯p 1− − ¯p ͑1−␩͒ , Yn = 1+ ͑1−F␩͒ − ͑1−D␩͒ − ¯p ͑1−␩͒ , ͉−x͉͘x dͩ 2 ͪ d 2ͩ 2 2 d ͪ

n 1 ␩ 2 n n n 2 n p =1−2¯p 1− + ¯p ͑1−␩͒ . YnQn = ͓1+¯pd͑1−F␩͒ − ¯pd͑1−D␩͒ − ¯p ͑1−␩͒ ͔. 2 clicks͉x dͩ 2 ͪ d 4 d Since Bob randomly chooses the basis he measures, with For a Poissonian source, the overall yield and error rate equal probabilities, and since he randomly chooses one out- are then come in the case of double clicks ͑conclusive or not͒, then 1 ¯p ¯p the probability that Bob’s result is conclusive when Alice d −␮F␩ d −␮D␩ 2 −␮␩ R␮ = 1+ e − e − ¯pde , sends n photons is 2ͩ 2 2 ͪ Y = 1 p + 1 p + 1 p + 1 p , n 2 ͑ ͉−z͉͘z 2 2 clicks͉z͒ 2 ͑ ͉−x͉͘x 2 2 clicks͉x͒ 1 R Q = ͑1+¯p e−␮F␩ − ¯p e−␮D␩ − ¯p2e−␮␩͒. and the error rate on these pulses is ␮ ␮ 4 d d d

͓1͔ See for instance N. Gisin, G. Ribordy, W. Tittel, and H. Zbin- ͓16͔ R. Renner, Ph.D. thesis, ETH, 2005; e-print quant-ph/0512258. den, Rev. Mod. Phys. 74, 145 ͑2002͒; A. Khalique, G. M. ͓17͔ A collective attack is an attack where the adversary treats each Nikopolous, and G. Alber, Eur. Phys. J. D 40, 453 ͑2006͒, and signal sent over the channel identically and independently of references therein. the other signals. ͓2͔ http://www.idquantique.com, http://www.magiqtech.com ͓18͔ An even tighter lower bound is given by r ͓3͔ N. Gisin, G. Ribordy, H. Zbinden, D. Stucki, N. Brunner, and ജsup ← ← inf S͑U͉VE͒−H͑U͉YV͒. This includes U X,V U ␴AB෈⌫Q V. Scarani, e-print quant-ph/0411022; D. Stucki, N. Brunner, the possibility that Alice sends some additional information V N. Gisin, V. Scarani, and H. Zbinden, Appl. Phys. Lett. 87, to Bob. However, we are not aware of any protocol where this 194108 ͑2005͒. additional step helps ͑at least not after the sifting phase͒. ͓4͔ K. Inoue, E. Waks, and Y. Yamamoto, Phys. Rev. A 68, ͓19͔ G. Smith, J. M. Renes, and J. A. Smolin, e-print quant-ph/ 022317 ͑2003͒. 0607018. ͓5͔ This description applies to a large class of QKD protocols. ͓20͔ J. M. Renes and G. Smith, e-print quant-ph/0603262. There are, however, certain proposals of QKD schemes where ͓21͔ H.-K. Lo, Quantum Inf. Comput. 1, 81͑ 2001͒. the encoding is different ͓3,4͔. ͓22͔ U. Maurer, IEEE Trans. Inf. Theory 39, 733 ͑1993͒. ͓6͔ In addition to the QBER, further parameters estimated by Alice ͓23͔ D. Gottesman and H.-K. Lo, IEEE Trans. Inf. Theory 49, 457 and Bob ͑e.g., the sifting rate͒ might be used to bound the ͑2003͒. adversary’s information. ͓24͔ H. F. Chau, Phys. Rev. A 66, 060302͑R͒͑2002͒. ͓7͔ G. Brassard and L. Salvail, Advances in Cryptology— ͓25͔ ␭ is a vector of eigenvalues ␭ij corresponding to the Bell states EUROCRYPT’93: Workshop on the Theory and Application ͉⌽ij͘. of Cryptographic Techniques, Lofthus, Norway ͑Springer, ͓26͔ Note that assuming that Eve has a purification of the state Berlin, 1994͒, p. 410. describing Alice’s and Bob’s system takes into account the fact ͓8͔ B. Kraus, N. Gisin, and R. Renner, Phys. Rev. Lett. 95, that Eve knows the classical information, about the bits which 080501 ͑2005͒. are grouped in the different blocks. ͓9͔ R. Renner, N. Gisin, and B. Kraus, Phys. Rev. A 72, 012332 ͓27͔ A. Acin, J. Bae, E. Bagan, M. Baig, Ll. Masanes, and R. ͑2005͒. Munoz-Tapia, Phys. Rev. A 73, 012327 ͑2006͒. ͓10͔ P. W. Shor and J. Preskill, Phys. Rev. Lett. 85, 441 ͑2000͒. ͓28͔ J. Bae and A. Acin, e-print quant-ph/0610048. ͓11͔ C. H. Bennett and G. Brassard, Proceedings of the IEEE Inter- ͓29͔ We do not consider the situation where Alice also sends a national Conference on Computers, Systems, and Signal strong reference pulse to Bob. In this case, the state Alice −␮ n Processing, Bangalore, India ͑IEEE, New York, 1984͒, pp. would send is of the form ͉␺͘=͚nജ0ͱe ␮ /n!͉n͉͘N−n͘, 175–179. where ͉n͘ denotes the state of n photons in a certain mode. ͓12͔ D. Bruss, Phys. Rev. Lett. 81, 3018 ͑1998͒; H. Bechmann- Here we consider the situation where she sends only the first of Pasquinucci and N. Gisin, Phys. Rev. A 59, 4238 ͑1999͒. these two systems to Bob. ͓13͔ C. H. Bennett, Phys. Rev. Lett. 68, 3121 ͑1992͒. ͓30͔ Similarly, one could consider any other distribution instead of ͓14͔ V. Scarani, A. Acin, G. Ribordy, and N. Gisin, Phys. Rev. Lett. the Poissonian distribution. 92, 057901 ͑2004͒. ͓31͔ We still make the so-called fair-sampling assumption, which ͓15͔ C. Branciard, N. Gisin, B. Kraus, and V. Scarani, Phys. Rev. A means that the errors are independent of the measurement 72, 032301 ͑2005͒. bases chosen by Bob.

012316-13 KRAUS, BRANCIARD, AND RENNER PHYSICAL REVIEW A 75, 012316 ͑2007͒

͓32͔ This means that, whenever Bob measures a double click, he could still give a small contribution to the key ͑Eve does not must to replace it by a random single click. have full information on these͒. For simplicity we limit our- ͓33͔ The factor 2 after the first equality sign is due to the renormal- selves to the one- and two-photon contributions. 1 ization ͑each of Alice’s outcomes k has probability 2 ͒. ͓40͔ M. Koashi, e-print quant-ph/0507154. 94 ͓34͔ H.-K. Lo, X. Ma, and K. Chen, Phys. Rev. Lett. , 230504 ͓41͔ W.-Y. Hwang, Phys. Rev. Lett. 91, 057901 ͑2003͒. ͑2005͒. ͓42͔ X.-B. Wang, Phys. Rev. Lett. 94, 230503 ͑2005͒. ͓35͔ Chi-Hang Fred Fung, K. Tamaki, and H.-K. Lo, Phys. Rev. A ͓43͔ The difference, for instance, in the plots for BB84 in Fig. 9 of 73, 012337 ͑2006͒. ͓36͔ In the untrusted-device scenario, with Bob’s detector replaced Ref. ͓35͔ and our Figs. 1 and 3 essentially comes from a dif- by the eavesdropper, Eve should not send any photon to Bob ferent definition of the dark count probabilities: in Ref. ͓35͔, when she receives an empty pulse from Alice, and therefore pdark is the probability that one of the two detectors has a dark R0 =0. In the trusted-device scenario however, the dark counts count, while here pd is the probability for each detector to have could contribute to the key with a positive term R0. For a a dark count ͑therefore we have pdarkӍ2pd͒. similar observation, see Ref. ͓46͔. ͓44͔ X. Ma, C-H F. Fung, F. Dupuis, K. Chen, K. Tamaki, and ͓37͔ D. Gottesman, H.-K. Lo, N. Lutkenhaus, and J. Preskill, Quan- H.-K. Lo, Phys. Rev. A 74, 032330 ͑2006͒. tum Inf. Comput. 4, 325 ͑2004͒. ͓45͔ A similar argument has also been used in Refs. ͓23,24͔ to ͓38͔ H. Inamori, N. Lutkenhaus, and D. Mayers, e-print quant-ph/ include this process. 0107017. ͓46͔ H.-K. Lo, Quantum Inf. Comput. 5, 413 ͑2005͒. ͓39͔ In the SARG protocol, the pulses with three or more photons

012316-14 Quantum Information and Computation, Vol. 7, No. 7 (2007) 639–664 c Rinton Press

ZERO-ERROR ATTACKS AND DETECTION STATISTICS IN THE COHERENT ONE-WAY PROTOCOL FOR QUANTUM CRYPTOGRAPHY

CYRIL BRANCIARD1, NICOLAS GISIN1 NORBERT L¨uTKENHAUS2, VALERIO SCARANI1 1Group of Applied Physics, University of Geneva 20, rue de l’Ecole-de-M´edecine, CH-1211 Geneva 4, Switzerland 2Institute for Quantum Computing, University of Waterloo 200 University Ave. W., Waterloo, ON Canada N2L 3G1

Received September 16, 2006

This is a study of the security of the Coherent One-Way (COW) protocol for quan- tum cryptography, proposed recently as a simple and fast experimental scheme. In the zero-error regime, the eavesdropper Eve can only take advantage of the losses in the transmission. We consider new attacks, based on unambiguous state discrimination, which perform better than the basic beam-splitting attack, but which can be detected by a careful analysis of the detection statistics. These results stress the importance of testing several statistical parameters in order to achieve higher rates of secret bits.

Keywords: Quantum Cryptography, Quantum Key Distribution, Eavesdropping Communicated by: H-K Lo & E Polzik

1 Introduction First proposed by Bennett and Brassard in 1984 (BB84 protocol, [1]), quantum cryptography has attracted a lot of attention, as means of realizing a useful task (key distribution for secret communication) based on the superposition principle of quantum physics. One of the features, that makes quantum cryptography appealing, is the possibility of implementing it with present-day technology. After several years devoted to more and more elaborated realizations of the BB84 protocol [2], people gained in confidence, and started devising new protocols that are tailored for practical implementations. A new class of such protocols are distributed phase reference schemes [3, 4, 5], where the signals have overall phase-relationships to each other which is expected to protect against some loss-related attacks, such as the photon-number splitting attack, in a similar way as the strong phase reference in the original Bennett 1992 (B92) protocol [6] does. These new protocols are providing new challenges for theorists, as we can no longer identify individual signals, and so the usual security proof techniques do not apply. It is important to understand how we prove the security, and the context of the present work is to show limitations of secure rates by showing specific attacks that can be performed by an eavesdropper. In a protocol like BB84, each bit is coded in a qubit: Alice prepares a photon in a given state which codes (say) for 0 and sends it to Bob; then, she prepares another photon in another state which codes (say) for 1, and sends it, and so on. In short, each quantum signal codes

639 640 Zero-error attacks and detection statistics in the coherent one-way protocol for quantum cryptography for one bit. For this kind of protocols, powerful security proofs have been derived for the case where the quantum signal is a single photon [7, 8, 9] or a weak coherent pulse [10, 11, 12]. But one can also code a bit in the relative phase between any two successive coherent pulses: in such a protocol (called differential phase shift) the first bit is in the phase between pulse one and pulse two, the second bit in the phase between pulse two and pulse three, and so on [3]. Thus, each pulse participates to the coding of two bits and is coherent with all the other pulses: there is a unique quantum signal, the string of all the pulses, which codes for the whole string of bits. The search for security bounds for such schemes is an important research activity in theoretical quantum cryptography. In this paper, we study a protocol of the same kind called Coherent One-Way (COW) [4, 5], which will be explained in detail later. We present new attacks on this protocol based on unambiguous state discrimination. These attacks take advantage of the fact that, on the one hand, the coding of COW makes use of empty pulses and, on the other hand, coherence is checked only between successive pulses: in particular then, no coherence is checked between all that comes before and all that comes after an empty pulse. Therefore, if Eve can be sure that a given pulse was empty, she can make an attack that breaks no observed coherence. The attacks that we have found do not introduce any errors in the statistical parameters that are usually checked, the quantum bit error rate (QBER) and the visibility of an interferometer; but they do introduce modifications in other statistical parameters, which Alice and Bob could check as well. The main message of this paper is that the COW protocol should include additional statistical checks. Of course, since we describe specific attacks, in this paper we derive only upper bounds for security (i.e., more powerful attacks may exist). The paper is organized as follows. In Section 2 we recall the definition of the COW protocol and introduce our working assumptions. Section 3 presents unambiguous state discrimination (USD) strategies on three and four successive pulses, and the detection rates for the COW protocol that Bob would observe if Eve applied those strategies. In Section 4, we present our main results: an attack that combines three USD strategies and that preserves all the observed detection rates in Bob’s detectors. Section 5 is a conclusion. In the Appendices, we provide the security study for a three-state protocol that is the analog of the COW protocol if the coherence between bits would be broken (Appendix A) and for the beam-splitting attack considered as a collective attack (Appendix B); we also present the detailed calculations for the best attack that we have found (Appendix C) and an attack that becomes possible if Alice and Bob would make a too limited statistical analysis (Appendix D); finally, we suggest a feasible modification of the COW protocol that would improve its security (Appendix E).

2 The COW protocol 2.1 The protocol The idea of the COW protocol is to have a very simple data line in which the raw key is created, protected by the observation of quantum interferences in a monitoring line. We review here its features, referring to Refs [4, 5] for a more comprehensive discussion of motivations and practical issues. The protocol is schematized in Fig. 1. Alice produces a train of equally spaced coherent pulses. The logical bit 0 is encoded in the sequence 0 2k α 2k 1 of a non-empty pulse at time t2k 1 followed by an empty one |  |  − − C. Branciard, N. Gisin, N. L¨utkenhaus, and V. Scarani 641

Alice Bob tB DB Laser IM 1t− B DM1 bit0 decoy DM2 bit1 Fig. 1. Schematic description of the COW protocol. A continuous, phase-stabilized coherent laser beam is sent through an intensity modulator (IM) that shapes discrete pulses, while preserving the coherence. See text for all other details. at time t ; thelogical bit 1 in the opposite sequence α 0 . We writeµ = α 2 the 2k | 2k| 2k 1 | | mean photon number in a non-empty pulse. Alice produces each−bit value with probability 1 f − ; with probability f, she sends out the decoy sequence d = α α , which does not 2 |  | 2k| 2k 1 encode any bit value. The coherence time of Alice’s laser is very large, so− that the quantum signal cannot be divided bitwise, because there is phase coherence between any two non-empty pulses. In other words, there is a single quantum signal, defined by Alice’s list, e.g.

”...0d01...” = ... :0α : αα :0α : α0:... (1) |  |  (from now on, the colon represents the bit separation). The coherence across different bits is crucial to this scheme — a protocol that uses the same coding of bits, but in which there is no distributed coherence, is presented in Appendix A. Alice and Bob are connected by a quantum channel of length ℓ, whose transmission coef- αattℓ/10 ficient is t =10− ; the parameter αatt, whose units are dB/km, is called attenuation coefficient. Bob’s detection is completely passive. At the entrance of Bob’s device, an asymmetric coupler sends a fraction tB of the photons into the data line, and the remaining fraction 1 t into the monitoring line. The data line consists of a single photon counter D : the − B B logical bits 0 and 1 are discriminated by measuring the time of arrival (this gives indeed the best unambiguous state discrimination between the states 0 α and α 0 ). The errorson the | |  | |  data line give the quantum bit error rate (QBER, Q). The monitoring line contains a stabilized unbalanced interferometer and two photon countersD M1, DM2. In the interferometer, the delayed half of each pulse is recombined by the non-delayed half of the next pulse: if the two pulses were non-empty, the interference is arranged in such a way that DM2 should never click. The cases where two successive pulses are non empty are (i) the decoy sequences, in which case the coherence is within the bit separation, and (ii) a logical bit 1 followed by a logical bit 0, in which case the coherence is across the bit separation. In each of these cases separately (s = d or s =1 0), Alice and Bob can estimate the errors through the visibility p(DM1 s) p(DM2 s) − Vs = | − | where p(D s) is the probability that detector D has fired at a time p(DM1 s)+p(DM2 s) | corresponding| to a s |sequence. For the estimation of the visibilities and of the counting statistics, Bob announces (i) in which two-pulse sequence he had a detection in the data line, and (ii) at which times he had a detection in DM1 and DM2. Alice tells Bob which items of the data line must be discarded because they correspond to decoy sequences; on her side, she estimates Vd and V10 and the counting statistics. Finally, Q is estimated as usual by Bob revealing some of the bits of the data line. 642 Zero-error attacks and detection statistics in the coherent one-way protocol for quantum cryptography

The amount of information gathered by Eve is estimated through Q, Vd, V10, but not only: the monitoring of other statistical quantities may provide much better estimates. Specifically, it is important to monitor detection rates, as we show in this paper. Finer checks could involve the monitoring of the frequency of each bit value and of many-bit strings, the rate at which any two or all three detectors fire, etc.

2.2 Detection statistics in the zero-error case In this work, we consider only attacks that introduce no errors in the state parameters of the coding (Q =0,V = 1), and that can therefore be detected only by looking at the statistics of the photon counters. Among the statistical parameters, we focus on detection rates. We suppose that all three Bob’s detectors have the same quantum efficiency η and no dark counts. We also work in the trusted-device scenario, i.e. the inefficiency of the detector is not given to Eve. Under these assumptions, the expected detection rates are the following: In detector D , one can estimate the detections due to ”bits” and those due to ”decoy • B sequences” (detection rate per two time-slots):

t µttB η D = (1 f)(1 e− ) , (2) B,bit − − t µttB η D =2f (1 e− ); (3) B,decoy − of course, the total detection rate in this detector is

t t t DB = DB,bit + DB,decoy . (4)

In detectors D and D , one can estimate two different detection rates. (i) The • M1 M2 detection rates at time t2k correspond to interference between two pulses within a bit sequence. The logical bits produce random outcomes, while the decoy sequences interfere constructively in DM1 (recall V =1): Dt = (1 f)D + fD , (5) M1,2k − rand int Dt = (1 f)D (6) M2,2k − rand µt(1 tB )η/4 µt(1 tB )η where D =1 e− − and D =1 e− − . (ii) The detection rates rand − int − at time t2k+1 correspond to interference between two pulses across the bit separation. Constructive interference appears in D in the cases 1 0, 1 d, d 0 and d d, i.e. M1 − − − − with probability (1 + f)2/4; in the case 0 1 there is no photon, so no detection, in the − other cases the outcome is random: 1 f 2 (1 + f)2 Dt = − D + D , (7) M1,2k+1 2 rand 4 int 1 f 2 Dt = − D . (8) M2,2k+1 2 rand

Now, since tB has been calibrated by Bob, these six detection rates depend only on two µtη parameters, namely f and x e− . Bob can verify that the observed detection rates are ≡ consistent in themselves, and with the expected values of f and x. About other statistical quantities that can be checked by Alice and Bob: in the attacks that we consider below, the coincidence rates are not really a concern, the bit values are equally probable; but the many-bit statistics are somehow biased and may reveal the attacks. C. Branciard, N. Gisin, N. L¨utkenhaus, and V. Scarani 643

2.3 Zero-error attacks In the ideal situation that we consider (zero-error, i.e. Q =0,V = 1), the eavesdropper can take advantage only of the losses in the channel, whose transmission is t. Here we characterize the full set of attacks that Eve can have performed, if Alice and Bob observe zero errors. The simplest attack is beam-splitting (BS) attack: Eve simulates the lossy channel by extracting the (1 t) fraction of the signal with a beam-splitter, and sends the expected − fraction t to Bob on a lossless line. Since a beam-splitter is strictly equivalent to losses, this attack is always possible and is impossible to detect by monitoring the data of Alice and Bob. Thus, this attack sets an obvious upper bound on the achievable secret key rate. We analyze it in detail in Appendix B, improving over the study of Ref. [5]. Though it is unavoidable, the BS attack is not very powerful: it would be a very good point for a protocol, if it could be shown that this attack is the only possible one in the absence of errors. The BS attack is an example of attacks that preserve the mode, while possibly changing the statistics of the photon numbers; these attacks always belong to the class of zero-error attacks. In distributed phase reference schemes, each photon belongs to an extended mode that encodes the coherence. Specifically, in the case of differential phase shift, the mode is 1 N iϕ A = e j a† where a† creates a photon in the j-th pulse [13]. In the case of COW, † √N j=1 j j the extended mode is  N A† a† (9) ∝ k,sk k=1 where s 0, 1,d defines the nature of the k-th two-pulse sequence, and the creation k ∈{ } operators are ak,† 0 = a2†k 1, ak,† 1 = a2†k and ak,d† = a2†k 1 + a2†k. The attacks that preserve− the extended mode would− be the only zero-error attacks if Alice and Bob would check all the coherence relations. In the case of COW however, Alice and Bob check the coherence only on two successive pulses: in particular, no coherence is checked between all that comes before and all that comes after an empty pulse. Therefore, if Eve can be sure that a given pulse was empty, she can make an attack that breaks the coherence at the location of that pulse. More generally, Eve can try and distinguish a sequence of n pulses that begins and ends with an empty pulse: if she succeeds, she can then resend photons belonging to this n-slots mode (”partial mode”). All these attacks must use unambiguous state discrimination (USD). In this paper we study examples of such attacks. The list of zero-error attacks is now complete. To see it, we note that any photon received from Bob is either one of the photons originally sent by Alice (which then belongs to the original extended mode), or a new photon created by Eve (in which case she must have known exactly in which partial mode to send it). In particular, the photon-number splitting (PNS) attack [14] is never a zero-error attack for the schemes under study [5, 15]: since any two non-empty pulses are coherent, any attempt of measuring the number of photons on a finite number of pulses breaks some coherence and contributes to errors.

3 Unambiguous State Discrimination on Three and Four Pulses 3.1 Generalities The attacks that we study are based on unambiguous state discrimination (USD). Suppose the set of possible states is known (cryptography is a natural example [16]): the unambigu- 644 Zero-error attacks and detection statistics in the coherent one-way protocol for quantum cryptography ous discrimination of any state ψ in the set is possible if and only if this state is linearly |  independent from all the other states in the set [17]. For the present study, we just need to identify one state ψ in the set; therefore, we consider measurements with only two out- |  comes: the unambiguous identification and the inconclusive outcome [18]. In this case, the optimal USD strategy is as follows: in the subspace formed by the states of the set, one se- lects φ as the state orthogonal to all but ψ , and performs the von Neumann measurement |  |  Pc = φ φ ,P = 11 Pc . If the state was not ψ , the result is certainly ; so if the result |  | ⊥ − |  ⊥ is c, the state was certainly ψ . Given that the state is ψ , the conclusive result c happens   |  |  with probability p = ψ φ 2. c | | | Specifically, Eve wants to discriminate a given finite sequence of pulses from all the other possible ones; the chosen sequence must be such that the first pulse and the last one are empty. When the result is conclusive, she can prepare and forward the same sequence to Bob; when the result is inconclusive, we suppose that she blocks everything (finer strategies are possible, but we neglect them [19]). By definition, such an attack leaves Q =0 andV = 1, because Bob receives something only when Eve is sure to forward the same sequence as Alice sent, and because no observable coherence has been broken thanks to the empty pulses [20]. However, Eve introduces losses, because the conclusive result is only probabilistic; and, according to the state she actually discriminates and forwards, Bob’s statistics are also modified. Our goal in what follows is to quantify the amount of information that Eve obtains and to analyze how Bob’s statistics are affected, for some examples of USD attacks on the COW protocol. Specifically, we are going to present three USD attacks (Fig. 2). These three attacks can be alternated with one another without introducing errors. Eve can also avoid errors by stopping the USD attacks after a successful discrimination. However, she cannot avoid the risk of errors if she resumes the attack again. What she can do, is to attack large blocks, then to stop also for a large block, then resume and so on: this way, the events in which Eve risks introducing an error have almost zero statistical weight (in particular, they can be overwhelmed by dark counts and other imperfections, which are neglected here).

......

USD3 USD4b USD3 USD4a

yes no no yes ......

Fig. 2. Schematic view of the USD attacks under consideration. Eve intercepts the signal sent by Alice (upper line) and performs the USD attacks. When the result is conclusive, she prepares photons in the same mode and sends it to Bob (bottom line); when the result is inconclusive, nothing is sent. These attacks introduce losses but no errors: no bit value is changed, no monitored coherence is broken.

3.2 USD3: Attack on Three Pulses The USD3 attack is defined as follows: Eve takes three pulses that come from Alice and wants to discriminate unambiguously the sequence 0α0 from the other possible three-pulses |  sequences. When the discrimination is successful, she forwards some photons (not necessarily C. Branciard, N. Gisin, N. L¨utkenhaus, and V. Scarani 645 a coherent state) in the central time-slot; when the result is not conclusive, she doesn’t forward anything. One can see immediately that this attack doesn’t introduce any errors in the data line, preserves the randomness of the bit value, and doesn’t make detector DM2 of Bob’s monitoring line click when it shouldn’t. The limitation of this attack is that Eve never forwards anything when Alice had sent two successive non empty pulses; so, if this attacks is performed systematically, Alice and Bob notice that no decoy sequences have been detected, nor do they have any data to estimate V .

3.2.1 Discriminating 0α0 |  Eve wants to discriminate the state 0α0 from the other possible states, which are the fol- |  lowing: 00α , 0αα , α00 , α0α , αα0 , ααα . (10) |  |  |  |  |  |  Note that the sequence 000 is never sent by Alice. Moreover, the sequences 00α and α00 |  |  |  can be sent only if the bit separation is between the two empty pulses; given that Eve knows the position of the separation, she therefore has only to discriminate between 0α0 and five |  other states. For each case, the six possible states are linearly independent. As a consequence, there is a state in this 6-dimensional subspace which is orthogonal to the five other possible states: this state is (in both cases)

1 ψ = ( 0α0 χ 0αα χ αα0 + χ2 ααα ) (11) | 0α0 1 χ2 | − | − |  |  − α 2/2 µ/2 where χ = 0 α = e−| | = e− . Eve performs a projective measurement which separates  |  ψ0α0 from the subspace orthogonal to it. Conditioned on the fact that the state 0α0 was |  2 2 2 |  µ 2 sent by Alice, the probability of a conclusive result is 0α0 ψ = (1 χ ) = (1 e− ) . | | 0α0| − − 3.2.2 Detection rates in COW for USD3 Let us compute the detection rates in Bob’s detectors when Eve performs the USD3 attack. Eve forwards something to Bob with probability

2 0α0 1 f µ 2 p = − (1 e− ) . (12) concl 2 −   We denote by Π(p)=1 (1 p)n the average detection probability of the state that Eve − − E |E forwards, as a function of the single-photon probability detection p. In particular, Π(p)= p if Eve forwards a single photon, Π(p) 1 if she forwards a bright pulse. The detection rates ≈ on the detector DB are 2 D(3) = p0α0 Π(t η) , (13) B,bit 3 concl B (3) DB,decoy =0. (14)

2 The factor 3 comes from the fact that we compute the detection rate per bit, i.e. for two time slots, while the attack was performed on three pulses. The detection rates on the monitoring 646 Zero-error attacks and detection statistics in the coherent one-way protocol for quantum cryptography line are just random clicks, since two successive pulses are never sent, and so we find

(3) (3) (3) (3) DM1,2k = DM2,2k = DM1,2k+1 = DM2,2k+1 2 η = p0α0 Π (1 t ) , (15) 3 concl − B 4 1  where the factor 4 in the transmission probability comes from the fact that each photon has the ”choice” between two paths in the interferometer, and the ”choice” between two detectors.

3.3 USD4a: A First Attack on Four Pulses The USD4a attack is defined as follows: Eve takes four pulses coming from Alice that cor- respond to two bits, and she wants to discriminate the sequence 0α : α0 from the other |  possible sequences. As before, when Eve successfully could discriminate this sequence, she forwards photons in the two middle time slots, making sure they will interfere correctly in Bob’s monitoring line, while when she couldn’t discriminate this sequence she doesn’t forward anything. Again, this attack doesn’t introduce any bit error, and doesn’t make the detector DM2 click when it shouldn’t. Contrary to USD3, V can be estimated, but only from 1 0 bit − sequences: no decoy sequences are ever forwarded.

3.3.1 Discriminating 0α : α0 |  Eve wants to discriminate the sequence 0α : α0 from the other possible following states that |  Alice could send: 0α :0α , 0α : αα , α0:0α , α0:α0 , (16) α| 0:αα , |αα :0α , |αα : α0, |αα : αα . |  |  |  |  In the subspace defined by the nine possible states, the state which is orthogonal to the eight states listed in (16) is

1 ψ = 2 ( 0α : α0 χ 0α : αα | 0α:α0 1 χ | − |  (17) − χ αα : α0 + χ2 αα : αα ) . − |  |  Eve performs a projective measurement which separates ψ from the subspace orthogonal | 0α:α0 to it. Conditioned on the fact that the state 0α : α0 was sent by Alice, the probability of a |  conclusive result is 0α : α0 ψ 2 = (1 χ2)2. This is the same probability as obtained | | 0α:α0| − before, in the discrimination of three-pulse state 0α0 . |  3.3.2 Detection rates in COW for USD4a Let us compute the detection rates in Bob’s detectors when Eve performs the USD4a attack. 0α:α0 Eve forwards something to Bob with probability pconcl which, as we just stressed, is given by (12). The detection rates on the detector DB are 1 D(4a) = p0α:α0 Π(t η) , (18) B,bit 2 concl B (4a) DB,decoy =0. (19) 1 The factor 2 comes from the fact that we compute the detection rate per bit, i.e. for two time slots, while the attack was performed on 4 pulses. We have also assumed that Bob’s detectors have no dead time [21]. C. Branciard, N. Gisin, N. L¨utkenhaus, and V. Scarani 647

The detection rates on the monitoring lines behave differently, according to the time. The detections at times t2k are just random, since there are no decoy sequences and consequently no interference between pulses within a bit sequence: 1 η D(4a) = D(4a) = p0α:α0 Π (1 t ) . (20) M1,2k M2,2k 2 concl − B 4  On the contrary, when Eve forwards something, there is always a coherence across the bit separation; therefore the detections at times t2k+1 exhibit full interference effects: 1 η D(4a) = p0α:α0 Π (1 t ) (21) M1,2k+1 2 concl − B 2 (4a)  DM2,2k+1 =0. (22) 3.4 USD4b: A Second Attack on Four Pulses The two attacks USD3 and USD4a share the same feature, namely, that no decoy sequences ever reach Bob. In order to pass as much unnoticed as possible, Eve could be obliged to alternate those attacks with another one, in which decoy sequences are sent. We consider the simplest one, in which Eve wants to discriminate 0:αα :0 from the other possible sequences. |  Again, the colon represents the bit separation: contrary to USD4a, now the four pulses are across three bit sequences. One realizes immediately that this is a curious attack: if performed systematically, Eve would forward only decoy sequences, so no raw key would be created! As we said, it is interesting to consider it only as a part of a more complex attack, in which Eve would alternate it with the attacks we have already presented.

3.4.1 Discriminating 0:αα :0 |  One might expect that the probability of conclusive result is the same as before. But this is not the case: there are now more possible sequences, across the 3 bits, that Alice could send. Specifically, Eve wants to discriminate the sequence 0:αα :0 from the following eleven |  states: 0:0α :0, 0:α0:0, 0:0α|: α , 0:α0:| α , 0:αα : α , (23) |α :0α :0, |α : α0:0, |α : αα :0, |α :0α : α, |α : α0:α,|α : αα : α . |  |  |  The state orthogonal to these eleven states is (1 + χ2)φ(αα) χ [φ(0α)+φ(α0)] ψ0:αα:0 = − (24) |  1 χ4 − where we have written 0X0 χ 0Xα χ αX0 + χ2 αXα φ(X)=| − | − |  |  . (25) 1 χ2 − Conditioned on the fact that the state 0:αα :0 was sent by Alice, the probability of a 2 | (1 χ2)3  conclusive result is 0:αα :0ψ = − 2 . Note that this is much smaller than the | | 0:αα:0| 1+χ value (1 χ2)2 obtained in the previous examples: specifically, for µ 1, it goes as 1 µ3 − ≪ 2 (three photons) instead of µ2 (two photons). 648 Zero-error attacks and detection statistics in the coherent one-way protocol for quantum cryptography

3.4.2 Detection rates in COW for USD4b Eve forwards something to Bob with probability

2 µ 3 1 f (1 e− ) p0:αα:0 = f − − . (26) concl 2 1+e µ   − The detection rates on the detector DB are (4b) DB,bit =0, (27) 1 D(4b) = p0:αα:0 Π(t η) (28) B,decoy 2 concl B 1 with the same factor 2 as discussed for the USD4a attack. Detections in the monitoring line behave just the opposite way as they did for the USD4a attack: 1 η D(4b) = p0:αα:0 Π (1 t ) , (29) M1,2k 2 concl − B 2 (4b)  DM2,2k = 0 ; (30) 1 η D(4b) = D(4b) = p0:αα:0 Π (1 t ) . (31) M1,2k+1 M2,2k+1 2 concl − B 4 In summary, there is an obvious symmetry between the USD4a and USD4b attacks. However, 0:αα:0 0α:α0 the fact that pconcl

4 Combining the three USD attacks In the previous Section, we have described an attack where Eve forwards ”bits” (USD3), an attack where she forwards ”coherence across the bit separation” (USD4a), and an attack which forwards ”decoy sequences” (USD4b). These are zero-error attacks as far as the state parameters are concerned (Q =0,V = 1), but each one taken separately introduces deviations from the expected detection rates. Here we show that, provided f < 0.236, Eve can alternate among the three attacks in order to simulate all the expected detection∼ rates.

4.1 Definition of the attack The attack that we consider (with no claim of optimality) is constructed as follows. Eve performs USD3 with probability q1, USD4a with probability q2, and USD4b with probability q3. With probability q0, she just forwards the pulses through a lossless channel (t = 1). Recall that Eve can alternate as she likes among the USD attacks, but she must not stop and resume them too often (see end of paragraph 3.1). We suppose that this is all she does, so that

q0 + q1 + q2 + q3 =1. (32)

We want all detection rates to be the expected ones: the six rates D = DB,bit, DB,decoy, DM1,2k, DM2,2k, DM1,2k+1 or DM2,2k+1 must be such that t=1 (3) (4a) (4b) t q0D + q1D + q2D + q3D = D . (33) C. Branciard, N. Gisin, N. L¨utkenhaus, and V. Scarani 649

We make two further assumptions, namely (i) that Eve forwards always a single photon when she has got a conclusive result [22], in particular then Π(p)=p; and (ii) that we can work in the limit µη 1, so that we can linearize all the detection rates Dt. In this case, an ≪ analytical solution can be found (Appendix C), that reads

µtF 1 q = − (34) 0 µF 1 − µ(1 t)F q = − j (j =1, 2, 3) (35) j µF 1 − where 3(1 4f f 2) 3(1 4f f 2) 1 F = − − = − − , (36) 1 4p0α0 (1 f)2 (1 e µ)2 concl − − − (1 + f)2 1+f 2 1 F = =4 , (37) 2 p0α:α0 1 f (1 e µ)2 concl  −  − − µ 4f 16 1+e− F3 = 0:αα:0 = 2 µ 3 , (38) pconcl (1 f) (1 e− ) − − µ 1 32 (1 e− ) F F + F + F = −F − (39) ≡ 1 2 3 (1 f)2 (1 e µ)3 − − − with =9+4f f 2. Note that, while F and F are always strictly positive, for F to be F − 2 3 1 non-negative one must have f √5 2 0.236: this means that Eve cannot reproduce the ≤ − ≈ detection rates with this attack if a large fraction of decoy sequences is used.

4.2 Upper Bound on the Secret Key Rate We can now compute the secret key rate that can be extracted by Alice and Bob in the presence of the attack just described. We consider the case of one-way classical post-processing, and use the Csisz`ar-K¨orner formula [23]

R = Dt [I(A : B) min (I(A : E),I(B : E))] (40) B,bit − where H is Shannon entropy, I(X : Y ) is mutual information, and by definition of our attacks we have

t t=1 (3) (4a) DB,bit = q0DB,bit + q1DB,bit + q2DB,bit . (41)

The use of the Csisz`ar-K¨orner formula can be justified by an argument analog to the one used in Ref. [24]: the USD attack immediately gives a decomposition of the data into those on which Eve has full information (i.e. those on which the USD attack has been applied and has given conclusive result) and those on which Eve has no information at all (i.e. those that have been sent over the ideal channel). In this case, the Csisz`ar-K¨orner formula gives a tight bound if Alice and Bob were sure that Eve is performing exactly that attack; since this is not proved (there might be better attacks compatible with the observed statistics), the value of R that we compute is an upper bound on the secret key rate that can be extracted with one-way post-processing. 650 Zero-error attacks and detection statistics in the coherent one-way protocol for quantum cryptography

Now, on the one hand, since there are no errors in the state, whenever Bob detects something in DB (other than a decoy sequence) he learns correctly Alice’s bit:

I(A : B)=1. (42)

This implies I(A : E)=I(B : E). On the other hand, Eve has full information on the bits that she attacked and forwarded and were detected in DB, and she has no information in all the other cases:

(3) (4a) q1DB,bit + q2DB,bit I(A : E)= t . (43) DB,bit This gives the expected results, namely that Alice and Bob have secrecy if and only if the bit was not attacked by Eve: µtF (µ) 1 R(µ)=q Dt=1 = − µt η(1 f) . (44) 0 B,bit µF (µ) 1 B − − As usual, Alice and Bob choose the value of µ that maximizes R. Another meaningful param- eter is µmax, the critical value such that R = 0 (that is, q0 = 0: Eve can perform her attack on all the bits). The calculation of µopt, R(µopt) andµ max has been done numerically; the results are shown in Fig. 3. These parameters can also be estimated analytically in the limit 2 1 32 (1 f) 2 µ 1, using F (µ) (1 f)2 µ3 and therefore q0 t −32 µ ; it yields ≪ ≈ − ≈ − 4√6 µ √t, (45) opt ≈ 3(1 f) − 8√6 R(µ ) t ηt3/2 , (46) opt ≈ 9 B µ √3 µ . (47) max ≈ opt For long distances, these analytical estimation are in close agreement with the numerical optimization. In Fig. 3, our attack is compared to the Holevo bound on the beam-splitting (BS) attack computed in Appendix B. As we can see in the right-hand side graph, the BS attack is more powerful than ours for ℓ < 100km; by referring to the left-hand side graph, we note a ∼ discontinuity in µopt. This is due to the fact that we have not considered a mixture between our attack and the BS attack; if we had considered it, the transition between the two would have been smooth.

4.3 Comments on the result We have described a specific attack, which introduces no errors in the state parameters, and which reproduces all the expected detection rates as well. Let’s comment on the results. To the attack, as we have studied it, many limitations can be found. First, this attack is not a real concern as of today: in fact, it outperforms the BS attack only for ℓ > 100km (Fig. 3), which is anyway the typical limiting distance when dark counts are taken into∼ account [5]. Second, the attack is not entirely undetectable with the actual setup: even though all the detection rates are reproduced, one could check other statistical parameters, which would C. Branciard, N. Gisin, N. L¨utkenhaus, and V. Scarani 651

0 10 R(µ ) for the BS attack (Holevo bound) opt −1 R(µ ) for our combination of USD attacks 0 10 opt 10

−2 10

−3 10 µ

−4 10 Secret key rate

−1 −5 10 10

µ for the BS attack (Holevo bound) opt −6 µ for our combination of USD attacks 10 opt µ for our combination of USD attacks max −7 10 0 20 40 60 80 100 120 140 160 0 20 40 60 80 100 120 140 160 Distance (km) Distance (km)

Fig. 3. USD attack that reproduces the detection rates: optimal mean photon number µopt (left- hand side) and corresponding secret key rate R (right-hand side) as a function of the Alice-Bob distance ℓ. The attack is compared to the Holevo bound on the beam-splitting attack. Parameters: η =0.1, αatt =0.25 dB/km, f =0.1, tB ≃ 1. behave in an unexpected way. For instance, since decoy sequences are always forwarded in the form 0:αα :0, Alice and Bob can realize that the two pulses before a decoy sequence |  that they detect always encodes a logical bit 1, and the two pulses after the decoy sequence always encodes a logical bit 0. Finally, as seen in Sec. 4.1, Alice and Bob could simply choose f>0.236, and the attack that we studied becomes impossible. A further interesting point is that the power of the attack can be further reduced by a hardware modification, which keeps the simplicity of the experimental realization: it simply amounts at adding empty decoy sequences. The idea is that, by adding a new kind of signal, the conclusive probabilities of USD become smaller, because Eve has to distinguish the desired state among a larger set. The analysis is done in Appendix E; the intuition is confirmed: by adding empty decoy sequences, we obtain a decrease R(µ ) t4/3 [Eq. (E.14)] at long opt ∝ distances, which is slower than R(µ ) t3/2 given in Eq. (46). Note that other hardware opt ∝ modifications would help as well, in particular adding interferometers that monitor coherence across more than one pulse; but these would make the experiment more complicated [25]. All these arguments can be made as an objection to the importance of our attack. However, that precise attack is only an example: there is no claim of optimality. There is some room for improvement even on USD strategies with three and four pulses [19], and we have not studied USD attacks on more than four pulses. Another concern is that we don’t have any estimate of the robustness of our result when the precision of the statistical estimates of Alice and Bob decreases. Here, we have worked without dark counts and in the limit of an infinite sequence: the presence of dark counts and the finite-size effects, obviously present in any real experiment, may blur the statistics. Eve’s attack may become much more serious if she is asked to guarantee only an approximation of the expected detection rates, or to reconstruct only a smaller set of statistical quantities. A simple example of what can happen if Alice and Bob do not make a careful enough statistical estimate is given in Appendix D.

5 Conclusion In conclusion, we have studied the security of the COW protocol in the regime of zero error in the state parameters (Q =0,V = 1). In this regime, Eve can take advantage only of the 652 Zero-error attacks and detection statistics in the coherent one-way protocol for quantum cryptography

losses; while the beam-splitting attack is always possible, because it preserves the collective mode in which all photons have been encoded, we addressed the existence of more powerful attacks. We have indeed found examples of other zero-error attacks, which however introduce some modifications in the statistics observed by Bob. We have presented an attack that preserves all the detection rates and can be detected only by looking at correlations between two or more bits. This attack becomes relevant only for large distances (ℓ > 100 km for typical values). These results show that, both in the experiment and in∼ the theoretical search of lower bounds for security, higher secret key rates can be achieved if the COW protocol includes several tests of Bob’s statistics. We conjecture that the beam-splitting attack is the only possible one in the zero-error limit provided Alice and Bob analyze all statistics of their data.

Acknowledgements C.B. acknowledges hospitality in IQC Waterloo, where part of this work was realized. We ac- knowledge financial support from the European Project SECOQC and from the Swiss NCCR ”Quantum Photonics”.

References 1. C. H. Bennett, G. Brassard, in Proceedings IEEE Int. Conf. on Computers, Systems and Signal Processing, Bangalore, India(IEEE, New York, 1984), pp. 175-179. 2. N. Gisin, G. Ribordy, W. Tittel, H. Zbinden, Rev. Mod. Phys 74, 145 (2002) 3. K. Inoue, E. Waks, Y. Yamamoto, Phys. Rev. A 68, 022317 (2003) 4. N. Gisin, G. Ribordy, H. Zbinden, D. Stucki, N. Brunner, V. Scarani, quant-ph/0411022 (2004) 5. D. Stucki, N. Brunner, N. Gisin, V. Scarani, H. Zbinden, Appl. Phys. Lett. 87, 194108 (2005) 6. C.H. Bennett, Phys. Rev. Lett. 68, 3121 (1992) 7. P.W. Shor, J. Preskill, Phys. Rev. Lett. 85, 441 (2000) 8. R. Renner, Security of Quantum Key Distribution, PhD thesis, quant-ph/0512258 9. B. Kraus, N. Gisin and R. Renner, Phys. Rev. Lett. 95, 080501 (2005); R. Renner, N. Gisin, B. Kraus, Phys. Rev. A 72, 012332 (2005) 10. H. Inamori, N.L¨utkenhaus, D. Mayers, quant-ph/0107017 11. D. Gottesman, H.-K. Lo, N. L¨utkenhaus, J. Preskill, Quant. Inf. Comput. 4, 325 (2004) 12. B. Kraus, C. Branciard, R. Renner, Phys. Rev. A 75, 012316 (2007) 13. E. Waks, H. Takesue, Y. Yamamoto, quant-ph/0508112 14. N. L¨utkenhaus, Phys. Rev. A 61, 052304 (2000); G. Brassard, N. L¨utkenhaus, T. Mor, B.C. Sanders, Phys. Rev. Lett. 85, 1330 (2000) 15. K. Inoue, T. Honjo, Phys. Rev. A 71, 042305 (2005) 16. Attacks based on unambiguous state discrimination were first invented against BB84 and similar protocols: M. Duˇsek, M. Jahma, N. L¨utkenhaus, Phys. Rev. A 62, 022306 (2000). They were generalized in: P. Raynal, N. L¨utkenhaus, S.J. van Enk, Phys. Rev. A 68, 022308 (2003). 17. A. Chefles, Phys. Lett. A 239, 339 (1998) 18. Usually, when speaking of USD measurements, the goal is to discriminate all the n possible states. Therefore the measurement has n + 1 outcomes, which either identify the state unambiguously, or say that the discrimination was inconclusive. Such are in particular the USD attacks as defined in [16]. 19. The inconclusive result is a projection onto a subspace. If in this subspace there are still pulse sequences that are linearly independent from all the others (as is the case in particular for the USD attacks under study in this paper), each of these sequences could then in turn be unambiguously discriminated with some probability. 20. Note that this attack is not possible on the differential phase shift protocol [3] because there no C. Branciard, N. Gisin, N. L¨utkenhaus, and V. Scarani 653

empty pulses are used. But other USD attacks are possible, as studied in: M. Curty, L.-L. Zhang, H.-K. Lo, N. L¨utkenhaus, Quant. Inf. Comput. 7, 665 (2007) 21. If Bob’s detectors have a dead time, the analysis of USD4a is more subtle, because the first non-empty pulse can be detected with the probability we have written in the main text; but the following pulse can be detected only if the first one has not been detected. This may introduce an asymmetry: the logical bit 1 may be detected more often than the logical bit 0. In the extreme case of bright pulses, the first non-empty pulse always triggers the detector, therefore only the logical bit 1 is detected. In the other extreme case, where Eve sends out a single photon, there is no asymmetry, because only one detection can take place. 22. Of course, the fact that Eve forwards always a single photon can be verified by the absence of the expected coincidence counts in two or three of Bob’s detectors. But this is not a serious concern: the probability of coincidence is small, and we can easily suppose that Eve sends sometimes a brighter pulse when she has a conclusive result in USD3. If she does so, she can reproduce the coincidence rates. Alice and Bob could still detect this attack by checking if the cases of coincidences are equally distributed among all possible bit and decoy sequences; but it is pointless to make such a detailed analysis here. Finally note that it may be advantageous for Eve to send other states that a single-photon state, for instance vacuum-substracted coherent states. 23. I. Csisz´ar, J. K¨orner, IEEE Trans. Inf. Theory 24, 339 (1978); R. Ahlswede, I. Csisz´ar, IEEE Trans. Inf. Theory 39, 1121 (1993). 24. T. Moroder, M. Curty, N. L¨utkenhaus, Phys. Rev. A 73, 012311 (2006) 25. In the absence of empty decoy sequences, it never happens that three consecutive pulses are empty; two additional interferometers, checking the coherence across two and three time slots respectively, would then be enough to make USD attacks impossible. 26. C.-H.F. Fung, H.-K. Lo, quant-ph/0607056 27. This is after Alice and Bob applied a random permutation on their qubit pairs and random bit-flip operations, and assuming they apply optimal error correction and privacy amplification. See [9] for details. Note that we don’t consider here the possible classical ”preprocessing” A′ ← A. 28. I. Devetak and A. Winter, Proc. R. Soc. Lond. A 461, 207 (2005) 29. M. Curty, N.L¨utkenhaus, Phys. Rev. A, 69, 042321 (2004) 30. For untrusted-device scenario, see Ref. [14]; for the trusted-device scenario: A. Niederberger, V. Scarani, N. Gisin, Phys. Rev. A 71, 042316 (2005) 31. C.W. Helstrom, Quantum Detection and Estimation Theory (Academic Press, New York, 1976) 32. A.S. Holevo, Probl. Inf. Transm. 9, 177 (1973) 33. The Holevo bound is computed here for the task of bitwise distinguishing the states. One can check that the Holevo bound remains the same if Eve tried to get information on longer strings of bits. 34. W.-Y. Hwang, Phys. Rev. Lett. 91, 057901 (2003); X.-B. Wang, Phys. Rev. Lett. 94, 230503 (2005); H.-K. Lo, X. Ma, K. Chen, Phys. Rev. Lett. 94, 230504 (2005).

Appendix A Three-state protocol Here we describe a three-state protocol, that was inspired by the study of the COW protocol. If the coherence across the bit separations in COW would be broken, the protocol could be seen as a implementation with weak coherent pulses of a standard three-state protocol for qubits. The qubits states thus obtained are + z 0 | ≡| z 1 (A.1) |−+ x≡|1( 0 + 1 ) . | ≡ √2 |  |  Each state of the Z basis is sent with probability (1 f)/2; it codes a bit value, and the − errors in these measurements give the quantum bit error rate (QBER) Q. The third state, 654 Zero-error attacks and detection statistics in the coherent one-way protocol for quantum cryptography belonging to the X basis, is sent with probability f; it allows to estimate a visibility V . In this appendix we give a quick overview of security studies for this protocol, relying mainly on Ref. [9], to which we refer for the justification of the methods. An independent study of this three-state protocol has been realized recently by Fung and Lo with different techniques [26].

A.1 Single photon case A.1.1 Quick review of the approach In Ref. [9], a lower bound on the secret-key rate for a general class of quantum key distribution protocols using one-way classical post-processing has been derived. Remarkably, the bound can be computed considering only two-qubit density operators σAB [27]:

r inf S(A E) H(A B) σAB ΓQ,V ≥ ∈ | − | = inf1 S(σAB ) (A.2) σAB ΓQ,V ∈ − where S is the Von Neumann entropy, H is the Shannon entropy, and the second line is obtained when Eve holds a purification of σAB which is a usual assumption in quantum cryptography. The set ΓQ,V is the set of two-qubit Bell-diagonal density operators which are compatible with the measured QBER Q and visibility V . Our goal is to characterize this set, and then to perform the minimization in Eq. (A.2). This is done by using the entanglement- based description of the three-state protocol, and considering the most general attack that Eve can perform on a qubit that goes from Alice to Bob.

A.1.2 Qubit pairs shared by Alice and Bob Let us first consider the equivalent entanglement-based version of the three-state protocol: Alice prepares the state

Ψ = 1 f Φ+ + f D + x (A.3) | AB − | AB | A| B where we used the standard notation Φ+ = 1 ( 00 + 11 ), and where D is a state |  √2 |  |  | A orthogonal to 0 and 1 (Alice’s system is therefore 3-dimensional); she keeps the first | A | A system and sends the second one to Bob. On her system, Alice performs a projective measurement in order to prepare Bob’s state. 1 f When Alice gets the result 0 A (which she does with probability −2 ), she prepares the state |  1 f 0 for Bob; when she gets 1 (with probability − ), she prepares the state 1 for Bob; | B | A 2 | B finally, when she gets D (with probability f), she prepares a decoy sequence + x for | A | B Bob. The system B that goes from Alice to Bob through the quantum channel can be attacked by Eve. Let us describe her action by a super operator = E . The state shared by Alice E { j} and Bob after the transmission of system B is then

ρ = ( Ψ Ψ ) AB E | AB  AB| = 11 E Ψ Ψ 11 E† . (A.4) A ⊗ j| AB AB| A ⊗ j j  C. Branciard, N. Gisin, N. L¨utkenhaus, and V. Scarani 655

After the public communication, Alice and Bob know which systems led to bits of the key (when Alice obtained either 0 or 1 and Bob measured in the Z basis), and which systems | A | A came from decoy sequences (when Alice obtained D and Bob measured in the X basis). | A They have 2 sets of systems in the states :

ρbit =(0 0 + 1 1 ) ρ ( 0 0 + 1 1 ) AB |  | |  | A AB |  | |  | A + + = (1 f) 11 E Φ Φ 11 E† (A.5) − A ⊗ j| AB AB| A ⊗ j j  ρdecoy = D D ρ D D AB |  |A AB |  |A = f 11 E D, +x D, +x 11 E† . (A.6) A ⊗ j | AB | A ⊗ j j  bit 1 bit decoy 1 decoy We shall write ρ = ρAB = 1 f ρAB and ρAB = f ρAB the corresponding normalized − states. Note that √2 D +x 11 Φ+ = D + x and therefore ρdecoy =2D +x |  |A ⊗ B | AB | A| B AB |  |⊗ 11 ρbit + x D 11. AB |  |⊗

A.1.3 Characterizing the set Γ Q,V The set ΓQ,V contains any state of the form

σAB = λ1PΦ+ + λ2PΦ− + λ3PΨ+ + λ4PΨ− (A.7) where we use the notationP = Φ Φ for any state Φ , where the Φ± , Ψ± are the Bell Φ |  | |  |  |  states, and where

+ + λ1 = Φ ρ Φ ,λ2 = Φ− ρ Φ−  +| | +  | |  . (A.8) λ = Ψ ρ Ψ ,λ= Ψ− ρ Ψ− 3  | |  4  | |  The first constraint is the definition of the QBER, the same for all protocols, namely

Q = λ3 + λ4. (A.9)

The constraint that defines V is typical of this protocol. To derive it, we use the fact that 1+V the probability for decoy sequences to be detected correctly by Bob is 2 : 1 V ± = D x ρdecoy D x 2  |⊗± | AB | ⊗|±  =2+x, x ρ + x, x . (A.10)  ± | | ±  Since + x, +x = 1 ( Φ+ + Ψ+ ), then |  √2 |  |  1+V =(Φ+ + Ψ+ )ρ( Φ+ + Ψ+ ) 2  |  | |  |  = λ + λ +( Φ+ ρ Ψ+ + c.c.) . (A.11) 1 3  | |  The Cauchy-Schwartz inequality implies Φ+ ρ Ψ+ √λ λ , and therefore Φ+ ρ Ψ+ + | | | | ≤ 1 3 | | |  Ψ+ ρ Φ+ 2√λ λ . We finally obtain the following constraint:  | | | ≤ 1 3 1+V ( λ λ )2 ( λ + λ )2 . (A.12) 1 − 3 ≤ 2 ≤ 1 3

656 Zero-error attacks and detection statistics in the coherent one-way protocol for quantum cryptography

1 V Similarly, starting from −2 , one obtains 1 V ( λ λ )2 − ( λ + λ )2 . (A.13) 2 − 4 ≤ 2 ≤ 2 4

For a state σAB to be in the set ΓQ,V , its coefficients λ s therefore have to satisfy the constraints (A.9), (A.12) and (A.13), along with the normalization condition λ1+λ2+λ3+λ4 = 1.

A.1.4 Lower bound on the secret key rate Now we have to compute the bound (A.2). One can show that, given our constraints, the infimum of 1 S(σ ) is obtained when − AB 1+V λ1 + λ3 = (A.14) 2 1 V λ2 λ4 = − (A.15) − 2 These equalities, together with Eq. (A.9) and the normalization condition, allow an analytical expression of the lower bound: r(Q,V ) 1 H λ ,λ ,λ ,λ (A.16) ≥ − 1 2 3 4 with   λ = (1 Q) 1+V QV (1 V 2)Q(1 Q) , 1 − 2 − − − − 1 V 2 λ = (1 Q)  − + QV + (1 V )Q(1 Q) , 2 − 2 − − 1 V 2 λ = Q − + QV + (1 V )Q(1 Q) ,  3 2 − − λ = Q  1+V QV (1 V 2)Q(1 Q) . 4 2 − − − − The results are plotted in Fig. A.1. For all values of the parameters, the rates we find are equal or better than those found by Fung and Lo [26]: in particular, for V = 1 we find security 1 V up to Q 11%, while they reach only up to Q < 7.57% (see Fig. 2 of Ref. [26], where α − ≈ ≡ 2 and e Q). ∼ b ≡ A.1.5 Special cases Q =0, V =1 Let’s study the particular cases Q =0andV = 1. With the previous analysis, we find 1 V R(Q =0,V) 1 h − , (A.17) ≥ − 2   R(Q,V =1) 1 2h(Q) (A.18) ≥ − where h is binary entropy. In particular, the second rate is the same as the one obtained for the BB84 protocol [7]. In these limiting cases, we have been able to compute a lower bound in a different way, namely using the Devetak-Winter bound for collective attacks [28] and then invoking a de Finetti theorem to extend the result to all possible attacks [8]. For the case Q = 0, we find exactly the same result; for the case V = 1 however, the lower bound calculated in this new way is slightly better. This is not a contradiction, as the method of Ref. [9] is not claimed to provide tight bounds in all circumstances. C. Branciard, N. Gisin, N. L¨utkenhaus, and V. Scarani 657

0.12

0.1

1 1−2h(Q) 0.08 0.8 1−h[(1−V)/2]

0.6 Q 0.06

0.4 r(Q,V) 0.04 0.2

0 1 0 0.02 0.02 0.8 0.04 0.6 SECURE 0.06 0.4 0 0.08 0.2 0 0.2 0.4 0.6 0.8 1 Q 0.1 V V 0

Fig. A.1. Security study of the three-state protocol in a single-photon implementation. Left-hand side: lower bound r as a function of Q and V ; right-hand side: projection of the left-hand side graph on the (Q,V ) plane, showing the region of parameters in which the protocol is provably secure.

A.2 Weak Coherent Pulses A.2.1 Conservative lower bound In our three-state protocol, exactly as it happens for BB84, as soon as a pulse contains two photons, Eve can obtain full information using the PNS attack. Therefore, all the pulses containing more than one photon are ”tagged”: it is as if they would carry a label which reveals the quantum state. Once one has a lower bound r in a single-photon implementation, a lower bound for implementations with weak coherent pulses can be computed using the techniques developed in Ref. [11]. Let ∆ be the fraction of tagged signals: on these, Eve has full information thanks to the tag. Eve’s best strategy consists in introducing no error on the tagged pulses, and a larger Q error Q1 = 1 ∆ on the untagged ones, so that the total QBER is still Q. A similar reasoning holds for V :− in Eve’s best strategy, the tagged pulses have V = 1, therefore the single photon V ∆ pulses have V1 = 1 −∆ . These estimates have a bearing on privacy amplification, while error correction must be− done for the average Q. The achievable secret key rate is finally bounded as

r (1 ∆) S (Q ,V ) h(Q) (A.19) ≥ − 1 1 − where S(Q,V )=r(Q,V ) h(Q) andr (Q,V ) is the single-photon lower bound of Eq. (A.16). − Finally, it is easy to compute the optimum value of ∆. In general, ∆ is the probability that Alice sends more than one photon, conditioned to the fact that Bob has received something. Clearly, the best case for Eve is that Bob always receives something when Alice has sent two or more photons. Therefore

µ µ 1 e− µe− µ ∆= − − . (A.20) 1 e µtη ≈ 2tη − − Knowing this, one can now multiply r by Bob’s detection rate to obtain the secret key rate in bits per pair of pulses, then optimize µ to maximize this quantity. Note that the lower bound (A.19) is very conservative because it holds only for the untrusted-device scenario — this is 658 Zero-error attacks and detection statistics in the coherent one-way protocol for quantum cryptography why the denominator in (A.20) contains η as well; it is not known how to prove a rigorous lower bound in the trusted-device scenario. (See also [29]).

A.2.2 PNS attack in the zero-error case In the main text, we have presented zero-error attacks against the COW protocol in the trusted-device scenario. For comparison, we compute the PNS attack against the three-state protocol implemented with weak coherent pulses: we recall that in this protocol, contrary to COW, there is no coherence across the bit separation. If Q =0andV = 1, we have I(A : B) = 1. Eve counts the number of photons in each two-pulse sequence corresponding to a bit: if she finds n = 1, she can either let the photon go or block it, but in any case she can’t learn anything; if she finds n>1, she keeps some photons and sends the others to Bob, and she has full information. For the purpose of this simple analysis, we write everything in the case µ 1 (the generalization is straightforward but ≪ µ complicates the formulae). We have then I(A : E)= 2t , the difference with (A.20) coming from the fact that we can compute this upper bound in the trusted-device scenario. The rate per bit becomes µ R = 1 µtt η(1 f) . (A.21) − 2t B −  This expression is optimal for µopt = t, therefore

t2 R(µ ) t η(1 f) . (A.22) opt ≈ 2 B −

This scales as t2, as it happens for BB84 under the same conditions [30]. This rate is much smaller than the upper bounds obtained in the main text for the COW protocol for the most powerful attacks described in this paper (Fig. 3). A better attack may exist against COW; however, we conjecture that this difference is intrinsic — in physical terms, we conjecture that the existence of coherence across the bit separation is a real advantage and increases the extractable secret key rates by a significant amount.

Appendix B Beam-Splitting attack and Devetak-Winter bound The beam-splitting attack is the only known attack which will simulate exactly all statistics for Alice and Bob given a lossy channel, since it is a physical model for such a lossy channel. The fraction 1 t of lost photons are given to Eve, who has forwarded the remaining fraction − t to Bob through a lossless channel. The information that Eve can extract from her data depends on the way she processes them. For each bit she wants to estimate, Eve faces the problem of distinguishing the two states 0α′ and α′0 , whereα ′ = √1 tα. |  |  − In Refs [4, 5], it was supposed that Eve performed the same measurement as Bob: she measures the time of arrival for each pulse, which corresponds to the best unambiguous state discrimination between the two states 0α′ and α′0 . With probability 1 0α′ α′0 , the |  |  − |  result is conclusive and she gets full information on the bit. Her average information on each bit is then

I =1 0α′ α′0 . (B.1) USD − |  C. Branciard, N. Gisin, N. L¨utkenhaus, and V. Scarani 659

However, there are other measurements that could give Eve more information. For instance, the minimum-error measurement [31] would give her the information

1 1 2 I =1 h 1 0α′ α′0 , (B.2) ME − 2 − 2 − |     which is larger than IUSD (h is the binary entropy function). The USD and ME measurements are bitwise measurements, and define the so-called indi- vidual (or incoherent) attacks. More generally, Eve can be allowed to make a collective attack from beam-splitting: each signal is split with the same fraction, as above, but then Eve is allowed to wait until the end of classical post-processing (error correction, privacy amplifica- tion) before performing a (possibly coherent) measurement on the quantum systems she has kept. What Eve does may be hard to find (actually, to our knowledge, this is not known for any protocol); but a computable bound for the secret key rate that can be extracted in the presence of collective attacks has nevertheless be found by Devetak and Winter [28]. The upper bound on the accessible information that Eve can learn, whatever the measurement she performs, is given by the Holevo bound [32]. For the problem of distinguishing the two states 0α′ and α′0 , the Holevo bound is [33] |  | 

1 0α′ α′0 χ = h − |  . (B.3) Hol 2   The Devetak-Winter bound for the secret key rate reads then

µttB η R (1 f) 1 e− (1 χ ) (B.4) ≥ − − − Hol µ(1 t)  1 e− − > (1 f) µttBη 1 h − (B.5) ∼ − − 2    the second expression being for the case µtt η 1. B ≪ As usual, Alice and Bob should choose µ in order to optimize R. Let’s define g(x)= − 1 e x x 1 h( − ) . Numerically, we find sup g(x) g(ξ) 0.1428, obtained for ξ 0.4583. − 2 x ≡ ≈ ≈ Therefore, the optimal value of µ in the case of a collective beam-splitting attack is   ξ µ = (B.6) opt 1 t − and the corresponding lower bound on the extractable secret key rate is t R(µ )=g(ξ) t η(1 f) . (B.7) opt 1 t B − − This is what we plotted in Figs 3 and D.1 in comparison to our attacks.

Appendix C On the attack that reproduces the detection rates

We give here the calculation of (q0,q1,q2,q3) that define the attack that reproduces the detection rates studied in Section 4, and comment on some of its features. We recall that we work in the limit µtη 1 and that we suppose that Eve sends one photon to Bob when she ≪ has got a conclusive result. 660 Zero-error attacks and detection statistics in the coherent one-way protocol for quantum cryptography

C.1 Calculation of the parameters (q0,q1,q2,q3) of the attack

For DB,bit and DB,decoy, the requirement (33) leads respectively to the following two condi- tions: 2 0α0 1 0α:α0 q1 p + q2 p µ(t q )= 3 concl 2 concl , (C.1) − 0 1 f − q p0:αα:0 µ(t q )= 3 concl . (C.2) − 0 4f

Given these two conditions, the requirement (33) is automatically satisfied for DMj,2k for both j =1, 2. This is not astonishing, as these detection rates depend on f in the same way as those of DB do. Finally, for the DMj,2k+1, the requirement (33) gives two new conditions:

4 0α0 0α:α0 0:αα:0 q1 p +2q2 p + q3 p µ(t q )= 3 concl concl concl , − 0 (1 + f)(3 + f) 4 0α0 0:αα:0 q1 p + q3 p µ(t q )= 3 concl concl . − 0 1 f 2 − It can be checked that one of these conditions is redundant, as it follows exactly from assuming the other one together with (C.1) and (C.2); as a third condition, we take then a simple linear combination of the last two ones, which reads q p0α:α0 µ(t q )= 2 concl . (C.3) − 0 (1 + f)2 In summary, we have four linear conditions [(C.1), (C.2), (C.3) and the normalization (32)] for the four coefficients qj: the system can be solved exactly as a function of µ, t and f. The solution — whose result is given in the main text, Eqs (34)–(38) — goes as follows. For j =1, 2, 3, we have qj = µ(t q0)Fj where F2 can be read directly in Eq. (C.3), F3 in −2 0α0 Eq. (C.2), and F1 = 3(1 4f f )/4pconcl can be derived from those and from Eq. (C.1). − − µtF 1 The normalization condition (32) gives then q0 = µF −1 with F = F1 + F2 + F3. We must still verify that q is a probability. Since−t<1, the condition q 1 is satisfied 0 0 ≤ provided µF > 1, which is true for all values of µ and f (in fact, it can be verified that the minimal value of µF , obtained for µ 2, is of the order 100, slightly dependent on f). Given ≈ µF > 1, the condition q 0 is satisfied provided µtF 1. To fulfill this condition, one must 0 ≥ ≥ know how µ varies with t. Let’s consider first µ as defined in (45): then µtF = 3(1 t), opt − therefore the condition is satisfied for t 2 or (with the parameters used for the graphs) ≤ 3 ℓ > 7km — in practice, recall that (45) is valid for µ 1 that is fort 1; so the result is ≪ ≪ consistent.∼ If we take now µ = √3µ , we find µtF =1 t: the condition can never be max opt − satisfied. This is not really a problem: it simply means that Eve must add some losses, i.e. that we must add to her strategy the possibility of blocking pulses.

C.2 Behavior of q1,q2,q3

In general, it holds F3 >F2 >F1, that is,q 3 >q2 >q1, for all values of f and µ. The fact that q does not vanish (and remains even larger than q and q ) iff 0 is an artefact of the 3 1 2 ≡ solution of the system. In fact, the requirement on DB,decoy reads originally 4fµ(t q0)= 0:αα:0 − q3 pconcl : iff> 0, it gives (C.2) as we stated it; but if f = 0, the requirement is automatically C. Branciard, N. Gisin, N. L¨utkenhaus, and V. Scarani 661 satisfied and no constraint is put on q3 (the best choice for Eve would then be q3 =0). Inany case, COW without decoy sequences would be much more vulnerable against Eve’s attacks [4, 5], so the case f 0 is not of real interest. A more meaningful question is, what happens ≡ in the limit f 0 forreal implementations (blurred statistics, finite key length); but, as → already mentioned, we haven’t developed the mathematical tools yet, which would allow to tackle this problem.

Appendix D The consequence of poor statistical analysis: an example Let us suppose that Alice and Bob verify Q =0,V = 1 (without distinguishing decoy sequences from 1 0 bit sequences) and just the average detection rate Dt . In particular, − B they don’t check that the fraction of decoy sequences is the expected one: Eve can set q3 =0. As simple examples of the attacks that become possible, Eve can always attack with USD3 (q2 = 0) or with USD4a (q 1 =0). USD3 attack. If q2 = q3 = 0 and only the detection rate in DB is monitored, the set of requirements (33) reduce to the sole condition q D(3) + (1 q )Dt=1 = Dt i.e. 1 B − 1 B B t=1 t DB DB q1 = − . (D.1) Dt=1 D(3) B − B The secret key rate that can be extracted against such an attack is

t (3) t=1 DB DB t=1 R = (1 q1)DB,bit = − (3) DB,bit . (D.2) − Dt=1 D  B − B

The values of µmax, µopt and R(µopt) can now be computed as a function of t. Numerical solutions are plotted in Fig. D.1, as a function of the distance. We have plotted two series of curves for our attack (describing the cases where Eve forwards either one photon or bright pulses) against the curve associated to the BS attack. Analytical solutions can be obtained 1 f 2 in the limit µ<<1: µmax = Ct, µopt = Ct/2 andR (µopt)= −4 tBηCt with C = [6(1 + f)t η]/[(1 f)2 Π(t η)]. Note that R(µ ) t2, whereas for the attack that preserves B − B opt ∝ the detection rates we had the much slower decrease R(µ ) t3/2 [Eq. (46)]. opt ∝ USD4a attack. The analysis of the case q1 = q3 = 0 follows exactly the same pattern, just (3) (4) 4 replacing DB with DB — in fact, the only difference is the factor 3 which relates these two quantities, see Eqs (13) and (18). This attacks gives slightly better rates than those plotted in Fig. D.1; in the case µ<<1, the analytical solutions for µmax, µopt and R(µopt) are the same as before, with now C = [8(1 +f )t η]/[(1 f)2Π(t η)]. B − B The message of Fig. D.1 is clear: these attacks are significantly more powerful than the one in which Eve is asked to reproduce all the detection rates (Fig. 3). In particular, the distance ℓ, at which the attacks become important, is approximately 50km, well within the actual experimental working range. To avoid these attacks, it is therefore mandatory that Bob checks carefully his detection rates.

Appendix E USD attacks in the case of ”empty decoy sequences” In this Appendix, we study a modification of the COW protocol, which makes it more robust against the attacks known to date (in particular, against the attacks studied in this paper), 662 Zero-error attacks and detection statistics in the coherent one-way protocol for quantum cryptography

0 10

0 µ for BS (Holevo bound) R(µ ) for BS (Holevo bound) 10 opt opt µ for USD3, Π(p) = p R(µ ) for USD3, Π(p) = p opt opt

µ for USD3, Π(p) = p −2 R(µ ) for USD3, Π(p) = 1 max 10 opt µ for USD3, Π(p) = 1 opt µ for USD3, Π(p) = 1 max −1 10 −4 10 µ Secret key rate −6 −2 10 10

−8 10

−3 10 0 20 40 60 80 100 120 140 160 0 20 40 60 80 100 120 140 160 Distance (km) Distance (km)

Fig. D.1. USD3 attack, which becomes possible if Alice and Bob check only the average detection rate. We plot the optimal mean photon number µopt (left-hand side) and corresponding secret key rate R (right-hand side) as a function of the distance d. Full lines: results for Π(tB η)=tB η (Eve forwards one photon); dashed lines: results for Π(tB η) = 1 (Eve forwards bright pulses). The attack is again compared to the Holevo bound on the BS attack (Appendix B). The parameters are the same as in Fig. 3. while keeping the simplicity at the experimental level. The modification consists in introduc- ing a new type of decoy sequence, which is just two empty pulses. In this modified COW, Alice sends an ”empty decoy sequence” 00 with probability f0, and a ”full decoy sequence” |  1 f αα with probability f . We will write f = f + f . With probability − , Alice sends a |  1 0 1 2 logical bit 0 (resp. 1). It may be at first sight astonishing, that additional vacuum signals may provide an ad- vantage; still, this happens also in decoy state protocols [34]. In our case, the possibility of new signals (albeit empty ones) makes the unambiguous state discrimination that we have studied in Section 3 less efficient, because the set of possible states becomes larger.

E.1 Attack on 3 pulses Eve wants to discriminate the state 0α0 from the seven other possible states, which are now: | 

000 , 00α , 0αα , α00 , α0α , αα0 , ααα . (E.1) |  |  |  |  |  |  | 

Note that the previous state ψ [Eq. (11)] is not orthogonal to 000 . Instead, the state | 0α0 |  orthogonal to the seven states listed in (E.1) is

φ(α) χφ(0) ψ0α0 = − (E.2) |  1 χ2 − where φ is given by Eq. (25). As before, Eve performs a projective measurement which separates ψ0α0 from the subspace orthogonal to it. Conditioned on the fact that the state |  2 2 3 0α0 was sent by Alice, the probability of a conclusive result is 0α0 ψ0α0 = (1 χ ) = |  µ 3 µ 2 | | | − (1 e− ) . This is smaller than the value (1 e− ) found in the absence of empty decoy − − sequences. C. Branciard, N. Gisin, N. L¨utkenhaus, and V. Scarani 663

E.2 Attack on 4 pulses Eve wants to discriminate the state 0αα0 from the fifteen other possible states, which are |  now: 0000 , 000α , 00α0 , 00αα , 0α00 , |  |  |  |  |  0α0α , 0ααα , α000 , α00α , α0α0 , (E.3) α| 0αα , |αα00 , αα| 0α, |ααα0,|αααα . |  |  |  |  |  Note that the analysis is the same for attacks USD4a and USD4b here, since all the sequences are possible. The state orthogonal to these fifteen states is

φ(αα) χφ(0α) χφ(α0) + χ2φ(00) ψ = − − . (E.4) | 0αα0 1 χ2 − Conditioned on the fact that the state 0αα0 was sent by Alice, the probability of a conclusive 2 2 4 |  result is 0αα0 ψ0αα0 = (1 χ ) . Again, the probability of success is smaller than the 2 3 | | (1| χ ) − 2 2 probability of success − 2 for the USD4b attack, and much smaller than the one (1 χ ) 1+χ − for the USD4a attack in the absence of empty decoy sequences.

E.3 Attack that preserves the detection rates The study follows exactly the same lines as for the attack studied in Section 4 and Appendix C. As we did there, we suppose that Eve performs one of the three USD attacks with probabilities qj, or forwards the pulses through a lossless channel with probability q0. The probabilities for each USD attack to be conclusive are the following :

0α0 1 f 1 f µ 3 p = − − + f (1 e− ) , (E.5) concl 2 2 0 −   2 0α:α0 1 f µ 4 p = − (1 e− ) , (E.6) concl 2 −   2 0:αα:0 1 f µ 4 p = f − + f (1 e− ) . (E.7) concl 1 2 0 −   Under the assumption that Eve forwards one photon when her attack is conclusive, and in µtF 1 the regime where µη 1, one finds q = µ(t q )F for j =1, 2, 3, and q = − , with ≪ j − 0 j 0 µF 1 now: −

2 3(1 4f1 (f1 f0) ) F1 = − −0α0 − (E.8) 4pconcl 2 (1 f0 + f1) F2 = − 0α:α0 (E.9) pconcl 4f1 F3 = 0:αα:0 (E.10) pconcl F = F1 + F2 + F3 . (E.11)

Apart from the obvious restriction f +f 1, since F has to be positive there is a restriction 0 1 ≤ 1 on the values of f and f for this attack to be possible: f min 1/4, 2+f + √5 4f . 0 1 1 ≤ − 0 − 0  664 Zero-error attacks and detection statistics in the coherent one-way protocol for quantum cryptography

The upper bound on the extractable secret key rate is

R(µ)=q Dt=1 = q µt η(1 f) . (E.12) 0 B,bit 0 B − 4 In the limit µ 1, the optimization of R can be done analytically, using F (µ) µF4 with 2≪ 3 ≈ (1+f1 f0) 4 µ = − 2 + 2 and q0 t . In order to optimize R, Alice and Bob will F (1 f1 f0) (1 f1+f0) ≈ − 4 choose − − − F

µ 1/3 t1/3 (E.13) opt ≈F and obtain the rate 3 1/3 R(µ ) F t η(1 f) t4/3 . (E.14) opt ≈ 4 B −

1/3 4/3 Note that now, µopt t and R(µopt) t : the new protocol with empty decoy sequences ∝ ∝ 1/3 is more robust against our USD attacks. Besides, one gets µmax =4 µopt. In general, the optimization of R over µ must be done numerically. We show the results in Fig. E.1 for the same parameters as we used for Fig. 3, but here f =0.1 is split into f0 = f1 =0.05. We see that, in the presence of empty decoy sequences, the USD attack that reproduces all rates overcomes the beam-splitting attack only for ℓ > 120km. ∼

0 −3 10 10

−4 10

−5

µ 10

−1 Secret key rate 10 µ for BS (Holevo bound) R(µ ) for BS (Holevo bound) opt −6 opt 10 µ for USD on the COW protocol R(µ ) for USD on the COW protocol opt opt without empty decoy sequences without empty decoy sequences µ for USD on the COW protocol R(µ ) for USD on the COW protocol opt opt with empty decoy sequences with empty decoy sequences −7 10 60 80 100 120 140 160 60 80 100 120 140 160 Distance (km) Distance (km)

Fig. E.1. USD attack that reproduces the detection rates, on the COW protocol, with and without empty decoy sequences, compared to the Holevo bound on the BS attack. Same parameters as in Fig. 3, and f0 = f1 =0.05. New Journal of Physics The open–access journal for physics

Upper bounds for the security of two distributed-phase reference protocols of quantum cryptography

Cyril Branciard1, Nicolas Gisin1 and Valerio Scarani2 1 Group of Applied Physics, University of Geneva, Geneva, Switzerland 2 Centre for Quantum Technologies, National University of Singapore, Singapore E-mail: [email protected]

New Journal of Physics 10 (2008) 013031 (25pp) Received 25 October 2007 Published 25 January 2008 Online at http://www.njp.org/ doi:10.1088/1367-2630/10/1/013031

Abstract. The differential-phase-shift (DPS) and the coherent-one-way (COW) are among the most practical protocols for quantum cryptography, and are therefore the object of fast-paced experimental developments. The assessment of their security is also a challenge for theorists: the existing tools, that allow to prove security against the most general attacks, do not apply to these two protocols in any straightforward way. We present new upper bounds for their security in the limit of large distances (d & 50 km with typical values in optical fibers) by considering a large class of collective attacks, namely those in which the adversary attaches ancillary quantum systems to each pulse or to each pair of pulses. We introduce also two modified versions of the COW protocol, which may prove more robust than the original one.

New Journal of Physics 10 (2008) 013031 1367-2630/08/013031+25$30.00 © IOP Publishing Ltd and Deutsche Physikalische Gesellschaft 2

Contents

1. Introduction 2 2. Definitions and tools 3 2.1. The COW and DPS codings ...... 3 2.2. Three versions of COW ...... 4 2.3. Secret key rates ...... 4 3. Collective beam-splitting attack (Q 0 and V 1) 5 = = 4. Collective attacks with Q > 0, V 6 1 7 4.1. Original COW coding: two-pulse attacks ...... 7 4.2. COWm1 coding: two-pulse attacks ...... 9 4.3. COWm2 coding: one-pulse attacks ...... 11 4.4. DPS coding: two-pulse attacks ...... 12 4.5. Numerical optimization and comparison ...... 13 5. Conclusion 14 Acknowledgments 15 Appendix A. Other possible variants of the COW protocol 15 Appendix B. Optimization of 2PA on COW 16 Appendix C. Optimization of 2PA on COWm1 18 Appendix D. Optimization of 1PA on COWm2 20 Appendix E. Optimization of 1PA and 2PA on DPS 21 References 25

1. Introduction

Over recent years quantum cryptography has evolved from niche physics to a technology that could revolutionize the science of secrecy. The basic idea, as formulated by Bennett and Brassard in 1984 (BB84), was based on the use of individual qubits [1], quickly ‘translated’ to individual photons. Given the lack of convenient single photon sources, most experiments use instead weak laser pulses. However, it was then realized that such sources sometimes emit multiphoton pulses and are thus in danger of photon-number-splitting (PNS) attacks [2]. The cheap counter-measure to PNS attacks is to reduce further the intensity of the weak laser pulses, but this solution leads to secret bit rates that scale quadratically with the quantum channel transmission coefficient, r t 2. Hwang [3] found an elegant way out of this drawback, suggesting using more than one intensity.∝ This method, called decoy state implementation, allows one to achieve a linear secret key rate, as for the historical single-qubit protocols [4]. The BB84 protocol in all its implementations, several variations thereof—two-state [5], six-state [6], SARG04 [7], protocols using higher-dimensional systems [8], etc—and all the corresponding entanglement-based versions [9], share a common feature: they all send quantum symbols one by one. However, convenient telecom laser sources emit either a continuous train of pulses (mode-locked lasers), or a continuous wave (cw) that can be formatted by an intensity modulator into trains of pulses. This observation led to new protocols for efficient quantum key distribution (QKD) like the differential-phase-shift (DPS) [10, 11] and the coherent-one-way (COW) [12, 13] protocols. In both protocols a continuous train of weak laser pulses is sent from

New Journal of Physics 10 (2008) 013031 (http://www.njp.org/) 3 the sender, Alice, to the receiver, Bob. In the DPS protocol the intensity of the pulses is constant, but the phase modulated. In the COW protocol, the phases of all pulses are constant, but their intensity modulated. The DPS and the COW protocols are so-called distributed-phase-reference protocols: the intervention of an adversary, Eve, is monitored by measuring the coherence between successive non-empty pulses. Both protocols are robust against PNS attacks, because these can be detected [13, 14]; security has also been studied against individual attacks [13, 15] and more recently against some form of intercept-resend attacks based on unambiguous state discrimination [16]–[18]. However, security against the most general attacks is still elusive: the tools that have been developed in the last decade to tackle this cannot be applied in any straightforward way, because both protocols move away from the symbol-per-symbol type of coding. The purpose of this paper is to analyze the security of the COW and the DPS protocols against a large class of collective attacks in the long distance regime (i.e. when the transmission coefficient t is small). This study leads also to defining variants of the COW protocol, which make it more robust while keeping its simplicity. The paper is structured as follows. In section 2, we recall the COW and DPS protocols, as well as some notions of security bounds. In section 3, we present the bound for security against a beam-splitting attack (BSA) treated as a collective attack. In section 4, we study a family of attacks that generalize the BSA by introducing errors. The basic idea is that the adversary, Eve, attaches ancillary quantum systems to each pulse or to each pair of pulses. For these attacks, bounds for security are provided in the limits of large distances, typically d & 50 km. These upper bounds on the secret key rates scale linearly with t.

2. Definitions and tools

The source, on Alice’s side, produces weak coherent pulses. A non-empty pulse is written α , its mean photon number µ α 2. The transmission coefficient of the quantum channel connecting| i Alice and Bob is t, the efficiency= | | of Bob’s photon counters is η; we neglect the effects of dark counts and dead times of the detectors. Accordingly, in the absence of Eve, when Alice sends µtη α , Bob receives √tα and has a probability 1 e− ( µtη in the limit µt 1) of detecting |a photon.i | i − ≈ ≪

2.1. The COW and DPS codings In the COW protocol, each bit is coded in a sequence of one non-empty and one empty pulse: the bit value 0 is coded in the sequence α 0 , the bit value 1 in the sequence 0 α . These two states are not orthogonal because of| thei| vacuumi component, and can be unambiguously| i| i discriminated in an optimal way by just measuring the time of arrival. This is the very simple data line, in which the raw key is created. The quantum bit error rate (QBER) Q is, as usual, the probability that Bob accepts the wrong value of the bit: in physical terms, this means that Bob has got a detection in a time slot in which Alice has sent an empty pulse. To estimate the loss of coherence in the channel (and thence Eve’s information), a fraction of the light is sent into a monitoring line, consisting of an unbalanced interferometer. The phase between the two arms is chosen so that two consecutive non-empty pulses sent by Alice should always interfere constructively in one output port (and be detected with probability pD0 > 0) and destructively

New Journal of Physics 10 (2008) 013031 (http://www.njp.org/) 4 in the other one (p 0). The departure from this ideal situation is measured by the visibility D1 = p p V D0 − D1 = pD0 + pD1 of the interference pattern observed for two consecutive non-empty pulses. Note that there is no a priori relation between Q and V . In the DPS protocol, Alice produces a sequence of coherent states of the same iϕk 1 iϕk iϕk+1 intensity ... e − α e α e α ..., where each phase can be set at ϕ 0 or ϕ π. The bits are coded| ini| the differencei| i between two successive phases: b =0 if eiϕ=k eiϕk+1 k = = and bk 1, otherwise. These two cases can be unambiguously discriminated using an unbalanced= interferometer. The same interferometer provides the information about the lack of coherence in the channel, used to estimate Eve’s information. Contrary to what happens for COW, the QBER Q and the visibility V of the interference pattern are tightly related in DPS 1 V through the relation Q − . = 2 2.2. Three versions of COW In the original version of COW, the pairing of the pulses is known in advance; in addition to sending the two sequences that code for a bit value, Alice should also send decoy sequences α α with probability f in order to prevent a subtle form of PNS attacks. Such sequences do not| i| codei for a bit value: therefore, if they give rise to a detection in the data line, this event must be eliminated in sifting. Throughout this paper we will set f 0: in fact, all the bounds for security that we are going to use are valid only in the asymptotic≈ limit of infinitely long keys, in which case an arbitrarily small amount of events is sufficient to produce meaningful statistics. Along with this original version, we introduce and study here two modified versions of COW, in which the pairing of the pulses is not known a priori by Bob, nor Eve. Alice and Bob’s devices are the same as in the original version: Alice sends a train of empty or non-empty pulses; Bob measures the time of arrival on his data line and checks the coherence of successive non-empty pulses on his monitoring line. Only after the transmission does Alice announce the pairings publicly; the bit is accepted if Bob has got one and only one detection in the data line corresponding to that pair of pulses. Given this, the two versions differ in the possible choices of pulses to be paired. In COWm1, Alice still pairs consecutive pulses: this makes it the closest analog to DPS. If she wants to use (almost) all the pulses, she will still send sequences α 0 or 0 α , and sometimes introduce an unused pulse. In COWm2, Alice is allowed to pair| i| anyi two| i| pulses;i obviously, all the pulses are used. There is no simple version of DPS that would be analog to COWm2, because in order to pair arbitrary pulses in DPS, Bob should arbitrarily change the unbalance in the interferometer3. Note that many other variants of COW can be imagined, as we mention in appendix A.

2.3. Secret key rates We consider from now on that the two values 0 and 1 are equally probable both in Alice’s and in Bob’s list; since this can be obtained by public communication, there is no loss in 3 Note that a modified version of DPS was proposed in [19], where Bob can choose between N path differences in his interferometer. For a large N, this would be analogous to COWm2. However, Bob needs to modify his apparatus, which does not make it very practical when N increases.

New Journal of Physics 10 (2008) 013031 (http://www.njp.org/) 5 generality in this assumption. As said, the bound for security against the most general attack by an eavesdropper has been elusive to date for both COW and DPS. In this paper, we are concerned with specific attacks, which of course define only upper bounds for security (i.e. it is guaranteed that one cannot obtain larger rates). In the family of attacks that we consider, Eve interacts with the pulses one-by-one or two-by-two, always with the same strategy. She is allowed to keep her ancillae in a quantum memory, and to extract the largest possible information out of them after Alice and Bob have run the classical post-processing. Therefore, we will compute the bound for security against collective attacks (as in most QKD studies to date, we compute this bound for the asymptotic case of an infinitely long raw key). For collective attacks, Devetak and Winter [20] have shown that Eve’s information on Alice’s bits is upper-bounded by the maximal capacity of a channel Alice–Eve, in which Alice A a would code her bit value a in the state ρE = . This quantity is called Holevo bound, and reads A 0 A 1 1 A 0 1 A 1 χ χ ρ = , ρ = S(ρ ) S(ρ = ) S(ρ = ), (1) AE ≡ E E = E − 2 E − 2 E 1 A 0 1 A 1 where ρE 2 ρE = + 2 ρE = is Eve’s state
and S is the von Neumann entropy. A similar definition holds for= Eve’s information on Bob’s bits. Concerning the Alice–Bob channel, the QBER is Prob(A B) Q; in particular, for the conditional Shannon entropy it holds H(A B) H(B A) 6=h(Q)=where h is the binary entropy. The Devetak–Winter bound reads, for the secret| = key rate| =r: r r 1 h(Q) min(χ , χ ) , (2) = sift − − AE BE where rsift is the sifting rate, i.e. the probability that Alice and Bob accept a bit; we suppose that the two protocols are run with the same repetition rate: the rates will be given ‘per time slot’ (or ‘per pulse’, independently of whether the pulse is empty or not). We work in the trusted-device scenario, in which one assumes that Eve cannot modify the efficiency of Bob’s detectors. Note that the whole analysis can be readily adapted to the untrusted-device scenario by replacing everywhere first η 1, then t tη. → →

3. Collective beam-splitting attack (Q = 0 and V = 1)

The beam-splitting attack (BSA) translates the fact that all the light that is lost in the channel must be given to Eve. The attack consists of Eve simulating the losses 1 t by putting a beam-splitter just outside Alice’s laboratory, and then forwarding the remaining− photons to Bob through a lossless line. Since it simulates exactly Bob’s expected optical mode, the BSA introduces no errors (here, Q 0 and V 1) and is therefore impossible to detect4. = = For both COW and DPS, Alice prepares a sequence of coherent states k αk : each αk is chosen in +α, 0 for COW, in +α, α for DPS. Bob receives the state ⊗ α| √it : Bob’s { } { − } ⊗k| k i optical mode is not modified. Eve’s state is k αk√1 t ; let us introduce the notations α α√1 t, µ α 2 and ⊗ | − i E = − E = | E| µE µ(1 t) γ e− e− − . (3) E = = 4 Apart from BSA, other attacks exist that do not introduce errors in distributed-phase-reference protocols: for instance, PNS attacks over the whole key, preserving the coherence (these are hard to parametrize and have never been studied in detail). For COW, there also exist zero-error attacks based on unambiguous state discri- mination [16].

New Journal of Physics 10 (2008) 013031 (http://www.njp.org/) 6

100 COW COW DPS DPS 10–1 100 10–2 opt µ 10–3 Secret key rate 10–4

10–1 10–5 0 20 40 60 80 100 0 20 40 60 80 100 Distance (km) Distance (km)

Figure 1. Optimal mean photon number µ and secret key rate as a function of the distance, for the BSA on the COW and DPS protocols. Detection efficiency: 1 η 0.1 losses: 0.25 dB km− ; no dark counts. = ;

When Bob announces a detection involving pulses k 1 and k, Eve shall extract the highest possible information out of her systems, measured by the− Holevo quantity (1). The information available to Eve differs for the two protocols, because of the different coding of the bits. In COW, the bit is 0 when αk 1 α , αk 0 and is 1 when αk 1 0 , αk α; so, writing − A=0 B =0 A 1 − =B 1 = Pψ the projector on ψ , we have ρE = ρE = P+αE,0 and ρE = ρE = P0,+αE ; therefore, noticing that +α , 0| 0,i+α γ , we obtain= = = = |h E | Ei| = E 1 γ χ χ χ COW(µ, t) h − E . (4) AE = BE ≡ E = 2   Since in COW half of the pulses are empty, the secret key rate is given by 1 µtη COW r (µ, t) 1 e− 1 χ (µ, t) . (5) COW = 2 − − E Since BSA is a pulse-by-pulse attack independent
 of the pairing, the analysis is unchanged for COWm1 and COWm2. In DPS, the bit is 0 when αk 1 αk and is 1 when αk 1 αk. So, with similar notations as A 0 B 0 1− = 1 − A=1 − B 1 1 1 above, we have ρE = ρE = P+αE,+αE + P αE, αE and ρE = ρE = P+αE, αE + P αE,+αE ; = = 2 2 − − = = 2 − 2 − therefore, noticing that +α α γ 2, we obtain |h E| − Ei| = E 1 γ 2 1 γ 4 χ χ χ DPS(µ, t) 2 h − E h − E , (6) AE = BE ≡ E = 2 − 2     and the resulting secret key rate is µtη DPS r (µ, t) 1 e− 1 χ (µ, t) . (7) DPS = − − E Both for COW and DPS, Alice and
Bob  should choose µ such that the secret key rate is maximized. We performed this one-parameter optimization numerically. Figure 1 shows the optimal choice for the intensity µ µopt and the corresponding secret key rates for the COW and the DPS protocols. = One notices that the two protocols show similar behaviors against BSA. The optimal choice of µ is approximately twice as large for COW as it is for DPS; since in COW one pulse out of two is empty, the number of photons per bit is thus approximately the same. As for the secret key rates obtained for the respective µopt, they are very similar, within a factor of two. The question

New Journal of Physics 10 (2008) 013031 (http://www.njp.org/) 7 of whether one protocol performs better than the other one, does not have a clear-cut answer: other practical issues should be taken into consideration. For instance, we did not consider for COW the fraction of the signal that should be sent through Bob’s monitoring line, which will not contribute to the key. We did not consider the losses in Bob’s interferometer either: in DPS, they will decrease the secret key rates, while in COW, they will not alter the key rates. A more complete analysis should therefore lead to different factors before the given key rates, and the factor of two that appears here between the two protocols is not meaningful in itself. In the limit of large distances µt 1 (typically, for d & 50 km5), the secret key rates under ≪ a BSA become linear in tη (r r0tη), and the µopt tend to a constant value (dashed lines on figure 1). Specifically: for COW,= µ 0.4583 and r 0.0714; for DPS, µ 0.2808 and opt → 0 ≈ opt → r0 0.1182. Note that the attacks presented in the next section of this paper shall be studied only≈ in this limit, due to their complexity, and will coincide with the asymptotic limits for BSA when Q 0 and V 1. = =

4. Collective attacks with Q > 0, V 6 1

In both COW and DPS, bits are coded in the relation between two successive pulses. In the study of upper bounds, a natural class of attacks is therefore the one in which Eve attacks coherently pairs of successive pulses. These we call ‘two-pulse attacks’ (2PA). In general, they are defined by E [ αk 1 αk ]A(k 1,k) E 9[αk 1, αk] B(k 1,k),E (8) | − i| i − ⊗ | i −→| − i − with the only constraint that the transformation must be unitary. This class is clearly too large to be parametrized efficiently. However, in the limit of large distances µt 1, multi-photon components on Bob’s side are supposed to be negligible; and Bob will have≪ to check, through the statistics of his detection rates (singles, double-clicks in two detectors, etc), that this is indeed the case. In view of this, we restrict our study to the case where, for any two-pulse signal sent by Alice, Bob’s Hilbert space consists only of the three orthogonal states 00 (no photon), 10 (one photon at time k 1) and 01 (one photon at time k). | i | i In this section, 2PA− are studied| i on COW (4.1), on COWm1 (4.2) and on DPS (4.4). On COWm2, since there is no preferred pairing at all, we shall rather study ‘one-pulse attacks’, 1PA (4.3). The resulting upper bounds will be computed numerically and compared (4.5). Unless stated otherwise, pure and mixed quantum states are normalized (in the limit µt 1) in all that follows. ≪

4.1. Original COW coding: two-pulse attacks 4.1.1. Eve’s attack. In the original COW protocol, the pairing of the pulses sent by Alice is publicly known. When Eve attacks the pulses two-by-two, we suppose that she does it according to the same pairing. The three sequences that Alice can send (bit 0, bit 1 and decoy sequence)

5 Of course, the distance cannot be too large: it has to be below the distance where dark counts become important; and for COW, also below the distance ( 100 km) at which other zero-error attacks become possible [16]. ∼

New Journal of Physics 10 (2008) 013031 (http://www.njp.org/) 8 are modified by Eve’s intervention as

√µ, 0 E 00 v + (1 Q)µt 10 p10 + Qµt 01 p01 | iA| i −→| iB| µ0iE − | iB| µ0iE | iB| µ0iE 0, √µ E 00 v + pQµt 10 p10 + (1 pQ)µt 01 p01 (9) | iA| i −→| iB| 0µiE | iB| 0µiE − | iB| 0µiE √µ, √µ E 00 v p+ (1 Q)µt ( 10 pp10 + 01 p01 ), | iA| i −→| iB| µµiE − | iB| µµiE | iB| µµiE where v jk E ( j, k 0, µ ) are thep states that Eve attaches to the vacuum part of the signal, | 10 i ∈01 { } while p jk E and p jk E are the states that Eve attaches to the 1-photon part of the signal. While we have| lefti Eve’s| statesi free (up to some constraints to be described soon), we have fixed the probability amplitude of each term. These amplitudes are motivated by the expected behavior of an imperfect intensity modulator on Alice’s side, which would prepare pulses of intensity (1 Q)µ and Qµ instead of perfectly modulated intensities µ and 0. In this case, for each bit sequence− sent by Alice we still have an average probability µt that a photon arrives at Bob; in a fraction 1 Q of these cases, it arrives at the correct time, in the other cases it arrives at the wrong time,− whence Q is indeed the QBER. Again, Bob has to check that the multi-photon components are negligible. The relations between Eve’s states are constrained by the requirement that the transformation must be unitary, and by the results of the parameter estimation (i.e. by the values of the visibilities). The requirement of unitarity reads (recall that we work in the limit µt 1) ≪ µ µ/2 v v e− , v v v v e− . (10) h 0µ| µ0i = h µµ| µ0i = h µµ| 0µi = The visibility in COW is measured only conditioned to the fact that Alice has sent two consecutive non-empty pulses. There are five such cases: the case of decoy sequences (two non-empty pulses in the same pair) and the four two-pair sequences (x, y) (0µ, µ0), (µµ, µ0), (0µ, µµ) and (µµ, µµ). The corresponding visibilities after Eve’s intervention= are

V Re p01 p10 , (11) µµ = h µµ| µµi   V Re v p01 p10 v . (12) xy = h x | x ih y | yi As an example, considerVµµ. When Alice sends a decoy sequence √µ, √µ , a detection in the interferometer at the correct timing should reveal the coherence between| 10i and 01 . After Eve’s intervention, the action of the interferometer (non-normalized) reads| i | i 10 p10 + 01 p01 D ( p10 + p01 ) + D ( p10 p01 ). (13) | iB| µµiE | iB| µµiE −→| 0i | µµiE | µµiE | 1i | µµiE − | µµiE

The probability that the photon going to Bob is detected by detector D0 (resp D1) of the interferometer is proportional to p p10 p01 2 2 2Re p01 p10 1 V , 0/1 ∝k | µµiE ± | µµiE k = ± h µµ| µµi ∝ ± µµ whence (11). The visibilities Vxy are computed in a similar way, considering that the interference across the pairing is due to the coherence between 01 00 and 00 10 . In the present study, we suppose that Alice and Bob check that all these visibilities| i| i are| thei| same:i V V V V V V. (14) µµ = 0µ,µ0 = µµ,µ0 = 0µ,µµ = µµ,µµ ≡

New Journal of Physics 10 (2008) 013031 (http://www.njp.org/) 9 4.1.2. Eve’s information. The task is to compute the information that Eve obtains when she performs the attack (9). For each bit detected by Bob, if Eve is interested in Alice’s A 0 10 10 bit, her information is the Holevo quantity χAE computed for ρE = (1 Q) pµ0 pµ0 + 01 01 A 1 01 01 10 10 = − | ih | Q pµ0 pµ0 and ρE = (1 Q) p0µ p0µ + Q p0µ p0µ ; if Eve is interested in Bob’s bit, her | ih | = − | ih | | ih B 0| 10 10 10 10 information is the Holevo quantity χBE computed for ρE = (1 Q) pµ0 pµ0 + Q p0µ p0µ B 1 01 01 01 01 = − | ih | | ih | and ρE = (1 Q) p0µ p0µ + Q pµ0 pµ0 . These are formal expressions, whose value has to be optimized= − under| theih constraints| | (10ih) and| (14). Now, none of the constraints (10)–(12) on 10 01 Eve’s states involves p0µ and pµ0 . Eve can, therefore choose these two states freely, and the best choice is obviously| toi take| themi orthogonal to one another and to all her other states, in order to distinguish those cases perfectly. In this case, χAE χBE Q + (1 Q)χ(Pp10 , Pp01 ), = = − µ0 µ0 that we write explicitly as 10 01 1 + pµ0 p0µ χCOW Q + (1 Q) h |h | i| . (15) = − 2 ! In particular, Eve has all the information on Alice’s and Bob’s bit when she introduces an error. So finally, the Devetak–Winter bound for 2PA on COW in the limit µt 1 reads ≪ r (Q, V ) r tη with r 1 µ 1 h(Q) χ . (16) COW = 0 0 = 2 − − COW Note that r0 does not depend on tη: the long-distanceh upper bound that wei obtain is linear in t.

4.2. COWm1 coding: two-pulse attacks 4.2.1. Eve’s attack. We now consider the first modified version of the COW protocol (COWm1). In this version, the coding still implies pairs of consecutive pulses, but the pairing is decided by Alice and Bob a posteriori. Thus, during the exchange of quantum signals, Eve does not know which pulses she should attack together: half of the times, her 2PA will therefore be applied on pulses that are not going to be paired to form a bit. In particular, now all four sequences of two consecutive pulses are possible: the transformation (9) must be complemented with a fourth line 0, 0 E 00 v + Qµt ( 10 p10 + 01 p01 ), (17) | iA| i −→ | iB| 00iE | iB| 00iE | iB| 00iE where the choice of probability amplitude is dictatedp by the same considerations as above. The requirement of unitarity consists of (10) and of the three additional constraints µ µ/2 v v e− , v v v v e− . (18) h 00| µµi = h 00| µ0i = h 00| 0µi = The computation of the loss of visibility is identical to the case of the original COW, leading to 10 01 10 01 (11) and (12); as for that case, we shall impose (14). Note that the states p0µ , pµ0 , p00 , p00 do not enter in any of the constraints, and can therefore be chosen orthogonal| i | to eachi | otheri | andi to all other states.

4.2.2. Eve’s information. When it comes to computing Eve’s information, two cases have to be treated separately:

Case 1. The two pulses that code a bit have been attacked together by Eve. In this case, the (2) (2) computation of Eve’s information is the same for the original COW protocol (4.1), so χAE χBE is given by (15). =

New Journal of Physics 10 (2008) 013031 (http://www.njp.org/) 10 Case 2. The two pulses that code a bit have not been attacked together by Eve. To study this case, we must consider four pulses. Writing j, k, j ′, k′ 0, 1 and neglecting as usual the two- photon terms, the transformation reads ∈ { }

k 01 j√µ, k√µ j ′√µ, k′√µ EE′ (k + ( 1) Q)µt 0100 p , v | iA| iA| i −→ − | iB| jµ,kµ j ′µ,k′µiE p j 10 + ( j ′ + ( 1) ′ Q)µt 0010 B v jµ,kµ, p E + . − | i | j ′µ,k′µi ··· p (19) The terms that we left out do not contribute, for we focus on the case where Bob detects a photon in one of the two middle time-slots and pairs precisely those slots. Moreover, a posteriori it is decided that pulses j ′ and k form a bit a, i.e. Alice must have used j ′ 1 k a. Depending on the sequence sent by Alice and on the bit detected by Bob, Eve’s (unnormalized)= − = state is thus

A jk, j ′k′ ,B 0 k 01 01 ρ ={ } = (k + ( 1) Q) p , v µ, µ p , v µ, µ , (20) E4 = − | jµ,kµ j ′ k′ ih jµ,kµ j ′ k′ |

A jk, j ′k′ ,B 1 j ′ 10 10 ρ ={ } = ( j ′ + ( 1) Q) v jµ,kµ, p v jµ,kµ, p . (21) E4 = − | j ′µ,k′µih j ′µ,k′µ| Eve’s (now normalized) states conditioned on Alice’s or on Bob’s bit become

A a 1 A ja,ak′ ,B b a,b a a,b a ρ = ρ ={ ¯ } = (1 Q)ρ = + Qρ =¯ , (22) E4 = 4 E4 ≡ − E4 E4 j,k ,b X′

B b 1 A ja,ak′ ,B b a b,b a b,b ρ = ρ ={ ¯ } = (1 Q)ρ = + Qρ =¯ , (23) E4 = 4 E4 ≡ − E4 E4 j,k ,a X′ where a 1 a and b 1 b, and where ¯ = − ¯ = −

0,0 1 01 01 0,1 1 10 10 ρ p , v0,k µ p , v0,k µ , ρ v jµ,µ, p v jµ,µ, p , (24) E4 = 4 | jµ,µ ′ ih jµ,µ ′ | E4 = 4 | 0,k′µih 0,k′µ| j,k j,k X′ X′

1,1 1 10 10 1,0 1 01 01 ρ v jµ,0, p v jµ,0, p , ρ p , vµ,k µ p , vµ,k µ . (25) E4 = 4 | µ,k′µih µ,k′µ| E4 = 4 | jµ,0 ′ ih jµ,0 ′ | j,k j,k X′ X′ ρ1,0 ρ0,1 As it happened for COW, E4 and E4 are orthogonal to one another and to the other two mixtures; therefore χ (4) χ (4) Q + (1 Q)χ(ρ0,0, ρ1,1). AE = BE = − E4 E4 On average, each of these two cases happens with probability 1 , so χ χ is given by 2 AE = BE 1 Q 1 + p10 p01 χ |h µ0| 0µi| χ ρ0,0, ρ1,1 . COWm1 Q + − h + E4 E4 (26) = 2 ( 2 ! )
The Devetak–Winter bound for 2PA on COWm1 in the limit µt 1 reads ≪ r (Q, V ) r tη with r 1 µ [1 h(Q) χ ]. (27) COWm1 = 0 0 = 2 − − COWm1

New Journal of Physics 10 (2008) 013031 (http://www.njp.org/) 11 4.3. COWm2 coding: one-pulse attacks 4.3.1. Eve’s attack. Let’s now consider the second modified version of the COW protocol (COWm2). In this version, Alice and Bob check the coherence on successive pulses, but pair arbitrary pulses in order to define key bits. In this case, there is no longer any natural definition of 2PA: almost always, Eve’s pairing shall not correspond to the pairing that defines a bit. Therefore, we obtain the upper bound on COWm2 considering 1PA: we suppose that Eve attaches a probe to each pulse sent by Alice, and performs the transformation 0 E 0 v + Qµt 1 p | iA| i −→| iB| 0iE | iB| 0iE p (28) √µ E 0 v + (1 Q)µt 1 p , | iA| i −→| iB| µiE − | iB| µiE where v0/µ E are the states that Eve attachesp to the vacuum part of the signal, while p0/µ E are the| statesi that Eve attaches to the 1-photon part of the signal. The probability amplitudes| i are fixed according to the same physical considerations done for COW and COWm1. The requirement of unitarity reads µ/2 v v e− . (29) h 0| µi = The loss of visibility introduced by Eve’s intervention is computed along the same lines as in 4.1. Suppose Alice sends a sequence √µ, √µ : in the limit µt 1, where we neglect | i ≪ the 2-photon terms, Eve’s intervention leads to 00 B vµ, vµ E + √(1 Q)µt[ 10 B pµ, vµ E + 01 v , p ] whence | i | i − | i | i | iB| µ µiE V Re v , p p , v v p 2. (30) = h µ µ| µ µi = |h µ| µi| None of these constraints involves p0, that can therefore be chosen orthogonal to all other states of Eve. | i

4.3.2. Eve’s information. On any pair of pulses that define a bit, Eve’s intervention has the product structure

√µ, 0 EE′ 00 v , v + (1 Q)µt 10 p , v + Qµt 01 v , p , | iA| i −→| iB| µ 0iE − | iB| µ 0iE | iB| µ 0iE p p (31) 0, √µ EE′ 00 v , v + Qµt 10 p , v + (1 Q)µt 01 v , p . | iA| i −→| iB| 0 µiE | iB| 0 µiE − | iB| 0 µiE For each bit detected by Bob, if Evep is interested in Alice’sp bit, her information is the Holevo A 0 A 1 quantity χ computed for ρ = (1 Q) p , v p , v + Q v , p v , p and ρ = AE E = − | µ 0ih µ 0| | µ 0ih µ 0| E = (1 Q) v0, pµ v0, pµ + Q p0, vµ p0, vµ ; if Eve is interested in Bob’s bit, her information is − | ih | | ih B |0 the Holevo quantity χBE computed for ρE = (1 Q) pµ, v0 pµ, v0 + Q p0, vµ p0, vµ and B 1 = − | ih | | ih | ρE = (1 Q) v0, pµ v0, pµ + Q vµ, p0 vµ, p0 . Since vµ, p0 and p0, vµ are orthogonal to one= another− and| to theih other| states| p , vih and v| , p , we| havei χ | χ igiven by | µ 0i | 0 µi AE = BE 1 + v p 2 χ Q + (1 Q)h |h 0| µi| . (32) COWm2 = − 2   So finally, the Devetak–Winter bound for 1PA on COWm2 in the limit µt 1 reads ≪ r (Q, V ) r tη with r 1 µ [1 h(Q) χ ]. (33) COWm2 = 0 0 = 2 − − COWm2

New Journal of Physics 10 (2008) 013031 (http://www.njp.org/) 12 4.4. DPS coding: two-pulse attacks We turn now to the DPS protocol and derive an upper bound for security considering 2PA. The formalism is analog to the one described for the COWm1 protocol in section 4.2, so we go fast through many details. The main differences are of course those related to the protocol: the different coding of bits, and the link between Q and V .

4.4.1. Eve’s attack. We suppose that Eve attaches her probe to two successive pulses sent by Alice. Four two-pulse sequences are possible: with σ, ω +, , Eve’s intervention reads ∈ { −} σ√µ, ω√µ E 00 v + √µt(σ 10 p10 + ω 01 p01 ), (34) | iA| i −→| iB| σωiE | iB| σωiE | iB| σωiE 10 where vσω E are the states that Eve attaches to the vacuum part of the signal, while pσω E 01| i | i and pσω E are the states that Eve attaches to the 1-photon part of the signal (as before, Bob shall| checki that the multi-photon components are negligible). The transformation leads to the expected detection rate µtη for each pulse. The constraint of unitarity reads 4µ v++ v v+ v + e− , (35) h | −−i = h −| − i = 2µ v++ v+ v++ v + v v+ v v + e− . (36) h | −i = h | − i = h −−| −i = h −−| − i = The visibilities can now be computed for all possible sequences, since there are no empty pulses. Formally, the expressions depend on which sequence of pulses was sent, and on whether the two pulses that interfere belong to a same or to different sequences according to the pairing chosen by Eve. The resulting visibilities are V Re p01 p10 , (37) σω = h σω| σωi 01 10 Vσω,σ ω Re vσω p p vσ ω . (38) ′ ′ = h | σωih σ ′ω′ | ′ ′ i Again, Alice and Bob shall check that all these visibilities are equal: for all σ, ω, σ ′, ω′ +, , ∈ { −}

V V V. (39) σω = σω,σ ′ω′ ≡ 4.4.2. Eve’s information. As happened for COWm1, when it comes to computing Eve’s information, two cases have to be treated separately:

Case 1. The two pulses that contribute to the detected event have been attacked to- 10 01 gether by Eve. The evolution in Bob’s interferometer is σ 10 B pσω E + ω 01 B pσω E 10 b 01 | i | i | i | i −→ b Db ψσ,ω,b E with ψσ,ω,b σ pσω + ( 1) ω pσω (non-normalized). Writing A |σω ,i|B b i | i = | i − | i ρ ={ } = ψ ψ E2 σ,ω,b σ,ω,b , Eve’s normalized states conditioned on Alice’s bit are PA 0 1 = | A σσih,B b | A 1 1 A σσ ,B b ρ ρ ={ } = and ρ ρ ={ ¯ } = (where σ σ ); Eve’s normalized E2= 8 σ,b E2 E2= 8 σ,b E2 = = B b 1 A σω ,B b ¯ = − states conditioned on Bob’s bit are ρ = ρ ={ } = . Eve’s information for this P E2P 8 σ,ω E2 case 1 is then = P (2) A 0 A 1 (2) B 0 B 1 χ χ ρ = , ρ = , χ χ ρ = , ρ = . (40) AE = E2 E2 BE = E2 E2

New Journal of Physics 10 (2008) 013031 (http://www.njp.org/) 13 Case 2. The two pulses that contribute to the detected event have not been attacked together by Eve. Then, we have to study the four-pulse sequence, in which the bit has been produced by the interference of pulses number two and three. The evolution in Bob’s 01 10 interferometer is ω 0100 B pσω, vσ ′ω′ E + σ ′ 0010 B vσω, pσ ω E b Db ψσ,ω,σ ′,ω′,b E | 01i | i b | i 10| ′ ′ i −→ | i| i with ψσ,ω,σ ,ω ,b ω p vσ ω + ( 1) σ ′ vσω p (non-normalized). Writing ′ ′ σω ′ ′ σ ′ω′ A σω,σ ω| ,B b i = | i| i − | i| i P ρ ={ ′ ′} = ψ ψ E4 σ,ω,σ ′,ω′,b σ,ω,σ ′,ω′,b , Eve’s normalized states conditioned on Alice’s A 0 =1 | ihA σω,ωω′ ,B| b A 1 1 A σω,ωω′ ,B b bit are ρ = ρ ={ } = and ρ = ρ ={ ¯ } = (where E4 32 σ,ω,ω′,b E4 E4 32 σ,ω,ω′,b E4 = = B b ω ω); Eve’s normalized states conditioned on Bob’s bit are ρ = P P E4 ¯1 = − A σω,σ ′ω′ ,B b = ρ ={ } = . Eve’s information for this case 2 is then 32 σ,ω,σ ′,ω′ E4 (4) A 0 A 1 (4) B 0 B 1 P χ χ ρ = , ρ = , χ χ ρ = , ρ = . (41) AE = E4 E4 BE = E4 E4 1 Each of the two cases happens with
probability 2 . Therefore,
Eve’s average information is

χ (2) + χ (4) χ (2) + χ (4) χ AE AE , χ BE BE . (42) AE = 2 BE = 2 For the versions of COW, some of Eve’s states could be immediately chosen as being orthogonal to all the other ones; there is no such simplification here. The Devetak–Winter bound for 2PA on DPS in the limit µt 1 reads ≪ 1 V r (Q, V ) r tη with r µ 1 h − min(χ , χ ) . (43) DPS = 0 0 = − 2 − AE BE     4.5. Numerical optimization and comparison In the previous subsections, we have derived upper bounds for the secret key rate of COW (16), COWm1 (27), COWm2 (33) and DPS (43) in the limit µt 1 of large distances. In this limit, ≪ all these bounds scale linearly with losses: r r0tη, where only the constant factor r0 depends on the protocol. Incidentally, we remind that= for COWm1 and COWm2 we have supposed that Alice makes the pairings; if Bob makes them, the rates given above for these protocols should be divided by 2. At this point, we want to evaluate these bounds. This involves a double optimization: first, for a fixed value of µ, one has to find the strategy that maximizes Eve’s information; then, one has to find the value of µ that maximizes r—in our case, r0. The details on how the optimizations over Eve’s strategies were performed, are given in appendices B–E. For COW and COWm2, these optimizations could be performed analytically, and we give the analytical expressions for Eve’s optimal states. For COWm1, the optimization was performed numerically, but we could find an analytical expression for Eve’s states, in which there remain only three parameters to optimize. For DPS, only numerical optimizations could be performed. The second optimization (over µ) could only be done numerically in all cases. The results of the optimizations are shown in figure 2 for the four protocols, as a function of V , and in the case Q 0 for all versions of COW. The effect of the QBER in the COW protocols is shown in figures= B.1, C.1 and D.1. As expected, when V 1 and Q 0, the attacks under study coincide for all protocols with the asymptotic limits for= BSA. As= was the case for BSA, one notices similar behaviors for the COW and the DPS protocols, at least for high visibilities: the secret key rates (or the factors r0) are again very similar, within a factor of two. Again, we cannot conclude that one

New Journal of Physics 10 (2008) 013031 (http://www.njp.org/) 14

100 2PA on COW 0 2PA on COW 2PA on COWm1 10 2PA on COWm1 1PA on COWm2 1PA on COWm2 2PA on DPS 2PA on DPS

10–1 –1 opt 0

r 10 µ

–2 10–2 10

1.0 0.95 0.9 0.85 0.8 0.75 1.0 0.95 0.9 0.85 0.8 0.75 V V

Figure 2. µopt and r0 as a function of the visibility V , for 2PA on the COW, COWm1 and DPS protocols, and for 1PA on COWm2. For all versions of COW, we show here the curve for Q 0. =

BSA on COW, V = 1.0 BSA on DPS, V = 1.0 2PA on COW @ V = 0.98 2PA on DPS @ V = 0.98 −2 2PA on COWm1 @ V = 0.98 −2 10 1PA on COWm2 @ V = 0.98 10

10−3 10−3

−4 −4 Secret key rate 10 Secret key rate 10

10−5 10−5 0 20 40 60 80 100 0 20 40 60 80 100 Distance (km) Distance (km)

Figure 3. Secret key rates as a function of the distance, for 2PA or 1PA on each protocol (for V 0.98), compared to BSA. Same parameters as in figure 1. Recall that the bounds= obtained for 2PA and 1PA are valid only in the limit of large distances. protocol performs better than the other one. The choice of which protocol to run should be motivated by various practical reasons that we did not consider here. Still, and as expected, the modified versions of COW provide better bounds than the original COW: Eve’s attack is less efficient when Eve does not know how Alice and Bob will choose the pairing of the pulses. Finally, in order to get the secret key rates for a given distance, one just has to multiply the factor r0 by tη. We show as an example in figure 3 the rates that we get for each protocol in the case of V 0.98 (and still Q 0 for COW and its variations), compared to BSA. = =

5. Conclusion

We have provided new upper bounds for the security of the COW (the original and two modified versions) and the DPS protocols, in the limit of large distances. In all cases, the secret key rate goes as r r tη and therefore scales linearly with the transmission t of the channel; also, all ≈ 0 the values of r0 are similar, within a factor of two for high visibilities. Hence, at least given

New Journal of Physics 10 (2008) 013031 (http://www.njp.org/) 15 our present-day knowledge, the choice between any of these protocols should be dictated by practical reasons rather than by security concerns. The two modified versions COWm1 and COWm2, introduced in a very natural way in the context of this paper, may also prove very useful in the future to find the bound for security against the most general attack by the eavesdropper. Indeed, intuition suggests that the random a posteriori choice of the pairing may provide the symmetry argument, which would allow to use the exponential De Finetti theorem [21].

Acknowledgments

We acknowledge financial support from the European Project SECOQC and from the Swiss NCCR ‘Quantum Photonics’. We are grateful to Antonio Acín, Norbert Lütkenhaus, Renato Renner and Christoph Simon for stimulating discussions.

Appendix A. Other possible variants of the COW protocol

In the main text, we introduced two modified versions of COW. More generally, many other variants can be defined, as we briefly mention in this appendix. We give examples of such variants, that could be useful for future studies. There are two main motivations for looking at possible variants: one is to find a more efficient or more robust protocol (in the present case for instance, COWm1 and COWm2 were found to be more robust against the attacks under study); the other one is to find a protocol for which it should be easier to prove the security (for instance, a protocol with more symmetries, or where the signals that code for different bits would be more independent). In all the following variants, Alice and Bob use the same devices as in the original COW protocol: Alice sends a certain fraction q of weak coherent pulses √µ (with an overall phase relationship) and a fraction 1 q of empty pulses 0 ; Bob measures| i the time of arrival on his data line and checks the coherence− of successive| non-emptyi pulses on his monitoring line. The only differences lie in the way the classical information is encoded, or in how the key reconciliation is performed. We do not provide here a security analysis for the following variants; nonetheless, in order to give a rough idea of how the various versions should perform, we estimate the sifting rate rs and the ideal mutual information per sifted pulse IAB between Alice and Bob in the limit of large distances (µt 1), in the absence of an eavesdropper and without dark counts. The ideal ≪ key rate would then be r rs IAB. The simplest possible= coding is that the logical bit value 1 is coded as a non-empty pulse √µ and the bit 0 as an empty pulse 0 . In such a simple coding, the raw key is as long as the | i | i entire train of pulses: rs 1 (as for instance in continuous variable QKD ([22] and references therein). However, even= in the absence of an adversary and of dark counts, the error rate is large: Bob is very likely to fail to detect a non-empty pulse, and the quantum channel acts as a Z-channel, where the bit 0 is always detected correctly, while the bit 1 has a high probability µtη e− to be detected as a 0. Straightforward application of Shannon channel capacity shows that 1 in the ideal case, IAB h(qµtη) qh(µtη) qlog2qµtη. For the optimal choice of q e− 1 = − ≈ − = one finds: r e− µtη 0.53 µtη. ≈ ln 2 ≈

New Journal of Physics 10 (2008) 013031 (http://www.njp.org/) 16 In practice, the main drawback of this basic protocol is the large error rate. In fact, while IAB can in principle be extracted by error correction (which we have supposed everywhere in this paper), real codes do not reach this bound and become very inefficient if the error rate is large. In other words, it is better to try and have fewer, better correlated signals, than to keep a lot of poorly correlated ones. One possibility to reduce this error rate is to include a sifting step: Bob would announce his qµtη fraction of time slots where he got a click on his data line, along with another fraction f0 where he had no click. In this case, the sifting rate reduces to r qµtη + f , but the fraction of errors to be corrected is also reduced. Depending on the s = 0 practical efficiency of the error correction, one can try to optimize f0. When dealing with such a Z-channel, a way to symmetrize the errors is to code the logical bits into two physical symbols: ‘0’; µ0, ‘1’ 0µ. In this prospect, the original coding of COW appears very naturally. Contrary→ to the previous→ version, there are no more errors due to the losses (Bob only keeps the cases where he had one detection), and in the absence of dark counts and of Eve IAB 1, and r rs. In the original version= of= COW, the pairs of pulses defining each classical bit are predefined. Alice sends pairs µ0 or 0µ, along with some decoy sequences µµ (and possibly also 1 sequences 00). When the fraction of decoy sequences is negligible, the sifting rate is rs 2 µtη. A first possible variant of this original COW corresponds to COWm1, where Alice= still sends sequences µ0 or 0µ, but sometimes she introduces an unused pulse, so that the bit separations are not known in advance by Eve. Again, if the fraction of unused pulses is 1 negligible, the sifting rate is rs 2 µtη. Another variant would be= that Alice sends a completely random train of pulses 0 and 1 | i √µ . She then pairs consecutive pulses a posteriori. Here we lose a factor 2 in the sifting rate | i 1 (rs 4 µtη) because of the sequences 00 and µµ that Alice sometimes pairs together, but the security= might be easier to analyze. In the previous two variants, one can also imagine that the pairs are not necessarily composed of successive pulses (such as in COWm2 for instance). This might be more robust against Eve’s attacks, but this necessitates a large amount of information to be sent from Alice to Bob for the key reconciliation. Also, one can imagine that it is Bob who chooses the pairing: when he gets a detection, he announces two time-slots (successive or not), and Alice checks that they correspond to a 1 sequence µ0 or 0µ. Since Bob has approximately a probability 2 to announce two time-slots that correspond to a sequence µµ instead, the sifting rate in this case is r 1 µtη. s ≈ 4 Finally, one can imagine that Alice and Bob use other (longer) sequences of pulses √µ and 0 to encode their classical bits (or dits). All previous variations, whether the way| thei pulses| i are grouped is defined a priori or a posteriori, by Alice or by Bob, whether they group successive pulses or not, also apply to this more general variant.

Appendix B. Optimization of 2PA on COW

We have to maximize χ (15), i.e. to minimize p01 p10 , submitted to the constraints COW |h 0µ| µ0i| µ µ/2 v v e− γ, v v v v e− , (B.1) h 0µ| µ0i = ≡ h µµ| µ0i = h µµ| 0µi = Re p01 p10 Re v p01 p10 v V, (B.2) h µµ| µµi = h x | x ih y | yi =    

New Journal of Physics 10 (2008) 013031 (http://www.njp.org/) 17 for the four two-pair sequences (x, y) (0µ, µ0), (µµ, µ0), (0µ, µµ) and (µµ, µµ). We 10 01 = notice that the states pµ0 and p0µ , whose overlap fully defines Eve’s information, are related to the states v and| v i through| i (B.2), specifically | µ0i | 0µi Re v p01 p10 v V. (B.3) h 0µ| 0µih µ0| µ0i = 10 01 So, we focus at first only on finding four states vµ0 , v0µ , pµ0 and p0µ that satisfy (B.3) 01 10 | i | i | i | i 10 and such that p0µ pµ0 is minimal. Later, we shall check that we can find states vµµ , pµµ , 01 |h | i| 01 10| i | i and pµµ in order to satisfy all the constraints (recall that the states pµ0 and p0µ are chosen to be| orthogonali to all other states). | i | i

B.1. Parametrization of Eve’s states First, let’s choose the first two basis vectors such that the states v and v read | µ0i | 0µi 1+γ 1+γ 2 2 vµ0 , v0µ . (B.4) 1 γ 1 γ | i = q −  | i =  q −  2 − 2 q   q  Let’s also define v⊥ as the orthogonal state to v , in the same two-dimensional (2D) subspace: | j i | j i

1 γ 1 γ −2 −2 v⊥ , v⊥ . (B.5) | µ0i =  q 1+γ  | 0µi = q 1+γ  − 2 2  q  01 10 q R  We must have (B.3). Now, if v0µ p0µ pµ0 vµ0 / , then Eve could just add a global phase 10 h | ih | i ∈ to pµ0 for instance, and increase V without changing her information. This implies that Eve’s maximal| i information compatible with V is obtained when the above quantity is real. Then 10 iφ we can write, for some factor λ [V , 1/V ] and some phase φ R: v p √λV e ˜ and ˜ µ0 µ0 01 iφ ∈ ∈ h | i = v p √V/λe ˜ . But since the phase φ does not play any role in Eve’s information (which h 0µ| 0µi = ˜ depends only on p01 p10 ), we can without loss of generality set it to 0. In conclusion, p10 |h 0µ| µ0i| | µ0i and p01 are of the form | 0µi 10 iφ0 p √λV v √1 λV cos θ e v⊥ + √1 λV sin θ w , (B.6) | µ0i = | µ0i − − 0 | µ0i − 0| 0i 01 iφ1 p V/λ v 1 V/λ cos θ e v⊥ + 1 V/λ sin θ w , (B.7) | 0µi = | 0µi − − 1 | 0µi − 1| 1i where w0 and w1 arep any states orthogonalp to both vµ0 and pv0µ and θ0, θ1, φ0 and φ1 are free parameters.| i | i | i | i

B.2. Results of the optimization For γ > 2√V (1 V ) (i.e. µ small enough) and V > 1/2, it can be proved analytically6 that the minimum of p01− p10 is |h 0µ| µ0i| p01 p10 (2V 1)γ 2 V (1 V ) 1 γ 2, (B.8) |h 0µ| µ0i| = − − − − 6 Here are the main steps of the proof: first, one can easilyp show thatpθ0, θ1 [0, π/2], φ0 φ1 0 and w0 w1 ∈ 01= 10= h | i = 1 are optimal; once this is fixed, one can show that for any given λ, the minimum of p p over θ0 and θ1 is − |h 0µ| µ0i| obtained for θ0 θ1 0; finally, one can prove that λ 1 is optimal. = = = New Journal of Physics 10 (2008) 013031 (http://www.njp.org/) 18

100 10−1 Q = 0 Q = 0 Q = 0.01 Q = 0.01 Q = 0.02 Q = 0.02 Q = 0.03 Q = 0.03 Q = 0.04 Q = 0.04 Q = 0.05 Q = 0.05 10−1 10−2 0 opt

r µ

10−1 10−3

10−1 10−4 1.0 0.95 0.9 0.85 0.8 0.75 1.0 0.95 0.9 0.85 0.8 0.75 V V

Figure B.1. COW, original version: µopt and r0 for 2PA, for different values of Q.

10 obtained for λ 1, θ0 θ1 φ0 φ1 0, in which case pµ0 √V vµ0 √1 V vµ⊥0 , 01 = = = = = | i = | i − − | i p √V v √1 V v⊥ . Having maximized Eve’s information, one can run the | 0µi = | 0µi − − | 0µi one-parameter optimization over the pulse intensity µ. The optimal choice µopt and the corresponding value of r0 are plotted in figure B.1, as a function of V and for different values of Q. 10 01 We still have to check that we can find states vµµ , pµµ and pµµ that satisfy all the constraints. This is indeed the case. For instance, we| completei | i the previous| i basis with a third orthogonal vector and choose

2γ 1+V c 1+V c 1+γ 2 2 v 0 , p10 q 1 V  , p01  q 1 V  , (B.9) µµ q  µµ −2 µµ −2 | i = 1 γ | i = | i = − 1+V 1+V 1+−γ  q   q     2 s  2 s        q  q   q  2V 2γ 1 V 1 γ 2V 1 γ 1 V 2γ with c + − − and s − − . The fact that the = 1+V 1+γ 1+V 1+γ = 1+V 1+γ − 1+V 1+γ 01 10 minimum ofq pq0µ pµ0 qcan beq reached withoutq usingq the constraintsq q that involve the sequence (µ, µ) means|h that| thei| presence of decoy sequences does not increase the security of COW against 2PA. 10 Note finally that if γ 6 2√V (1 V ) or if V 6 1/2, Eve can choose her states pµ0 01 − γ V | i and p0µ (for instance λ 1, cos θ0 , θ1 φ0 φ1 0) such that (1 V )γ +2√V (1 V )√1 γ 2 | i = = − − − = = = p01 p10 0, in which case Eve can perfectly discriminate the two states: she has the full h 0µ| µ0i = information on Alice and Bob’s bit. Therefore, γ > 2√V (1 V ) and V > 1/2 are necessary conditions for Alice and Bob to establish a secret key. −

Appendix C. Optimization of 2PA on COWm1

We have to maximize χCOWm1 (26) submitted to the constraints (B.1), (B.2) and µ µ/2 v v e− γ , v v v v e− . (C.1) h 00| µµi = ≡ h 00| µ0i = h 00| 0µi =

New Journal of Physics 10 (2008) 013031 (http://www.njp.org/) 19 C.1. Parametrization of Eve’s states We write the states v as | jki 1+γ 1+γ 2 2  1 γ   1 γ  v q − , v q − , | µ0i = 2 | 0µi = − 2  0   0  q   q   0   0        2γ   2γ 1+γ 1+γ q0   q0  v00 , vµµ . (C.2) | i = 1 γ | i = 1 γ  1+−γ   γ 1+−γ    −  q0   1 qγ     −  These states satisfy the constraints (B.1) and (C.1). We still have four states to consider, 10 01 10 01 01 10 10 01 pµ0 , p0µ , pµµ and pµµ (recall that the states pµ0 , p0µ , pµµ and pµµ have already been| i chosen| i | orthogonali | to alli other states). Therefore,| Eve’si | statesi | underi consideration| i live in general in an 8D space. We have performed the numerical optimization over the most general choice of the four p states that satisfied the constraints (B.2). | i C.2. Results of the optimization The best attack we found can be realized by 4D states and depends only on three free parameters (θ0, θ1 and φ), that are still to be optimized. Let’s introduce the following vectors:

1 γ 1 γ −2 −2 0  q 1+γ  q 1+γ  ,1 0 v⊥ 2 , v⊥ 2 , v⊥   , | µ0i = − | 0µi = | µµ i = 1 γ 2  0   0  −  q  q   γ   0   0  p           1 γ  1+−γ ,2  q0  v⊥ , (C.3) | µµ i = 2γ  γ 1+γ     √2γq√1 γ  − −    0 0 0 1 0 0 w2   , w3   , w4   . (C.4) | i = 0 | i = 1 | i = 0  0   0   1        Our best attack is then defined by     p10 √V v √1 V w , p01 √V v √1 V w , (C.5) | µ0i = | µ0i − − | µ0i | 0µi = | 0µi − − | 0µi p10 √V v √1 V w10 , p01 √V v √1 V w01 , (C.6) | µµi = | µµi − − | µµi | µµi = | µµi − − | µµi New Journal of Physics 10 (2008) 013031 (http://www.njp.org/) 20

0 10 10−1

10–1 10−2 opt 0 µ r

10–2 10−3 Q = 0 Q = 0 Q = 0.01 Q = 0.01 Q = 0.02 Q = 0.02 Q = 0.03 Q = 0.03 Q = 0.04 Q = 0.04 Q = 0.05 Q = 0.05 10–3 10−4 1.0 0.95 0.9 0.85 0.8 0.75 1.0 0.95 0.9 0.85 0.8 0.75 V V

Figure C.1. COWm1: µopt and r0 for 2PA, for different values of Q. where

w cos θ v⊥ + sin θ cos θ w + sin θ sin θ w , (C.7) | µ0i = 0 | µ0i 0 1 | 3i 0 1 | 4i

w cos θ v⊥ + sin θ cos θ w + sin θ sin θ w , (C.8) | 0µi = 0 | 0µi 0 1 | 3i 0 1 | 4i

10 1 ,1 ,2 1 w (cos φ v⊥ + sin φ v⊥ ) w2 , (C.9) | µµi = √2 | µµ i | µµ i − √2 | i

01 1 ,1 ,2 1 w (cos φ v⊥ + sin φ v⊥ ) + w2 . (C.10) | µµi = √2 | µµ i | µµ i √2 | i Note that these states satisfy a more constraining version of (B.2): p01 p10 V, v p01 h µµ| µµi = h 0µ| 0µi = v p01 p10 v p10 v √V . Finally, the optimization over the three remaining h µµ| µµi = h µ0| µ0i = h µµ| µµi = parameters θ0, θ1 and φ was performed numerically. Having maximized Eve’s information, one can run the one-parameter optimization over the pulse intensity µ. The optimal choice µopt and the corresponding value of r0 are plotted in figure C.1.

Appendix D. Optimization of 1PA on COWm2

We have to maximize χ (32), i.e. to minimize v p , submitted to the constraints COWm2 |h 0| µi| µ/2 v v e− , (D.1) h 0| µi = v p 2 V. (D.2) |h µ| µi| = The state p0 was already chosen to be orthogonal to the three other states; we have therefore to work in a| 3Di Hilbert space. Without loss of generality, we choose the following parametrization, which ensures automatically that the constraints are satisfied: µ/2 1 e− √V µ iφ iφ vµ 0 , v0 √1 e , pµ e ˜ √1 V cos θe , (D.3) | i =   | i =  − −  | i = − −  0 0 √1 V sin θ −       New Journal of Physics 10 (2008) 013031 (http://www.njp.org/) 21

100 10−1

10–1 10−2 0 opt

r µ

10–2 10−3 Q = 0 Q = 0 Q = 0.01 Q = 0.01 Q = 0.02 Q = 0.02 Q = 0.03 Q = 0.03 Q = 0.04 Q = 0.04 Q = 0.05 Q = 0.05 10–3 10−4 1.0 0.95 0.9 0.85 0.8 0.75 1.0 0.95 0.9 0.85 0.8 0.75 V V

Figure D.1. COWm2: µopt and r0 for 1PA, for different values of Q. actually the phase φ does not play any role, and we set it to be 0. So, for a given V and a ˜ given µ, Eve’s states are parametrized by θ and φ. µ µ e− V For e− 6 1 V , Eve can choose φ 0 and cos θ 1 e µ 1 V , which gives v0 pµ 0: − = = − − − h | i = in this case, Eve has full information on Alice and Bob’sq bit. A necessary condition for Alice µ and Bob to have secret bits is therefore to choose µ such that e− > 1 V . In this case, one can easily show that the minimum overlap is −

µ/2 µ v p e− √V √1 e √1 V , (D.4) |h 0| µi| = − − − − obtained by setting θ φ 0. Having maximized= Eve’s= information, one can run the one-parameter optimization over the pulse intensity µ. The optimal choice µopt and the corresponding value of r0 are plotted in figure D.1.

Appendix E. Optimization of 1PA and 2PA on DPS

As mentioned in the main text, the optimization of Eve’s information for a 2PA on DPS is more complicated than the one for COW, because we could not find any evident simplification and had therefore to start from the general formal expressions. For this reason, we find it useful to sketch first the study of 1PA on DPS—if only to show that our optimization on the 2PA yields indeed a more strict bound.

E.1. Optimization of 1PA on DPS E.1.1. Eve’s attack and information. We have not studied 1PA on DPS in the main text, but the pattern is the same as for all other attacks, so we just list the main points. Eve’s attack is defined by (with σ +, ) ∈ { −} σ√µ E 0 v + σ √µt 1 p (E.1) | iA| i −→| iB| σ iE | iB| σ iE so the unitarity condition and the visibility constraints read

2µ v+ v e− γ, (E.2) h | −i = ≡

New Journal of Physics 10 (2008) 013031 (http://www.njp.org/) 22

σ, ω +, , Re v p p v V. (E.3) ∀ ∈ { −} h σ | σ ih ω| ωi = iφ This last condition implies v p  v p √V e ˜ , for some φ which won’t play any role, + + ˜ and which we set to 0; so weh have| i = h −| −i =

v+ p+ v p √V . (E.4) h | i = h −| −i = Note how all the states participate in the constraints, contrary to what is the case in all versions of COW. To compute Eve’s information, we start from Eve’s conditioned states A σω ,B b b ρE ={ } = ψσ,ω,b ψσ,ω,b with ψσ,ω,b σ pσ , vω + ( 1) ω vσ , pω and the mix- a,b =1 | Aih σσ(a) |,B b | i = | a i − | i ={ } = tures ρE 8 σ ρE where σ(a) ( 1) σ. Note that these states are not = a,b 1+V = − 1 V normalized; rather, Tr(ρE ) is equal to 2 1 Q if a b, and to −2 Q if a b. A a P a,b B b a,b = − = = 6= Finally, ρE = b ρE and ρE = b ρE (now normalized). Eve’s information is given by A 0= A 1 = χAE χ(ρ = , ρ = ), and similarly for χBE. = E PE P E.1.2. Parametrization of Eve’s states. Eve’s states can be chosen in a 4D Hilbert space. First, let’s choose a basis with the first two vectors in the subspace spanned by v+ , v , and in {| i | −i} which v+ and v read | i | −i 1+γ 2  q 1 γ  v σ − (E.5) | σ i = 2  0   q   0      so that (E.2) is satisfied. Let’s also define v⊥ as the orthogonal state to v , in the subspace | σ i | σ i spanned by v+ , v : {| i | −i} 1 γ −2  q 1+γ  v⊥ σ . (E.6) | σ i = − 2  0   q   0      The constraint (E.4) on the visibility implies that p can be written as p √V v | σ i | σ i = | σ i − √1 V wσ , where wσ is any (4-D) state orthogonal to vσ ; this can be further decomposed − | i iφσ | i | i as wσ cos θσ e vσ⊥ + sin θσ wσ′ for some states wσ′ orthogonal to both v+ and v . | i = | i | i | i | i | −i Finally, we choose the last two vectors of the basis such that w+′ and w′ read | i | −i 0 0 0 0 w+′  iφ/2 , w′  iφ/2  . (E.7) | i = cos(θ/2)e | −i = cos(θ/2)e− sin(θ/2)eiφ/2   sin(θ/2)e iφ/2    −    − 

New Journal of Physics 10 (2008) 013031 (http://www.njp.org/) 23

100 2PA 2PA 1PA 1PA 10−1

–1 10 10−2 0 opt r µ

10−3

10–2

10−4 1.0 0.95 0.9 0.85 0.8 0.75 1.0 0.95 0.9 0.85 0.8 0.75 V V

Figure E.1. µopt and r0 for 1PA and 2PA on DPS.

In summary, for a given V and a given µ, we are left without loss of generality with the six free parameters θ+, θ , θ, φ+, φ and φ that define − −

iφσ p √V v √1 V cos θ e v⊥ √1 V sin θ w′ . (E.8) | σ i = | σ i − − σ | σ i − − σ | σ i E.1.3. Results of the optimization. The optimization over the six free parameters was performed numerically. We find that Eve’s optimal states have real coefficients (the parameters φ , φ can be chosen to be 0), and also that θ+ θ . Once we fix this, there remains only two free± parameters to optimize. = − − Having maximized Eve’s information, one can run the one-parameter optimization over the pulse intensity µ. The optimal choice µopt and the corresponding value of r0 are plotted in figure E.1, along with the results for 2PA. In the case V 1, this attack reduces to the BSA; in all other cases, the optimal 1PA is manifestly less powerful= than the best 2PA we have found. Note that after optimization, we find χAE 6 χBE: Eve knows less about Alice’s bit than about Bob’s.

E.2. Optimization of 2PA on DPS

We now consider the 2PA on DPS, and we have to optimize χAE and χBE as given in (42), submitted to the constraints

2µ 4µ 2 vσω vσω vσω vσω e− γ, vσω vσω e− γ , (E.9) h | ¯ i = h | ¯ i = ≡ h | ¯ ¯ i = =

01 10 01 10 Re p p Re vσω p p vσ ω V, (E.10) h σω| σωi = h | σωih σ ′ω′ | ′ ′ i = for all σ, ω, σ ′, ω′ +, . We see that all the twelve states of Eve appear in the expressions of the constraints. ∈ { −}

New Journal of Physics 10 (2008) 013031 (http://www.njp.org/) 24 E.2.1. Parametrization of Eve’s states. Without any loss of generality, we choose the following symmetric parametrization for Eve’s four states v : | σωi 1+γ 1+γ 1+γ 2 2 2 1 γ 1 γ 1 γ  −2   −2   −2  v++ , v , v+ − , | i = 1 γ 2 | −−i = 1 γ 2 | −i = 0  −2   −2      −   1 γ 2  q 0   q0   −       2    1+γ   q  2 1 γ  −2  v + − , (E.11) | − i = 0    1 γ 2   −  − 2   q  so that (E.9) is satisfied. At this point, we would have to optimize over Eve’s most general states 10 01 pσω and pσω that satisfied the constraints (E.10). In general, these eight states live in a 12D |space,i and| the numberi of free parameters is quite large. In order to have a more tractable problem, we make some assumptions (admittedly, we lose generality here). First, we look for states that satisfy a more constraining version of (E.10), namely

p01 p10 V , v p01 v p10 √V , (E.12) h σω| σωi = h σω| σωi = h σω| σωi = for all σ, ω. Then, we can write

p01 √V v √1 V w01 , (E.13) | σωi = | σωi − − | σωi

p10 √V v √1 V w10 (E.14) | σωi = | σωi − − | σωi 01 10 01 10 with vσω wσω vσω wσω 0 and wσω wσω 0. Note that this may not be a true restriction:h | actually,i = h for| all thei = cases treatedh above,| i = an analog choice was found to be optimal. 10 01 A more serious restriction comes now: we suppose that the eight states wσω and wσω live in a 6D space and are parametrized only by real coefficients. At this stage,| wei run the| numericali optimization.

E.2.2. Results of the optimization. After having maximized Eve’s information, one can run the one-parameter optimization over the pulse intensity µ. The optimal choice µopt and the corresponding value of r0 are plotted in figure E.1, along with the results for 1PA. In the case V 1, this attack reduces again to the BSA. = We did not run the optimization aver all possible states, but we believe that our results are very close to the optimal bounds we could get for 2PA on DPS. Anyway, even though we might have missed the true maximum of Eve’s information, the attack we found and the curves that are plotted still provide valid upper bounds, more strict than the bounds given by 1PA on DPS. Note finally that as for 1PA, we find after optimization χAE 6 χBE: Eve knows less about Alice’s bit than about Bob’s.

New Journal of Physics 10 (2008) 013031 (http://www.njp.org/) 25

References

[1] Bennett C H and Brassard G 1984 Proc. IEEE Int. Conf. on Computers, Systems and Signal Processing, Bangalore, India (New York: IEEE) pp 175–9 [2] Lütkenhaus N 2000 Phys. Rev. A 61 052304 Brassard G, Lütkenhaus N, Mor T and Sanders B C 2000 Phys. Rev. Lett. 85 1330 [3] Hwang W-Y 2003 Phys. Rev. Lett. 91 057901 [4] Wang X-B 2005 Phys. Rev. Lett. 94 230503 Lo H-K, Ma X and Chen K 2005 Phys. Rev. Lett. 94 230504 [5] Bennett C H 1992 Phys. Rev. Lett. 68 3121 [6] Bruß D 1998 Phys. Rev. Lett. 81 3018 Bechmann-Pasquinucci H and Gisin N 1999 Phys. Rev. A 59 4238 [7] Scarani V, Acín A, Ribordy G and Gisin N 2004 Phys. Rev. Lett. 92 057901 [8] Cerf N J, Bourennane M, Karlsson A and Gisin N 2002 Phys. Rev. Lett. 88 127902 [9] Ekert A K 1991 Phys. Rev. Lett. 67 661 Bennett C H, Brassard G and Mermin N D 2002 Phys. Rev. Lett. 68 557 [10] Inoue K, Waks E and Yamamoto Y 2002 Phys. Rev. Lett. 89 037902 Inoue K, Waks E and Yamamoto Y 2003 Phys. Rev. A 68 022317 [11] Takesue H, Nam S W, Zhang Q, Hadfield R H, Honjo T, Tamaki K and Yamamoto Y 2007 Nat. Photon. 1 343 [12] Gisin N, Ribordy G, Zbinden H, Stucki D, Brunner N and Scarani V 2004 Preprint quant-ph/0411022 [13] Stucki D, Brunner N, Gisin N, Scarani V and Zbinden H 2005 Appl. Phys. Lett. 87 194108 [14] Inoue K and Honjo T 2005 Phys. Rev. A 71 042305 [15] Waks E, Takesue H and Yamamoto Y 2006 Phys. Rev. A 73 012344 [16] Branciard C, Gisin N, Lütkenhaus N and Scarani V 2007 Quantum Inf. Comput. 7 639 [17] Curty M, Zhang L L, Lo H-K and Lütkenhaus N 2007 Quantum Inf. Comput. 7 665 [18] Tsurumaru T 2007 Phys. Rev. A 75 062319 [19] Honjo T and Inoue K 2006 Opt. Lett. 31 522 [20] Devetak I and Winter A 2005 Proc. R. Soc. Lond. A 461 207 [21] Renner R 2005 Security of quantum key distribution PhD Thesis ETH, Zurich (Preprint quant-ph/0512258) Renner R 2007 Nat. Phys. 3 645 [22] Cerf N and Grangier P 2007 J. Opt. Soc. Am. B 24 324

New Journal of Physics 10 (2008) 013031 (http://www.njp.org/)

PHYSICALREVIEWLETTERS week ending PRL 99, 210407 (2007) 23 NOVEMBER 2007

Experimental Falsification of Leggett’s Nonlocal Variable Model

Cyril Branciard,1 Alexander Ling,2,3 Nicolas Gisin,1 Christian Kurtsiefer,2 Antia Lamas-Linares,2 and Valerio Scarani2 1Group of Applied Physics, University of Geneva, Switzerland 2Centre for Quantum Technologies, National University of Singapore, Singapore 3Temasek Laboratories, National University of Singapore, Singapore (Received 14 August 2007; published 21 November 2007) Bell’s theorem guarantees that no model based on local variables can reproduce quantum correlations. Also, some models based on nonlocal variables, if subject to apparently ‘‘reasonable’’ constraints, may fail to reproduce quantum physics. In this Letter, we introduce a family of inequalities, which use a finite number of measurement settings, and which therefore allow testing Leggett’s nonlocal model versus quantum physics. Our experimental data falsify Leggett’s model and are in agreement with quantum predictions.

DOI: 10.1103/PhysRevLett.99.210407 PACS numbers: 42.50.Xa, 03.65.Ta, 03.65.Ud Introduction.—Quantum physics provides a precise rule  ; †, and enforces that the marginal probabilities must to compute the probability that the measurement of A and be compatible with such states: B performed on two physical systems in the state j i will lead to the outcomes (rA, rB): P r jA†ˆ d ; †h jP j i; (2) A Z rA j †ˆh jP P j i PQ rA;rB A; B rA rB (1) where P is the projector on the subspace associated to the r P rBjB†ˆ d ; †h jP r j i: (3) measurement result r. For entangled states, this formula Z B predicts that the outcomes are correlated, irrespective of The correlations however must include some nonlocal the distance between the two measurement devices. A effect, otherwise this would be a (nondeterministic) LV natural explanation for correlations established at a dis- model and would already be ruled out by Bell’s theorem. tance is preestablished agreement: the two particles have What Leggett showed is that the simple requirement of left the source with some common information , called a consistency (i.e., no negative probabilities should appear at local variable (LV), that allows them to compute the out- any stage) constrains the possible correlations, even non- comes for each possible measurement; formally, rA ˆ local ones, to satisfy inequalities that are slightly but fA A; † and rB ˆ fB B; †. Satisfactory as it may seem clearly violated by quantum physics. A recent experiment a priori, this model fails to reproduce all quantum corre- [7] demonstrated that state-of-the-art setups can detect this lations: this is the celebrated result of John Bell [1], by now violation in principle. However, their falsification of the tested in a very large number of experiments. The fact that Leggett model is flawed by the need for additional assump- quantum correlations can be attributed neither to LV nor to tions because of the inequality they used [8], just as the communication below the speed of light is referred to as original one by Leggett, supposes that data are collected quantum nonlocality. from infinitely many measurement settings. In this Letter, While nonlocality is a striking manifestation of quantum we present a family of inequalities, which allow testing entanglement, the essence of quantum physics may be Leggett’s model against quantum physics with a finite somewhere else [2]. For instance, nondeterminism is an- number of measurements. We show their experimental other important feature of quantum physics, with no a violation by pairs of polarization-entangled photons. We priori link with nonlocality. Generic theories featuring conclude with an overview of what has been learned and both nondeterminism and nonlocality have been studied, what is still to be learned about NLV models. with several interesting achievements [3]; but it is not yet Theory.—We restrict our theory to the case where the clear what singles quantum physics out. In order to quantum degree of freedom under study is a qubit. We progress in this direction, it is important to learn which consider von Neumann measurements, that can be labeled other alternative models are compatible with quantum ´ S A ! a~ B ! physics, and which are not. Bell’s theorem having ruled by unit vectors in the Poincare sphere : and ~ out all possible LV models, we have to move on to models b; their outcomes will be written rA, rB 2 f‡1 ; ÿ1g. Pure based on nonlocal variables (NLV). The first example of states of single particles can also be labeled by unit vectors S testable NLV model was the one by Suarez and Scarani [4], u~, v~ in . Leggett’s model requires [9] falsified in a series of experiments a few years ago [5]. A P r ;r ja;~ b~†ˆ d u;~ v~†P r ;r ja;~ b~† (4) different such model was proposed more recently by A B Z u;~ v~ A B Leggett [6]. This model supposes that the source emits product quantum states j i j i with probability density with

0031-9007=07=99(21)=210407(4) 210407-1  2007 The American Physical Society PHYSICALREVIEWLETTERS week ending PRL 99, 210407 (2007) 23 NOVEMBER 2007

1 probing a violation of the inequalities (7) can be identified P r ;r ja;~ b~†ˆ ‰1 ‡ r a~
u~ ‡ r b~
v~ u;~ v~ A B 4 A B from Fig. 1. The largest violation for an ideal singlet state would occur for j sin’ jˆuN , i.e., at ’ ˆ 14:4 for N ˆ 2, ‡ r r C u;~ v;~ a;~ b~†Š: (5) 2 4 A B increasing with N up to ’ ˆ 18:3 for N !1. The correlation coefficient C u;~ v;~ a;~ b~† is constrained only Experiment.—The experiment has to focus on different by the requirement that (5) must define a probability issues than when usual Bell inequalities are tested. On one distribution over (r , r ) for all choice of the measure- hand, here there is no concern about spacelike separation, A B as the model under test is based on NLV. On the other hand, ments a~, b~. Remarkably, this constraint is sufficient to while the violation of a Bell inequality rules out LV models derive inequalities that can be violated by quantum physics irrespective of which settings are ultimately used, the in- [6,8,10]. In the derivation of these inequalities, one defines equalities (7) require a precise control of the measurement two orthogonal planes in the Poincare´ sphere:  ˆfa~ 2 j settings [14]. We begin with a traditional parametric down Sja~
n~j ˆ 0g for n~j 2 S and n~1
n~2 ˆ 0. For each unit ? conversion source [16] for polarization-entangled photon vector a~j 2 j, let us define a~j ˆ n~j  a~j: the inequal- pairs with optimized collection geometry in single mode ities are then obtained in terms of coefficients Ej † which optical fibers [17] (Fig. 2). Light from a continuous-wave are the average over all directions a~j of the correlation Ar-ion laser at 351 nm is pumping a 2 mm thick barium- coefficient beta-borate crystal, cut for type-II parametric down con- version to degenerate wavelengths of 702 nm with a ~ ~ C a~j; bj†ˆ rArBP rA;rBja~j; bj† (6) X Gaussian spectral distribution of 5 nm (FWHM). We chose rA;rB a pump power of about 40 mW to ensure both single with b~ ˆ cos†a~ ‡ sin†a~? [11]. This is a problematic frequency operation of the pump laser and to avoid satu- j j j ration effects in the photodetectors. Collection of down- feature: such inequalities can be checked only by perform- converted light into single mode optical fibers ensures a ing an infinite number of measurements or by adding the reasonably high polarization entanglement to begin with. assumption of rotational invariance of the correlation co- ~ In this configuration, we observed visibilities of polariza- efficients C a;~ b†, as in [7 ]. It is thus natural to try and tion correlations of >98% both in the horizontal/vertical replace the average over all possible settings with an (HV) and 45 linear basis for polarizing filters located average on a discrete set. This is done by the following before the fibers. In order to avoid a modulation of the estimate: let w~ and c~ be two unit vectors, and let RN be collection efficiency due to wedge errors in the wave  w~ c~ the rotation by N around the axis orthogonal to ( , ); then plates, we placed subsequent polarization analyzing ele- 1 Nÿ1 k 1  it holds N kˆ0 j RNc~†
w~ jN cot2N  uN [12]. Replac- ments behind the fiber. P ing the full average by this discrete average in the other- The projective polarization measurements for the differ- wise unchanged proofs [8,10], we obtain the following ent settings of the two observers were carried out using family of inequalities: quarter wave plates, rotated by motorized stages by re- N N N N spective angles 1;2, and absorptive polarization filters jE1 a~1;’†‡E1 a~1; 0†j ‡ jE2 a~2;’†‡E2 a~2; 0†j rotated by angles 1;2 in a similar way with an accuracy ’ of 0.1 . This combination allows us to project on arbitrary  LN a~1; a~2;’†4 ÿ 2uN sin (7) 2 elliptical polarization states. Finally, photodetection was

done with passively quenched silicon avalanche diodes, where

Nÿ1 N 1 k ~k Ej a~j;†ˆ C a~j ; bj † (8) 4 N kXˆ0 QM for ideal singlet state L ~ ? k 3.9 with bj ˆ cos†a~j ‡ sin†a~j and the notation c~ ˆ †k ~  ~ RN;j c (the N -rotation is along nj). This defines 2N and 3.8 NLV 4N settings for A and B, respectively. for For a pure singlet state, the quantum mechanical pre- N = 2 3.7 N = 3 diction for LN a~1; a~2;’† is value correlation N = 4 N → ∞ ÿ †ˆ ‡ † 3.6 L ’ 2 1 cos’ (9) 0 5 10 15 20 25 30 relative angle ϕ independent of N and of the choice of a~1, a~2 since the state is rotationally invariant. The inequality for N ˆ 1 cannot FIG. 1 (color online). Dependency of the combined correlation be violated because u1 ˆ 0 [13]. Already for N ˆ 2, how- parameters L ’† as a function of the separation angle ’ for the ever, quantum physics violates the inequality; for N !1, quantum mechanical prediction for a pure singlet state, and 2 uN !  , and one recovers the inequality derived in bounds for nonlocal variable models assuming an averaging Ref. [8]. The suitable range of difference angles ’ for over various numbers of directions N. 210407-2 PHYSICALREVIEWLETTERS week ending PRL 99, 210407 (2007) 23 NOVEMBER 2007

α β N 1 1 groups, respectively, with each Ej 0† containing a HV FPC analyzer setting. D 1 The measured values of L corresponding to inequalities λ /4 PF for N ˆ 2, 3, and 4 are shown in Fig. 3, together with the CC corresponding bounds (7) and the quantum expectation for BBO a pure singlet state (9). The corresponding standard devia- PL IF tions in the results were obtained through usual error SMF propagation assuming Poissonian counting statistics and λ /2 independent fluctuations on subsequent settings. For N ˆ 2, we already observe a clear violation of the NLV bound; λ /4 PF the largest violation was obtained for N ˆ 4 with about 17 D2 standard deviations above the NLV bound. As expected, FPC α β the experimental violation increases with growing number 2 2 of averaging settings N. Selected combinations of (N, ’) FIG. 2 (color online). Experimental setup. Polarization- violating NLV bounds are summarized in Table I. entangled photon pairs are generated in Barium-beta-borate Our results are well-described assuming residual colored (BBO) by parametric down conversion of light from an Ar ion noise in the singlet state preparation [18]. In the inset of pump laser (PL). After walk-off compensation (=2, CC), down- Fig. 3, we check that Lexpt ’†ˆLexpt ÿ’† as it should. If converted light is collected behind interference filters (IF) into this symmetry would be broken, e.g., by imprecise align- birefringence-compensated (FPC) single mode optical fibers ment of the polarizers, the violation may be overestimated, (SMF). Polarization measurements are carried out with a combi- whence the importance of consistency checks. nation of a quarter wave plate (=4) and polarization filters (PF) in front of photon counting detectors D1;2. The measurement basis for each arm (1,2) is chosen by rotation of the wave plate 4 and polarizing filter by angles 1;2, 1;2 accordingly. N =2 3.9 and photon pairs originating from a down conversion 3.8 ϕ process were identified by coincidence detection. The ϕ compensator crystals (CC) and fiber birefringence com- ϕ ϕ pensation (FPC) were adjusted such that we were able to 3.7 detect photon pairs in a singlet state. -20 -15 -10 -5 0 5 10 15 20 3.6 After birefringence compensation of the optical fibers, 4 we observed the corresponding polarization correlations  L N =3 between both arms with a visibility of 99:5 0:2% in the 3.9 HV basis, 99:0  0:2% in the 45 linear basis, and 98:2  0:2% in the circular polarization basis. Typical 3.8 count rates were 10 100 sÿ1 and 8000 sÿ1 for single events ÿ1 in both arms, and about 930 s for coincidences for 3.7

orthogonal polarizer positions. We measured an accidental correlation value coincidence rate using a delayed detector signal of 0:41  3.6 ÿ1 0:07 s , corresponding to a time window of 5 ns. 4 The two orthogonal planes we used in the Poincare´ N =4 sphere included all the linear polarizations for one, and 3.9 HV linear and circular polarizations for the other. That way, we intended to take advantage of the better polariza- 3.8 tion correlations in the ‘‘natural’’ basis HV for the down conversion crystal. Each of the 4N correlation coefficients 3.7 C a;~ b~† in (7) and (8) was obtained from four settings of the 3.6 polarization filters via 0 5 10 15 20 25 30 relative angle ϕ n ~ ‡ n ~ ÿ n ~ ÿ n ~ C a;~ b~†ˆ ~a;b ÿ ~a;ÿb ÿ ~a;b ~a;ÿb (10) FIG. 3 (color online). Experimental results for the observed na;~ b~ ‡ nÿa;~ ÿb~ ‡ nÿa;~ b~ ‡ na;~ ÿb~ correlation parameters LN (dots), the quantum mechanical pre- diction for a pure singlet state (curved lines, dashed lines), and from the four coincident counts n ~a;b~ obtained for a fixed the bounds for the nonlocal variable models (almost straight integration time of T ˆ 4seach. For N ˆ 2, 3, and 4, we lines). In all cases, our experiment exceeds the NLV bounds for carried out the full generic set of 8, 12, and 16 setting appropriate difference angles ’. 210407-3 PHYSICALREVIEWLETTERS week ending PRL 99, 210407 (2007) 23 NOVEMBER 2007

TABLE I. Selected values of L violating the NLV bounds [1] J. S. Bell, Physics (Long Island City, N.Y.) 1, 195 (1964). LNLV for different averaging numbers N. [2] S. Popescu and D. Rohrlich, Found. Phys. 24, 379 (1994). [3] See, e.g., N. J. Cerf, N. Gisin, S. Massar, and S. Popescu,  ÿ N’LNLV Lexpt Lexpt LNLV Phys. Rev. Lett. 94, 220403 (2005); N. Brunner, N. Gisin, 2 12.5 3.8911 3:9127  0:0033 6:45 and V. Scarani, New J. Phys. 7, 88 (2005); N. Linden, 2 15 3.8695 3:8970  0:0036 7:59 S. Popescu, A. J. Short, and A. Winter, arXiv:quant-ph/ 2 17.5 3.8479 3:8638  0:0042 3:83 0610097; H. Barnum, J. Barrett, M. Leifer, and A. Wilce, 3 12.5 3.8743 3:9140  0:0027 14:77 arXiv:quant-ph/0611295. 3 15 3.8493 3:8930  0:0030 14:58 [4] A. Suarez and V. Scarani, Phys. Lett. A 232, 9 (1997). 3 17.5 3.8243 3:8608  0:0034 10:67 [5] H. Zbinden, J. Brendel, N. Gisin, and W. Tittel, Phys. Rev. 3 20 3.7995 3:8400  0:0036 11:15 A 63, 022111 (2001); A. Stefanov, H. Zbinden, N. Gisin, 4 12.5 3.8686 3:9091  0:0024 17:01 and A. Suarez, Phys. Rev. Lett. 88, 120404 (2002). [6] A. J. Leggett, Found. Phys. 33, 1469 (2003). 4 15 3.8424 3:8870  0:0026 16:84 [7] S. Gro¨blacher, T. Paterek, R. Kaltenbaek, Cˇ . Brukner, 4 17.5 3.8164 3:8656  0:0029 17:11 M. Zukowksi, M. Aspelmeyer, and A. Zeilinger, Nature (London) 446, 871 (2007). [8] Supplementary information of Ref. [7]. Overview and perspectives.—Let us now set this work in [9] The specific form of the marginal distributions is called a broader context. Assuming that the various loopholes in Malus’ law in the case of polarization. experimental violations of Bell’s inequality are of techni- [10] S. Parrott, arXiv:0707.3296. cal and not of fundamental nature, any mechanism that [11] This step is taken after (27) in [8], before (8) in [10]. The reproduces quantum correlations must be nonlocal. For derivation of the original inequalities goes through the instance, a possible assumption is that the source produces same step between (3.9) and (3.10) in [6]. [12] Proof: let ~ be the angle between w~ and c~, and  ˆ ~ ÿ independent particles, which later exchange some kind of †mod  , such that  2‰0; Š: then it holds Nÿ1 j Rk c~†
‘‘communication’’ (which cannot be used to send classical 2 N N kˆ0 N Nÿ1 ~ k Nÿ1 Pk w~ jˆ kˆ0 j cos  ‡ N †j ˆ kˆ0 sin  ‡ N †ˆsin ‡ information). Because this communication would need to P P travel faster than light, its speed would be frame depen- NuN cos  NuN as announced. dent. The model could have a preferred frame (‘‘quantum [13] Actually, the data measured on a singlet state for N ˆ 1, ether’’), in which case signaling could be defined consis- as in [7], can be reproduced by the explicit NLV Leggett- type model presented in [8]. Indeed, the validity condition tently [19]; or a frame defined by the measuring devices, in for that NLV model is that there exists unit vectors u~, v~ in which case the model would depart from quantum predic- the Poincare´ sphere, such that, for all pairs of observables tions when the devices are set in relative motion [4,5]. ~a, b~ measured in the experiment, one has j ~a
b~  ~u
~aj There are also NLV models that do reproduce quantum 1  v~
b~ (Eq. (10) of [8]) or, equivalently, ja~
b~ v~
b~j predictions exactly. Explicit examples are Bohmian 1u~
a~. Now, for the case N ˆ 1, one would mea- ~ Mechanics [20] and, for the case of two qubits, the sure four sets of observables a~j, bj ˆ cos†a~j ‡ ? Toner-Bacon model [21]. Both are deterministic. Now, in sin†a~j in planes j ˆ 1, 2 and for  ˆ 0, ’. Then ? ? Bohmian mechanics, if the first particle to be measured is for u~ ˆÿv~ orthogonal to both a~1 and a~2 and whatever ~ ~ A, then assumption (2) can be satisfied, but assumption (3) , one has ja~j
bj  v~
bjjˆjcos  u~
‰ cos †a~j ‡ ? cannot. This remark sheds clearer light on the Leggett sin†a~j Šj ˆ j cos 1  u~
a~j†j  1  u~
a~j as re- model, where both assumptions are enforced: the outcomes quired. [14] In our experiment, as well as in those performed in Vienna B of particle are required to reproduce the expected local [7,15], the detection loophole is obviously still open, and statistics, but also to take nonlocal information into ac- there is a memory loophole, since data have been collected count to generate the correlations. in a sequential way. As a conclusion, it must be said that the broad goal [15] T. Paterek et al., preceding Letter, Phys. Rev. Lett. 99, sketched in the introduction, namely, to pinpoint the es- 210406 (2007). sence of quantum physics, has not been reached yet. [16] P.G. Kwiat, K. Mattle, H. Weinfurter, A. Zeilinger, A. V. However, Leggett’s model and its conclusive experimental Sergienko, and Y. Shih, Phys. Rev. Lett. 75, 4337 (1995). falsification reported here have added a new piece of [17] C. Kurtsiefer, M. Oberparleiter, and H. Weinfurter, Phys. information towards this goal. Rev. A 64, 023802 (2001). We are grateful to Anthony J. Leggett, Artur Ekert, and [18] A. Cabello, A. Feito, and A. Lamas-Linares, Phys. Rev. A Jean-Daniel Bancal for fruitful discussions. C. B. acknowl- 72, 052112 (2005). [19] Ph. Eberhard, A Realistic Model for Quantum Theory with edges the hospitality of the National University of a Locality Property, edited by W. Schommers, Quantum Singapore. This work was partly supported by ASTAR Theory and Pictures of Reality (Springer, Berlin, 1989). grant No. SERC-052-101-0043, by the European QAP [20] D. Bohm and B. J. Hiley, The Undivided Universe IP-project, and by the Swiss NCCR ‘‘Quantum Photonics.’’ (Routledge, New York, 1993). Note added.—Paterek et al. have independently worked [21] B. F. Toner and D. Bacon, Phys. Rev. Lett. 91, 187904 on the same line of thought, and have presented data that (2003). violate the N ˆ 2 inequality [15].

210407-4 LETTERS Testing quantum correlations versus single-particle properties within Leggett’s model and beyond

CYRIL BRANCIARD1*, NICOLAS BRUNNER1, NICOLAS GISIN1, CHRISTIAN KURTSIEFER2, ANTIA LAMAS-LINARES2, ALEXANDER LING2 AND VALERIO SCARANI2 1Group of Applied Physics, University of Geneva, 20 Rue de l’Ecole de Medecine,´ CH-1211 Geneva 4, Switzerland 2Centre for Quantum Technologies/Physics Department, National University of Singapore, 117543 Singapore *e-mail: [email protected]

Published online: 6 July 2008; doi:10.1038/nphys1020

Quantum theory predicts and experiments confirm that nature of the correlations Pl results from a communication between can produce correlations between distant events that are non- Alice and Bob. This can be guaranteed by ensuring spacelike local in the sense of violating a Bell inequality1. Nevertheless, separation between Alice and Bob. Non-signalling correlations Bell’s strong sentence ‘Correlations cry out for explanations’ happen without any time ordering: there is not a first event, let (ref. 2) remains relevant. The maturing of quantum information us say on Alice’s side, that causes the second event via some science and the discovery of the power of non-local correlations, spooky action at a distance. We may phrase it differently: non- for example for cryptographic key distribution beyond the signalling correlations happen from outside space-time, in the standard quantum key distribution schemes3–5, strengthen Bell’s sense that there is no story in space-time that tells us how they wish and make it even more timely. In 2003, Leggett proposed an happen. This is the case in orthodox quantum physics, or in some alternative model for non-local correlations6 that he proved to be illuminating toy models such as the non-local box of Popescu and incompatible with quantum predictions. We present here a new Rohrlich (PR box)10. Mathematically, the no-signalling condition approach to this model, along with new inequalities for testing it. reads Pl(α a,b) Pl(α a) and Pl(β a,b) Pl(β b): Alice’s local These inequalities can be derived in a very simple way, assuming statistics are| not= influenced| by Bob’s| choice= of| measurement, only the non-negativity of probability distributions; they are also and reciprocally. stronger than previously published and experimentally tested In 2003, Leggett proposed another model of the form (1), which Leggett-type inequalities6–9. The simplest of the new inequalities can also be experimentally tested against quantum predictions6. is experimentally violated. Then we go beyond Leggett’s model, This model was recently brought into focus by the work of and show that we cannot ascribe even partially defined individual Groblacher¨ et al.7. The basic assumption of Leggett’s model is that properties to the components of a maximally entangled pair. locally everything happens as if each single quantum system would Formally, a correlation is a conditional probability distribution always be in a pure state. We shall be concerned here with the case of P(α, β a, b), where α, β are the outcomes observed by two binary outcomes α,β 1, though generalizations are possible. In partners,| Alice and Bob, when they make measurements labelled this case, the supplementary= ± variables l in Leggett’s model describe by a and b, respectively. On the abstract level, a and b are merely pure product states of two qubits, denoted by normalized vectors inputs, freely and independently chosen by Alice and Bob. On u,v on the Poincare´ sphere, a more physical level, Alice and Bob hold two subsystems of l u v , a quantum state; in the simple case of qubits, the inputs are = | i⊗| i naturally characterized by vectors on the Poincare´ sphere, hence the and the local expectation values have the usual form as predicted by , notation a b. quantum physics: How should we understand non-local correlations, in particular those corresponding to entangled quantum states? A natural α l u a·σ u u·a, (2) approach consists in decomposing P(α, β a,b) into a statistical h i = h | | i = mixture of hopefully simpler correlations: | β l v b·σ v v·b. (3) h i = h | | i = P(α,β a,b) d lρ(l)Pl(α,β a,b). (1) If the qubits are encoded in the polarization of photons, as in | = Z | Leggett’s initial idea, then the assumption is that each photon A B Bell’s locality assumption is Pl(α, β a, b) Pl (α a)Pl (β b), should locally behave as if it were perfectly polarized (in the admittedly the simplest choice, but an inadequate| = one| as it turns| directions u and v), and the local observations, conditioned on each out: quantum correlations violate Bell’s locality1. Setting out to l, should fulfil Malus’s law. It is worth emphasizing that Leggett’s explore other choices, it is natural to require first that the Pl assumption concerns exclusively the local marginals α l and β l h i h i fulfil the so-called no-signalling condition, that is, that none of the probability distributions Pl, whereas nothing is specified nature physics VOL 4 SEPTEMBER 2008 www.nature.com/naturephysics 681

© 2008 Macmillan Publishers Limited. All rights reserved. LETTERS

z γA θA FPC

DA a3 b3′ IF λ/4 PF

CC BBO b b3 ϕ 2 PS

SMF /2 ϕ a2 λ

y

ϕ IF λ/4 PF b b1 2′ b1′ DB a1 FPC x γ B θB

Figure 1 Alice’s (green) and Bob’s (red) measurement settings used to test inequality (4). In order for inequality (4) to hold, Bob’s settings must be such that Figure 2 Experimental set-up. Polarization-entangled photon pairs are generated the three pairs (bi ,b′ ) form the same angle ϕ, and the three directions ei of bi b′ in a nonlinear optical crystal (BBO) and coupled into single-mode optical fibres i − i (blue) are orthogonal. The largest violation is obtained when Alice’s settings ai are (SMF), similarly as in ref. 9. Polarization measurements in arbitrary settings for each chosen to be along the directions of bi b′. photon are made with polarization filters (PF) and quarter-wave plates (l/4), + i followed by single-photon detectors (DA,B). More details can be found in Supplementary Information, section 1.

about the correlation coefficients αβ l. Leggett’s model can thus still be non-local, and can in generalh violatei a Bell inequality. Both in the original paper6 and in ref. 7, the model was All previously available derivations of Leggett-type inequalities presented by implicitly assuming a time ordering of the events were quite lengthy and failed to suggest possible improvements (indeed, Bob’s output is assumed to depend on Alice’s input: or generalizations. We have found a much more straightforward her input must therefore have been defined before Bob’s output derivation (see the Methods section), simply based on the fact materializes). Any model based on such an assumption had that each Pl must be a valid probability distribution, so in 11,12 already been falsified by the so-called before–before experiment , particular Pl(α, β a,b) 0. Remarkably, this constraint of non- as Suarez emphatically stressed13. However, assumptions (2)–(3) negativity of probabilities,| ≥ weak as it may seem, is enough to clearly define non-signalling correlations, and Leggett’s model induce an observable incompatibility between Leggett’s model and can be defined without any reference to time ordering. As a quantum predictions. In our derivation, it also seems that the consequence, its study does add something to our understanding previously derived Leggett-type inequalities are suboptimal; among of quantum non-locality. But what exactly? In what are such Pl the improved inequalities that our approach suggests, the simplest ‘simpler’ than the usual quantum correlations? To answer these one reads questions, we recall that, in quantum theory, the singlet state is 3 such that the properties of the pair are sharply defined (the state 1 2 ϕ C(a ,b ) C(a ,b′ ) L (ϕ) 2 sin , (4) is pure), but the properties of the individual particles are not. i i i i 3 3 Xi 1 | + | ≡ ≤ − 3| 2 | In this perspective, Leggett’s model is an attempt at keeping the = correlations and reintroducing sharp properties at the individual where C(a, b) αβP(α, β a, b) is the usual correlation = α,β | level as well. coefficient. This inequalityP holds provided the three measurements Leggett’s model cannot reproduce the correlations of the on Alice’s side and six on Bob’s fulfil some relations; a possible set singlet state. Experimental falsifications have already been reported, of measurements is given in Fig. 1. For the singlet state, quantum first under additional assumptions7, then more directly8,9. These mechanics predicts CΨ (a, b) a · b. Thus, for the settings − = − works relied on the violation of so-called Leggett-type inequalities. defined in Fig. 1, L3 (ϕ) is Analogous to Bell’s inequalities, these criteria say that, under ϕ Leggett’s assumptions (2) and (3), a measurable quantity L should LΨ (ϕ) 2 cos . − = | 2 | satisfy L Lmax, whereas quantum theory predicts that L > Lmax can be observed≤ for suitable measurements. An important feature of This expression violates inequality (4) for a large range of values ϕ. Leggett-type inequalities is that, in contrast to Bell’s inequalities, To test the Leggett-type inequality (4) in an experiment, the bound Lmax is not a fixed number: instead, like the model we prepared polarization-entangled photon pairs in single-mode itself, it depends on the quantum measurements that are made. optical fibres in a close approximation to a singlet state, similarly Consequently all experimental data aiming at disproving Leggett’s as in ref. 9. In our set-up (Fig. 2), we choose the settings model should present evidence that the settings used in the of polarization measurements ai , bi and b′i for the individual experiment have been properly adjusted. photons by dialling in appropriate orientation angles γA,B for

682 nature physics VOL 4 SEPTEMBER 2008 www.nature.com/naturephysics

© 2008 Macmillan Publishers Limited. All rights reserved. LETTERS

2.0 0.08 QM (pure singlet) 0.07 1.9 0.06 0.05

1.8 ( , )] L Experiment L 0.04 3.65σ for η = 0.56 ϕ ϕη 1.7 ( ) – 0.03 3 exp

3 L Upper bound L 0.02 ϕ

1.6 for Leggett’s model max[ 0.01 0 1.5 0.5 0.6 0.7 0.8 0.9 1.0 1.4 η

–90 –60 –30 0 30 60 90 ϕ (°) Figure 4 Experimental test of the generalized Leggett inequality for different degrees of purity η. From the measurement shown in Fig. 3, we extract the

Figure 3 Violation of Leggett’s model. The experimental values for L3 over a range maximal excess of the experimental L3 (ϕ) with respect to the upper bound (denoted of separation angles ϕ (points with error bars) violate the bound given by Leggett’s L ) in inequality (5), for various degrees of purity η. For η < 0.6 data at ϕ 15◦ L = − model (solid line), and follow qualitatively the quantum-mechanical (QM) prediction are considered, whereas for η > 0.6 the largest violations are observed for (dashed line). The error bars indicate 1 standard deviation of propagated ϕ 25◦ . Poissonian counting statistics assumed± for photodetection events. The largest = − violations of inequality (4) are found for ϕ 25◦ , with 40.6 and 38.1 standard deviations, respectively. = ± 2 ϕ L (ϕ) 2 η sin , (5) 3 ≤ − 3 | 2 |

which, for angles ϕ small enough, is violated by LΨ (ϕ) for two quarter-wave plates (l/4) and angles θA,B for two absorptive − polarization filters. Details of the experimental implementation can any value of η > 0. Thus, as soon as the degree of purity be found in Supplementary Information, section 1. Through four of the ‘local states’ is non-zero, this generalization of Leggett’s consecutive coincidence measurements between photodetectors model also fails to reproduce quantum-mechanical predictions (see Supplementary Information, section 3 for a more complete analysis DA,B for all combinations of settings a, a and b, b, we establish an experimental value for a correlation− coefficient −C(a,b). of this generalization). The correlation coefficients necessary to compose values for Experimentally, we cannot expect to conduct a meaningful η L (ϕ 30◦) were obtained with an integration time of T 60 s comparison between these two predictions down to 0, owing 3 = ± = = per point, leading to values of 1.9068 0.0009 for ϕ 30◦ and to imperfections in the state preparation. From the measurement of ± = − 1.9005 0.0010 for ϕ 30◦. This corresponds to a violation of the Fig. 3, however, we can claim experimental evidence of a violation ± = for all η 0.56, with a statistical significance of at least 3.65 bound for L3 (ϕ 30◦) and L3 (ϕ 30◦) in Leggett’s model by ≥ 83.7 and 74.5 standard= − deviations, respectively.= + standard deviations, thus putting a lower bound for this class of models (Fig. 4). The asymmetry in the measured values of L3 (ϕ) is an indication for experimental imperfections in the accuracy of the settings, such It is then natural to conjecture that no model of form (1), as a possible misalignment of one of the quarter-wave plates with with non-signalling correlations Pl, can perfectly reproduce the correlations of the singlet state CΨ (a,b) a·b, unless respect to the polarizing filters. To test this alignment, we collected − = − values for L3 over a larger range of ϕ with an integration time of T 15 s per setting (Fig. 3). The variation of L with ϕ is α l β l 0 3 h i = h i = compatible= with the quantum-mechanical prediction for a singlet state with residual coloured noise and an orientation uncertainty for all measurements a and b (except perhaps for a few l in a of the quarter-wave plate of 0.2◦. zero-measure set). In the Methods section we prove this conjecture The falsification of Leggett’s model proves that it is impossible for models with discrete supplementary variables l; continuity to reconstruct quantum correlations from hypothetical, more arguments should enable us to extend the result to more general elementary correlations in which individual properties would be models. We thus have a necessary condition for a non-signalling sharply defined. Let us argue that a much stronger statement holds, model to be compatible with quantum mechanics. However, given namely, that individual properties cannot be even partially defined. a model with non-trivial marginals, finding an explicit inequality We first consider the following straightforward generalization that can be tested experimentally against quantum predictions is of Leggett’s model: we allow the ‘local states’ l to be mixed states, another problem; for this, we need the specific details of the model. for example photons with a degree of polarization η. Therefore, we In summary, with the general goal of improving our replace (2) and (3) by understanding of quantum correlations, we reformulated Leggett’s model. No time ordering of the events was assumed, and all · α l η u a, assumptions were made on the local part of the correlations. We h i = with 0 < η 1. β l η v·b, ≤ derived new Leggett-type inequalities, simpler and stronger than h i = previously known. The simplest version of our inequalities has The derivation of inequalities for this model follows exactly the been experimentally violated. Finally we investigated more general same pattern as for usual Leggett-type inequalities. In particular, models a` la Leggett, for which we imposed only the no-signalling the generalized version of (4) is condition. We argued that any such model with biased marginals is nature physics VOL 4 SEPTEMBER 2008 www.nature.com/naturephysics 683

© 2008 Macmillan Publishers Limited. All rights reserved. LETTERS incompatible with quantum predictions for the singlet state. This This inequality is general for all models with ‘local marginals’, that is, that fulfil shows that quantum correlations cannot be reconstructed from the no-signalling condition. ‘simpler’ correlations in which the individual properties would be even partially defined. Nature is really such that, in some cases, Derivation of a simple Leggett-type inequality. Now we derive an inequality individual properties are completely lost whereas global properties satisfied by Leggett’s specific model, that can be experimentally tested. Inequality are sharply defined. (8) implies, for the particular form of equation (3) for Bob’s marginals, Our result is in good agreement with the recent work in of 14 C(a,b) C(a,b′) 2 dlρ(l) v·(b b′) . (9) Colbeck and Renner , who have derived general inequalities to | + | ≤ −Z | − | falsify such models with non-trivial marginals. An example of a non-signalling model that successfully reproduces the singlet Let us consider three triplets of settings (ai ,bi ,b′i ), with the same angle ϕ correlations can be found in ref. 15; indeed, this model has unbiased between all pairs (bi ,b′ ), and such that bi b′ 2sin(ϕ/2)ei, where e1,e2,e3 i − i = { } marginals. It is also worth mentioning the non-local model of Toner form an orthogonal basis (Fig. 1). After combining the three corresponding 3 16 · and Bacon , which reproduces analytically the singlet correlations inequalities (9), using the fact that i 1 v ei 1 and the normalization l l = | | ≥ with one bit of communication. In this model, the probability d ρ( ) 1, we finally get the Leggett-typeP inequality (4). R For a= pure singlet state, inequality (4) is violated when distributions Pl have non-vanishing marginals; however, the Pl ϕ < 4arctan(1/3) 73.7◦, and the maximal violation is obtained for are signalling. The remarkable property of the Toner–Bacon model | | ≃ ϕ 2arctan(1/3) 36.9◦. In the case of imperfect interference visibility is that the communication is cleverly hidden, such that the final | | = ≃ V (LΨ (ϕ) 2V cos(ϕ/2) ), a violation can still be observed as long as ˜ − probability distribution P is non-signalling. (3) = | 2 | V > Vth √1 (1/3) (2√2/3) 94.3%. This work is part of the general research programme that looks Note= that other− Leggett-type= inequalities≃ can be derived, as we mention in for non-local models compatible or incompatible with quantum Supplementary Information, section 2. predictions. The goal is to find out what is essential in quantum correlations. Here we have found that to simulate or to decompose ANY NON-SIGNALLING MODEL MUST HAVE VANISHING MARGINALS the singlet correlations we cannot use non-signalling correlations We prove here that all marginals in a non-signalling model must necessarily Pl with non-trivial marginals. This nicely complements the result satisfy the constraints (11) and (12) below; and we argue that this in turn of ref. 17, that the correlations corresponding to very partially implies the claim made in the main text, namely, all the marginals must vanish entangled states, hence large marginals, cannot be simulated by a (apart perhaps on a zero-measure subset of l). single PR box, which has trivial marginals. In order for a general non-signalling model to reproduce all quantum correlations CΨ (a,b) a·b of the singlet state, we must have, according to − , =, − METHODS equation (8), for all a b b′ on the Poincare´ sphere

B B dlρ(l) M (b) M (b′) 2 a·(b b′) SIMPLE DERIVATION OF INEQUALITIES THAT TEST LEGGETT’S MODEL Z | l ± l | ≤ −| ∓ | Convenient notations. As mentioned, in this paper we focus on the case of binary outcomes α,β 1. In this case, the correlations can conveniently be and therefore, for all b,b′, written as = ± l l B B d ρ( ) Ml (b) Ml (b′) 2 b b′ , (10) 1 A B Z | ± | ≤ −|| ∓ || Pl (α,β a,b) 1 αMl (a,b) βMl (a,b) αβCl (a,b) . (6) | = 4 + + +
where · is the Euclidian norm. || || This expression enables us to clearly distinguish the In the case where b′ b, the first constraint of equation (10) implies that A = − marginals Ml (a, b) α,β αPl (α, β a, b) on Alice’s side for all b B = | and M (a,b) βPl (α,β a,b) on Bob’s, and the correlation coefficient l = α,β | Cl (a,b) α,βPαβPl (α,β a,b). Throughout the Methods section, we l l B B = | d ρ( ) Ml (b) Ml ( b) 0. (11) shall use theseP notations; in the main text, we have used more standard Z | + − | = A and simplified notations, the correspondence being α l Ml (a,b), B A h i = A In the case b′ b, the two vectors being normalized, we have β l Ml (a,b). The no-signalling condition is Ml (a,b) Ml (a) and → 2 2 h Bi = B = 2 b b′ 2 √4 b b ( b b′ /4) and therefore the Ml (a,b) Ml (b). − || + || = − −|| − ′|| ∼ || − || In order= for the decomposition (1) to be a valid mixture of correlations, all second constraint of (10) implies that for all b distributions Pl should be non-negative. As we said, this constraint is enough B B to derive Leggett-type inequalities. From equation (6), we can see that the M (b) M (b′) lim dlρ(l) | l − l | 0. (12) non-negativity implies the general constraints b bZ b b = ′→ || − ′|| A B l l l Ml (a) Ml (b) 1 Cl (a,b). (7) Let us now prove, in the case of discrete ( i ), that (11) and (12) in | ± | ≤ ± B ∈ { } turn necessarily imply that the marginals Ml (b) must vanish. In this case, the l l A B integral d ρ( ) should be changed to a discrete sum i pli . Constraints on the marginals Ml or Ml thus imply constraints on the ConstraintR (11) indeed implies that for all l (suchP that pl > 0) and for correlation coefficients C , and vice versa. i i l all b, MB ( b) MB (b), that is, MB must be an odd function of b. This is Let us now consider one measurement setting a for Alice and two li li li a very natural− property= − that we would impose on such a model; in particular, measurement settings b,b for Bob, and let us combine the previous inequalities ′ Leggett’s model indeed has odd marginals. (7) that we get for (a,b) and (a,b′). Using the triangle inequality, we get In addition, constraint (12) implies that for all li and for all b, B B B limb b( Ml (b) Ml (b′) / b b′ ) 0, that is, that all Ml are B B ′→ | i − i | || − || = i Cl (a,b) Cl (a,b′) 2 M (b) M (b′) . differentiable, and their derivative is zero for all b: therefore, they are | ± | ≤ −| l ∓ l | constant. As they have to be odd functions, then necessarily they are equal to zero. These constraints must hold for all probability distributions Pl. After In conclusion, for discrete l, Bob’s marginals MB (b) must all vanish; integration over the l, we get, for the averaged correlation coefficients li of course, the same reasoning holds for Alice’s marginals MA (a). This result C(a,b) dlρ(l)C (a,b), li l l = R should also be valid for any distribution ρ( ), at least those physically reasonable (for example piecewise continuous): we conjecture that for any B B C(a,b) C(a,b′) 2 d lρ(l) M (b) M (b′) . (8) | ± | ≤ −Z | l ∓ l | reasonable model to reproduce the quantum correlations of the singlet state,

684 nature physics VOL 4 SEPTEMBER 2008 www.nature.com/naturephysics

© 2008 Macmillan Publishers Limited. All rights reserved. LETTERS

the marginals must necessarily vanish, in the sense that 9. Branciard, C. et al. Experimental falsification of Leggett’s nonlocal variable model. Phys. Rev. Lett. 99, 210407 (2007). 10. Popescu, S. & Rohrlich, D. Quantum nonlocality as an axiom. Found. Phys. 24, 379–385 (1994). l l A a, d ρ( ) Ml (a) 0, 11. Stefanov, A., Zbinden, H., Gisin, N. & Suarez, A. Quantum correlations with spacelike separated ∀ Z | | = beam splitters in motion: Experimental test of multisimultaneity. Phys. Rev. Lett. 88, 120404 (2002). 12. Stefanov, A., Zbinden, H., Gisin, N. & Suarez, A. Quantum entanglement with acousto-optic l l B modulators: Two-photon beats and Bell experiments with moving beam splitters. Phys. Rev. A 67, b, d ρ( ) Ml (b) 0, ∀ Z | | = 042115 (2003). 13. Suarez, A. Nonlocal ‘realistic’ Leggett models can be considered refuted by the before–before A B l that is, for all a,b, Ml (a) Ml (b) 0 for ‘almost all’ (except for a experiment. Found. Phys. 38, 583–589 (2008). zero-measure subset| of the |l =, that | could| = possibly depend on a,b). 14. Colbeck, R. & Renner, R. Hidden variable models for quantum theory cannot have any local part. Preprint at (2008). 15. Cerf, N. J., Gisin, N., Massar, S. & Popescu, S. Simulating maximal quantum entanglement without Received 30 January 2008; accepted 6 June 2008; published 6 July 2008. communication. Phys. Rev. Lett. 94, 220403 (2005). 16. Toner, B. F. & Bacon, D. Communication cost of simulating Bell correlations. Phys. Rev. Lett. 91, 187904 (2003). References 17. Brunner, N., Gisin, N. & Scarani, V. Entanglement and non-locality are different resources. New J. 1. Bell, J. S. On the Einstein–Podolsky–Rosen Paradox. Physics 1, 195–200 (1964). Phys. 7, 88 (2005). 2. Bell, J. S. Speakable and Unspeakable in Quantum Mechanics 152 (Cambridge Univ. Press, Cambridge, 1987). Supplementary Information accompanies this paper on www.nature.com/naturephysics. 3. Barrett, J., Hardy, L. & Kent, A. No signaling and quantum key distribution. Phys. Rev. Lett. 95, 010503 (2005). Acknowledgements 4. Ac´ın, A., Gisin, N. & Masanes, L. From Bell’s theorem to secure quantum key distribution. Phys. Rev. Lett. 97, 120405 (2006). We thank A. Ekert and C. Simon for comments. C.B., N.B. and N.G. acknowledge financial support 5. Ac´ın, A. et al. Device-independent security of quantum cryptography against collective attacks. Phys. from the EU project QAP (IST-FET FP6-015848) and Swiss NCCR Quantum Photonics. A.L.L. and C.K. acknowledge ASTAR for financial support under SERC grant No 052 101 0043. This work is partly Rev. Lett. 98, 230501 (2007). supported by the National Research Foundation and Ministry of Education, Singapore. 6. Leggett, A. J. Nonlocal hidden-variable theories and quantum mechanics: An incompatibility theorem. Found. Phys. 33, 1469–1493 (2003). 7. Groblacher,¨ S. et al. An experimental test of non-local realism. Nature 446, 871–875 (2007). Author information 8. Paterek, T. et al. Experimental test of nonlocal realistic theories without the rotational symmetry Reprints and permission information is available online at http://npg.nature.com/reprintsandpermissions. assumption. Phys. Rev. Lett. 99, 210406 (2007). Correspondence and requests for materials should be addressed to C.B.

nature physics VOL 4 SEPTEMBER 2008 www.nature.com/naturephysics 685

© 2008 Macmillan Publishers Limited. All rights reserved. Testing quantum correlations versus single-particle properties within Leggett’s model and beyond

SUPPLEMENTARY INFORMATION

Cyril Branciard, Nicolas Brunner, Nicolas Gisin Group of Applied Physics, University of Geneva, Geneva, Switzerland

Christian Kurtsiefer, Antia Lamas-Linares, Alexander Ling, Valerio Scarani Centre for Quantum Technologies / Physics Dept., National University of Singapore, Singapore

SUPPLEMENTARY INFORMATION I: in the ±45◦ basis. At this point, we were reasonably con- TECHNICAL ASPECTS OF THE EXPERIMENT fident that we observe photon pairs in a good approxi- mation of a singlet polarization state. Typical visibilities A. Pair source and detection we reached were VHV ≈ 99% and V 45 ≈ 98%. There is no direct evidence in the± experimental result The polarization-entangled photon pair source in our for L3(ϕ) if the orientation of the quarter wave plates experimental setup (Figure 2 of the article) is based on a with respect to the polarizing filters is accurate. We thus non-collinear type-II parametric down conversion process verified the orientation of the first wave plate by sym- in a 2 mm thick properly cut Barium-beta-borate crystal, metrization of the polarization correlations with a fixed where photon pairs with almost degenerate wavelengths polarization filter in Bob’s arm under 0◦ linear polariza- around 702 nm are collected [1]. As a pump source (PS), tion, and varying θB while observing coincidences. With we used an Argon ion laser with a center wavelength of this procedure, we were able to find the symmetric posi- 351 nm and a power of 38 mW. Longitudinal and partial tion within ∆γA ≈ 0.2◦. The quarter wave plate in Bob’s transverse walk-off compensation was established in the arm was oriented in a similar way. usual way using a half wave plate and two 1mm thick To test the inequality (4) of the article, we used the BBO crystals (CC) of the same cut as the conversion following Poincar´evectors (see Figure 1): crystal [2]. ϕ ϕ ~a = ~x, ~b /~b′ = cos , ± sin , 0 , For the polarization measurements we used zero order 1 1 1 ³ 2 2 ´ quarter wave plates (λ/4) and polymer-film based polar- ϕ ϕ ~a = ~y, ~b /~b′ = 0, cos , ± sin , ization filters (PF) with a small wedge error and an ex- 2 2 2 ³ 2 2 ´ tinction ratio of better than 1:10,000. All four elements ϕ ϕ ~a = ~z, ~b /~b′ = ± sin , 0, cos , (S1) could be oriented with motorized rotation stages with a 3 3 3 ³ 2 2 ´ reproducibility of about 0.1◦. Photo events were generated with fiber-coupled pas- so that ϕ sively quenched silicon avalanche photodiodes (DA,B). ~ ~ bi − bi′ = 2sin ~ei , with (~e1,~e2,~e3)=(~y, ~z, ~x). (S2) All photo events were recorded, and pairs identified when 2 photo events coincided in a time window of τ = 15 ns. The x axis in this notation corresponds to ±45◦ linear, A pair of interference filters (IF, center wavelength the y axis to circular, and the z axis to horizontal/vertical 702 nm, full transmission width 5 nm at half maximum) polarization, the latter coinciding with the natural basis was used for initial alignment of the pair source, and left of the parametric down conversion process in the nonlin- in the system to avoid a change in beam orientations. ear optical crystal. The correlation coefficients C(~a,~b) for each of the six settings for testing inequality (4) were obtained by B. Alignment and setup characterization recording photo-detection coincidences c during an inte- gration time T for four combinations of orthogonal po- As a first step in our alignment procedure, the single larizations by rotating the polarizers by additional 90◦ mode optical fibers were adjusted for neutral polarization accordingly: transport with polarization controllers (FPC). Under sta- ble temperature conditions, we maintained an extinction c(~a,~b)+ c(−~a, −~b) − c(−~a,~b) − c(~a, −~b) C(~a,~b)= . (S3) ratio better than 1:1000 over half a day. Then, the exact c(~a,~b)+ c(−~a, −~b)+ c(−~a,~b)+ c(~a, −~b) orientation θB of the polarizing filter with respect to the first one was fixed to an accuracy of 0.2◦ by searching for This way, artefacts due to imbalanced detector efficien- a minimum of coincidence events, with the quarter wave cies were minimized. plates removed. Compensation crystals were adjusted to In order to ensure the stability of the alignment, we maximize the visibility of polarization (anti-)correlations recorded polarization correlations in the HV and ±45◦ 2

700 actually enough [7]. In addition, inequality (4) is stronger 600 than the previously derived inequalities [3–6]. Consider for instance the simplest inequalities of [5, 6]: in our 500 formalism, they would be obtained by (i) choosing four 400 triplets, in two orthogonal planes, and (ii) setting ~ai = ~bi. Now, the choice of the triplets was not optimal, nor was 300 the choice (ii), as the geometry of the problem clearly 200 shows.

coincidences in 1 sec Following our reasoning, one can derive even more ro- 100 bust inequalities by increasing the number N of (judi- 0 ciously chosen) triplets (~ai,~bi,~b′ ), thus defining N direc- 0° 45° 90° 135° 180° i θ tions ~e for ~b −~b . If 1 N |~v · ~e |≥ ξ > 0 holds for B i i i′ N i=1 i N all ~v, then one gets the Leggett-typeP inequality Supplementary Figure 1: Polarization correlations in the HV ϕ ◦ ◦ basis (open circles, θA = 0 ) and ±45 linear basis (filled LN (ϕ) ≤ 2 − 2 ξN | sin | , (S4) ◦ 2 circles, θA = 45 ). The corresponding visibilities are VHV = 98.9 ± 0.8% and V±45◦ = 97.8 ± 0.8%. 1 N with LN (ϕ) = |C(~ai,~bi)+ C(~ai,~b′ )|. This in- N Pi=1 i equality is violated by the singlet state, for which LN (ϕ) ϕ is still equal to L − (ϕ) = 2| cos |. The threshold visibil- linear polarization bases both before and after the acqui- Ψ 2 ity is now V (N) = 1 − ξ2 . The next simple case after sition of the correlations for L3 in the usual way (i.e., th N the one we studiedp is N = 4: in this case the four direc- γA = θA fixed, γB = θB varies). Supplementary Fig- tions ~ei should point to the four vertices of the regular ure 1 shows these polarization correlations directly be- 1 4 1 tetrahedron. One can then show that |~v·~ei|≥ fore the main measurement. We extract visibilities of 4 Pi=1 √6 ◦ 1 VHV = 98.9 ± 0.8% and V 45 = 97.8 ± 0.8%, respec- (i.e. ξ4 = √ ), and one gets an inequality that toler- ± 6 tively. (4) 5 ates a visibility of Vth = ≃ 91.3%. In the infinite The uncertainties in all experimental values of L3 are q 6 obtained assuming Poissonian counting statistics for pho- (and experimentally non-testable) limit of all directions ~ ~ 1 todetection events, independent variations for each set- ~e scanned by the vectors bi − bi′ , we would have ξN → 2 , (N ) √3 ting, and the usual error propagation through (S3) and and V →∞ = ≃ 86.6%. (4). th 2 To track potential drifts of the apparatus, the set shown in Figure 3 of the article was recorded in two in- SUPPLEMENTARY INFORMATION III: terleaving series with a spacing of 5◦ for ϕ each. The A STRAIGHTFORWARD GENERALIZATION absence of a modulation of L3(ϕ) with a 5◦ period in OF LEGGETT’S MODEL the presented graph indicates that the residual asymme- try can not be attributed to drifts of our setup, but to Here we come back to the generalization of Leggett’s a residual misalignment of the quarter wave plates with model, in which we impose that the marginals should respect to each other. From a simulation with a noisy have the following form: singlet state, the residual asymmetry seems to be com- patible with a misalignment on the order of 0.2 . hαiλ = η ~u · ~a, ◦ with 0 <η ≤ 1 . (S5) The polarization correlations after these measurements hβiλ = η ~v ·~b , revealed values of VHV = 99.3 ± 0.8% and V 45◦ = 97.8±0.8%, indicating again that the alignment of± source, This generalized model satisfies inequalities similar to optical fibers and measurement system has not drifted (S4): significantly over the measurement time of about 9 h. ϕ L (ϕ) ≤ 2 − 2 ηξ | sin | . (S6) N N 2 SUPPLEMENTARY INFORMATION II: For any value of η > 0, these inequalities are violated by OTHER LEGGETT-TYPE INEQUALITIES the quantum mechanical prediction LΨ− (ϕ), for a small enough angle ϕ. Thus, such generalizations of Leggett’s Inequality (4) in the article is certainly the simplest model also fail to reproduce quantum mechanical predic- one that allows to test Leggett’s model versus quantum tions, and can also be tested experimentally. mechanics. It involves only 3 settings for Alice and 6 The required visibility to violate inequalities (S6) de- (N) 2 for Bob. Note that on Alice’s side, two settings could pends on η: Vth = 1 − (ηξN ) . In the experimen- p 1 actually be chosen to be the same: in our case, one could tal run shown in Figure 3, we had N = 3, ξ3 = , ~ ~ 3 for instance rotate the triplet (~a1, b1, b1′ ) around the y and an average visibility of 98.4 ± 0.4% . Therefore our axis, so that ~a1 = ~a3 = ~z. Thus, 2 × 6 settings are data allows us to falsify these generalized models for all 3

η > 0.528 ± 0.07. The statistical significance of the ex- 3.65 σ for η = 0.65 up to 40.6 σ of the Leggett model perimental excess of L3 with respect to the generalized bound (4) for η = 1. Leggett bound increases roughly linearly with η, from

[1] Kurtsiefer, C., Oberparleiter, M. & Weinfurter, H. High- [5] Paterek, T., Fedrizzi, A., Gr¨oblacher, S., Jennewein, T., efficiency entangled photon pair collection in type-II para- Zukowski, M., Aspelmeyer, M. & Zeilinger, A. Experi- metric fluorescence. Phys. Rev. A 64, 023802 (2001). mental Test of Nonlocal Realistic Theories Without the [2] Kwiat, P. G., Mattle, K., Weinfurter, H., Zeilinger, A., Rotational Symmetry Assumption. Phys. Rev. Lett. 99, V. Sergienko, A. & Shih, Y. New High-Intensity Source of 210406 (2007). Polarization-Entangled Photon Pairs. Phys. Rev. Lett. 75, [6] Branciard, C., Ling, A., Gisin, N., Kurtsiefer, C., Lamas- 4337-4341 (1995). Linares, A. & Scarani, V. Experimental Falsification of [3] Leggett, A.J. Nonlocal Hidden-Variable Theories and Leggett’s Nonlocal Variable Model. Phys. Rev. Lett. 99, Quantum Mechanics: An Incompatibility Theorem. 210407 (2007). Found. Phys. 33, 1469-1493 (2003). [7] Of course, we do not claim that this number of settings [4] Gr¨oblacher, S., Paterek, T., Kaltenbaek, R., Brukner, C.,ˇ (2 × 6) is minimal. We have found other inequalities, some Zukowski, M., Aspelmeyer, M. & Zeilinger, A. An ex- with terms of the form |C(~a,~b) − C(~a,~b′)|, that use fewer perimental test of non-local realism. Nature 446, 871-875 settings but which are less robust. (2007). Vol 454 | 14 August 2008 | doi:10.1038/nature07121 LETTERS

Testing the speed of ‘spooky action at a distance’

Daniel Salart1, Augustin Baas1, Cyril Branciard1, Nicolas Gisin1 & Hugo Zbinden1

Correlations are generally described by one of two mechanisms: not follow here, is to speculate that there is a tachyonic field9 that either a first event influences a second one by sending information couples specifically to entangled particles. encoded in bosons or other physical carriers, or the correlated Bohm’s10 pilot-wave model of quantum mechanics is an example events have some common causes in their shared history. of a theory containing an explicit spooky action at a distance, which Quantum physics predicts an entirely different kind of cause for requires the assumption that there is a universally privileged frame11. some correlations, named entanglement. This reveals itself in cor- Also, if the spooky action at a distance propagates at finite speed, then relations that violate Bell inequalities (implying that they cannot an experiment like the one presented below could possibly falsify the be described by common causes) between space-like separated pilot-wave model12. Reference 12 stresses that the existence of a uni- events (implying that they cannot be described by classical com- versally privileged frame would not contradict relativity. munication). Many Bell tests have been performed1, and loopholes By 2000, a Bell experiment along the lines presented above had related to locality2–4 and detection5,6 have been closed in several already been analysed8,13,14. However, the analysis concerned only two independent experiments. It is still possible that a first event could hypothetically privileged reference frames. The first frame was influence a second, but the speed of this hypothetical influence defined by the ,2.7 K cosmic microwave background radiation. (Einstein’s ‘spooky action at a distance’) would need to be defined The second frame analysed was the ‘Swiss Alps reference frame’, that in some universal privileged reference frame and be greater than is, not a universal frame but merely the frame defined by the massive the speed of light. Here we put stringent experimental bounds on environment of the experiment. The assumption that the privileged the speed of all such hypothetical influences. We performed a Bell frame depends on the experiment’s environment leads naturally to test over more than 24 hours between two villages separated by the issue of situations in which the massive environments on both 18 km and approximately east–west oriented, with the source sides of the experiment differ, and this was the main subject of the located precisely in the middle. We continuously observed two- experiment in 2000 (refs 13, 14). In both of these analyses, the hypo- photon interferences well above the Bell inequality threshold. thetical superluminal influence was termed the speed of quantum Taking advantage of the Earth’s rotation, the configuration of information to stress that it is not classical signalling. We shall use our experiment allowed us to determine, for any hypothetically this terminology, but we emphasize that this is only the speed of a privileged frame, a lower bound for the speed of the influence. For hypothetical influence and that our result casts very serious doubts example, if such a privileged reference frame exists and is such that on its existence. For views on the speed of quantum information, see 2 the Earth’s speed in this frame is less than 10 3 times that of the ref. 15. speed of light, then the speed of the influence would have to exceed Before presenting our experiment and results, let us clarify the that of light by at least four orders of magnitude. principle of our measurements and how to obtain bounds on this According to quantum theory, quantum correlations violating Bell speed of quantum information in any reference frame. inequalities simply happen, somehow from outside space-time, in In an inertial reference frame centred on the Earth, two events A the sense that there is no space-time explanation for their occurrence: and B (in our experiment two single-photon detections) respectively there is no event here that somehow influences another distant event occur at positions rA and rB at times tA and tB. Let us consider another there. Yet such a description of correlations, which is radically dif- inertial reference frame F, the hypothetically privileged frame, rela- ferent from all those found in any other part of science, should be tive to which the Earth frame moves with a velocity v (Fig. 1). When correlations violating a Bell inequality are observed, the speed of thoroughly tested. quantum information V in frame F that could cause the correlation In 1989, Eberhard7 realized that the existence of a hypothetically QI is bounded from below as follows: privileged reference frame can be experimentally tested for. The idea r 0 {r 0 is that the speed of this influence, although greater than the speed of B A VQI§ light, is finite. Hence, if the events are simultaneous in the hypothet- t0 {t 0 ically privileged frame, then the signal does not arrive on time and no B A 9 9 9 9 violation of Bell inequalities should be observed. Note that if the where (r A, t A) and (r B, t B) are respectively the coordinates of events are simultaneous in some reference frame, then they are also events A and B in frame F, obtained from (rA, tA) and (rB, tB) by simultaneous with respect to any reference frame moving in a dir- Lorentz transformation. After simplification, we obtain ection perpendicular to the line joining the two events. Accordingly, 2 2 2 VQI (1{b )(1{r ) Eberhard proposed (Ph. H. Eberhard, personal communication) to §1z ð1Þ c (rzb )2 perform a Bell test over a long distance oriented east–west, over a jj period of 12 hours (ref. 8). If the events were simultaneous in the where b 5 v/c is the speed (v 5 jjvjj) of the Earth frame in frame F 5 Earth’s reference frame, then they would also be simultaneous with relative to the speed of light (c); bjj vjj/c, with vjj the component of v respect to all frames moving in the plane perpendicular to the east– parallel to the A–B axis; and r 5 ctAB/rAB quantifies the alignment of west axis, and in 12 hours all possible hypothetically privileged the two events in the Earth frame, with tAB 5 tB 2 tA and frames would be scanned. An intriguing alternative, that we will rAB 5 jjrB 2 rAjj. In the following, we will consider space-like separated

1Group of Applied Physics, University of Geneva, 20 Rue de l’Ecole de Me´decine, CH-1211 Geneva 4, Switzerland. 861 ©2008 Macmillan Publishers Limited. All rights reserved LETTERS NATURE | Vol 454 | 14 August 2008

events, for which jrj < 1: the bound on VQI in equation (1) will then be As we show in the Supplementary Information, in order to bound larger than c. For a given privileged frame F, this bound depends on the jbjjj from above during a period of time T, we can consider two cases: > orientation of the A–B axis through bjj and on the alignment r. To one in which v does not point close to a pole (CTjtanxj jtanaj), and 2 obtain a good lower bound for VQI, we should bound the term one in which it does (CTjtanxj # jtanaj). Here CT 5 cos (vT/4), 2 (r 1 bjj) from above by the smallest possible value, during a period which ,1 when vT is small. There exists a time interval of length of time T needed to observe a Bell violation (which, in our experiment, T during which jbjj(t)j is bounded from above by will be the integration time of a two-photon interference fringe). vT To gain some intuition, we first consider the simple case in which jbj sin2 x cos2 a{ cos2 x sin2 a 2 r 5 0 (the two events are perfectly simultaneous in the Earth frame) qffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi and the A–B axis is perfectly aligned in the east–west direction. Then, in the first case and by when the Earth rotates, there will be a moment t0 when the east–west vT 5 jbjjcos x sin aj{j sin x cos aj cos direction is perpendicular to v, that is, bjj(t0) 0. During a small time 2 interval around t0, we can bound jbjj(t)j by a small value, and thus in the second case. These bounds, together with equation (2), provide obtain a high lower bound for VQI. In principle, the alignment r could be optimized for each privi- the desired lower bound for VQI. leged frame that we wish to test, so as to decrease the bound that can We now describe our experiment. In essence it is a large Franson 1 2 interferometer16. A source situated in our laboratory in Geneva emits be put on (r bjj) during the time interval T (and increase the term (1 2 r2) at the same time). In our experiment, however, because we entangled photon pairs using the standard parametric down-conver- want to scan all possible frames, we do not optimize r for each frame; sion process in a nonlinear crystal (here a continuous-wave laser 17 instead, we align the detection events such that jrj # rr = 1, where rr pumps a waveguide in a periodically poled lithium niobate crystal) . is our experimental precision on the alignment r. We then use the Using fibre Bragg gratings and optical circulators, each pair is deter- 2 2 2  2 ministically split and one photon is sent through the Swisscom fibre fact that (1{r )=(rzbjj) §(1{rr )=(rr zjbjjj) to get the follow- ing bound: optic network to Satigny, a village west of Geneva, and the other photon is sent to Jussy, a village east of Geneva. The two receiving 2 2 2 VQI (1{b )(1{rr ) stations, located in those two villages, are separated by a direct dis- §1z ð2Þ  2 c (rr zjbjjj) tance of 18.0 km (Fig. 2). We use energy–time entanglement, a form of entanglement well suited to quantum communication in standard The problem reduces to bounding jbjjj directly. telecommunications fibres18. At each receiving station, the photons In the configuration of our experiment, the A–B axis is almost, but pass through identically unbalanced fibre-optic Michelson interfe- not perfectly, oriented along the east–west direction. Consequently, rometers. The imbalance (,25 cm) is larger than the single-photon the component bjj(t) has a 24-hour period, and geometric considera- coherence length (,2.5 mm), meaning that any single-photon inter- tions show that it can be written as (see the Supplementary ference is avoided, but is much smaller than the pump laser coher- Information) ence length (>20 m). Accordingly, when a photon pair is detected simultaneously in Satigny and Jussy, there is no information about bjj(t)~b cos x sin azb sin x cos a cos vt which path—the long arm or the short arm—the photons took in where x is the zenith angle of v, a is the angle between the A–B axis their interferometers. But because the photons were also emitted and the equatorial x–y plane (Fig. 1), and v is the angular velocity of simultaneously, they must both have taken the same long or short the Earth. path. This indistinguishability leads, as always in quantum physics, to interference between the long–long and short–short paths. N z Continuously scanning the phase in one interferometer (at Jussy), ω while keeping the other one stable, produces a sinusoidal oscillation of the correlation between the photon detections at Satigny and Jussy (Fig. 3). The phases were controlled by the temperature of the fibre- χ based interferometers. v

B N y a W E France α Jussy S APD Satigny Lake Genev d A x APD 18.0 km

8.2 k m 10.7 km

Underground fibre length: 13.4 km Fibre length: 17.5 km Fibre coil length: 4.1 km Geneva Total fibre length: 17.5 km France 2 km Switzerland z′ Figure 2 | Experimental setup. The source sends pairs of photons from F Geneva to two receiving stations through the Swisscom fibre-optic network. y′ The stations are situated in two villages, Satigny and Jussy, that are x′ respectively 8.2 and 10.7 km from Geneva. The direct distance between them is 18.0 km. At each receiving station, the photons pass through identically unbalanced Michelson interferometers and are detected by a single-photon InGaAs avalanche photodiode (APD) (id201, id Quantique). The length of Figure 1 | Reference frames. The Earth frame moves with respect to a the fibre going to Jussy is 17.5 km. The fibre going to Satigny is only 13.4 km hypothetically privileged reference frame F at a speed v. The zenith angle x long, so we added a fibre coil of 4.1 km (represented as a loop) to equalize the between v and the z axis can have values between 0u and 180u. The A–B axis lengths of the fibres. Having fibres with the same length allows us to satisfy forms an angle a with the equatorial (x–y) plane. v, angular velocity of the the condition of good alignment (r = 1). d indicates the scanning of the Earth. phase of the interferometer at Jussy. 862 ©2008 Macmillan Publishers Limited. All rights reserved NATURE | Vol 454 | 14 August 2008 LETTERS

80 precision of the alignment in the actual experiment; see equation (2). We wished to have a good alignment (r = 1), so the difference 70 in the arrival times of the single photons tAB was minimized. First, the length of each fibre between the source and the single- 60 photon detectors was measured. The long fibres (several kilometres in length) were measured using a single-photon optical time-domain 50 reflectometer20 and the short fibres (less than 500 m in length) were measured using an optical frequency-domain reflectometer21. The 40 fibre on the Satigny side was found to be shorter than the other by 4.1 km. We added a fibre coil to the short side (represented as a loop in 30 Fig. 2), reducing this difference to below 1 cm with an uncertainty of

Coincidences per min 1 cm, which corresponds to a light travel time of 49 ps. To remove any 20 doubt about where exactly the measurement took place, we adjusted the lengths of the fibres from the source to the fibre couplers inside 10 each interferometer and also to the photodiodes (where the photons are detected). Hence, the configuration was totally symmetric. 0 0 30 60 90 120 150 180 210 240 Next, we considered the chromatic dispersion in the fibres. Time (min) Chromatic dispersion added an uncertainty in the arrival times, and because the entangled photons were anticorrelated in energy, 5 Figure 3 | Interference fringes. Interference fringes with a period T 900 s their time delays were always opposite to each other, which always obtained during a 4-hour measurement, fitted with a sinusoidal function 6 increased this uncertainty. Chromatic dispersion was measured to be yielding a visibility of 87.6% 1.1%. If we subtract the accidental 21 21 22 coincidences, the (net) visibility climbs to 94.1% 6 1.0%. This result is 18.2 ps nm km using a chromatic dispersion analyser . For a significant because the period of the interference fringes remains stable for a spectral half-width of Dl 5 0.5 nm and twice the distance of very long time, which allows us to fit the entire measurement with a 17.5 km, this is equivalent to a 319-ps uncertainty. Thus, the overall continuous fit and obtain a high visibility value. uncertainty in the relative lengths of the fibres was, when expressed in light travel time, tAB 5 323 ps. This, together with the direct distance 5 Interference fringes were recorded in many runs, which usually between the receivers, rAB 18.0 km, allowed us to estimate the pre- 26 lasted several hours (up to 15 hours for the longest run (see Fig. 4)). cision of our alignment: jrj # rr 5 5.4 3 10 = 1. By juxtaposing several of these measurement runs obtained over Last, we used equation (2) to calculate a lower bound for VQI. We several weeks, we covered a 24-hour period with interference fringe used the value of rr just calculated, the period of time T 5 360 s needed periods of T 5 360 s with visibilities well above the threshold (1/!2) to observe a Bell violation (corresponding to the interference fringe set by the Clauser–Horne–Shimony–Holt Bell inequality19. The vis- period), and the angle formed by the axis between the two receiving ibility is large enough to exclude any common-cause explanation. stations (the A–B axis) and the equatorial (x–y) plane, a 5 5.8u. The The correlations are thus due either to entanglement, as predicted by results are shown in Fig. 5, for certain hypothetically privileged frames. quantum physics, or to some hypothetical spooky action at a distance In Fig. 5a, we scan all possible directions x, but set the Earth’s relative whose speed we wish to bound from below. Because long measure- ments of fringes with short fringe periods T are difficult to fit con- a tinuously, we fitted the data over a time window corresponding to 250,000 one-and-a-half fringes and scanned this time window, as explained in 100,000

the Supplementary information. c / 75,000 QI

The violation of the Bell inequality at all times of day makes it V 50,000 possible to calculate the lower bound for the speed of quantum information in any reference frame. This bound depends on the 25,000 Bound on 10,000 1.0 7,500 5,000 0.9 0° 30° 60° 90° 120° 150° 180° χ

Visibility 0.8 b 106 0.7 00:00 03:00 06:00 09:00 12:00 15:00 18:00 21:00 00:00 105

Time (h:min) c / 104 QI

1.0 V 103 0.9 102 Bound on

Visibility 0.8 101

0.7 100 00:00 03:00 06:00 09:00 12:00 15:00 18:00 21:00 00:00 10–5 10–4 10–3 10–2 10–1 100 Time (h:min) β Figure 4 | Visibility fits. Visibility fits for several uninterrupted runs Figure 5 | Lower bounds for the speed of quantum information. a, Bound 23 obtained at different times of the day. Together these runs cover each obtained for VQI/c as a function of the angle x, for b 5 10 . For x = a or moment of the day at least twice. The limitations on the lengths of these x > 180u 2 a, the bound is obtained by considering the second case measurements were due to the end of the cooling ramp and small discussed in the text, whereas for a = x = 180u 2 a, the bound is obtained instabilities in the set-up that produced short interruptions in the scan. by considering the first case. The bound at x 5 90u is VQI $ 54,000c. Visibility values remain above the threshold value of 1/!2 (black line) set by b, Bound obtained for VQI/c as a function of the speed b, for x 5 90u. Asb  the Clauser–Horne–Shimony–Holt Bell inequality at all times. tends to zero, our bound on VQI/c tends to 1/. 863 ©2008 Macmillan Publishers Limited. All rights reserved LETTERS NATURE | Vol 454 | 14 August 2008

23 7. Eberhard, PhH Quantum Theory and Pictures of Reality (ed. Schommers, W.) speed at b 5 10 . A lower bound for VQI greater than 10,000 times the 169–216 (Springer, Berlin, 1989). speed of light is found in any such reference frame. The imperfect east– 8. Scarani, V. et al. The speed of quantum information and the preferred frame: west orientation (a ? 0) is responsible for the minimum values of the analysis of experimental data. Phys. Lett. A 276, 1–7 (2000). bound at angles x near0u and 180u. For smaller Earth speeds, the bound 9. Feinberg, G. Possibility of faster-than-light particles. Phys. Rev. 159, 1089–1105 (1967). on VQI is even larger. However, if b is very large, then the correspond- 10. Bohm, D. A suggested interpretation of the quantum theory in terms of ‘‘hidden’’ ing bound on VQI is less stringent. To illustrate this, in Fig. 5b we set variables I. Phys. Rev. 85, 166–179 (1952). x 5 90u, that is, with v in the equatorial plane, and scan the velocity b. 11. Bohm, D. A suggested interpretation of the quantum theory in terms of ‘‘hidden’’ Indeed, for b < 1, the bound drops rapidly. Recall, however, that for variables II. Phys. Rev. 85, 180–193 (1952). large values of b we could in principle optimize the alignment r in the 12. Bohm, D. & Hiley, B. J. The Undivided Universe 293 (Routledge, London, 1993). b 13. Gisin, N., Scarini, V., Tittel, W. & Zbinden, H. Optical tests of quantum nonlocality: experiment to get a better bound on VQI. For small values of , our from EPR-Bell tests towards experiments with moving observers. Annal. Phys. 9, bound is limited by the inverse of our precision of alignment rr. 831–841 (2000). In conclusion, we performed a Bell experiment using entangled 14. Zbinden, H. et al. Experimental test of nonlocal quantum correlation in relativistic photons between two villages separated by 18 km and approximately configurations. Phys. Rev. A 63, 022111 (2001). 15. Garisto, R. What is the speed of quantum information? Preprint at Æhttp:// east–west oriented, with the source located precisely in the middle. arxiv.org/abs/quant-ph/0212078æ (2002). The rotation of the Earth allowed us to test all possible hypothetically 16. Franson, J. D. Bell inequality for position and time. Phys. Rev. Lett. 62, 2205–2208 privileged frames over a period of 24 hours. Two-photon interference (1989). fringes with visibilities well above the threshold set by the Bell 17. Tanzilli, S. et al. PPLN waveguide for quantum communication. Eur. Phys. J. D 18, 155–160 (2002). inequality were observed at all times of day. From these observations 18. Thew, R. et al. Experimental investigation of the robustness of partially entangled we conclude that the nonlocal correlations observed here and in qubits over 11 km. Phys. Rev. A 66, 062304 (2002). previous experiments1 are indeed truly nonlocal. To maintain an 19. Clauser, J. F., Horne, M. A., Shimony, A. & Holt, R. A. Proposed experiment to test explanation based on spooky action at a distance we would have to local hidden-variable theories. Phys. Rev. Lett. 23, 880–884 (1969). 20. Scholder, F., Gautier, J.-D., Wegmu¨ller, M. & Gisin, N. Long-distance OTDR using assume that the spooky action propagates at speeds even greater than photon counting and large detection gates at telecom wavelength. Opt. Commun. the bounds obtained in our experiment. 213, 57–61 (2002). 21. Passy, R. et al. Experimental and theoretical investigations of coherent OFDR with Received 2 April; accepted 30 May 2008. semiconductor laser sources. J. Lightwave Technol. 12, 1622–1630 (1994). 22. Brendel, J., Gisin, N. & Zbinden, H. in Proc. 5th Opt. Fiber Measurement Conf. (eds 1. Aspect, A. Bell’s inequality test: more ideal than ever. Nature 398, 189–190 (1999). Boisrobert, Ch. & Tanguy, E.) 12–17 (Universite´ de Nantes, Nantes, 1999). 2. Aspect, A. et al. Experimental realization of Einstein-Podolsky-Rosen-Bohm Gedankenexperiment: A new violation of Bell’s inequalities. Phys. Rev. Lett. 49, Supplementary Information is linked to the online version of the paper at 91–94 (1982). www.nature.com/nature. 3. Tittel, W., Brendel, J., Zbinden, H. & Gisin, N. Violation of Bell inequalities by Acknowledgements We acknowledge technical support by J.-D. Gautier and photons more than 10 km apart. Phys. Rev. Lett. 81, 3563–3566 (1998). C. Barreiro. The access to the telecommunications network was provided by 4. Weihs, G., Jennewein, T., Simon, C., Weinfurter, H. & Zeilinger, A. Violation of Swisscom. This work was supported by the Swiss NCCR Quantum Photonics and Bell’s inequality under strict Einstein locality conditions. Phys. Rev. Lett. 81, the European Union project QAP. The image of the Earth in Fig. 1 is a NASA 5039–5043 (1998). Goddard Space Flight Center Image by R. Sto¨ckli. 5. Rowe, M. A. et al. Experimental violation of a Bell’s inequality with efficient detection. Nature 409, 791–794 (2001). Author Information Reprints and permissions information is available at 6. Matsukevich, D. N. et al. Bell inequality violation with two remote atomic qubits. www.nature.com/reprints. Correspondence and requests for materials should be Phys. Rev. Lett. 100, 150404 (2008). addressed to D.S. ([email protected]).

864 ©2008 Macmillan Publishers Limited. All rights reserved [f`1('%('*/&eXkli\'7121 JLGGC

Testing the speed of spooky action at a distance Daniel Salart1, Augustin Baas1, Cyril Branciard1, Nicolas Gisin1 & Hugo Zbinden1

Supplementary Figures and Legends

Supplementary Figure 1 | Experimental setup. A cw laser pumps a nonlinear waveguide creating pairs of entangled photons. Each photon is sent to a receiving station located several km away through installed optical fibers. After travelling through a Michelson interferometer with arms of different length, each photon is detected by an avalanche photodiode. De- tection events are continuously monitored in search for coincidences in their arrival times.

1Group of Applied Physics, University of Geneva, 20, Rue de l’Ecole de M´edecine, CH-1211 Geneva 4, Switzerland

nnn%eXkli\%Zfd&eXkli\ ( 1 [f`1('%('*/&eXkli\'7121 JLGGC

Supplementary Figure 2 | Experimental setup. Classical channels. A function generator (FG) sends a trigger signal of 1 MHz to two lasers. The optical signals are sent through 17.5 km of optical fibers to their respective receiving stations where they are detected by p-i-n photodiodes. The single-photon detectors are triggered by these signals and detection events are sent back to Geneva using the same fibers. WDMs and different laser wavelengths ensure the separation of the signals.

Supplementary Figure 3 | Upper bounds for | f(t) | during an interval IT of length T . Three cases for the analysis of f(t) = A − B cos ωt, depending on A and B.

nnn%eXkli\%Zfd&eXkli\ ) 2 [f`1('%('*/&eXkli\'7121 JLGGC

Supplementary Discussion - Experiment The experimental setup These are the details of our experimental setup (see Supplementary Figure 1). The laser is a cw single mode external cavity diode laser (2.7 mW at 785.2 nm). It pumps a PPLN (Periodically Poled Lithium Niobate, LiNbO3) nonlinear waveguide (HC Photonics) that creates pairs of photons through the process of spontaneous parametric down-conversion. All the guided light at 785.2 nm is blocked with a Silicon filter (F). The photon pairs are separated with two circulators and two fiber Bragg gratings (FBG). The first FBG reflects the photons at 1573.0 nm (∆λ=1.0 nm) and transmits all the other wavelengths. The second FBG reflects the photons at 1567.8 nm (∆λ=1.0 nm). The photons are sent to their respective receiving stations through standard communication optical fibers. The fibered Michelson interferometers have arms of different lengths. The path-length difference is the same in both of them (l=267 mm or τ=1.3 ns). This is much shorter than the coherence length of the pump laser (l=23 m), allowing one to detect an entangled state when both photons pass through the same arm at their respective interferometers. At the same time, this is much longer than the coherence length of the single photons (l=2.47 mm), so there is no single-photon interference, and no phase-dependent variations in the single rates are observed. To compensate for birefringence effects in the arms of the interferometers (i.e. to stabilize polarization), Faraday mirrors (FM) are used. The photons are detected by single-photon InGaAs avalanche photodiodes (APD) (id Quantique, id201). The quantum efficiency is 10% and the dead time is 10 µs. The photodiodes are operated in the gated mode with a repetition frequency of 1 MHz and a gate width of 100 ns. The measured single count rates for the detectors at Satigny and Jussy were 5.0 and 4.1 kHz, including 0.7 and 1.1 kHz of dark counts, respectively. A trigger signal is sent from Geneva to both detectors so as to open the gates synchronously. This improves the chances of having a coincidence detection. Each time the single-photon APDs detect an event, a classical optical signal is sent back to Geneva, where it is detected by a p-i-n photodiode and then sent to a time-to-amplitude-converter (TAC) that takes one of the signals as start and the other as the stop, measuring the difference in their arrival times. Coincidences in the arrival times between events coming from different detectors indicate that those photons passed either through the short-short or the long-long paths in the interferometers. The other two non-interfering possibilities (photons that passed through different arms − short-long or long-short paths) are discarded using a discriminator with a narrow window (600 ps). The same fibers are used to send the trigger signal to the APDs and the detection signal back to Geneva. These are the classical channels shown in detail in Supplementary Figure 2. In the classical channels, the lasers at both ends of the fibers have different wavelengths (1550 nm and 1310 nm) and Wavelength Division Multiplexers (WDM) are used to separate the signals. These fibers are not the same ones that send the single-photons to the APDS (quantum channels in Supplementary Figure 1). During each run of the experiment we continuously monitored both the single count rates (as a check of the stability of the entire setup) and the coincidence count rate. The average coincidence rate was 33 coinc./min. and the number of accidental coincidences 2.5 coinc./min.

The phase scan To change the temperature and scan the phase in one of the interferometers, a voltage ramp is applied to its temperature controller. The temperature decreases regularly for several hours and is then heated quickly at the end of the ramp. This process was repeated during several days. The end of the cooling ramp stops the phase scan for several minutes making impossible to obtain arbitrarily long measurements of uninterrupted fringes. The bound for VQI is higher for shorter fringe periods T . To reduce the time T , one should increase the rate of the phase scan (more degrees per unit of time). Unfortunately, with a higher rate, the number of coincidences per minute diminishes, hence, the slope of the temperature ramp was adjusted so as to obtain a compromise period of T =360s.

The visibility fit Long measurements of interference fringes with short fringe periods are usually very difficult to fit continously because slight variations in the period of the fringes can hinder the whole fit. To calculate the visibility values shown in Figure 4 of the article, we used a sinusoidal fit with an approximate length of one and a half fringes. This fit was displaced one point at a time throughout the entire measurement, fitting all the fringes. In a few cases, a fit gave a visibility value that differed considerably from the values given by the fits preceding it and following it. Two consecutive fits only differ by one point and visibility only has meaning when at least one fringe is involved, therefore this could not be due to a change in the visibility but instead because of an artifact of the fitting program. Taking the median of the ten values (less than a fringe) around each point and doing this for all the points of the measurement, we obtained the visibility values for all the interference fringes.

nnn%eXkli\%Zfd&eXkli\ * 3 [f`1('%('*/&eXkli\'7121 JLGGC

Supplementary Discussion - Theory

An expression for βk(t) We denote by α the angle between the x-y equatorial plane and the direction A-B (see Figure 1). The unit vector eAB in the A-B axis has a fixed component along the z direction, and a component in the x-y plane that rotates with an angular velocity ω: eAB(t) = sin α ez + cos α exy(t). The speed v (or β = v/c) of the Earth frame in frame F can also be decomposed along the z axis and in the e eF x-y plane: β = β cos χ z + β sin χ xy. e eF By choosing the origin of time such that xy(t) · xy = cos ωt, one gets:

βk(t) = β · eAB(t) = β cos χ sin α + β sin χ cos α cos ωt . (1)

Upper bounds for |βk(t)| during a period of time T Consider, as a case study, the function f(t)= A − B cos ωt, for two parameters A, B ∈ R. For a given T > 0 (such that ωT < π), we want to find an interval IT of length T , during which we can upper bound f(t) by the smallest possible value. A rigorous analysis gives the following results, where three cases must be distinguished (see Supplementary Figure 3 for a schematic representation of the three cases):

2 ωT • If |A|≤|B| cos 2 , then there exists IT , such that for all t ∈ IT ,

2 ωT ωT |f(t)| ≤ B2 sin − A2 tan2 r 2 2 ωT ≤ B2 − A2 . (2) p 2

2 ωT 2 ωT • If |B| cos 2 ≤|A|≤|B| cos 4 , then there exists IT , such that for all t ∈ IT ,

|f(t)| ≤ |B|−|A| . (3)

2 ωT • If |A|≥|B| cos 4 , then there exists IT , such that for all t ∈ IT ,

ωT |f(t)| ≤ |A|−|B| cos . (4) 2

For A = β cos χ sin α and B = −β sin χ cos α, we get f(t) = βk(t), to which we can apply the previous results. The bound (2) being also valid in the second case above, we grouped the first two cases to simplify the discussion, and thus obtained the two cases mentioned in the text of the Letter. Note that, since in our experiment we have ωT ≪ 1, the second case above is actually negligible.

nnn%eXkli\%Zfd&eXkli\ + 4 Quantifying multipartite nonlocality

Jean-Daniel Bancal, Cyril Branciard, Nicolas Gisin, Stefano Pironio Group of Applied Physics, University of Geneva, 20 rue de l’Ecole-de-Medecine,´ CH-1211 Geneva 4, Switzerland (Dated: March 16, 2009) The nonlocal correlations of multipartite entangled states can be reproduced by a classical model if sufficiently many parties join together or if sufficiently many parties broadcast their measurement inputs. The maximal number m of groups and the minimal number k of broadcasting parties that allow for the reproduction of a given set of correlations quantify their multipartite nonlocal content. We show how upper-bounds on m and lower-bounds on k can be computed from the violation of the Mermin-Svetlichny inequalities. While n-partite GHZ states violate these inequalities maximally, we find that W states violate them only by a very small amount.

By performing local measurements on an n-partite entan- The first measure that we consider is based on classical gled state one obtains outcomes that may be non-local, in the communication models a` la Svetlichny, where the n parties are sense that they violate a Bell inequality [1]. According to to- divided into disjoint subgroups. Within each group the parties day’s physics this is the only way to produce non-local corre- are free to collaborate and communicate to each other, but are lations between space-like separated parties. Hence, violation not allowed to do so between distinct groups. The idea is that a of a Bell inequality is the signature of quantumness. given set of correlations contains more multipartite nonlocal- In the last decade, nonlocality has attracted a lot of atten- ity if more parties need to join to be able to reproduce these tion, mainly because of its counter-intuitive character and be- correlations (see Fig. 1). We compute the maximal value of cause of the many beautiful experimental demonstrations with the Mermin-Svetlichny (MS) expressions achieved by models entangled photons and ions [2, 3, 4]. More recently, it has where m groups are formed out of n parties (m = 2 is the case been realized that nonlocal correlations represent a resource considered in [9, 10, 11, 12]). Our bounds depend only on the different from entanglement. For instance, the security of number of groups, but not on how the parties are distributed Quantum Key Distribution (QKD) in the device-independent within each group (see Fig. 1). scenario requires the existence of nonlocal correlations be- tween the honest parties, very much in the spirit of Ekert’s QKD protocol [5, 6, 7, 8], and the only entanglement wit- nesses that do not rely on assumptions on the dimension of the Hilbert spaces are Bell inequalities, i.e., witnesses of non- locality [7]. n m While non-locality has been extensively studied in the bi- FIG. 1: Different groupings of = 4 parties into groups. Within each group, every party can communicate to any other party, as indi- partite ( ) and to a lesser extent in the tripartite ( ) n = 2 n = 3 cated by the arrows. a) If all parties join into one group (m = 1), case, the general n-partite case remains much unexplored. they can achieve any correlations. b) and c) If they split into m =2 A natural way to characterize nonlocality is to attempt to groups they can realize some non-local correlations but not all. d) If replicate it using models where some non-local interactions they are all separated (m = n), they can only reproduce local corre- (such as communication) are allowed between the parties. lations. A Bell-like test for a given number of groups could a priori Sveltichny [9] and followers [10, 11] have considered mod- depend on how the groups are formed, e.g., 2+2 in b) or 1+3 c), and els where arbitrary nonlocal interactions are allowed within on which party belongs to which group, but the tests that we present here depend only on the total number m of groups. two disjoint subsets of the parties, but where each subset is independent from the other one. They have written down a family of inequalities which are satisfied by any model of We introduce a second measure of multipartite nonlocal- ity based on models where k parties broadcast their measure- arXiv:0903.2715v1 [quant-ph] 16 Mar 2009 this form and which are violated by some n-partite entan- gled states. Hence, all parties must be somehow connected ment inputs to all others. In the measurement scenario that we among themselves in any model that reproduces the quantum consider in this work (restricted to “correlation functions”), a correlations. These results have been extended by Jones et communication model with k = n m broadcasting parties is − al, who have shown that an even more general class of mod- more powerful than a communication model with m disjoint els that involve communication between all the parties satisfy groups. Yet, we find that the bounds on the MS expressions Svetlichny’s inequality and thus cannot reproduce all quantum are identical in both cases. This shows, as observed in [12] correlations [12]. for the case m = 2, that the structure of the MS inequalities The idea behind the present paper is that in order to make allows to detect a stronger form of non-locality than the one further progress on the understanding of multipartite nonlo- induced by grouping. We will identify precisely the most gen- cality we should find ways to quantify it. Motivated by this eral communication model associated with this stronger form problem, we introduce two simple measures of multipartite of nonlocality. non-locality and present a series of Bell-type tests to evaluate By comparing the amount by which quantum states violate them. the MS inequalities with our bounds, we obtain constraints 2 on the allowed values of m and k to reproduce their nonlocal from this subset (this is obvious in the case of the broadcast- correlations. We carry out this analysis for different quantum ing model; in the case of the grouping model, simply pick states in the last part of this paper. one party in each of the m groups). As we will see shortly, m Definitions. We consider a Bell experiment involving n this feature limits in a fundamental way the value of the Sn parties which can each perform one out of two measurements. expressions. This leads us to also consider the most general

The outcomes of these measurements are written aj and aj′ communication model with this property. and can take the values 1. Letting M1 = a1, we define Restrained-subset: Among the n parties, there is a subset recursively the MS polynomials± [9, 11, 13, 14] as of •m parties, such that none of the n parties receive more than one input from this subset. The other parties are free to com- 1 1 municate as they wish. Note that the parties within the special Mn = (an + an′ )Mn 1 + (an an′ )Mn′ 1 (1) 2 − 2 − − subset of m parties cannot receive inputs from any other party 1 in the subset, as they already receive their own input. M ± = (Mn M ′ ) , (2) n √2 ± n Theorem. For all three models,

m (n m)/2 where M is obtained from M by exchanging all primed and S 2 − . (4) n′ n | n |≤ non-primed a ’s. The expressions M are equivalent under j n± Moreover this bound is thight, i.e., for each one of the three the exchange a ,a a ,a for any single party j, j j′ j′ j models there exist a strategy that yields Sm = 2(n m)/2 (in which corresponds{ to} a ↔ relabeling {− of} its inputs and outputs. n − the case of the grouping model, this is| true| for any possible The MS polynomials are symmetric under permutations of the grouping of the n parties into m groups). parties. Before proving our theorem, let us elaborate on some com- We interpret these polynomials as sums of expectation val- ments. First of all, for m = 2, the results obtained in [10, 11] ues by identifying each term of the form a ...a with the 1 n for the grouping model and in [12] for the restrained-subset correlation coefficient a ...a , which is the expectation 1 n model are recovered. value of the product of theh outputsi a ...a . The above poly- 1 n Note also that since we consider correlation functions only, nomials can thus be interpreted as Bell inequalities. Their lo- the grouping model is contained in the broadcasting model, cal bounds are known [11] to be M 1 and M √2, n n± which is itself contained in the restrained-subset model. The while the algebraic bounds (the| maximal| ≤ violation| achieved| ≤ second relationship is obvious. To see that the broadcasting by an arbitrary nonlocal model) are easily found to be Mn −1 model is stronger than the grouping model, note that within n n + 1 | |≤ 2⌊ 2 ⌋ and M ± 2⌊ 2 ⌋ 2 . | n |≤ each of the m groups of the grouping model, we can as- In the remainder of this paper, we shall be interested in the sume that all parties send their input to one singled-out party, following family of polynomials: who can then produce the correct output for the entire group. This is because we are interested here in correlation coeffi- M for n m even Sm = n − (3) cient a1 ...an where it is only the product of the individ- n M + for n m odd . ual outputsh thati matters and not each output individually. We ( n − thus have singled-out m parties (one for each group), that do Quantifying multipartite nonlocality through communica- not need to send any input, but receive inputs from other par- tion models. In a classical communication model, the n par- ties. This situation is clearly a special case of the broadcasting ties have access to shared randomness and are allowed to model. communicate their inputs to some subset of the other parties. The fact that the same bounds hold for the three models Given the information available to them, each party then pro- is not trivial. Actually, it is possible to construct inequalities duces a local output. We refer to [12] for a detailed descrip- that distinguish between these models. It thus appears to be a tion of such models and a general formalism to analyze them. special property of the MS expressions. Here, as explained in the introduction, we define two families Note that the restrained-subset model is optimal for the MS of models that depend on a parameter m (or k = n m) which expressions in the sense that any additional communication − quantify the extent of multipartite nonlocality. between the parties allows them to violate the bound (4). In- Grouping: The n parties are grouped into m subsets. deed, if there is a party that receives two inputs from the re- • Within each group, the parties are free to collaborate and com- strained subset, this party knows the inputs of n m + 2 municate to each other, but are not allowed to do so between parties (the two from the restrained subset plus the ones− from distinct groups. the n m unrestrained parties). It can thus reproduce the Broadcasting: Out of the n parties, k = n m of them correct− output for the corresponding group of n m + 2 par- • − can broadcast their input to all other parties. The remaining ties. Assuming conservatively that the remaining−m 2 parties m parties cannot communicate their input to any other party. produce each a local output that do not depend on the− input of Our objective now is to compute the maximal value of the any other parties, the n parties are thus separated into m 1 MS expressions achieved by both models. These two models groups. Since the bound (4) is tight, the parties can achieve− share the feature that there exist a special subset of m parties the bound for m 1 groups, which is strictly greater than the such that none of the n parties knows more than one input bound for a restrained− subset of m parties. 3

Note finally that the fact that the above bounds are tight for Let Gi,(i = 1, . . . , m) denote the m groups into which all three models implies that the bounds for any intermediary the n parties are distributed. For all group Gi having an model, in which for instance two parties join to form a group odd number ki of parties, there exists a strategy that the par- and another one broadcasts its input, can be readily computed, ties in Gi can use to reach both algebraic bounds MGi = (ki 1)/2 | | in this case it corresponds to k = 2 or m = n 2. M ′ = 2 − at the same time. This is because the − | Gi | Proof of (4). It is sufficient to prove (4) for our strongest (tight) algebraic bound for + is ki/2 and Eq. (2) tells us MGi 2 model, i.e., for the restrained-subset model. Since the MS in- that in order to achieve it both and must reach MGi MG′ i equalities are symmetric under permutations of the parties, we their algebraic limit. Similarly one can show that there ex- can assume without loss of generality that the parties 1, . . . , m ists a strategy for groups with even number of parties ki such + (k 1)/2 are the ones in the restrained subset. that − i . We shall thus associate MGi = MGi = 2 − m | | | | + Consider first the case where n m is even, for which Sn = M, M ′ polynomials to odd groups and M , M − to even − { } { } Mn. Applying twice the recursive definition (1), we get ones. Consider now two groups G , G , and their union G = 1 i j ij Mn = (anan 1Mn′ 2 + anan′ 1Mn 2 Gi Gj. From the definitions (1) and (2), one can derive the 2 − − − − (5) following∪ decompositions: + an′ an 1Mn 2 an′ an′ 1Mn′ 2) . − − − − − 1 ( ) ( ) MGij = MGi MGj + MG′ + MG′ MGj MG′ Using again twice (1) for Mn′ 2, we can replace Mn′ 2 as a 2 j i − j ( ) − n m − h    i function of M ′ in (5). Iterating this process − times, we 1 + + + n 4 2 − − − − MGij = MGi MGj + MGj + MGi MGj MGj end up with the following expression for Mn: 2 − 1 h    i 1 M ± = M ± MG + M ′ M ∓ MG M ′ . 1 Gij 2 Gi j Gj ∓ Gi j − Gj sn sm+1 sn...sm+1 (6) Mn = (n m)/2 an ...am+1 Mm , h    i 2 − sn,...,sm+1=0 Similar relations are also obtained for M ′ by using the fact X Gij ′ 0 1 that MG± = MG±. Now inserting in the above relations where ai = ai, ai = ai′ , and where, depending on the value ± sn,...,sm+1 the value attained by the strategies that we just mentioned for of (s ,...,s ), M is equal to one of the poly- n m+1 m the two initial
groups, one finds that that their combined strat- nomials M , M . m m′ (ki 1)/2 (kj 1)/2 {± ± } sn...sm+1 egy can achieve MGij = MG′ = 2 − 2 − or The MS polynomial Mm is a function of | | | ij | s ...s + (ki 1)/2 (kj 1)/2 n m+1 M = M − = 2 − 2 − , depending on which the outputs a1,a1′ ...,am,am′ , i.e, Mm = | Gij | | Gij | sn...sm+1 { } set of polynomials are associated to the two initial groups. Mm (a ,a′ ...,a ,a′ ). Among the parties m + 1 1 m m { 1,...,n there exists a (possibly empty) subset j1,...,jl Iterating this construction by joining groups successively 2 } { } m (ki 1)/2 that do not receive any input from parties 2, . . . , m, but pos- by 2, we find that Mn = i=1 2 − when there is an | | m even number of even groups, and M + = 2(ki 1)/2 sibly from party 1. Define two effective outputs A1 and A1′ n i=1 − sj1 sjl sj1 sjl Q | | as A1 = a1a ...a and A′ = a′ a ...a . There also otherwise. Since the parity of the number of even groups is j1 jl 1 1 j1 jl Q exist similar disjoint subsets for parties 2, . . . , m, for which the same as the parity of n m, this implies that their exists a − m (ki 1)/2 (n m)/2  we also define effective outputs . Then strategy that achieves Sn = 2 − = 2 − . A2,A2′ ,...,Am,Am′ | | i=1 we can write Nonlocality of quantum states. Suppose that one observes Qm (n m)/2 a violation of the inequality Sn 2 − . One can then asn ...asm+1 M sn...sm+1 | | ≤ n m+1 m (7) conclude that in order to reproduce the corresponding nonlo- sn...sm+1 = Mm (A1,A1′ ...,Am,Am′ ). cal correlations in the framework of our communication mod- els, the parties cannot be separated in more than m 1 groups, sn...sm+1 − Formally, Mm (A1,A1′ ...,Am,Am′ ) is a MS polyno- or that at least k +1= n m + 1 parties must broadcast their − m mial that involves m parties isolated from each other, since input. Thus, the above bounds on Sn allow us to give a bound the outputs Aj,Aj′ of party j do not depend on the input on the multipartite character of the observed nonlocal correla- of any of the other m 1 parties. It can therefore not ex- tions (an upper bound on m, or a lower bound on k). − ceed its local bound 1. Inserting this bound in (6), we find Here we discuss the violation of the inequalities (4) for n- (n m)/2 Mn 2 − . partite partially entangled GHZ and W states. Partially entan- | |≤ For the case where n m is odd, we have to consider the gled GHZ states are defined as m +− polynomials Sn = Mn . Using the definitions (1) and (2), + one can show that Mn has a similar decomposition than Mn GHZθ = cos θ 00...0 + sin θ 11...1 . (8) + | i | i | i in (6). The same reasoning as before then leads to Mn (n m)/2 | | ≤ 2 − .  It was conjectured in [15] that the maximal value of Mn that (n 1)/2 Proof of the tightness of (4). To prove that (4) is a tight these states could achieve is Mn = max 1, 2 − sin 2θ . bound, it is sufficient to prove that it can be reached by our Numerical optimizations induce us to conjecture{ that similarly} + (n 1)/2 weaker communication model, ie the grouping model (for any Mn = max √2, 2 − sin 2θ . Thus when the values of + { } possible distribution of the n parties into m groups). Mn, Mn exceed the local bounds, their maximal violations 4

+ M M + FIG. 2: Maximal values of the expressions Mn and Mn for partially FIG. 3: Maximal values of n (solid line) and n (dashed line) for entangled GHZ states for 3 n 6. The dots correspond to the n-partite W states. The curves were obtained by a general numerical value given by our numerical≤ optimizations≤ and the solid lines rep- optimization for n 9, and under the hypothesis that all parties use − + n 1 ≤ n M M 2 θ identical measurement settings for 10 19. The asymptotic resent the conjectured violation n = n = 2 sin 2 (valid ≤ ≤ M M + values for n computed as explained in the text are also shown. only above 1 for n and √2 for n ). →∞

(n 1)/2 n 1 + are given by 2 − sin 2θ (see Fig 2). For maximally en- Since Sn− = Mn > 1 for n 3, letting one party broacast tangled GHZ states (θ = π/4), this is known to be the maxi- his input is not sufficient to reproduce≥ the correlations of the mal violation allowed by quantum mechanics. Upon compar- W state. However, we cannot reach the same conclusion for ison with the bound (4), we conclude that all n-partite GHZ k = n m 2 broadcasting parties since the criterion (4) states with θ > π/8 are maximally non-local according to our is not violated− ≥ in this case. Similarly, for the grouping model criterion (i.e., all parties must be grouped together or n 1 it is not sufficient that two parties join together (so that the n − parties must broadcast their input to reproduce their correla- parties form n 1 groups) to simulate a W state, but we find tions). Less entangled GHZ states, on the other hand, cannot no violation if they− are separated in less than n 1 groups. − be simulated if the parties are separated in more than m 1 Conclusion. We have proposed in this paper two simple − groups or if fewer than k +1= n m + 1 parties broadcast measures of multipartite nonlocality and have introduced a se- − their inputs whenever θ > θc with ries of Bell tests to evaluate them. This represents a primary m−1 step towards a quantitative understanding of quantum nonlo- 2 (9) sin 2θc = 2− . cality for an arbitrary number n of parties. Interestingly, θc is the same for all n. While GHZ states exhibit a strong form of multipartite non- Consider now the W state locality according to our criterion, we have found that W 1 states violate our inequalities only for small values of k. This W = ( 10 ... 0 + 01 ... 0 + ... + 0 ... 01 ) . | ni √n | i | i | i leaves open the possibility that a simple model where only a few parties broadcast their inputs or join together is sufficient Numerical optimizations suggest that the maximal values of to reproduce the correlations of W states. Or, it might actu- the MS polynomials for these states are upper-bounded by a ally be that other inequalities or other measures are necessary small constant for all n (see Fig. 3). To convince ourselves to quantify the nonlocality of W states. Finding which one that this is indeed the case, we analyzed analytically the case of these possibilities is the correct one is an interesting prob- where all pairs of measurement settings are the same for all lem for future research. It would also be of interest to look parties. This is justified by the results of our numerical op- for other measures of multipartite nonlocality, based on other timizations up to n = 9, for which the optimal measure- nonlocal models than the ones considered here. ment settings can always be of this form. We thus introduce Finally, let us stress that the criterions we presented in this for all n parties two measurement operators A0 and A1 rep- paper can be tested experimentally. It would thus be worth (re- resented by vectors ~ai = (sin θi cos φi, sin θi sin φi, cos θi). )considering experiments on multipartite nonlocality in view One can show that as n increases, the maximal value of Mn of our results. or M + can be reached for both parameters θ tending| to 0,| | n | i We acknowledge support by the Swiss NCCR Quantum and φi = 0. Assuming a power law for θi(n), one finds that Photonics and the ERC Advanced Grant QORE. ki it should be given by θi √n at the maximum. After op- ∼ + timization of the constants k0 and k1 for both Mn and Mn , we found that the asymptotic maximal values of the MS poly- nomials (under our assumptions, which we believe are not re- strictive) are [1] J. Bell, Speakable and unspeakable in quantum mechanics (Cambridge University Press, 1987). + 2 [2] G. Weihs et al, Phys. Rev. Lett. 81, 5039 (1998). M 1.62, M = 2 1.72 . (10) [3] W. Tittel et al, Phys. Rev. Lett. 81, 3563 (1998). | ∞|≃ | ∞| r e ≃ 5

[4] D. N. Matsukevich et al, Phys. Rev. Lett. 100, 150404 (2008). [5] A. K. Ekert, Phys. Rev. Lett. 67, 661 (1991). [6] J. Barrett, L. Hardy, and A. Kent, Phys. Rev. Lett. 95, 010503 (2005). [7] A. Acin et al, Phys. Rev. Lett. 98, 230501 (2007). [8] L. Masanes, arxiv:0807.2158 (2008). [9] G. Svetlichny, Phys. Rev. D 35, 3066 (1987). [10] M. Seevinck and G. Svetlichny, Phys. Rev. Lett. 89, 060401 (2002). [11] D. Collins et al, Phys. Rev. Lett. 88, 170405 (2002). [12] N. S. Jones, N. Linden, and S. Massar, Phys. Rev. A 71, 042329 (2005). [13] N. D. Mermin, Phys. Rev. Lett. 65, 1838 (1990). [14] R. F. Werner and M. M. Wolf, Phys. Rev. A 64, 032112 (2001). [15] V. Scarani and N. Gisin, J. Phys. A: Math. Gen. 34, 6043 (2001).

PHYSICAL REVIEW A 78, 052110 ͑2008͒

Possible entanglement detection with the naked eye

Nicolas Brunner,* Cyril Branciard, and Nicolas Gisin Group of Applied Physics, University of Geneva, CH-1211 Geneva 4, Switzerland ͑Received 6 February 2008; revised manuscript received 18 September 2008; published 12 November 2008͒ The human eye can detect optical signals containing only a few photons. We investigate the possibility to demonstrate entanglement with such biological detectors. While one person could not detect entanglement by simply observing photons, we discuss the possibility for several observers to demonstrate entanglement in a Bell-type experiment, in which standard detectors are replaced by human eyes. Using a toy model for biologi- cal detectors that captures their main characteristic, namely, a detection threshold, we show that Bell inequali- ties can be violated, thus demonstrating entanglement. Remarkably, when the response function of the detector is close to a step function, quantum nonlocality can be demonstrated without any further assumptions. For smoother response functions, as for the human eye, postselection is required.

DOI: 10.1103/PhysRevA.78.052110 PACS number͑s͒: 03.65.Ud, 03.67.Mn, 42.50.Ct, 87.19.lt

I. INTRODUCTION replaced by human eyes ͑see Fig. 1͒, or more generally, by biological detectors. In case the collected data would lead to The human eye is an extraordinary light sensitive detec- the violation of a Bell’s inequality ͓8͔, one could argue that tor. It can easily stand a comparison to today’s best man- entanglement has been “seen.” Let us stress that, though such made detectors ͓1͔. Already back in the 1940s, experiments an experiment would probably not lead to a better under- on the sensibility of the human eye to weak optical signals standing of quantum nonlocality itself, it would definitely be were conducted ͓2͔, leading to the conclusion that rod pho- fascinating. toreceptors can detect a very small number of photons, typi- The main difference between man-made photon counters cally less than ten during an integration time of about 300 ms and the human eye is a detection threshold. To test whether a ͓3͔. To date, this prediction has been confirmed by many detector is able to detect single photons, one usually checks experiments ͓1͔. Though most specialists still disagree on the that the response of this detector to very low intensities is exact number of photons required to trigger a neural re- linear. Indeed, this is not the case for the eye, where the sponse, it seems to be now commonly accepted that there is efficiency of detection plotted as a function of the number of a threshold number of incident photons, below which no incoming photons is a typical S-shaped curve ͑see ͓1͔͒. In neural signal is sent to the brain. This assumption is sup- this paper we report a preliminary theoretical study of Bell ported by the good agreement between theoretical models tests with threshold detectors. Our goal is to provide a good and experimental data from behavioral experiments. Our vi- understanding of Bell experiments with a toy model for the sual system works basically as follows: first, a photon is detector that captures the main characteristic of the human absorbed by the rod, which then amplifies the signal with eye. some very efficient chemical reactions; then, some postpro- The presentation is organized as follows. After a general cessing ͑basically a thresholding͒ is performed on the signals description of the scenario we consider ͑Sec. II͒, we first incoming from a group of 20–100 rods ͓4͔; finally, a neural focus on detectors with a perfect threshold, i.e., no detection signal is eventually sent to the brain. The role of the thresh- below the threshold and perfect detection above ͑Sec. III͒. old is possibly to maintain a very low dark noise in the visual We show that, even for a Poissonian source, the threshold is process, in particular, to get rid of electrical noise originating not a restriction for demonstrating quantum nonlocality; in from the individual rods ͓4,5͔. other words, Bell inequalities can be violated ͑in the strict In quantum information, experiments carried out on pho- sense͒ with such detectors. Then we smoothed the threshold, tons are now routinely performed for demonstrating fascinat- in order to make our detector model closer to the human eye ing quantum features, such as entanglement and quantum ͑Sec. IV͒. We show that, except for close-to-perfect thresh- nonlocality ͓6,7͔. In this context, and considering the amaz- olds, one must then perform postselection in order to obtain ing performances of the human eye, it is quite intriguing to a violation of a Bell inequality ͑Sec. V͒. ask whether one could demonstrate entanglement without the help of man-made detectors, but using only naked eyes. It II. GENERAL FRAMEWORK should be reminded at this point that entanglement is usually Let us consider a typical Bell test scenario. A source sends demonstrated in Bell-type experiments ͑where correlations pairs of entangled particles ͑each pair being in state ␳͒ to two between two distant parties are measured͒, and not via single “ Q Source shot measurements. Therefore one person cannot expect to +” Alice Bob “+” see entanglement directly. Nevertheless, one could perform a Bell experiment in which man-made photon detectors are “-” “-”

FIG. 1. ͑Color online͒ Bell experiments with human *[email protected] detectors.

1050-2947/2008/78͑5͒/052110͑5͒ 052110-1 ©2008 The American Physical Society BRUNNER, BRANCIARD, AND GISIN PHYSICAL REVIEW A 78, 052110 ͑2008͒

distant observers, Alice and Bob, who perform measure- 0.2 ments on their respective particles. Here, Alice and Bob 0.18 (a) choose between two different measurement settings A ,A N=1 1 2 0.16 and B1 ,B2, each of these measurements giving a binary result ␣,␤෈͕+,−͖. In this case the relevant Bell inequality is the H 0.14 fC0.12 famous Clauser-Horne-Shimony-Holt ͑CHSH͒ inequality N=2 ͓9͔, which we will express here in the Clauser-Horne ͑CH͒ 0.1 ͓10͔ form, 0.08 N=3

Violation o N = 10 0.06 N=4 N=5 CH ϵ P++͑A1B1͒ + P++͑A1B2͒ + P++͑A2B1͒ N = 20 0.04 N=7 N = 100 − P++͑A2B2͒ − P+͑A1͒ − P+͑B1͒ ഛ 0, ͑1͒ 0.02 0 where P+͑AiBj͒ϵP͑++͉AiBj͒ is the probability that ␣=␤ 1 N = 100 =+ when Alice ͑Bob͒ has performed measurement Ai͑Bj͒. N = 20 Note that under the hypothesis of no signaling, the CH and N = 10 0.95 (b) N=7 CHSH inequalities are strictly equivalent ͓11͔. N=5 N=4 0.9 N=3 III. PERFECT THRESHOLD N=2 0.85 Now let us bring the threshold detector into the picture. We start by considering a detector with a perfect threshold at 0.8 N=1

N photons; optical signals containing at least N photons are Resistance to noise w always detected ͑note that our detector is not photon number 0.75 resolving͒, while signals with less than N photons are never detected. The response function of our detector is simply a 0.7 0 0.05 0.1 0.15 0.2 0.25 step function, the step occurring at N photons.
/ First, it is clear that the number of emitted pairs M has to be larger or equal than the threshold N, otherwise the detec- FIG. 2. ͑Color online͒ Violation of the CH inequality ͑a͒ and tors will never fire. At this point it should be reminded that resistance to noise w ͑b͒ vs the degree of entanglement of the state, Bell inequalities are usually considered in a situation where for different threshold values N. Remarkably the inequality is vio- the source emits a single pair of entangled particles at a time. lated for any value of the threshold N. Nevertheless, the violation of Bell inequalities can also be optimization is performed over the four measurement set- studied in the multipair scenario ͓12–14͔; of particular inter- tings. The results are presented in Fig. 2͑a͒, for different est are experimental situations where single entangled pairs values of the threshold N. Surprisingly, the inequality can be cannot be individually created or measured, for instance, in violated for any N; this can be shown analytically for the many-body systems ͓14͔. Nevertheless, such studies require maximally entangled state ͑see ͓15͔͒. For large values of N, a careful analysis, in particular, when postselection is per- this is quite astonishing, since the probabilities ͑2͒ are very formed, as we shall see in Sec. V. small; most events do not lead to a click in the ϩ detector. To gain some intuition, let us start with the simplest situ- Let us stress that no particular assumptions ͑such as fair- ation M =N: the source emits exactly the threshold number of sampling͒ are required here, since no events have been dis- pairs. In this case a detector clicks whenever all photons take carded. Another astonishing feature is that, for increasing the same output of the polarizing beam splitter. Thus the values of N, the state that achieves the largest violation is probabilities entering the CH inequality are simply given by less and less entangled. Note that in general, the relation between entanglement and nonlocality is not well under- P ͑A ͒ = p ͑A ͒N, P ͑A B ͒ = p ͑A B ͒N, ͑2͒ + i + i ++ i j ++ i j stood, but hints suggest that a partially entangled state con- +  + where p++͑AiBj͒=tr͓͑Ai Bj ͔␳͒ is the quantum joint prob- tains more nonlocality than maximally entangled ones ability for a single pair to give a click in the “ϩ” detector on ͓16–18͔. Alice’s and on Bob’s side, and similarly for the marginal Next we compute the resistance to noise, defined as the probability p ͑Ai͒. It should be stressed that, though the de- maximal amount ͑1−w͒ of white noise that can be added to + 1 tectors are supposed to be perfectly efficient, there are many the state ͉␺͘ such that the global state ␳=w͉␺͗͘␺͉+͑1−w͒ 4 inconclusive events “‡” ͑not giving any click in the ϩ de- still violates the Bell inequality. The optimization is per- tector or in the Ϫ detector͒, because of the threshold. Since formed as above. We find that the more entangled the state is, we consider only the outcome ϩ in the CH inequality, one the more robust it is, though for Nജ2 the maximal violation may relabel the outcomes in the following way: ϩ → ϩ and is not obtained for the maximally entangled state ͑see Fig. 2͒. −,‡ →0. Then, the experiment still provides binary out- So the close relation that exists, in the standard case N=1, comes, ϩ or 0, but no events have been discarded. between the amount of violation and the resistance to noise, Inserting probabilities ͑2͒ into the CH inequality, we com- does not hold here anymore ͓19͔. Indeed, in the perspective pute numerically the maximal amount of violation for pure of experiments, the resistance to noise is the relevant figure entangled states of two qubits ͉␺͘=cos ␪͉00͘+sin ␪͉11͘. The of merit.

052110-2 POSSIBLE ENTANGLEMENT DETECTION WITH THE … PHYSICAL REVIEW A 78, 052110 ͑2008͒

1 1 N = 4 (majority vote) 0.99 0.99 N=3,N=5 0.98 0.98 N=2,N=6

N=1,N=7 0.97 =10 w 0.97 se i

=9 o

0.96 n

0.08 0.96 o 0.04 t N = 4 (majority vote) 0.95 =9 ce N=3,N=5 0.95 n a N=2,N=6 =10 t 0.94 =7 s  i

N=1,N=7 0.94 es 0.93 R Resistance to noise w =3  =3

Violation of CH =7 0.93 0.92 Violation of CH 0 0 0 0.1
/ 0.2 0.25 0 0.1
/ 0.2 0.25 0 0.05 0.1 0.15 0.2 0.25 0 0.05 0.1 0.15 0.2 0.25
/
/

FIG. 3. ͑Color online͒ Violation of the CH inequality ͑inset͒ and FIG. 4. ͑Color online͒ Violation of the CH inequality ͑inset͒ and the resistance to noise w ͑figure͒ vs the degree of entanglement of resistance to noise w ͑figure͒ vs the degree of entanglement of the the state, for different thresholds N. The source emits a fixed num- state, for a Poissonian source. The threshold is fixed to N=5, while ber of pairs M =7. The optimal threshold, N=4, corresponds to a the mean number of emitted pairs ␮ is varied. majority vote ͑see the text͒.

͑␮͒ ͑M͒ P++ = ͚ pMP++ , ͑4͒ Now let us consider the case where the source emits M M ജN entangled pairs, and the detector is characterized by a ͑M͒ ͑M͒ response function ⌰͑x͒, where x is the number of incident with P+ and P++ defined in Eqs. ͑3͒. Numerical optimiza- photons. The probabilities ͑2͒ now read tions show that the CH inequality can be violated. Figure 4 shows the results for a detector with a perfect threshold at n+ n− ͑M͒ p+ p− N=5. The largest violation is obtained for ␮Ϸ9.05Ϸ2N−1, P+ = ͚ ⌰͑n+͒M! , n +n =M n+! n−! so basically when the threshold corresponds to a majority + − ␮+1 vote on the mean number of pairs, NϷ 2 . The resistance to n␣␤ noise has a very different dependance on ␮ ͑see Fig. 4͒. p␣␤ P͑M͒ = ⌰͑nA͒⌰͑nB͒M! ͑3͒ Smaller values of ␮ are more robust against noise. Intuitively ++ ͚ + + ͟ ͩ n !ͪ ͚n␣␤=M ␣,␤=Ϯ ␣␤ this can be understood as follows. The term with M =N pairs is the most robust against noise, as discussed previously. For where the indices n␣,␤ represent the numbers of pairs that take the outputs ␣ on Alice’s side and ␤ on Bob’s side, and small values of ␮, more weight is given to this term ͑com- A B pared to terms with more pairs͒, thus leading to a stronger n+ ϵn+++n+− while n+ ϵn+++n−+. For now, we still consider detectors with a perfect thresh- resistance to noise. old, i.e., ⌰͑xϽN͒=0 and ⌰͑xജN͒=1. Again, the amount of violation of the CH inequality as well as the resistance to IV. SMOOTH THRESHOLD noise can be computed numerically. We have performed op- timization for Nഛ10 and found that the CH inequality can We just showed that a threshold is not a limiting factor for still be violated but that the resistance to noise decreases for demonstrating quantum nonlocality, and consequently, en- increasing values of M. In Fig. 3 we present the results in a tanglement. However, the response function of real biologi- slightly different way: for a fixed number of emitted pairs cal detectors, such as the human eye, is not a perfect thresh- ͑M =7͒, we compute the violation of the CH inequality and old but a smooth curve. Typically, for a number of photons the resistance to noise for different thresholds N. The optimal near the threshold, the efficiency is low; for instance, ϳ20% M+1 for 60 incoming photons ͑see ͓1͔ for details͒, here the thresh- threshold is found to be N=⌊ 2 ⌋. Note that if we had photon counting detectors, then this threshold would simply corre- old being the minimum number of photons that can be de- tected with a strictly positive probability. Let us also stress spond to a majority vote ͓14͔: if n+ ജn−, then the result is ϩ, otherwise it is Ϫ. It should also be pointed out that detectors that the efficiency of the human eye does strongly depend on with threshold N and M −N+1 are equivalent, which can be the number of incoming photons. Therefore the probability seen by inverting the outputs ϩ and Ϫ ͓20͔. of seeing cannot be characterized by a single parameter ͑for Next we consider a Poissonian source. The probability of instance, the efficiency for a single photon͒ as is the case for ␮M linear detectors. One must consider the eye’s ͑S-shaped͒ re- emitting M pairs is p =e−␮ , where ␮ is the mean number M M! sponse function. of emitted pairs. Again we compute the probabilities entering We have checked that, for smooth thresholds, the demon- the CH inequality as follows: stration of quantum nonlocality in the strict sense is compro- ͑␮͒ ͑M͒ mised, except if the response function is close to a step func- P+ = ͚ pMP+ , M tion. Therefore, in the case of a response function with a

052110-3 BRUNNER, BRANCIARD, AND GISIN PHYSICAL REVIEW A 78, 052110 ͑2008͒ smooth threshold, for instance, in the case of the human eye, 4 L(4) postselection must be performed. 3.9

V. POSTSELECTION 3.8 L(3) We postselect only the events leading to a conclusive re- 3.7 sult on both sides, i.e., when one detector on Alice’s side and one detector on Bob’s side fire. In this case probabilities 3.6 CHSH must be renormalized such that ¯P͑␣␤͉ij͒ 3.5 = P͑␣␤͉AiBj͒/͚␣,␤=ϮP͑␣␤͉AiBj͒. Since we postselect coin- cidences, it is now more convenient to express the CHSH 3.4 inequality in its standard form ͑in which only correlation 3.3 terms appear͒ L(2) 3.2 S ϵ͉E͑A ,B ͒ + E͑A ,B ͒ + E͑A ,B ͒ − E͑A ,B ͉͒ ഛ L, 1 1 1 2 2 1 2 2 0 0.05 0.1 0.15 0.2 0.25 θ π ͑5͒ / FIG. 5. ͑Color online͒ Violation of the CHSH inequality for where E͑A ,B ͒=͚ ␣␤¯P͑␣␤͉A B ͒, and L is the local i j ␣,␤=Ϯ i j different thresholds N. The local bound is a function of N ͑see the bound ͑for a single pair L=2͒. Let us stress already that text͒. Violations are obtained for a source emitting exactly N pairs because of the postselection, the local bound L for multipairs ͑solid blue lines͒ as well as for a Poissonian source with ␮=0.1 will be modified ͑see below͒. ͑dotted green lines͒. Note also that the set of pure entangled states The detector now has a smooth threshold at N photons: that violate the CHSH inequality becomes smaller for increasing N. below the threshold the efficiency is zero ⌰͑xϽN͒=0; at the The settings are optimized for all states. threshold the efficiency is limited to 0Ͻ⌰͑x=N͒Ͻ1, and the efficiency above the threshold is, for now, arbitrary. We start We proceed as follows. We perform a numerical optimi- again with the case where the source sends exactly N pairs. zation over any local probability distribution for two binary The source is supposed to send multiple copies of the same settings on each side. This probability distribution is of the state ␳. For the singlet state ͑␳=͉␺−͗͘␺−͉͒, one has that ជ ជ form of N copies of a ͑two-input–two-output͒ local probabil- p ͑␣␤͉aជb͒=͑1−␣␤aជ ·b͒/4; here measurement settings are ␺− ity distribution, because of our hypothesis. The largest value written as vectors on the Bloch sphere. This leads to of S͑N͒ is obtained for the following probability distribution

ជ N ជ N ͓22͔: ជ ͑1−aជ · b͒ − ͑1+aជ · b͒ E͑N͒ aជ,b = . 6 ͑ ͒ ជ ជ ͑ ͒ p͑␣ = ␤͉ij͒ =3/8, p͑␣
␤͉ij͒ =1/8, if i = 1 or j =1, ͑1−aជ · b͒N + ͑1+aជ · b͒N

These correlations are stronger than those of quantum phys- p͑␣ = ␤͉ij͒ =1/8, p͑␣
␤͉ij͒ =3/8, if i = j =2, ͑8͒ ics for a single pair. This is a consequence of the postselec- tion we performed. Note also, that our postselection depends leading to the local bound ͑in general͒ on the measurement settings, therefore the local bound L of the CHSH inequality must be modified accord- 3N −1 L͑N͒ =4 . ͑9͒ ingly. Inserting the correlators ͑6͒ into the CHSH inequality, ͫ 3N +1ͬ one gets an expression that is maximized by the usual opti- mal settings, i.e., A =␴ , A =␴ , B = ␴ +␴ /ͱ2, and B One can check that S͑N͒ ϾL͑N͒ for any N ͑see Fig. 5͒. 1 z 2 x 1 ͑ z x͒ 2 ␺− =͑␴z −␴x͒/ͱ2. In this case one gets Remarkably, probability distribution ͑8͒ is obtained quan- tum mechanically by performing the optimal measurements ͑1+1/ͱ2͒N − ͑1−1/ͱ2͒N S͑N͒ =4 . ͑7͒ ͑mentioned above͒ on the Werner state ͓23͔͓␳w ␺− /ͱ N /ͱ N 1/ 1 ͑1+1 2͒ + ͑1−1 2͒ =w͉␺−͗͘␺− ͉ +͑1−w͒ 4͔ for w= ͱ2 , i.e., when ␳w ceases to violate the CHSH inequality. Thus, the resistance to noise for For Nജ2, S͑N͒ exceeds the Tsirelson bound ͑2ͱ2͓͒21͔: For ␺− the singlet state is independent of N. It would be interesting example, S͑2͒ =8ͱ2/3Ϸ3.77. In fact Eq. ͑7͒ tends to the al- ␺− to see if a strictly lower bound exists for separable states. ͑N͒ gebraic limit of the CHSH inequality, lim → S =4. Note, however, that the bound 9 is valid only under the N ϱ ␺− ͑ ͒ Thus we find that the violation of the CHSH inequality for assumption that the source sends multiple copies of the same the singlet state increases with the threshold N. However, in state ␳. In case this assumption breaks, the local bound order to conclude for the presence of entanglement one still reaches the algebraic limit of CHSH inequality ͑L=4͒, thus has to find the bound for separable states. For N=1 this removing any hope of demonstrating entanglement. More bound is indeed equal to the local limit of the inequality ͑L precisely, there is a local model giving L=4 for all Nജ2. =2͒. In the case Nജ2, the local bound will be increased Whether this bound can be reached by a separable two-qubit because of the postselection, as intuition suggests. Next we state is unclear. We stress that this was not the case for per- compute this local bound, which is indeed also a bound for fect thresholds; there no assumption had to be made on the any separable state of the form ␳N. source.

052110-4 POSSIBLE ENTANGLEMENT DETECTION WITH THE … PHYSICAL REVIEW A 78, 052110 ͑2008͒

Curiously, no violation is obtained when the source sends for violating Bell inequalities. In particular, we showed that a fixed number of pairs larger than the threshold ͑M ϾN͒ close to perfect threshold detectors can be used to test quan- ͓24͔. However, for a Poissonian source, the CHSH inequality tum nonlocality without the need of any supplementary as- can be violated for small values of ␮, the mean number of sumption, such as fair sampling. For detectors with a emitted pairs ͑see Fig. 5͒. Intuitively, if ␮ӶN, the term with smoother response function, one must perform postselection, N pairs is dominant. When ␮→0, the curve M =N is recov- but Bell inequalities can still be violated, thus highlighting ered. Note that for a Poissonian source, the local bound must the presence of entanglement under reasonable assumptions. be defined carefully, since the number of emitted pairs var- These results represent a first encouraging step, since there is ies. However, when ␮ӶN it is reasonable to consider the apparently no fundamental restriction to detect entanglement local bound L͑N͒. with threshold detectors. Nevertheless, the next crucial step will be to estimate the feasibility of such an experiment with realistic parameters. VI. CONCLUSION ACKNOWLEDGMENTS Amazed by the performances of the human eye, which can detect a few photons, we investigated whether biological The authors thank J.D. Bancal, V. Scarani, and C. Simon detectors might replace man-made detectors in Bell-type ex- for discussions. We aknowledge financial support from the periments. We showed that the main characteristic of these EU project QAP ͑Grant No. IST-FET FP6-015848͒ and detectors, namely, a detection threshold, is not a restriction Swiss NCCR Quantum Photonics.

͓1͔ F. Rieke and D. A. Baylor, Rev. Mod. Phys. 70, 1027 ͑1998͒. ͓17͔ A. Cabello and J.-A. Larsson, Phys. Rev. Lett. 98, 220402 ͓2͔ S. Hecht, S. Schlaer, and M. Pirenne, J. Gen. Physiol. 25, 819 ͑2007͒. ͑1942͒. ͓18͔ N. Brunner, N. Gisin, V. Scarani, and C. Simon, Phys. Rev. ͓3͔ H. B. Barlow, J. Opt. Soc. Am. 46, 634 ͑1956͒. Lett. 98, 220403 ͑2007͒. 22 ͓4͔ H. Okawa and A. P. Sampath, Physiology , 279 ͑2007͒. ͓19͔ In the case N=1 the resistance to noise w can be expressed as ͓5͔ G. D. Field, A. P. Sampath, and F. Rieke, Annu. Rev. Physiol. L−M a function of the amount of violation Q:w= , where Q 67, 491 ͑2005͒. Q−M =tr͑B͉␺͗͘␺͉͒, M=tr͑B͒/4, and B is the Bell operator and L is ͓6͔ A. Aspect, Nature ͑London͒ 398, 189 ͑1999͒. ͓7͔ R. Prevedel, M. Aspelmeyer, C. Brukner, T. Jennewein, and A. the local bound of the inequality. Zeilinger, J. Opt. Soc. Am. B 24, 241 ͑2007͒. ͓20͔ For a threshold M −N+1, having a click in detector Ϫ implies ͓8͔ J. Bell, Physics ͑Long Island City, N.Y.͒ 1, 195 ͑1964͒. that n− ജM −N+1. We suppose that in case both detectors fire, ͓9͔ J. F. Clauser, M. A. Horne, A. Shimony, and R. A. Holt, Phys. the result ϩ is outputted. Thus, to get output Ϫ, one must add Rev. Lett. 23, 880 ͑1969͒. the constraint that n+ ϽM −N+1, which implies that n− ജN, ͓10͔ J. F. Clauser and M. A. Horne, Phys. Rev. D 10, 526 ͑1974͒. since n+ +n− =M. So models with thresholds N and M −N+1 ͓11͔ D. Collins and N. Gisin, J. Phys. A 37, 1775 ͑2004͒. are made equivalent by inverting the outputs ϩ and Ϫ. This ͓12͔ P. D. Drummond, Phys. Rev. Lett. 50, 1407 ͑1983͒. also shows that the double click events play no role. If in case ͓13͔ M. D. Reid, W. J. Munro, and F. De Martini, Phys. Rev. A 66, of a double click, the outcome ϩ is given, then considering the 033801 ͑2002͒. output Ϫ provides a model without the double click. ͓14͔ J.-D. Bancal, C. Branciard, N. Brunner, N. Gisin, S. Popescu, ͓21͔ B. S. Tsirelson, Hadronic J. Suppl. 8, 329 ͑1993͒. and C. Simon, e-print arXiv:0810.0942. ͓22͔ We conjecture that Eq. ͑8͒ gives the largest violation of the ͓15͔ Consider, for example, the maximally entangled state, and the CHSH inequality ͑we checked it for small values of N͒, since settings A1 =␴z, A2 =cos͑2␸͒␴z +sin͑2␸͒␴x, B1 =cos͑␸͒␴z it is obtained by an equal mixture of the eight deterministic +sin͑␸͒␴x, and B2 =cos͑␸͒␴z −sin͑␸͒␴x. One gets CH strategies saturating the CHSH inequality; geometrically, it sits 3N ␸2 Ͼ0 when ␸→0. Thus the CH inequality can be vio- in the center of the CHSH inequality facet. ϳ 2N+1 lated for all N, with ␸ small enough. ͓23͔ R. F. Werner, Phys. Rev. A 40, 4277 ͑1989͒. ͓16͔ A. A. Méthot and V. Scarani, Quantum Inf. Comput. 7, 157 ͓24͔ Here we have considered the following response function: ͑2007͒. ⌰͑xϽN͒=0, ⌰͑x=N͒=␩Ͼ0, and ⌰͑xϾN͒=1.

052110-5

arXiv:0902.2896v1 [quant-ph] 17 Feb 2009 inb h y as detec- eye a the to by corresponding tion an operator positive as the define losses modeled we significant is very very eye by theoretical preceded The evidence tector following experimental the [9]. the on well describes based which are Ref. results model with Our starting detail significant [8]. in studied been have stimulated detectors. by human-eye realization with the cloning experiments for that quantum approach promising of show very we a single is Here a emission cre- from experimental starting [7]. clones the of allowed photon thousands recently of emission has tens 6] of stimulated ation 5, via 4, states 3, photon [2, Quantum single ask [1]. of to detectors optics cloning as quantum is eyes perform approach human to with possible possible experiments be One might it life. whether level, everyday macroscopic to the bring- to and of closer ways various phenomena explore quantum to ex- ing interest everyday of phe- our is These It from removed perience. view. far world typically scientific are the nomena had on impact already have major entanglement a and superpositions tum 1 η rjcinoeao orsodn oa da threshold threshold ideal with an detector to corresponding operator projection 9 ecos h values the choose we [9] pnecreo h y,wihloslk mohdout smoothed a re- like looks experimental which the eye, the for of fit curve excellent sponse an provide values h oscanl where channel, loss the eetdi eetn and detecting in terested nrdcdtesubscript the introduced hs opigto coupling whose n oascesu eeto.Aaoosy h operator is the non-detection Analogously, a detection. for successful a to ing 1 unu xeiet ihhmnee sdtcosbsdo cl on based detectors as eyes human with experiments Quantum − cos = h htndtcincaatrsiso h ua eye human the of characteristics detection photon The quan- as such physics quantum of principles basic The P θ m − 2 =0 1 γ | 0 = ae Sekatski Pavel m n .Vtli hs e.Lett. Rev. Phys. recen Vitelli, a C. in realized and hum situation naked “micro-macro” the the with on Focusing distinguished be can emission stimulated naprn aao,wihw eov yntn htteBell the that these noting of by robustness resolve great we The which entanglement p a paradox, amplified account. greatly apparent the into is an for taken one detectors are other human-eye losses the with whereas experiment directly, Bell detected is pair ASnumbers: PACS loss. high for even entanglement macro ih . eso hoeial httemlipoo ttsobtaine states multi-photon the that theoretically show We m 8frtetasiso fteee These eye. the of transmission the for 08 | ihpoo ubrstates number photon with , a E ˆ y srsosbefrtels.W have We loss. the for responsible is = E ˆ 2 θ C n a ..WlsPyisLbrtr,Uiest fBitl United Bristol, of University Laboratory, Physics Wills H.H. 1 before y and , θ c ioa Brunner Nicolas , L † stemd htw r in- are we that mode the is = T oma ys,correspond- “yes”, mean to steiiilyepymode empty initially the is 1 ˆ o h hehl and threshold the for 7 = y ru fApidPyis nvriyo eea Switzerland Geneva, of University Physics, Applied of Group C C h mlfiainpoes oee,w lopoeta there that prove also we However, process. amplification the L L † C T ˆ L where n C = da hehl de- threshold ideal L ae nRef. on Based . e oeformally, More . γ T ˆ ( y a 100 † = c 1 − , Dtd eray1,2009) 17, February (Dated: 2 | ac 561(08] hr n htnfo noiia entangle original an from photon one where (2008)], 253601 , m 1 yi Branciard Cyril , 1 † i − ) sthe is , | 0 T ˆ i n emission c = is aefr o n hieo qaoilbss hsi why is This basis. equatorial of choice any for form same n ae.Rewriting bases. ent H ieetcocso h phase the of choices Different oncneso rcs is the process for down-conversion down- Hamiltonian appropriate parametric the where type-II [6], collinear conversion stimulated on based elzdb h oaiainsae fsnl htn na in photons single of mode states qubits spatial circle Considering polarization great the equator. a the by on realized e.g. makes lie sphere, that cloner Bloch phase-covariant states the experi- input A of of the only 13]. to copies [7, close good stay Refs. to of order ments in [6], emission ulated n otepm oe,and power, pump the cryst to the and of susceptibility non-linear the to proportional a n etclplrzto oe orsodn othe to corresponding mode modes spatial polarization vertical and tal etn hr l nu ttsaetetdeuly Here equally. treated on are instead states focus input we all where setting a ue 2 ]i h otx of context the in 3] [2, duced is eye emission. naked stimulated the via with cloning with detection combined if possibility, that realistic show become we detectors a work human-eye present with in the experiments considered quantum in used Nevertheless, model is idealized [1]. model more eye Ref. the realistic of than above inde- violation rather the [10], of the if numbers allow inequality not large Bell a observing does approach pairs of the entangled example, [1] For pendent Ref. detector. in a studied [9]. as eye Ref. of the 2 using Fig. cf. ca. eye, of the vicinity on the impinging in photons occurs 100 step the where function, step n ot oe fteBohshr,oecnintroduce can modes one “equatorial” sphere, of Bloch the basis of a poles south and tions lnn ysiuae msinwsoiial intro- originally was emission stimulated by Cloning experiments quantum design to easy not priori a is It = 1 ioa Gisin Nicolas , a xeiet[.D atn,F Sciarrino, F. Martini, De [F. experiment t iχ 2 H ( neewt ihecec n fidelity. and efficiency high with eye an pie,w hwta efriga performing that show we mplified, a = ycoigsnl-htnqbt via qubits single-photon cloning by d φ † oo per elsi,ee when even realistic, appears hoton eut ne htnls ed to leads loss photon under results 2 √ 1 + ilto rvsteeitneof existence the proves violation 2 a a e hs-oain lnrcnb realized be can cloner phase-covariant a , Identifying . a iφ φ † ( ⊥ 2 a + ) φ 1 phase-covariant n hitp Simon Christoph and , + H h.c. a i Kingdom φ ntrsof terms in n a e that see can one ; H ⊥ nn i stimulated via oning sgniemicro- genuine is ), universal a a = H H a a V iχa φ φ and and = and orsodt differ- to correspond H † lnn 1]b stim- by [12] cloning √ a a 1 a lnn 1] ..in i.e. [11], cloning V † 2 V a V a e φ + φ − r h horizon- the are ihtenorth the with ⊥ h.c. and iφ d i h rela- the via ( 1 a where , H φ a − φ a the has ⊥ a i gives φ χ ⊥ al is ). 2

Since the eye is not a perfect threshold detector, and since the photon number distributions in the two states A0 and A1 have large variances [15], there will also be events| i where| i both eyes detect something, where none of the eyes detect anything, or even where only the “wrong” FIG. 1: A single-photon qubit is amplified through cloning via eye responds. Introducing the notation p(y,n Φ) for the stimulated emission in a non-linear crystal (χ). The clones are probability of a detection (“yes”) in mode a and| no de- split into two orthogonal polarization modes, and each mode tection (“no”) in mode a , given the state Φ , and anal- is detected by a naked human eye. The polarization basis can ⊥ | i be varied with the help of a waveplate (φ). ogously for the other cases, one can then define the prob- ability for a conclusive measurement, corresponding to a detection in only one eye, as the cloning process is phase covariant. We will assume ε = p(y,n Φ) + p(n,y Φ) = p(y,n Φ )+ p(n,y Φ ), (2) that a choice of basis has been made and denote the corre- | | | ⊥ | ⊥ sponding equatorial modes by a and a for compactness where the equality follows from Eq. (1) (and ε stands for ⊥ of notation. “efficiency”). The accuracy of the measurement can be We now show that the multi-photon states obtained by quantified via the visibility V , defined as cloning single-photon qubits via stimulated emission can p(y,n Φ) p(n,y Φ) be distinguished with the naked eye with a high proba- V = | − | . (3) p(y,n Φ) + p(n,y Φ) bility for a conclusive result and high fidelity. Consider | | cloning the two orthogonal single-photon qubit states Based on the above model of the eye as a pho- a† 0, 0 = 1, 0 and a† 0, 0 = 0, 1 . The time evolu- | i | i ⊥| i | i iHt ton detector, the probabilities can be expressed as tion operator for the cloning process is e− = UU ˆ ˆ 2 2 ⊥ p(y,n Φ) = A1 Ey A1 A0 En A0 , and analogous g (a† a2) g (a† a2 ) with U = e 2 − , U = e 2 ⊥ − ⊥ , where we have | h | | ih | | i ⊥ relations for the other probabilities. In order to evaluate defined the amplification gain g = χt, with t the inter- the expectation values of Eˆy and Eˆn, one has to evaluate action time for the down conversion process. After the m general terms of the form P | i = A C† m m C A A0 0 L L 0 amplification, the qubit states become m | i h | | ih | | i and P | i = A C† m m C A . The pro- A1 1 L L 1 | i h | | ih | | i Φ = UU 1, 0 = A1 A0 , jector on a Fock state m can be written as ⊥ ⊥ | i | i | i| i 1 2π | i ik(a†a m) Φ = UU 0, 1 = A0 A1 , (1) m m = δa†a,m = 2π R0 dk e− − . The above | ⊥i ⊥| i | i| i⊥ expressions| ih | can be evaluated using operator ordering where we have introduced the notation A1 = techniques that follow Ref. [16]. As a first step one can | i 1 †2 † 1 1 2 U 1 , A0 = U 0 , and analogously for the perpen- tanhga ln(coshg)(a a+ ) tanhga | i | i | i show that U = e 2 e− 2 e− 2 dicular modes. It is easy to show, e.g. by inte- tanγac† ln(cos γ) a†a and CL = e e 0 c. Furthermore grating the equations of motion in the Heisenberg pic- ika†a ln(1 η+ηe−ik )a|†ai ln(X )a†a C† e C = e e 0 , ture, that U a U = cosh(g) a + sinh(g) a, which allows L − L − − † † † where we have introduced the≡ expression one to calculate the mean photon numbers in the two ik 1 2 X0 = (1 η + ηe− )− , which allows us to states A and A , A a†a A = 3 sinh (g)+1, and † † 0 1 1 1 − ika a ln(X0)a a | i | 2i h | | i evaluate U †CL† e− CLU = U †e− U = A0 a†a A0 = sinh (g). This shows that stimulating the 2 h | | i 1 1 ln Xa†a 1 Za† 1 Za2 1 ln Xa†a down-conversion process with a single photon leads to Y − 2 e− 2 e 2 e 2 e− 2 , with 2 an approximate tripling of the resulting output photon X = X cosh2 g sinh g , Y = X , and Z = 1 ∂ X. 0 X0 X0 2 g − † 1 number compared to a vacuum input (for large g). ika a 2 This gives A0 CL† e− CL A0 = Y − and † h | |1 i Our proposal for distinguishing Φ and Φ using hu- ika a 2 1 ⊥ A1 CL† e− CL A1 = Y − X− , which implies | i | i h | | i 1 man eyes as detectors, which is illustrated in Fig. 1, is m 1 − 2 1 ikm 2 i Y P | i = R dk e Y − = R dz m+1 and based on this significant difference in typical photon num- A0 2π 2π Γ z | i 1 m 1 − 2 −1 1 ikm 2 1 i Y X bers between the states A1 and A0 , in combination P | i = R dk e Y − X− = R dz m+1 , | i | i A1 2π 2π Γ z with the fact that the eye is a (smooth) threshold detec- | i ik where we made the change of variable z = e− and tor. The amplification gain g can be adjusted in such a Γ is the unit circle in the complex plane with clock- way that A1 will give a detection by the eye with high wise orientation. Note that X and Y are functions probability| (i.e.i it is “above the threshold”), whereas of z through their dependence on X0. It is easy A0 will not (it is “below the threshold”). Under these to show that X and Y are never zero inside Γ for |conditions,i separating the two modes a and a and di- ⊥ finite g, which allows us to apply the Cauchy inte- recting each of them to one eye [14], Φ will mostly give m 1 m 1 gral formula, yielding P | i = ∂ Y 2 , and | i A0 m! z − z=0 rise to detections in the eye exposed to mode a, whereas | i | m 1 m 1 1 P | i = ∂ (Y 2 X ) . Φ will mostly give rise to detections in the eye exposed A0 m! z − − z=0 ⊥ | |to modei a . | Thesei results make it possible to calculate the de- ⊥ 3

FIG. 3: We consider the micro-macro entanglement scenario of Refs. [7, 13], but with human-eye detectors for the macro system.

state FIG. 2: Efficiency ε and visibility V , defined in Eqs. (2) and 1 (3), of the human-eye detection method for amplified single- Ψ = ( Φ a 0, 1 b Φ a 1, 0 b) (4) photon qubits, as a function of the mean photon number after | −i √2 | i | i − | ⊥i | i amplification hNai (thick lines). The efficiency has a maxi- mum of ε = 0.61 for hNai = 288.The visibility never drops (still written in the equatorial basis for both spatial 1 modes). The capability of human-eye detectors to dis- below √2 , which is relevant for Bell experiments in the micro- macro setting of Refs. [7, 13], cf. text and Fig. 3. We also tinguish the two states Φ and Φ with high visibil- | i | ⊥i show V and ε for the case of additional losses after the ampli- ity implies the possibility of observing a violation of the η fication, corresponding to overall transmission factors 2 (thin CHSH Bell inequality with the same visibility for this η lines) and 4 (dashed lines). entangled state, provided that the detection of the un- amplified photon in mode b does not introduce any er- rors. Note that measurements in two different equatorial bases for both systems a and b are sufficient for testing tection probabilities p(y,n Φ) etc., and thus the visibil- the CHSH inequality. The detection of the un-amplified | ity V and the efficiency ε, as a function of the gain g, photon also serves as a trigger, signaling that a pair has which directly determines the mean photon number af- indeed been produced in the low-gain down-conversion. ter amplification, summed over both polarization modes, It is worth noting that the proposed measurement by 2 Na = 4 sinh (g) + 1, cf. above. The results are shown human eye, although clearly motivated by conceptual h i in Fig. 2. One sees that ε has a maximum for ca. 300 rather than practical considerations, can in fact be or- photons. Despite a dip in the region of high efficiency, ders of magnitude more efficient than the “orthogonality V always stays greater than 1 , which is an important √2 filter” technique used in Refs. [7, 13], for which the suc- 4 bound for Bell experiments, cf. below. We thus see that cess probability is of order 10− . This is because the eye the states Φ and Φ can be distinguished with high as a threshold detector is extremely well suited to the efficiency and| i accuracy| ⊥i at the same time. Thanks to task of discriminating the states Φ and Φ . | i | ⊥i the discussed phase covariance, this result is true for any The robustness of the visibility with respect to losses equatorial basis. Fig. 2 also shows the effect of other shown in Fig. 2 means that a strong Bell inequality vi- losses after the amplification in addition to the unavoid- olation could be achieved for arbitrarily high losses, pro- able losses in the eye. Since the model of the eye used is vided that the amplification is sufficiently strong. This an ideal threshold detector preceded by losses, this can is paradoxical at first sight, since losses are clearly going be done simply by varying the value of η. One sees that to affect the micro-macro entanglement, as information the effect of losses can be completely compensated by about the macro-state ( Φ or Φ ) leaks into the envi- increasing the gain. ronment. Even in the case| i where| there⊥i are only the losses intrinsic to the eye, i.e. for η = 0.08, most of the pho- Let us now apply these results to one particular inter- tons are lost, such that the environment contains almost esting experimental situation, namely the micro-macro all the available information, which means that the re- scenario of Refs. [7, 13], see also Fig. 3. In these maining micro-macro entanglement must be quite small. experiments, a first low-gain down-conversion process So how can the visibility of the Bell violation remain so creates an entangled photon pair into the two distinct high? spatial modes a and b in a polarization singlet state, 1 This apparent paradox can be resolved by realiz- ψ = (aH† bV† aV† bH† ) 0, 0, 0, 0 , where 0, 0, 0, 0 de- | −i √2 − | i | i ing that, while the efficiency of the proposed detection notes the vacuum for all participating modes. Thanks to method is quite high, it is always significantly smaller the rotational invariance of the singlet, this can be rewrit- 1 than one, such that the measurement is nevertheless post- ten in an equatorial mode basis as ψ = √ (a†b† | −i 2 ⊥ − selective. Moreover, whereas in the lossless case the a† b†) 0, 0, 0, 0 . The photon in the b spatial mode is macro-system lives in a two-dimensional Hilbert space detected⊥ | directly,i whereas the photon in the a mode is spanned by Φ and Φ , in the presence of losses it greatly amplified with the phase-covariant cloning pro- lives in a much| i larger| ⊥ (ini fact, in principle infinite- cess described above, leading to a micro-macro entangled dimensional) space. Together these two facts open up 4 an important “loophole”. Conclusive (i.e. (y,n) or Ψ CL† aJyaσybCLa Ψ = η( A1 a†a A1 h −| | −i 2 h | | i − (n,y)) results for different equatorial bases correspond A a†a A ) = η(2 sinh g + 1). On the other h 0| | 0i to different, almost orthogonal, subspaces of the high- hand, Na = Ψ CL† a(a†a + a† a )CLa Ψ = h i h −| ⊥ ⊥2 | −i dimensional Hilbert space. It is not difficult to construct η( A a†a A + A a†a A ) = η(4 sinh g + 1), which h 1| | 1i h 0| | 0i separable multi-photon states that exploit this loophole finally yields J~a ~σb Na =2η. One can see that the to achieve the same visibility as in Fig. 2 [17]. The exper- violation of this|h genuine· i|−h micro-macroi entanglement cri- imental observation of such a visibility by itself therefore terion is sensitive to photon loss as expected. However, allows no conclusion about the existence of micro-macro some micro-macro entanglement persists even for high entanglement. loss. Note that experimentally demonstrating micro- Nevertheless, the same measurements do allow one to macro entanglement in this way would require counting prove the entanglement of the original entangled pair be- large photon numbers with single-photon accuracy. fore amplification. From this perspective, the amplifica- As a consequence of the above-mentioned “loophole”, tion and losses can be simply seen as part of the detection we are not aware of a way of demonstrating genuine process for the original single photon. The Hilbert space micro-macro entanglement in the presence of losses with of the original photon is only two-dimensional, so there is human eye detectors, or with the orthogonality filter no risk of different subspaces being detected for different technique of Refs. [7, 13]. choices of measurement basis. Moreover, the detection We have shown that quantum experiments with human efficiency is independent of the choice of equatorial basis eyes as detectors appear possible, based on a realistic thanks to the phase covariance of the amplification. For model of the eye as a photon detector. We note that these proving non-locality (as opposed to just entanglement), results remain valid even if losses not only after, but also there is still the usual detection loophole due to the lim- before and during the amplification process, are taken ited measurement efficiency. However, it is no more se- into account, which is possible using similar techniques vere than for any other detection method that has compa- as in the present paper [19]. Motivated by recent experi- rable efficiency. Let us note that the amplification-based ments [7, 13], we focused on a micro-macro scenario, but detection is different from conventional photon detection other experiments, such as bunching of amplified single in one interesting way. Namely, in the present scenario photons, or macro-macro experiments where both pho- the choice of detection basis can be made after the ampli- tons from an original pair are amplified, can also be con- fication process. This is quite different compared to con- sidered. The latter scenario requires a heralded source ventional discussions of the measurement process, where of photon pairs, since otherwise the amplified vacuum, the amplification only occurs after the choice of basis. which is invariant under equatorial rotations, will dom- Briefly relaxing our focus on human eyes as detec- inate all detections. Moreover universal cloning can be tors, we now show that proving genuine micro-macro considered instead of phase-covariant cloning. The pro- entanglement in the presence of losses is possible using posed experiments will require quantum amplifiers that measurements that are not post-selective. Using the operate at visible wavelenghts, and pulse durations that same methods as in Ref. [18] one can derive the following are adapted to the timescales of the human eye. We in- condition, which has to be fulfilled for all separable tend to address all these points in more detail in a future publication [19]. states: J~a J~b NaNb . As in Ref. [18], J~a and |h · i| ≤ h i J~b are the Stokes (polarization) vectors corresponding This work was supported by the Swiss NCCR Quan- to two different spatial modes of the light field, and tum Photonics and by the EU Integrated Project Qubit Na and Nb are the corresponding photon number Applications. We thank M.J. Collett, F. De Martini, S. operators. In particular, one can choose a convention Gonzalez-Andino and A. Lvovsky for helpful comments and useful discussions. where Jza = aH† aH aV† aV , and Jxa = a†a a† a , i.e. the x direction− is identified with the arbitrary− ⊥ ⊥ phase choice φ that was used to define the modes a and a above. Let us emphasize that the dynamics of J ⊥(in fact, of any Stokes vector component in y [1] N. Brunner, C. Branciard, and N. Gisin, Phys. Rev. A the x y plane) will be exactly equivalent to that of 78, 052110 (2008). − b Jx. For our micro-macro scenario, the state of is a [2] C. Simon, G. Weihs, and A. Zeilinger, Phys. Rev. Lett. single-photon state, leading to the simplified criterion 84, 2993 (2000). J~a ~σb Na , where ~σb is the vector of Pauli [3] F. De Martini, V. Mussi, and F. Bovino, Opt. Comm. spin|h · matrices.i| ≤ h Thisi means that we have to evaluate 179, 581 (2000). in particular J~a ~σb = Ψ C† J~a ~σbC a Ψ [4] A. Lamas-Linares, C. Simon, J.C. Howell, and D. La L 296 for Ψ fromh Eq.· (4).i Oneh − can| show· quite easily| −i Bouwmeester, Science , 712 (2002). | −i [5] S. Fasel et al., Phys. Rev. Lett. 89, 107901 (2002). that Ψ CL† aJzaσzbCLa Ψ = η, whereas for the − − [6] E. Nagali, T. De Angelis, F. Sciarrino, and F. De Martini, h | | i 76 equatorial components Ψ CL† aJxaσxbCLa Ψ = Phys. Rev. A , 042126 (2007). h −| | −i 5

[7] F. De Martini, F. Sciarrino, and C. Vitelli, Phys. Rev. since a single observer is usually not aware which of his Lett. 100, 253601 (2008). eyes sees a particular light signal. 4 2 [8] S. Hecht, S. Shlaer, and M. Pirenne, J. Gen. Physiol. 25, [15] The variances are 6 sinh g + 4 sinh g for |A1i and 4 2 819 (1942). 2 sinh g + 2 sinh g for |A0i. [9] F. Rieke and D.A. Baylor, Rev. Mod. Phys. 70, 1027 [16] M.J. Collett, Phys. Rev. A 38, 2233 (1988); M.J. Collett, (1998). private communication. [10] In fact, one can show that the achievable visibility of [17] For example, the following separable N + 1 the correlations for this approach is only of order 0.03, photon state achieves a violation of the whereas a visibility of 1 = 0.71 is required for violating Bell inequality with post-selection: ρ = √2 1 2π the CHSH Bell inequality. This will be shown in more 2π R0 dφU(φ)|N, 0i|0, 1ihN, 0|h0, 1|U(φ)†, where U(φ) detail in Ref. [19]. is a rotation of the whole system around the z axis by [11] V. Buˇzek and M. Hillery, Phys. Rev. A 54, 1844 (1996); an angle φ. The same model also achieves high visibility D. Bruß et al., Phys. Rev. A 57, 2368 (1998). for the orthogonality filter measurements of Refs. [7, 13]. [12] D. Bruß, M. Cinchetti, G. M. D’Ariano, and C. Macchi- These points will be discussed in more detail in Ref. [19]. avello, Phys. Rev. A 62, 012302 (2000). [18] C. Simon and D. Bouwmeester, Phys. Rev. Lett. 91, [13] F. De Martini, F. Sciarrino, and C. Vitelli, 053601 (2003). arXiv:0804.0341 (2008). [19] P. Sekatski et al., in preparation. [14] Note that the eyes should not belong to the same person,

PHYSICAL REVIEW A 78, 062110 ͑2008͒

Testing a Bell inequality in multipair scenarios

Jean-Daniel Bancal,1 Cyril Branciard,1 Nicolas Brunner,1 Nicolas Gisin,1 Sandu Popescu,2,3 and Christoph Simon1 1Group of Applied Physics, University of Geneva, 20 rue de l’Ecole-de-Médecine, CH-1211 Geneva 4, Switzerland 2H.H. Wills Physics Laboratory, University of Bristol, Tyndall Avenue, Bristol BS8 1TL, United Kingdom 3Hewlett-Packard Laboratories, Stoke Gifford, Bristol BS12 6QZ, United Kingdom ͑Received 8 October 2008; published 15 December 2008͒ To date, most efforts to demonstrate quantum nonlocality have concentrated on systems of two ͑or very few͒ particles. It is, however, difficult in many experiments to address individual particles, making it hard to highlight the presence of nonlocality. We show how a natural setup with no access to individual particles allows one to violate the Clauser-Horne-Shimony-Holt inequality with many pairs, including in our analysis effects of noise and losses. We discuss the case of distinguishable and indistinguishable particles. Finally, a comparison of these two situations provides insight into the complex relation between entanglement and nonlocality.

DOI: 10.1103/PhysRevA.78.062110 PACS number͑s͒: 03.65.Ud

I. INTRODUCTION way to tell which particle is entangled with which. The cor- responding loss of entanglement has been derived in Ref. ͓5͔. Entanglement is the resource that allows one to establish In the second case, the pairs are indistinguishable; so in some quantum nonlocal correlations ͓1͔. These correlations have sense the information about the pairing is here lost in a co- been the center of a wide interest, because of their fascinat- herent way. ing nature and of their impressive power for processing in- Reid et al. ͓6͔ have considered the case of indistinguish- formation. Experimentally, quantum nonlocality has been able pairs ͑with global measurement͒ in optics. More specifi- demonstrated in so-called Bell experiments, which have to cally, these authors, extending on a previous work of Drum- date all confirmed the quantum predictions ͓2͔. mond ͓7͔, showed how Bell inequalities can be tested ͑and Most theoretical works on Bell experiments and Bell in- violated͒ when many pairs are created via PDC. In this case equalities have focused on the case where the source emits a the pairs are indistinguishable because of the process of single entangled pair of particles at a time. Indeed, this is the stimulated emission. In Ref. ͓8͔, Jones et al. have considered simplest situation to study. From the experimental point of a related scenario; there, entangled pairs are delivered via an view, most experiments have been designed in order to inept delivery service, but at the end only a single pair is match this theoretical model. For example, in photonic ex- measured. Also considering multiparticle entanglement in periments, the source, usually based on parametric down- such scenario is an interesting problem: see, for example, conversion ͑PDC͒, is set in the weak regime; i.e., when the Refs. ͓9,10͔. source emits something, it is most likely a single pair of In this paper we will study the violation of Bell inequali- entangled photons. ties in a general multipair scenario. We start by treating the However, there are experimental situations, such as in case of independent pairs ͑Sec. II͒. We argue that the resis- many-body systems, where producing single entangled pairs tance to noise is here the relevant measure of nonlocality, is rather difficult. For instance, in Ref. ͓3͔ many entangled evaluating it. The consequences of particle losses are also pairs ͑Ӎ104͒ of ultracold atoms have been created, but can- investigated. Next, we move to the case of indistinguishable not be addressed individually. So, while entanglement has pairs ͑Sec. III͒ after a brief review of the results of Ref. ͓6͔, definitely been created in this system, one still lacks an effi- we present an analysis of the influence of noise and losses in cient method for demonstrating its quantum nonlocality this case. In Sec. IV, we compare the entanglement and non- through the violation of some Bell inequality. The goal of the present paper is to discuss techniques for testing Bell in- equalities in such multipair scenarios, where the particles on Alice’s and Bob’s side cannot be individually addressed, and must therefore be measured globally ͑see Fig. 1͒. What we mean here by global measurements is that each particle is submitted to the same measurement. Note that the case of more general measurements ͑collective measurements on all particles͒ has been considered in Ref. ͓4͔. Basically one should distinguish two cases: independent FIG. 1. Setup: a source produces M independent pairs ͑or pairs and indistinguishable pairs. In the first case, the pairs equivalently M independent sources each produce a pair͒, the pair- are created independently, but cannot be addressed individu- ing between Alice’s and Bob’s particles is lost during their trans- ally; therefore, they must be measured globally ͑on both Al- mission, and each party measures all their incoming particles in the ice’s and Bob’s sides͒. During this global measurement, the same basis. The total number n+͑−͒ of particles detected in the ϩ͑Ϫ͒ classical information about the pairing is lost: there is no outcome is tallied on both sides.

1050-2947/2008/78͑6͒/062110͑8͒ 062110-1 ©2008 The American Physical Society BANCAL et al. PHYSICAL REVIEW A 78, 062110 ͑2008͒

locality in both cases. This leads us to a surprising result: threshold N=⌈M /2⌉,⌈2M /3⌉,...,M such that the outcome is while the state of indistinguishable pairs contains more en- + iff n+ ജN. tanglement than the state of independent pairs ͑after the clas- At this point the two relevant questions are the following: sical mixing͒, the latest appears to be more nonlocal. In other first, is it possible to violate the CH inequality with any of words, the incoherent loss of information provides more non- these voting procedures? Second, if yes, which strategy locality, but less entanglement, than the coherent loss of in- yields the largest violation? To address these questions one formation ͑indistinguishable pairs͒. This provides a novel ex- must compute the joint and marginal probabilities entering ample ͑here in the case of multipairs͒ of the complex relation the CH inequality for each procedure. between entanglement and nonlocality. Finally we provide some experimental perspectives ͑Sec. V͒ and conclusions. B. Pure states

II. INDEPENDENT PAIRS Let us first consider the pure entangled states We consider a source emitting M entangled pairs, each of ͉␺͘ = cos ␪͉00͘ + sin ␪͉11͘, ͑4͒ them being in the same entangled two-qubit state ␳. Thus the so that in Eq. ͑1͒, ␳=͉␺͗͘␺͉. We will also write ͉⌿M͘ global state is =͉␺͘M. For detectors with a perfect efficiency ␩=1, all M M particles are detected on both Alice’s and Bob’s sides. The ␳M = ␳ = ␳  ␳  ¯  ␳. marginal and joint probabilities entering the CH inequality M times ͑1͒ for a vote with given threshold N are

Each pair being independent, Alice and Bob receive M M M uncorrelated particles. Since Alice and Bob are unable to A n+ M−n+ P+͑A͒ = ͚ ͩ ͪp+͑A͒ p−͑A͒ , ͑5͒ address single particles in their ensemble, they perform a n =N n+ global measurement on their M particles; i.e., all M particles + are measured in the same basis ͑we shall consider here only p ͑A,B͒n␣␤ von Neumann measurements͒ or, equivalently, in the same ␣␤ P++͑A,B͒ = M! ͚ ͟ , ͑6͒ ෈ n ! direction on the Bloch sphere. After the measurement appa- n␣␤ ⌶ ␣,␤ ␣␤ ratus, two detectors count the number of particles, n and n , + − where p ͑A ,B ͒= 1 tr(͑1+A ͒  ͑1+B ͉͒␺͗͘␺͉) and in each output mode ͑see Fig. 1͒. If the detectors are per- ++ i j 4 i j p A /B = 1 tr( 1+A  1/1  1+B ␺ ␺ ) are the quantum fectly efficient ͑␩=1͒, one has M =n +n . +͑ i j͒ 2 ͑ i͒ ͑ j͉͒ ͗͘ ͉ + − joint and marginal probabilities for a single pair. Alice and ෈ Bob’s outputs are denoted ␣,␤ ͕+,−͖, n␣␤ is the number of A. Testing the CH inequality pairs which gave detections ␣ and ␤, and ⌶=͕n␣␤ ෈N A B Our goal is to test a Bell inequality. Here we shall focus + ͉͚n␣␤=M ,n+ =n+++n+−ജN,n+ =n+++n−+ജN͖ is the on the simplest Bell inequality, the Clauser-Horne-Shimony- set of all events yielding the result “ϩϩ” after voting. Holt ͑CHSH͒ inequality ͓11͔, which involves two inputs on Next, one can choose the state ͉␺͘ and the measured set- Alice and Bob’s sides, A1, A2 and B1, B2, and two outputs tings. For the maximally entangled state of two qubits ͑␪ ␣,␤෈͕+,−͖. For convenience we write it under the CH form =␲/4͒ one may choose the standard optimal ͑for the case ͓12͔ M =1͒ settings for the CH inequality—i.e., A0 =␴z, A1 =␴x, ␴ +␴ −␴ +␴ B = x z , and B = x z . Doing so with majority voting I =−PA͑A ͒ − PB͑B ͒ + P ͑A ,B ͒ + P ͑A ,B ͒ 0 ͱ2 1 ͱ2 CH + 1 + 1 ++ 1 1 ++ 1 2 ͑N=⌈M /2⌉͒, the CH inequality can be violated for any value + P++͑A2,B1͒ − P++͑A2,B2͒ ഛ 0, ͑2͒ of M; the maximal amount of violation is numerically found to decrease with the number of emitted pairs as M−1. where P A ,B is the probability for both Alice and Bob to ++͑ i j͒ Remarkably, a higher violation is found for different mea- output “ϩ” when performing measurements A and B , re- i j surement settings, given by spectively. Recall that under the hypothesis of no-signaling

both CH and CHSH inequalities are equivalent ͓13͔. Now, in A0 = ␴z, order to test inequality ͑2͒, Alice and Bob must transform their data, basically n and n , into a binary result “ϩ” or + − A1 = sin 2␣␴x + cos 2␣␴z, “Ϫ”. A natural way of doing it is by invoking a voting pro- cedure: for instance, B0 = sin ␣␴x + cos ␣␴z, → ͑i͒ Majority voting: if n+ ജ n− “+”; B = − sin ␣␴ + cos ␣␴ . 7 otherwise → “−”, 1 x z ͑ ͒ ␲ −1/2 With ␣ϳ 2ͱ2 M , those settings are numerically found to be → I −1/2 ͑ii͒ Unanimous voting: if n+ = M “+”; optimal. In this case the decrease of CH is only M ͓see Fig. 2͑a͔͒. The state leading to the largest violation is always otherwise → “−”, ͑3͒ the maximally entangled one ͑␪=␲/4͒ for majority voting. or any intermediate possibility—for instance, 2/3 or 3/ 4 ma- The one-parameter planar settings ͑7͒ were already used jority. For each voting method and given M corresponds a by several authors ͓6,7͔; for example, in Bell experiments

062110-2 TESTING A BELL INEQUALITY IN MULTIPAIR SCENARIOS PHYSICAL REVIEW A 78, 062110 ͑2008͒

noise can be modeled at the level of the source, supposing that the produced pairs are not in the pure state ͉␺͗͘␺͉, but instead in a Werner state of the form

1 ␳ = w͉␺͗͘␺͉ + ͑1−w͒ . ͑8͒ 4

The resistance to noise of a given violation is then defined by the maximal amount ⑀=1−w of white noise that can be added to the pure state ͉␺͗͘␺͉ such that the resulting state ␳ still violates a Bell inequality ͑CH here͒. Considering now that the sources of Fig. 1 produce the state ͑8͒, we look for the largest value of ⑀ which still gives I a positive value of CH, using settings of the form ͑7͒ and optimizing on the state ͑␪͒. For all voting strategies we find a resistance to noise decreasing like ⑀ϳM−1, the majority voting being still the best choice ͓see Fig. 2͑b͔͒. Unlike when I maximizing CH in the absence of noise, here the optimal state is always the maximally entangled one ͑␪=␲/4͒, even I for intermediary voting strategies, for which the CH viola- tion with this state decreases exponentially with M. This shows that appropriate figures of merit need to be used when examining practical situations. These results are encouraging, but just as detectors might not be perfect, maybe the source cannot guarantee an exact number of pairs, M, as needed here. To show that these vio- FIG. 2. ͑Color online͒ CH violation and resistance to noise for a lations are relatively robust towards this issue, we now look source producing M independent pairs. The states and settings used at the case of sources producing a number of entangled pairs are discussed in the text. ͑a͒ Maximal CH values for various thresh- which follow a Poissonian distribution. olds: majority voting ͑solid red line͒,3/4 voting ͑dotted green line͒, and unanimity ͑dashed blue line͒. The decrease is as M−1/2 for the first two and exponential for the last one. The highest violation is D. Poisson sources thus reached using a majority vote. ͑b͒ Resistance to noise for the different thresholds ͑same colors͒. All curves decrease as M−1. The A Poissonian source produces a state ␳M of M pairs with most resistant violation is that achieved by using majority voting. a Poissonian probability

M using a state we shall look at 10 later with the unanimous ␮ ␮ ͑ ͒ p͑M͒ = e− , ͑9͒ vote for any M. M! Performing numerical optimizations, we also found that a violation can be obtained for any voting strategy with any where ␮ is the mean number of photon pairs. With such a number of emitted pairs M ͓see Fig. 2͑a͔͒. We optimized the source, a different number of pairs is created every time. So state ͑␪͒ and the four measurement settings, each time find- for a chosen voting assignment ͑3͒ the threshold N varies ing optimal settings of the form ͑7͒. For the unanimous vote, with the total number of photons detected, M =n+ +n− ͑we for instance, the optimal state is less and less entangled as the still consider perfect detectors͒, according to each realiza- number of emitted pairs, M, increases, as described in ͓14͔, tion. and the violation decreases exponentially with M. Thus for Using settings of the form ͑7͒, we optimized numerically pure entangled two-qubit states, the largest amount of viola- ␣ and the state ͑␪͒ for several votes, in a situation where the tion is obtained with majority voting. source is Poissonian. Doing so in order to get the largest CH violation and the highest resistance to noise, we obtained results very similar to that of the fixed M case, verifying in C. Resistance to noise I −1/2 particular a decrease of CH as ␮ for the majority vote We now compute the resistance to noise that these viola- and of the resistance to noise as ␮−1 ͑see Fig. 3͒. Similarly, I tions could bear, which is the relevant measure of nonlocality the states yielding the largest CH values are the maximally considering experimental perspectives—the amount of viola- entangled one for the majority vote and partially entangled tion being basically just a number, without much significance ones for the two other votes. A difference, however, is that I in the present case as we shall see. CH is found to decrease slower than exponentially for the In a practical Einstein-Podolsky-Rosen ͑EPR͒ experiment, unanimity vote. I imperfect detectors, noisy sources, or disturbing channels in- Note also that since it is possible to find CHϾ0 and the troduce noise in the measurement results. To first order, this probability to get a ϩ result vanishes for ␮→0, there exist

062110-3 BANCAL et al. PHYSICAL REVIEW A 78, 062110 ͑2008͒

FIG. 4. ͑Color online͒ CH violation with inefficient detectors as a function of the probability for a photon to be detected. The upper thin curve shows the traditional case M =1 with known critical ef- ficiency ␩=2/3 ͓15͔. The two other curves are for M =5 pairs with majority ͑solid red line͒ and unanimity voting ͑dashed blue line͒. find a Bell violation in such circumstances. Figure 4 shows the maximal CH violations obtained ͑optimizing on states and settings͒ as a function of the detection efficiency for M =1 and M =5 with majority and unanimity voting. The re- quired detector efficiency increases with the number of pairs, leaving no chance to find a violation at high M with ␩Ӷ1. One way to deal with detector inefficiencies consists in post-selecting events in which exactly M photons are de- tected on both sides. In this way, cases in which particles FIG. 3. ͑Color online͒ Maximal Bell violation and resistance to were not detected are neglected and the Bell violation is noise with a Poissonian source of independent pairs. The red lines recovered independently of the losses. ͑If detectors also have represents the majority voting, the green dotted lines the 3/4 vot- dark counts, noise will appear in the statistics, which can be ing, and the blue dashed lines the unanimity voting. Settings are treated with Werner states as presented in the “resistance-to- chose in the form ͑7͒; optimal states are discussed in the text. ͑a͒ noise” section.͒ This approach is, however, not perfect as it is subject to the so-called detection loophole ͓16͔: there exist For a large mean photon number, the decrease of ICH goes like ␮−1/2 for the majority and 3/4 vote, just like for the fixed M case. local models, exploiting detectors inefficiencies, that can vio- late a Bell inequality ͓17͔. But also, one needs to know ex- Concerning the unanimity vote, ICH decreases faster than a polyno- mial, but slower than an exponential. ͑b͒ Resistance to noise is very actly the number of pairs, M, created before measuring them. similar for all strategies, decreasing as ␮−1 just like with as source This last condition might not be guaranteed, for example, of fixed pairs number. with Poissonian sources where knowledge of M is often in- ferred from the number of detected particles. To estimate the impact of losses, we consider the case in an optimal ␮Ӎ1.2–1.8 yielding a maximum CH violation. which exactly 1 of the M photons flying to Alice and 1 going But this feature is not found in the resistance to noise. to Bob are not detected. As the number of created pairs in- creases, this is a situation that must happen frequently even E. Inefficient detectors with very efficient detectors. Using the majority and unanim- ity vote in this situation, we numerically verified that the CH We now consider detectors with finite efficiency ␩Ͻ1 inequality could not be violated, at least for M ഛ50. and look in what circumstance a Bell violation can still be A way to understand this result is by noting that the sets observed in a multipair scheme with such detectors. ␩ is to of events yielding results ϩ and Ϫ are separated by only one be understood here as the probability for a particle to be photon number. Thus, removing one photon mixes the two detected. sets. It should thus be advantageous to separate these two In general, in the presence of detector inefficiencies or → → ͑ cases such that, for instance, n+ ജN +, n− ജN −, M −N particle losses͒ the total number of particles detected by Al- Ͻn ϽN→‡. Using this particular post-selection, we could A A
B B + ice and Bob are different ͑n+ +n− n+ +n−͒. Thus, for a given find a Bell violation in the case of one photon loss on both voting strategy, the thresholds N applied by Alice and Bob sides, with N=M −1 ͑unanimity voting͒, starting at M =5. might be different for the same event, since it depends on the For details on this post-selection, see Ref. ͓14͔. total number of photons detected by each party. Testing a Bell inequality in this situation without appealing to post- III. INDISTINGUISHABLE PHOTONS selection introduces no detection loophole, but it is not a In the first part of this work we showed how, using mul- surprise to find that high efficiencies are needed in order to tiple independent pairs together with independent global

062110-4 TESTING A BELL INEQUALITY IN MULTIPAIR SCENARIOS PHYSICAL REVIEW A 78, 062110 ͑2008͒ measurement on all the photons produced, one could find a substantial CH violation, even in the presence of lots of pairs. But how good is this compared to a source producing the 2M photons altogether? For the sake of comparison we now consider a specific example, commonly produced in many laboratories. By the same occasion it will uncover some aspects of the relation between entanglement and non- locality. The state we are discussing now can be written as ␳M =͉⌽M͗͘⌽M͉ with

1 † † † † M ͉⌽M͘ = ͑a0b0 + a1b1͒ ͉0͘, ͑10͒ M!ͱM +1 where a0 and a1 are orthogonal modes on Alice’s side and b0 and b1 orthogonal modes on Bob’s side ͑for instance, hori- zontal and vertical polarization modes͒. A way to produce this state is with a PDC source, which gives a Poissonian distribution of such states. The same global measurements as previously performed on M photons can be realized here by just using the same setup as before: a polarizer followed by two photon counters on each side ͑same setup as represented in Fig. 1, but with a different source͒. Considering the state ͑10͒, we make a similar analysis as previously, briefly reviewing the results of ͓6,7͔ for the amount of violation achievable and presenting our own analysis for the resistance to noise. I We computed the new probabilities entering the CH ex- pression for this specific state and, choosing various voting procedures, numerically optimized the settings according to FIG. 5. ͑Color online͒ Comparison between sources producing I independent pairs or indistinguishable photons, using settings of the ␣, Eqs. ͑7͒, in order to get the largest CH violation. Surpris- ingly, for any number of photons, M, all voting procedures form ͑7͒. ͑a͒ Maximal CH violation achieved with a source of in- I distinguishable photons for various voting procedure ͑superposed yield approximately the same maximum violation of CH, decreasing as M−1 ͓see Fig. 5͑a͔͒. This is even more surpris- black dots͒. Compared to the previously calculated violations for ing as the settings needed for that are not the same for all independent pairs ͓same curves as in Fig. 2͑a͔͒, unanimity voting lower blue dashed line yields less violation, while majority voting voting methods. ͑ ͒ ͑upper red line͒ yield the highest I values. Note that the maximal Note that Reid et al. ͓6͔ used another figure of merit: S CH I violation with indistinguishable photons almost does not depend on CH+B A B = B ͓with B= P+͑A1͒+ P+͑B1͔͒, which gives different re- the voting procedure used. ͑b͒ Maximal resistance to noise in the sults for the different voting strategies. Recalling the artifacts majority voting scenario ͑solid red lines͒ and the unanimity sce- we already found in the amount of CH violation for Poisso- nario ͑dashed blue lines͒ for sources producing independent pairs nian sources, we choose to look now at an experimentally ͓thick line, same curves as in Fig. 2͑b͔͒ or indistinguishable photons meaningful figure of merit: namely, the resistance to noise. ͑thin line͒. The unanimous vote is more robust for indistinguishable photons, but majority voting on independently produced pairs yields the most persistent violation. A. Noisy symmetric state

Unlike for distinguishable photons, the effect of a noise The state after the noisy channel is thus given by map on a symmetric M-photon state does not affect each photon independently. We thus need here a more precise  1 †  1 noise model. For the sake of simplicity, we put ourselves in ␳out = ͵ p͑␤͒͑U ͒␳in͑U ͓͒dU͔͑11͒ an asymmetric setting, modeling the noise observed in the SU͑2͒ state measured by Alice and Bob as coming from the imper- ϱ ␲ ␲ fection of the channel linking the source and Alice. Because 1 2 = d␤ d␪ d␾sin2 ␤ sin ␪ p ␤ the channel slightly deteriorates the systems passing through ͵ ͵ ͵ ͑ ͒ ͑ ͒ ͑ ͒ 4␲ −ϱ 0 0 it, but has no preferred basis, we model it, by an average  1 †  1 over all rotation axes nជ =͑sin ␪ cos ␾,sin ␪ sin ␾,cos ␪͒ in ϫ͓U͑␤,␪,␾͒ ͔␳in͓U ͑␤,␪,␾͒ ͔, ͑12͒ the Bloch sphere of rotations U by an angle 2␤, with ␤ where we have used the appropriate Haar measure of following a properly normalized Gaussian distribution p͑␤͒ 2 −␤2/2␴2 ជ ជ ជ SU͑2͒ in terms of the Euler angles: ͓dU͔ = e . For any representation ␴ជ = J ,J ,J of 1 −2␴2 ͱ ͑ x y z͒ 2 ͑1−e ͒ 2␲␴ = 4␲ sin ͑␤͒sin͑␪͒d␤ d␪ d␾. We introduced the Haar mea- SU͑2͒ generators, the rotation operator is U=exp͑−␤nជ ·␴ជ ͒. sure here because it is the only measure which is invariant

062110-5 BANCAL et al. PHYSICAL REVIEW A 78, 062110 ͑2008͒

M under group operations. It thus treats every rotation the same ͉0͘A͉0͘B + ͉1͘A͉1͘B way, reflecting the fact that the noise has no preferred rota- ͉⌿M͘ = ͩ ͱ2 ͪ tion axis. M This channel applied to a single pair state ␳in=͉⌽1͗͘⌽1͉ 1 † † † † =2−M/2 ␲͉0͘i͉1͘M−i  ␲͉0͘i͉1͘M−i with ͉⌽1͘= ͱ2 ͑a0b0 +a1b1͉͒0͘ produces a Werner state ͑8͒, al- ͚ ͚ A A B B i=0 ෈ M lowing one to make a correspondence between the usual ␲ ⌸i noise model used in the previous part of this work, in terms sym M of Werner states and this one: ——→ −M/2 2 ͚ ͉i,M − i͘A͉i,M − i͘B ϳ͉⌽M͘, i=0 2 2 2 ͑16͒ 3w = e−2␴ + e−4␴ + e−6␴ . ͑13͒ M M where ⌸i is the set of all ͑ i ͒ possible arrangements of i “0” ͑a†͒i͑a†͒M−i and M −i “1”, and i,M −i = 0 1 0 is the Fock state This relation allows us to interpret the amount of white noise ͉ ͘A ͱi!͑M−i!͒ ͉ ͘ ⑀=1−w as being, to first order, the variance of the random describing i of Alice’s M photons in the “0” state and M −i in rotation angle: the “1” state. So the only difference between ͉⌿M͘ and ͉⌽M͘ is the dis- tinguishability of the M photons flying to Alice or Bob. But ⑀ =4␴2 + O͑␴4͒. ͑14͒ in the setup we considered ͑as described in Fig. 1͒, we did not take advantage of the particular pairing between some of Applying this channel to the state ͉⌽ ͘ for various M and M Alice’s photons with some of Bob’s ones. Because we ap- performing the majority and unanimity votes with settings in plied a global measurement, we could even suppose that all ␣, Eqs. ͑7͒, we found that the unanimity procedure is more photons on Alice’s ͑Bob’s͒ side were mixed before reaching robust to noise than the majority vote, scaling like ϳM−1 the beam splitter. In other words, we classically lost trace of ͓see Fig. 5͑b͔͒. the pairing between Alice’s and Bob’s photons. We are thus comparing a situation in which one explicitly chose not to B. Particle losses distinguish between photons belonging to a given set, with another one for which these photons are intrinsically indis- To compare indistinguishable and independent pairs in the tinguishable. case of losses, we consider the case in which one particle is Let us now compare the entanglement present in both lost on each side, yielding a total number of detections, states. Eisert et al. ͓5͔ calculated the amount of entanglement 2͑M −1͒. In terms of modes, the state measured after the loss present in the state of distinguishable particles ͉⌿M͘ after of particles can be written having forgotten the pairing of Alice’s photons with Bob’s ones. For M even,

M/2 ␳ ϳ a b ͉⌽ ͗͘⌽ ͉a†b† + a b ͉⌽ ͗͘⌽ ͉a†b† ͑2j +1͒2 M +1 M−1 0 0 M M 0 0 0 1 M M 0 1 E = E͉͑⌿ ͒͘ = log ͑2j +1͒. d M ͚ M ͩ / ͪ 2 † † † † j=0 2 ͑M +1͒ M 2−j + a1b0͉⌽M͗͘⌽M͉a1b0 + a1b1͉⌽M͗͘⌽M͉a1b1. ͑15͒ ͑17͒

Concerning the state of indistinguishable particles ͉⌽M͘, Using such a state, we could find a violation for sufficiently writing it in terms of modes as in Eq. ͑16͒, we see that its many pairs M ജ10, starting with majority voting. Thus, there entanglement is given by is no need for additional post-selection here. Ei = E͉͑⌽M͒͘ = log2͑M +1͒, ͑18͒ since it is a maximally entangled state of two systems of IV. DISTINGUISHABLE VERSUS dimension M. Evaluating these two quantities, we find Ei ——M→ϱ INDISTINGUISHABLE PAIRS ϾEd ∀M, and more precisely Ei /Ed → 2. So more en- tanglement is present in the state where photons are quan- In the last sections we examined how two different mul- tumly indistinguishable, while a larger violation of the CH tiparticle bipartite states ͉⌿M͘, Eq. ͑4͒, and ͉⌽M͘, Eq. ͑10͒, inequality can be observed using a natural setup if the pho- could be used to show nonlocality using a natural setup pro- tons are in principle distinguishable, but we choose not to ducing binary outcomes. These two states are actually re- make any difference between them. Looking at how resistant lated: if one were to produce the state of independent pairs these violations are with respect to noise confirms this order. ͉⌿M͘ with fundamentally indistinguishable photons on both It should only be noted that compared to particle losses, the Alice and Bob’s sides, then the state created would be sym- indistinguishable case looks more resistant, since no addi- metric with respect to permutations between Alice’s photons tional post-selection was necessary to find a violation when or Bob’s ones, and we would actually have produced state both Alice and Bob lost a particle during the experiment. ͉⌽M͘. This can be seen by projecting ͉⌿M͘ onto the corre- This is in agreement with other results ͓18͔, showing that sponding symmetric subspaces: entanglement and nonlocality are different measures.

062110-6 TESTING A BELL INEQUALITY IN MULTIPAIR SCENARIOS PHYSICAL REVIEW A 78, 062110 ͑2008͒

TABLE I. Summary of the main results of this work.

Indistinguishable Independent pairs photons

M ͉0͘A͉0͘B + ͉1͘A͉1͘B 1 † † † † M ͓a0b0 + a1b1͔ ͉0͘ State ͫ ͱ2 ͬ M!ͱM +1

Entanglement after particles 1 log ͑M +1͒ ϳ log2͑M͓͒5͔ 2 order loss 2

Largest CH ϳM−1/2 ϳM−1 violation ͑majority voting͒ ͑any voting procedure͒

Highest ϳM−1 ϳM−1 resistance ͑majority voting͒ ͑unanimous voting͒ to noise

Loss of one No violation without post- Violation possible particle on selection, at least for M ഛ50 for M ജ10 each side

V. EXPERIMENTAL PERSPECTIVES entanglement using PDC sources was demonstrated in ͓10͔. A careful analysis of post-selection might thus open the pos- In this section we give a brief overview of experimental sibility to feasible experiments. situation where our techniques might be applied. As mentioned previously, the experiment of Ref. ͓3͔ VI. CONCLUSION shows evidence for entanglement in ensembles of ultracold We considered Bell experiments on multiple pairs of par- atoms of 87Rb in an optical lattice. Entanglement between ticles, where the two parties are not able to address each two atomic levels is generated via a partial swap gate, an particle separately and thus call upon global measurements, entangling operation. In order to apply our techniques, the projecting all of their incoming particles in the same basis. atoms of each level should be addressed separately; that is, Votes were introduced as a natural way to produce binary Alice should hold all atoms in the ground state and Bob all outcomes from two detection numbers. This allowed us to atoms in the excited state. Note that in this experiment the test the CH inequality in the presence of both a source of M pairs are independent because they are located in different independent pairs and of M indistinguishable pairs, high- regions of the optical lattice. lighting a violation of the CH inequality for any number of Another experimental situation invoking Bose-Einstein pairs, M. Considering the resistance to noise of such viola- condensates where our techniques might be useful is super- tions, modeled as a noisy channel, we could provide an ex- radiant scattering ͓19͔. It has been argued that this process perimentally meaningful measure of nonlocality. The impact generates entanglement between the emitted photons and the of losses was also evaluated for the two situations, showing atoms of the condensates. In that case the particles would be that indistinguishable pairs are more robust against losses. indistinguishable. More detailed results are summarized in Table I. Finally, a A third possibility is the experiment discussed in Ref. comparison of the nonlocality observed for each source with ͓20͔, which is a proposal for energy-time entanglement of the entanglement of their respective states provided another quasiparticles in a solid-state device. This experiment is an example of the nonmonotonicity between these two quanti- adaptation of the Franson-type experiment ͓21͔ with en- ties. tangled electron-hole pairs. Finally it is also worth mentioning quantum optics. How- ACKNOWLEDGMENTS ever, it is not clear that our techniques will turn out useful in We thank F.S. Cataliotti for pointing out the potential ap- this field, since they require high detection efficiencies, a plication of our results to superradiant scattering. We ac- feature that still lacks generally in optics. Still, sources pro- knowledge financial support from the EU project QAP ͑No. ducing independent entangled pairs, or indistinguishable IST-FET FP6-015848͒ and the Swiss NCCR Quantum photons via PDC, are already well understood. Multiphoton Photonics.

062110-7 BANCAL et al. PHYSICAL REVIEW A 78, 062110 ͑2008͒

͓1͔ J. Bell, Physics ͑Long Island City, N.Y.͒ 1, 195 ͑1964͒. ͓11͔ J. F. Clauser, M. A. Horne, A. Shimony, and R. A. Holt, Phys. ͓2͔ A. Aspect, Nature ͑London͒ 398, 189 ͑1999͒. Rev. Lett. 23, 880 ͑1969͒. ͓3͔ M. Anderlini et al., Nature ͑London͒ 448, 452 ͑2007͒. ͓12͔ J. F. Clauser and M. A. Horne, Phys. Rev. D 10, 526 ͑1974͒. ͓4͔ Y.-C. Liang and A. C. Doherty, Phys. Rev. A 73, 052116 ͓13͔ D. Collins and N. Gisin, J. Phys. A 37, 1775 ͑2004͒. ͑2006͒. ͓14͔ N. Brunner, C. Branciard, and N. Gisin, Phys. Rev. A 78, ͓5͔ J. Eisert, T. Felbinger, P. Papadopoulos, M. B. Plenio, and M. 052110 ͑2008͒. Wilkens, Phys. Rev. Lett. 84, 1611 ͑2000͒. ͓15͔ P. H. Eberhard, Phys. Rev. A 47, R747 ͑1993͒. ͓6͔ M. D. Reid, W. J. Munro, and F. De Martini, Phys. Rev. A 66, ͓16͔ P. Pearle, Phys. Rev. D 2, 1418 ͑1970͒. 033801 ͑2002͒. 260 ͓7͔ P. D. Drummond, Phys. Rev. Lett. 50, 1407 ͑1983͒. ͓17͔ N. Gisin and B. Gisin, Phys. Lett. A , 323 ͑1999͒. ͓8͔ S. J. Jones, H. M. Wiseman, and D. T. Pope, Phys. Rev. A 72, ͓18͔ A. A. Méthot and V. Scarani, Quantum Inf. Comput. 7, 157 022330 ͑2005͒. ͑2007͒. ͓9͔ G. Toth, C. Knapp, O. Guhne, and H. J. Briegel, Phys. Rev. ͓19͔ S. Inouye et al., Science 285, 5427, ͑1999͒. Lett. 99, 250405 ͑2007͒. ͓20͔ V. Scarani, N. Gisin, and S. Popescu, Phys. Rev. Lett. 92, ͓10͔ H. S. Eisenberg, G. Khoury, G. A. Durkin, C. Simon, and D. 167901 ͑2004͒. Bouwmeester, Phys. Rev. Lett. 93, 193901 ͑2004͒. ͓21͔ J. D. Franson, Phys. Rev. Lett. 62, 2205 ͑1989͒.

062110-8