Quantum Communication and Security (NATO Science for Peace and Security Series: Information and Communication Security) (NATO Security Through Science Series. D: Information and Com)

QUANTUM COMMUNICATION AND SECURITY

NATO Science for Peace and Security Series This Series presents the results of scientific meetings supported under the NATO Programme: Science for Peace and Security (SPS). The NATO SPS Programme supports meetings in the following Key Priority areas: (1) Defence Against Terrorism; (2) Countering other Threats to Security and (3) NATO, Partner and Mediterranean Dialogue Country Priorities. The types of meeting supported are generally “Advanced Study Institutes” and “Advanced Research Workshops”. The NATO SPS Series collects together the results of these meetings. The meetings are co-organized by scientists from NATO countries and scientists from NATO’s “Partner” or “Mediterranean Dialogue” countries. The observations and recommendations made at the meetings, as well as the contents of the volumes in the Series, reflect those of participants and contributors only; they should not necessarily be regarded as reflecting NATO views or policy. Advanced Study Institutes (ASI) are high-level tutorial courses to convey the latest developments in a subject to an advanced-level audience. Advanced Research Workshops (ARW) are expert meetings where an intense but informal exchange of views at the frontiers of a subject aims at identifying directions for future action. Following a transformation of the programme in 2006 the Series has been re-named and reorganised. Recent volumes on topics not related to security, which result from meetings supported under the programme earlier, may be found in the NATO Science Series. The Series is published by IOS Press, Amsterdam, and Springer Science and Business Media, Dordrecht, in conjunction with the NATO Public Diplomacy Division. Sub-Series A. B. C. D. E.

Chemistry and Biology Physics and Biophysics Environmental Security Information and Communication Security Human and Societal Dynamics

Springer Science and Business Media Springer Science and Business Media Springer Science and Business Media IOS Press IOS Press

http://www.nato.int/science http://www.springer.com http://www.iospress.nl

Sub-Series D: Information and Communication Security – Vol. 11

ISSN 1874-6268

Quantum Communication and Security

Edited by

Marek Żukowski University of Gdańsk, Poland

Sergei Kilin B.I. Stephanov Institute of Physics, Belarus

and

Janusz Kowalik University of Gdańsk, Poland

Amsterdam • Berlin • Oxford • Tokyo • Washington, DC Published in cooperation with NATO Public Diplomacy Division

Proceedings of the NATO Advanced Research Workshop on Quantum Communication and Security Gdańsk, Poland 10–13 September 2006

© 2007 IOS Press. All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, without prior written permission from the publisher. ISBN 978-1-58603-749-9 Library of Congress Control Number: 2007926784 Publisher IOS Press Nieuwe Hemweg 6B 1013 BG Amsterdam Netherlands fax: +31 20 687 0019 e-mail: [email protected] Distributor in the UK and Ireland Gazelle Books Services Ltd. White Cross Mills Hightown Lancaster LA1 4XS United Kingdom fax: +44 1524 63232 e-mail: [email protected]

Distributor in the USA and Canada IOS Press, Inc. 4502 Rachael Manor Drive Fairfax, VA 22032 USA fax: +1 703 323 3668 e-mail: [email protected]

LEGAL NOTICE The publisher is not responsible for the use which might be made of the following information. PRINTED IN THE NETHERLANDS

v

Quantum Communication and Security M. Żukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

Preface This volume contains a selection of papers invited and presented at the NATO sponsored Advanced Research Workshop on ``Quantum Communication and Security’’ held at the Gdańsk University in Gdańsk, Poland from September 10th to 13th, 2006. The purpose of the workshop was to assess the state of the art in the workshop subject area and identify new research challenges. The workshop was an opportunity for many experts from Western Europe, USA and former Soviet Union Republics for discussing theoretical and applied aspects of quantum communication and cryptography. We wish to thank the NATO Security Through Science Division and more specifically Dr. Hadassa Jakobovits, Director of Information and Communication Security Program for the generous support of the workshop. Special thanks are due to the Gdańsk University administration officials, Rector, Prof. Andrzej Ceynowa and Dean, Prof. Andrzej Kowalski who made available all workshop facilities at no cost. Without any reservation, we say that Gdańsk University was the highest quality host of this NATO workshop. There are several persons who contributed directly to the success of the workshop. They provided an excellent office and technical support. They include Prof. Wiesław Miklaszewski, Mrs Elżbieta Bandura, Mrs Anita Charkot, Mr Tomasz Paterek, and Mr Wiesław Laskowski. But above all we are deeply grateful to the participants of the workshop, especially those who contributed papers to this book. Marek Żukowski, Sergei Kilin and Janusz Kowalik

This page intentionally left blank

vii

List of Speakers 1. 2.

3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17. 18. 19. 20. 21.

Markus Aspelmeyer, Physics Faculty, University of Vienna, Boltzmanngasse 3, 1090 Wien, Austria Časlav Brukner, Institut für Quantenoptik und Quanteninformation, Österreichische Akademie der Wissenschaften, Boltzmanngasse 3, 1090 Wien, Austria, Anton Zeilinger, Institut for Experimentolphyscis, University of Vienna, Bolzmanngasse 5, 1090 Vienna, Austria Dmitri Horoshko, B.I. Stepanov Institute of Physics, National Academy of Sciences of Belarus, Nezavisimosti Avenue 68, 220072 Minsk, Belarus Sergei Kilin, Stepanov Institute of Physics, National Academy of Sciences of Belarus, Nezavisimosti Avenue 68, 220072 Minsk, Belarus Serge Massar, Laboratoire d'Information Quantique CP, Universite Libre de Bruxelles, 50 Av. F.-D. Roosevelt, 1050 Bruxelles, Belgium Zdeněk Hradil, Department of Optics, 17. listopadu 50, 772 00 Olomouc, Czech Republic Philippe Grangier, Laboratoire Charles Fabry de l’Institut d’Optique (UMR 8501), Campus Polytechnique, RD 128, 91127 Palaiseau Cedex, France Sebastien Tanzilli, Laboratoire de Physique de la Matière Condensée – LPMC, Université de Nice Sophia Antipolis, Parc Valrose, 06108 Nice Cedex, France Harald Weinfurter, Max Planck Institute for Quantum Optics, Munich LMU University, Munich, Germany Richard Gill, Math. Institut, University Utrecht, Box 80010, 3508 TA Utecht, Netherlands Robert Alicki, Wydział Matematyki, Fizyki i Informatyki, Uniwersytet Gdański, Wita Stwosza 57, 80-952 Gdańsk, Poland Karol Horodecki, Wydział Matematyki, Fizyki i Informatyki, Uniwersytet Gdański, Wita Stwosza 57, 80-952 Gdańsk, Poland Konrad Banaszek, Instytut Fizyki, Uniwerystet Mikołaja Kopernika, ul. Grudziądzka 5, 87-100 Toruń, Poland Michał Horodecki, Wydział Matematyki, Fizyki i Informatyki, Uniwersytet Gdański, Wita Stwosza 57, 80-952 Gdansk, Poland Marek Kuś, Centrum Fizyki Teoretycznej, Polska Akademia Nauk, Al. Lotników 32/46, 02-668 Warszawa, Poland Władyslaw Adam Majewski, Wydział Matematyki, Fizyki i Informatyki, Uniwersytet Gdański, Wita Stwosza 57, 80-952 Gdańsk, Poland Karol Życzkowski, Instytut Fizyki, Uniwersytet Jagielloński, Reymonta 4, 30-059 Kraków, Poland Marek Żukowski, Wydział Matematyki, Fizyki i Informatyki, Uniwersytet Gdański, Wita Stwosza 57, 80-952 Gdańsk, Poland Yuri Golubev, V.A. Fock Physics Instytute, St. Petersburg State University, Ul'yanovskaya 1, 198504 St. Petersburg, Russia Alexandr Kazakov, Department of Higher Mathematics, State University of AeroSpace Instrumentation, B. Morskaya 67, 190000 St.-Petersburg, Russia

viii

22. Sergei Kulik, Department of Quantum Electronics, Moscow M.V. Lomonosov State University, Leninskie Gory 1, str. 2, 119992 Moscow, Russia 23. Dmitriy Kupriyanov, Department of Theoretical Physics, St.-Petersburg StatePolytechnic University, Polytechnicheskaya Str. 29, 195251 St.-Petersburg, Russia 24. Vladimir Kurochkin, Institute of Semiconductor Physics Siberian, Academician M.A. Lavrentjev ave. 13, 630090 Novosibirsk, Russia 25. Sergei Molotkov, Institute of Solid State Physics RAS, Russian Academy of Sciences, Institutskaya 2, Mocow District 142432 Chernogolovka, Russia 26. Yuri Ozhigov, Kafedra Quantum Informatics, Moscow State University, VMK 2 Gum. Building, Vorobievi Gori, 119992 GSP-2 Moskow, Russia 27. Ivan Sokolov, V.A. Fock Institute of Physics, St. Petersburg State University, Ul'yanovskaya, 1198504 Stary Petershof, St.-Petersburg, Russia 28. Mário Ziman, Research Center for Quantum Information, Institute of Physics, Slovak Academy of Sciences, Dubravská cesta 9, 845 11 Bratislava, Slovak Republic 29. Antonio Acín, ICFO Institut de Ciencies Fotoniques, Meditarranean Technology Park, Av. Del Canal Olimpic, Castelldefels, 08860 Barcelona, Spain 30. Adán Cabello, Departamento de Física Aplicada II, University of Seville, Avda. Reina Mercedes s/n, 41012 Sevilla, Spain 31. Mohammed Bourennane, Physics Department, Stockholm Univeristy, Albanova universitetcentrum, 10691 Stockholm, Sweden 32. Hugo Zbinden, GAP-O, Université de Genève, 20, rue de l'Ecole-de-Médecine, 1211 Genève 4, Switzerland 33. Jeremy O’Brien, Department of Physics & Department of Electrical Engineering Merchant Venturers Building, Woodland Rd, BRISTOL BS8 1UB, UK 34. Ruediger Schack, Department of Mathematics, Royal Holloway University of London, Egham, TW20 0EX Surrey, UK 35. Ian Walmsley, Department of Physics, University of Oxford, Parks Road, OX1 3PU Oxford, UK 36. Robert Young, Toshiba Reserarch Europe Ltd., Unit 260 Cambridge Science Park, Milton Road, CB4 0WE Cambridge, UK 37. Constantin V. Usenko, Theoretical Physics Division, Physics Department, Univerity of Kyiv, Glushkova 2, 03127 Kyiv, Ukraine 38. Mark Hillery, Department of Physics, Hunter College, 695 Park Avenue, New York, NY 10021, USA 39. Alexei Trifonov, Ioffe Institute RAS, RUSSIA and MagiQ Technologies, Inc., 11 Ward Street, 02143 Somerville MA, USA 40. Marek Czachor, Technical University of Gdańsk, Narutowicza 11/12, 80-952 Gdańsk, Poland

ix

Technical Summary of the Workshop ˙ Compiled by Marek ZUKOWSKI The presentations and discussions of the workshop concentrated mainly around quantum cryptography (both technical and experimental aspects and pure theory), general problems of theoretical quantum information and its realizations (laboratories and applied physics), and finally the related topics concerning quantum theory itself – the most fundamental questions. The general feeling of both the organizers and the participants was that a very broad spectrum of advances in quantum information and communication was presented and discussed during the workshop.

1. Quantum cryptography • Massar discussed protocols for Quantum Communication. In his talk he covered three topics. First of all he discussed quantum coin tossing and quantum string flipping: the task in which two parties that do not trust each other want to generate a single random coin, or a string of random coins. He showed that better security is possible using quantum communication than classical communication. These results are illustrated by an experimental demonstration based on the plug and play scheme for quantum cryptography. Second, he presented a method, called error filtration, for detecting errors during quantum communication. An experimental demonstration was presented in which a quantum key distribution scheme which is insecure is rendered secure by using error filtration. Third, he presented preliminary results concerning a novel source of photon pairs: parametric fluorescence in periodically poled twin hole fibers. • Horoshko presented a definition of asymmetric universal entangling machine which entangles a system in an unknown state to a specially prepared ancilla. The machine produces a fixed state-independent amount of entanglement in exchange to a fixed degradation of the system state fidelity. We describe explicitly such a machine for any quantum system having d levels and prove its optimality. A d2 -dimensional ancilla is sufficient for reaching optimality. The introduced machine is a generalization to a number of widely investigated universal quantum devices such as the symmetric and asymmetric quantum cloners, the symmetric quantum entangler, the quantum information distributor and the universal-NOT gate. He discussed the application of the asymmetric universal entangling machine to eavesdropping on a quantum cryptographic line with BB84 or 6-state protocols and one-way error correction. The entangling machine is optimal for intercepting the key when the bit error rate in the line is higher than the maximal value required by the unconditional security.

x

• Kulik discussed the security of Quantum Key Distribution protocol based on ququarts. The QKD protocol with four-state system is based on single spatial and frequency non-degenerate down converted photons. A simple scheme for biphoton generation and their deterministic measurements was analyzed. Also he discussed the ways how to control the biphoton polarization state using optical fiber and Mach-Zehnder interferometer. The critical noise level was estimated for the measurement scheme operated with coincidence which is typical for biphotons. Three main incoherent attacks (intersept-resend, intermediate basis and optimal attack) on QKD protocol in Hilbert space with dimension D = 4 using three mutually unbiased bases were analyzed. QKD protocol with four-dimensional states belonging to three mutually unbiased bases provides better security against the noise and eavesdropping than protocols exploited two bases with qubits and ququarts. A intensive debate on the validity of this approach followed this talk. • Quantum information science overcomes a number of barriers for conventional information transfer, cryptography and computation (Bourennane). In quantum cryptography, and in particular in secret sharing protocol, a protocol where a secret message is split among several parties in a way that it reconstruction require the collaboration of the participating parties. It has been proven that assisted multipartite entanglement secret sharing protocol is secure. It has been also shown that quantum multiparty communication complexity protocols assisted with multipartite entanglement are clearly superior with respect to classical ones. However, so far the only quantum scheme that reached the stage of commercial application is quantum key distribution. Bourennane showed that one can experimentally realize multiparty communication complexity and secret sharing protocols by using single qubit communication. • Standard Quantum Key Distribution schemes base their security on Quantum Mechanics laws plus the assumption that the honest parties have a perfect knowledge on their devices. Actually, any protocol built from correlation data that do not violate any Bell’s inequality requires some assumptions on the devices for its security proof. On the other hand, starting from data producing a violation of a Bell’s inequality, it is possible to construct a QKD scheme without making any assumption on the devices (Acín). • Trifonov overviewed the recent progress of deploying quantum key distribution technique to be used in existing optical networks. He emphasized problems specific for optical networking, such as wavelength division multiplexing (WDM), routing of the signal, etc. The perspective and benefits of entanglement-based QKD was reviewed. • Zbinden discussed long distance quantum communication, practical QKD up to the goal of constructing quantum repeaters. He presented, experimentally demonstrated new protocol for practical quantum cryptography. An implementation with weak coherent pulses giving a high key generation rate. The key is obtained by a simple time-of-arrival measurement on the data line the presence of an eavesdropper is checked by an interferometer on an additional monitoring line. The setup is experimentally simple; moreover, it is tolerant to reduced interference visibility and to photon number splitting attacks, thus featuring a high efficiency in terms of distilled secret bit per qubit. He also presented recent results of a quantum teleportation experiment over installed optical fibers and a new source of coherent pho-

xi

ton pairs, which allows Bell-state measurements after many kilometers of fibers. These are a necessary ingredients for a future quantum repeater. • Walmsey discussed two novel protocols relevant to quantum information processing, specifically in quantum state detection and in quantum cryptography. First, he described an implementation of a new method for optimal state discrimination based on maximizing the a posteriori probability for correctly assigning the input state given a particular measurement outcome. This procedure enables each of three non-orthogonal states to be identified with probability 2/3 independent of the other states in the ensemble. Second, he analyzed the utility of the continuous degrees of freedom of photon pairs (e.g. the transverse wavevector and frequency) to enable a secure key distribution protocol with several bits per photon transmitted. It was shown that the security characteristics are not the same as those of conventional continuous variable cryptography, and that secure communications of about bits per photon over links with up to 25 dB of attenuation were possible with realistic source and detectors designs. This results from the inherent non-Gaussian character of the detector noise in single-photon measurements as compared with homodyne detection, which constrain the sorts of attacks that an eavesdropper may use and remain undetected. • Molotkov presented a free-space relativistic quantum cryptography. Whereas quantum cryptography ensures security by virtue of complete indistinguishability of nonorthogonal quantum states, attenuation in quantum communication channels and unavailability of single-photon source present major problems. In view of these difficulties, the security of quantum cryptography can change from unconditional to conditional. Since the restrictions imposed by non-relativistic quantum mechanics and used to formulate key distribution protocols are largely exhausted, new principles are required. The fundamental relativistic causality principle in quantum cryptography can be used to formulate a new approach to ensuring unconditional security of quantum cryptosystems that eliminates the aforementioned difficulties. Quantum cryptosystems of this kind should be called relativistic. It can be shown that relativistic quantum cryptosystems remain unconditionally secure: first, attenuation in a quantum communication channel can only reduce the key generation rate, but not the security of the key: second, the source may not generate pure single-photon states, and a nonzero single-photon probability will suffice. The scheme remains secure even if the contribution of a single-photon component is small. This formally implies that a state may be characterized by an medium mean photon number. • Czachor discussed the relation between Bohm’s interpretation of quantum mechanics and quantum cryptography based on entanglement (Ekert type protocols). He showed that standard quantum cryptographic protocols are not secure if one assumes that nonlocal hidden variables exist and can be measured with arbitrary precision. The security can be restored if one of the communicating parties randomly switches between two standard protocols.

2. General experimental methods for quantum communication • The guest of the workshop, Zeilinger, gave a broad introduction to various experimental methods used in test of quantum mechanics and in practical quantum

xii

•

•

•

•

•

communication. This ranged from the early neutron interferometry experiments, to test the linearity of the Schroedinger equation, up to the proposed quantum communication schemes with and via satellites. Banaszek presented a demonstration that passive linear-optics manipulations of optical codes capable of correcting for photon loss exhibit limitations resulting directly from the recoverability condition. A three-photon code protecting against a single photon loss was introduced. He also discussed its preparation and transformations using linear optics and auxiliary photons. Weinfurter showed that multiphoton entanglement is ideal for multiparty quantum communication. He reported observations of various states. They were analyzed for their entanglement, entanglement persistency. He also demonstrated multi party protocols realized in his lab, e.g., secret sharing and quantum telecloning. Grangier reported on the findings of the recent paper “Single photons for quantum information processing”. A brief review of existing single photon sources was given. Next he focused on experiments using single NV centers in diamond nanocrystals, which have been used for quantum cryptography (A. Beveratos et al., Phys. Rev. Lett. 89 (18), 187901, 2002) and for observing single-photon interferences (V. Jacques et al., Eur. Phys. J. D 35, 561-565, 2005). Finally he describe an experiment using individual Rubidium atoms trapped in a microscopic optical tweezer. This single-atom source can produce single mode single photons (B. Darquié et al., Science 309, 454, 15 July 2005), which are shown to be indistinguishable (J. Beugnon et al., Nature 440, 779, 6 April 2006), and thus potentially useful for linear quantum computing. Over the past 10 years, people have tried to link the technology of guided-wave optics to quantum communication protocols. One of the best examples was perhaps the demonstration, in 1998, by the Geneva Group of Applied Physics (GAP), that nonclassical quantum correlations were not affected when energy-time entangled photons are physically separated by more than 10 km using telecom optical fibers. The use of integrated optics on Lithium Niobate combined with quasi-phase matched second order non-linear interactions, extensively developed in their own laboratory on Lithium Niobate, were presented by Tanzilli within the framework of quantum communication experiments. This technology is very attractive as it allows the integration of various optical components on a single chip, such as entangled photon-pair sources based on spontaneous parametric down-conversion, electrically controllable beam splitters, and tapered waveguides. Eventually this implies eliminating the need for bulk optical interconnections by simple fiber pigtailing. Such integrated components permit the realization of compact, robust and efficient key elements for various quantum communication protocols such as photonic quantum interfaces and integrated quantum relays, which are presented individually. Kilin presented and advocated for diamond-based quantum information technologies Different color centers in diamond (NV, NE8, NV+N) have been considered. It was shown that these color centers are perspective for QI tasks. With the help of modern experimental techniques it is possible: (i) to store QI at the level of single electron and nuclear spins belonging to one color center, (ii) efficiently read-out QI written on quantum states of the spins, (iii) to control and to operate with the

xiii

systems of qubits (make Q-gates, purify and swap entanglement), (iv) to create single photon source integrated into optical fibers, (v) to implement quantum repeaters. Technological tasks towards practical implementations of diamond-based QIT have been discussed including: ultra-pure diamond thin films and nanocrystals, new color centers; fabrication of systems and arrays of defects by means of electron beam and ion (N+) beam lithography; incorporation diamond nanocrystals containing a single color centre inside micro-cavities, so as to enhance collection efficiency of the emitted photons • Young showed that single InAs quantum dots embedded can be a useful source of both triggered single photons as well as polarization-entangled photon pairs. The former was demonstrated with a second order correlation function under 0.05 and the latter with a fidelity exceeding 70%. Such quantum dot devices may be useful in quantum communications and quantum information processing. • Kazakov discussed theoretically exponential superradiance and macroscopic entangled states Interaction between ensemble of two-level identical atoms and three-mode light is considered, when one of the modes is classical and its Rabi frequency much exceeds the effective Rabi frequencies of the remainder modes to be quantized. It is supposed that initial states are coherent state for the first quantized mode and vacuum state for the second quantized mode. It was found that occupation number of each quantized mode can exponentially depend on the number of atoms and time and the field in the quantized modes may be entangled. The obtained entanglement is nearly perfect and results is an continuous analog of the maximally entangled EPR state of the light with macroscopic large number of photons. • The process of lossless light propagation in a transparent and extended atomic medium was discussed by Kupryanov in context of light-matter quantum interface. We consider the scheme when the fluctuating linear polarization components of the circularly polarized light wave effectively interfere with the alignment fluctuations in the spin subsystem of a spin oriented macroscopic atomic ensemble. For this particular process there is a convenient symmetric interaction between atomic alignment components and linear polarization Stokes components of light. This interaction can be employed for the creation of the quantum memory and in entanglement protocols. As a practically relevant example one can consider the interaction of a light pulse with the system of hyperfine transitions for D1 line of 87 Rb. The quality of the proposed protocols can be verified via evaluation of their basic characteristics and numerical analysis.

3. Quantum theory and quantum information • A novel theoretical approach to macroscopic realism and classical physics within quantum theory can be formulated Brukner. While conceptually different from the decoherence program, it is not at variance with it. It puts the stress on the limits of observability of quantum effects of macroscopic objects, i.e., on the required precision of our measurement apparatuses such that quantum effects can still be observed. Brukner shows that for unrestricted measurement accuracy a violation of macrorealism is possible for arbitrary large systems. Also, given the restric-

xiv

tion of coarse-grained measurement resolution, not only macrorealism becomes valid but even the classical Newtonian laws emerge out quantum laws. Classical physics can thus be seen as implied by quantum mechanics under the course grained measurements. • Aspelmeyer presented anexperimental test of nonlocal hidden variable theories. Nonlocal hidden variable theories are often being discussed as possible extensions of quantum theory. They could explain intrinsic quantum phenomena, above all quantum entanglement, by nonlocal interactions while maintaining a realistic description of nature. Up to now, however, no experiments have investigated such theories. He presented an inequality, similar in spirit to the one given by Clauser, Horne, Shimony and Holt (CHSH) on local hidden variables, that allows to test an important class of nonlocal hidden variable theories against quantum theory. The theories under test provide an explanation of all existing two-qubit Bell-type experiments. The derivation is based on a recent theorem by Leggett, which was extended to apply to real experimental situations and to simultaneously test against all local hidden variable models. Finally, an experiment was performed which showed violations of the new inequality and hence excludes for the first time a broad class of nonlocal hidden variable theories as possible models underlying quantum theory. • Ku´s discussed new measures of multiparticle entanglement: an approach to a quantitative characterization of entanglement properties of, possibly mixed, bi- and multipartite quantum states of arbitrary finite dimension. Particular emphasis was given to: 1) the derivation of reliable estimates which allow for an efficient evaluation of entanglement measures, 2) construction of measures of entanglement useful in the monitoring of the time evolution of multipartite correlations under incoherent environment coupling and experimental production of entangled states, 3) construction of quantities characterizing entanglement which are directly measurable (defined in terms of physically realizable operators). To this end were proposed generalizations of concurrence for multipartite quantum systems that can distinguish qualitatively distinct quantum correlations (generalized multipartite and multidimensional concurrences). A lower bound was derived for the concurrence of mixed quantum states, valid in arbitrary dimensions. As a corollary, a weaker, purely algebraic estimate was found, which can be used to detect mixed entangled states with a positive partial transpose. The monotonicity of the constructed quantities under local operations and classical communication (LOCC) was discussed. A necessary and sufficient condition for the monotonicity of generalized multipartite concurrences, what qualifies them as legitimate entanglement measures, was proposed. The constructed measures were used in an optical experiment showing that it is possible to directly quantify the pure-state entanglement via a measurement of a physical observable. Similar experiment could be, in principle, performed also in a multipartite case. • Essentially multivariate entanglement based schemes of quantum teleportation were presented by Sokolov. He examined some parallel models of quantum holographic teleportation and telecloning of optical images, based on essentially multivariate continuous variables entanglement. It was shown that one can consider the models as an extension of conventional holography to quantum domain. In particular, a new version of holographic teleportation and telecloning was described that

xv

•

•

•

•

allows for the color (frequency) conversion between the input and the teleported image(s), when an input image is teleported or telecloned to the output image(s) at different frequency with preservation of its original multimode quantum state. This new phenomenon may of importance for parallel quantum interface between light and resonant atoms, where it is often desirable to have a tunable source of light that does not change its quantum state in the tuning process. Horodecki M. discussed the quantum coding theorem, its new proofs, and the relation with privacy and distinguishability. Originally, the coding theorem was provided by Lloyd, Shor and Devetak. The first fully rigorous proof is due to Devetak, based on random CSS codes. The aim was to simplify the proof of coding theorem, and show that one can obtain it by applying various type of codes. Also, a formula was obtained that bounds so called “quantum error” in terms of distinguishability by receiver and by environment: the faithful transmission of quantum information requires that receiver can distinguish the codewords, while the environment cannot. the authors have quantified this relation, generalizing in this way its special application of Devetak. Horodecki K. showed that there are channels with zero quantum capacity but through which one can establish unconditionally secure key. This is achieved by showing, that we can verify untrusted key distillable states without need of quantum communication, but with just local measurements and classical communication. A general class of protocols was pinpointed, which distill key if only the channel allows to share key-distillable states. This applies even if the shared state is bound entangled. The authors also show how in certain cases turn this protocol into a prepare and measure one. The example of a two-qubit channel with zero quantum but nonzero private capacity, based on states already found in quantph/0506203 which allows for one-way prepare end measure key distillation is presented. Entanglement in continuous-variable systems is not as well understood as entanglement in finite-dimensional systems. Hillery discussed a class of inequalities whose violation shows the presence of entanglement in two-mode systems. The authors initially consider observables that are quadratic in the mode creation and annihilation operators and find conditions under which a two-mode state is entangled. Further examination allows one to formulate additional conditions for detecting entanglement that contain expectation values of arbitrarily high powers of creation and annihilation operators. It was shown how these conditions can be used to find inputs of optical devices that lead to entangled outputs. He also present non-Gaussian states whose entanglement can be detected by our new conditions but whose entanglement is not demonstrated by previously known conditions. Finally, he concluded by showing how the methods used here can be extended to find entanglement in systems of more than two modes. Ziman analyzed how entanglement between two components of a bipartite system behaves under the action of local channels of the form [E ⊗ I]. it can be shown that a set of maximally entangled states is by the action of [E ⊗ I] transformed into the set of states that exhibit the same degree of entanglement. The entanglement-induced state ordering is “relative” and can be changed by the action (in) (in) of local channels. That is, two states ρ1 and ρ2 such that the entanglement (in) (in) E[ρ1 ] of the first state is larger than the entanglement E[ρ2 ] of the second

xvi (out)

•

•

•

•

(out)

(out)

(out)

state are transformed into states ρ1 and ρ2 such that E[ρ2 ] > E[ρ1 ]. The result is that almost any unilocal channel affects the ordering for arbitrary (nondiscrete) entanglement measure. This implies a weaknesses of the concept of abstract entanglement measures. Majewski provided new arguments indicating that non-completely positive maps can describe open quantum evolution. In particular, it can be shown, that for the subsystem given by the fermionic algebra associated with n sites of 1D lattice, the reduced “hamiltonian” type dynamics is positive unital only, i.e. dynamical maps are given by non-decomposable transformations. Single photons are ideal systems for quantum information science applications – including quantum communication and quantum metrology – due to intrinsically low decoherence and easy one-qubit rotations. However, realizing twoqubit logic gates for quantum computation requires a massive optical nonlinearity. In 2001 Knill, Laflamme and Milburn (KLM) discovered that a “measurementinduced” nonlinearity can be realized nondeterministically using only single photon sources, linear optical networks, and single photon detectors. There have been a number of important theoretical improvements – including cluster state approaches to optical quantum computing – and experimental proof-o-principal demonstrations. In addition, it has been recognized that the measurement-induced optical nonlinearity at the heart of the KLM scheme can be applied to other quantum information protocols: including generalized quantum measurements, nonlinear absorption of single photons, and quantum metrology. O’Brien described an approach to building and characterizing entangling quantum logic gates for single photon qubits, along with recent architecture simplifications. Then he showed how optical nonlinearities can be used in the context of generalized measurements – i.e. non-destructive and arbitrary strength, for the realization of weak values, and as non-local measuring devices for a demonstration of non-locality without entanglement. Finally, he described how the ideas of KLM can be extended from non-linear phase shifts to non-linear absorption. Alicki presented a proof of a no-go theorem for storing quantum information in equilibrium systems. Namely, quantum information cannot be stored in a system with time-independent Hamiltonian interacting with heat bath of temperature T > 0 during time that grows with the number of used qubits. The result implies fundamental difference between quantum and classical information in physical terms. He also presented a general definition of a qubit and discuss its implications for two physical systems which might be used to carry quantum information. The first one, polarization degrees of freedom of light beam, can correspond to a qubit only for a single photon “beam”. In particular the amount of entanglement which can be encoded into two beams is inversely proportional to the larger averaged number of photons. Similarly, it was argued that the so-called superconducting qubits might be essentially classical objects that not carry genuine quantum information. Ozhigov attempted to substantiate an algorithmic approach to quantum mechanics, that can give the more appropriate mathematical formalism of quantum theory than the standard one. It can be shown how to construct the universal effective classical algorithm which can simulate quantum dynamics of n particles with the linear memory O(n). The decoherence is treated as the influence of the limitation

xvii

•

•

•

•

on the classical computational resources in the quantum simulation. He showed how Born rule for quantum probability arises from the existence of the grain of amplitude. He also represented an economical way of simulation of entanglement. Christandl discussed a new kind of quantum de Finetti theorem for representations of the unitary group U (d). Consider a pure state that lies in the irreducible representation Uμ+ν for Young diagrams mu and nu. Uμ+ν is contained in the tensor product of Uμ and Uν ; let ξ be the state obtained by tracing out Uν . It can be shown that ξ is close to a convex combination of states Uv , where U is in U (d) and v is the highest weight vector in Uμ . When Uμ+ν is the symmetric representation, this yields the conventional quantum de Finetti theorem for symmetric states, and the presented method of proof gives near-optimal bounds for the approximation of ξ by a convex combination of product states. For the class of symmetric Werner states, was given a second de Finetti-style theorem (“half” theorem); the de Finetti-approximation in this case takes a particularly simple form, involving only product states with a fixed spectrum. The proof uses purely group theoretic methods, and makes a link with the shifted Schur functions. It also provides some useful examples, and gives some insight into the structure of the set of convex combinations of product states. ˙ Zyczkowski conducted an analysis of ideal error correcting codes for randomized unitary channels determined by two unitary error operators – what we call “binary unitary channels” – on multipartite quantum systems. In a wide variety of cases one can give a constructive description of the code structure for such channels. Specifically, and find a practical geometric technique to determine the existence of codes of arbitrary dimension, and then derive an explicit construction of codes of a given dimension when they exist. For instance, given any binary unitary noise model on an n-qubit system, one can design codes that support n − 2 qubits. This is accomplishable by verifying a conjecture for higher rank numerical ranges of normal operators in many cases. Really the title of Gill’s presentation should have been “better Bell experiments”. He described the convex sets of joint probability distributions of outcomes of a Bell-type experiment with p parties, q measurements per party, r outcomes per measurement. One can distinguish between the big non-signalling polytope, the smaller quantum body, and the still smaller classical (local realism) polytope. A good experiment corresponds to supQ inf P D(Q : P ) where D is some distance measure, P varies through all local realist theories, and Q varies over the design space of the quantum experimenter (state, measurements, joint setting probabilities . . . ). Euclidean distance corresponds to noise resistance, relative entropy corresponds to statistical power. It turns out that the GHZ experiment is no better than CHSH according to the latter criterion, when implemented as in current experiments, and assuming everything perfect! There are many good conjectures to be made about 2 × 2 × r experiments (CGLMP inequalities) and the best experiments of this type use not-maximally entangled states! New ladder type experiments have been constructed, based on singlets, better than traditional CHSH (though using correlated settings). New CH-type inequalities have been derived for taking account of non-detections by seeing this as a 2 × 2 × 3 experiment. Cabello’s presentation was about Bell inequalities based on equalities. Bell’s original inequality can be considered the first of a family of Bell inequalities based on

xviii

Einstein-Podolsky-Rosen’s definition of elements of reality, whose scaling properties, together with some recent developments, like the possibility of achieving almost perfect correlations and the possibility of preparing pairs of particles in hyperentangled states make them useful to solve two still-open experimental problems: (i) The experimental verification that the violation of local realism grows exponentially with the size of the subsystems. (ii) The design of a loophole-free refutation of local realism with currently available photo-detection efficiencies. • Usenko pointed that one of the most interesting phenomena in quantum physics is the ability of quantum system to create information, for instance, in measurement of electron spins for an EPR-pair. This property is actively used in different areas of quantum physics, like Quantum Key Distribution. States of quantum system with such peculiarity are known as entangled states. Recently a lot of entangled states has been studied and there exists an urgent problem of classification of all the set of entangled states. Subject of the talk dealt with the idea of the invariance of entangled states under transformations of a group of symmetry. Each state of quantum system is invariant under phase coefficient thus composite system is to be invariant under transformations of the group of symmetry of each subsystem. These groups form the group of symmetry of the whole system so the set of all states of the system can be classified through irreducible representations of that group. Almost of each space of irreducible representation consists entangled states only. Entropy of sub-states from each space with nontrivial representation exceeds entropy of whole state. Excess of entropy of a subsystem over entropy of the whole system indicates the presence of entanglement in the system. An extended public discussion with Horodecki R followed the talk. • Schack asked the following fundamental question: In precisely what way are random numbers generated by a quantum device superior to classically generated random numbers? Properties of the generated string such as its algorithmic complexity are not directly relevant to this question, and then shows that any answer to this question must depend on the interpretation of probabilities, and thus on the interpretation of quantum states. Most authors interpret probabilities derived from quantum states as objective. The talk explained why the objectivist approach is unlikely to provide insight into the nature of quantum random numbers. Alternatively, quantum states can be interpreted in a subjectivist way as representing Bayesian degrees of belief. Within the subjectivist approach, one can formulate and prove a theorem that captures in a precise way what is uniquely quantum about quantum random numbers. ˙ • Zukowski presented new methods of deriving Bell inequalities, and new applications of Bell inequalities (especially in communication complexity problems).

xix

Contents Preface Marek Żukowski, Sergei Kilin and Janusz Kowalik

v

List of Speakers

vii

Technical Summary of the Workshop Marek Żukowski

ix

1. Quantum Cryptography Three Topics in Quantum Communication: Error filtration, Quantum String Flipping, Photon Pair Generation in Periodically Poled Twin Hole Fibers Serge Massar, Kien Phan Huy, Edouard Brainis, Anh-Tuan Nguyen, Marc Haelterman, Philippe Emplit, Nicolas Cerf, Louis-Philippe Lamoureux, David Amans, Costantino Corbari, Albert Canagasabey, Morten Ibsen, Peter G. Kazansky, Andrei Fotiadi, Patrice Mégret and Olivier Deparis

3

Entanglement and Eavesdropping in Quantum Cryptography Dmitri Horoshko and Sergei Kilin

11

Experimental Single Qubit Quantum Multiparty Communication Mohamed Bourennane, Christian Schmid, Pavel Trojek, Christain Kurtsiefer, Časlav Brukner, Marek Żukowski and Harald Weinfurter

22

Relativistic No-Cloning Theorem Sergey N. Molotkov and D.I. Pomozov

31

Fast Quantum Key Distribution with Photon Number Decoys Daryl Achilles, Ekaterina Rogacheva and Alexei Trifonov

37

Cryptographic Properties of Non-Local Correlations Antonio Acín, Nicolas Gisin, Serge Massar, Stefano Pironio and Valerio Scarani

50

2. Theory of Quantum Information A Coarse-Grained Schrödinger Cat Johannes Kofler and Časlav Brukner

63

Measures of Multiparticle Entanglement Marek Kuś

69

Bell Inequalities Based on Equalities Adán Cabello

75

A Quantum de Finetti Theorem for the Unitary Group Matthias Christandl, Robert König, Graeme Mitchison and Renato Renner

83

xx

Production of Information and Entropy in Measurement of Entangled States Constantin V. Usenko

89

Better Bell Inequalities Richard D. Gill

99

3. Production of Entangled States, Experimental Techniques The Entanglement of the Symmetric Four-Photon Dicke State Christian Schmid, Nikolai Kiesel, Wiesław Laskowski, Enrique Solano, Geza Tóth, Marek Żukowski and Harald Weinfurter

113

Security of Quantum Key Distribution Protocol Based on Ququarts Alexander P. Shurupov and Sergei P. Kulik

123

Linear-Optics Manipulations of Photon-Loss Codes Konrad Banaszek and Wojciech Wasilewski

133

Long Distance Quantum Communication: From Practical QKD to Unpractical Quantum Relays Hugo Zbinden, Alexios Beveratos, Nicolas Gisin, Olivier Landry, Rob Thew, Valerio Scarani, Damien Stucki and Jeroen van Houwelingen Generating Triggered Single and Entangled Photons with a Semiconductor Source Robert J. Young, R. Mark Stevenson, Andy Hudson, Paola Atkinson, Ken Cooper, David A. Ritchie and Andrew J. Shields Quantum Memory via Coherent Scattering of Light by Optically Thick Atomic Medium Oksana S. Mishina and Dmitriy V. Kupriyanov Exponential Superradiance and Macroscopic Entangled States Valery N. Gorbachev, Alexander Ya. Kazakov and Andrey I. Trubilko

139

146

155 163

4. Quantum Communication and Computation Quantum Cryptography: A Practical Information Security Perspective Kenneth G. Paterson, Fred Piper and Rüdiger Schack

175

Biased Reconstruction: Homodyne Tomography Dmitri Mogilevtsev, Jaroslav Řeháček and Zdenĕk Hradil

181

Entanglement Conditions for Two- and Three-Mode States Mark Hillery

190

Entanglement Measures: State Ordering vs. Local Operations Mário Ziman and Vladimír Bužek

196

Diamond-Based Quantum Information Technologies Sergei Kilin, Alexander Nizovtsev, Alexander Bukach, Jean-François Roch, François Treussart, Jörg Wrachtrup and Fedor Jelezko

205

xxi

Towards Quantum-Based Election Scheme Vladimír Bužek, Mark Hillery and Mário Ziman

215

Author Index

225

This page intentionally left blank

1. Quantum Cryptography

This page intentionally left blank

Quantum Communication and Security ˙ M. Zukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

3

Three Topics in Quantum Communication: Error filtration, Quantum String Flipping, Photon Pair Generation in Periodically Poled Twin Hole Fibers Serge MASSAR, a,1 Kien PHAN HUY a , Edouard BRAINIS b , Anh-Tuan NGUYEN b , Marc HAELTERMAN b , Philippe EMPLIT b , Nicolas CERF g , Louis-Philippe LAMOUREUX g , David AMANS c , Costantino CORBARI d , Albert CANAGASABEY d , Morten IBSEN d , Peter G. KAZANSKY d , Andrei FOTIADI e , Patrice MÉGRET e , Olivier DEPARIS f a

Laboratoire d’Information Quantique, Université Libre de Bruxelles, Brussels, Belgium b Service d’Optique et d’Acoustique, Université Libre de Bruxelles, Brussels, Belgium c Université de Lyon, F-69003, Lyon; Université Lyon 1, F-69622 Villeurbanne; CNRS, UMR5620, Laboratoire de Physico-Chimie des Matériaux Luminescents, F-69622 Villeurbane, France d Optoelectronic Research Centre, University of Southampton, Southampton, United Kingdom e Service d’Electromagnétisme et de Télécommunications, Faculté Polytechnique de Mons, Mons, Belgium f Solid State Physics Lab., Facultés Universitaires Notre-Dame de la Paix, Namur, Belgium g QUIC, CP 165/59, Université Libre de Bruxelles, Brussels, Belgium Abstract. We briefly present three topics in quantum communication. First of all a method, called error filtration, to reduce errors during quantum communication. We apply this method to quantum cryptography in a noisy environment, and describe an experimental realisation thereof. Second we describe an experimental realisation of quantum string flipping, in which two parties that do not trust each other want to generate a string of random bits. Finally we present the experimental realisation of a source of photon pairs at telecommunication wavelengths based on parametric fluorescence in periodically poled twin hole fibers. Keywords. Quantum communication, error filtration, string tossing, parametric fluorescence, periodically poled twin hole fibers

1 Corresponding Author: Serge Massar: Laboratoire d’Information Quantique, CP 225, Université Libre de Bruxelles, Boulevard du Triomphe, B-1050 Bruxelles, Belgium; E-mail: [email protected].

4

S. Massar et al. / Three Topics in Quantum Communication

Introduction At the NATO Advanced Research Workshop "Quantum Communication and Security" several results in the field of quantum communication obtained by the group at Université Libre de Bruxelles and their collaborators were presented. The first two topics are concerned with applications, other than the usual Quantum Key Distribution (QKD), which can be realised with the techniques[1] developped for long distance QKD in fiber optics at telecommunication wavelengths (1550nm). First of all we presented a method to reduce errors in quantum communication [2] and an implementation thereof[3]. Second we presented an experimental realisation of quantum string flipping[4], which is the task of generating, using only (quantum) communication, a string of random bits, between two parties that do not trust each other. This shows that fiber optics is a versatile medium in which to carry out quantum information processing. The above two applications use attenuated coherent pulses as a substitute for a true single photon source. However for some applications of quantum communication, such as those based on quantum non locality, or realisation of quantum relays, one needs entangled photons. The third topic presented at the workshop was the realisation of a source of photon pairs based on periodically poled twin hole fibers that produces photon pairs at 1550nm. As the source is entirely fiber based it could be easily integrated into telecommunication networks. The first two results have already been published, but not the last topic. For this reason in what follows we shall pass very rapidly on the first results, and present more in depth the photon pair source.

1. Error Filtration Error correction is an essential feature of information theory. Indeed it guarantees that, given the inevitable presence of imperfections, one can nevertheless store and transmit information reliably. The proof that one can in principle correct errors that occur in quantum memories[5] and in quantum communication[6] means that all the idealised protocols of quantum information invented by theorists can in principle be realised in a real world environment. However such error correction schemes are very difficult to implement in practice because they require multi particle interactions. So far only a few proof of principle laboratory demonstrations have been realized. A simpler approach is to only try to detect if errors occured. If an error is detected, the message is discarded: one only keeps the occurences when no error was detected. This is of course much weaker than error correction. But if the error rate is not too high, it may suffice for some applications, such as quantum key distribution (QKD). In [2] it was shown that such an approach can be easily implemented using present technology. Such a realisation of error detection was called “error filtration”. Error filtration can be applied when one can encode a small dimensional system, say one qubit, in a single particle. One then encodes this quantum state in a Hilbert space of large dimension. This encoding must be done in such a way that the Hilbert space H can be decomposed into a sum of Hilbert spaces H = ⊕i Hi such that the noise acts independently on the different subspaces Hi . It is then possible, using an interferometer, to detect with high probability whether an error has occurred, and, if so, to discard the state.

S. Massar et al. / Three Topics in Quantum Communication

5

Thus let us suppose that the Hilbert spaces Hi all have dimension d and that one prepares a d dimensional quantum state |ψ of a single particle. One then puts this particle N into an equal superposition of the difference “channels”: |ψ → √1N i=1 |ψi  where |ψi  ∈ Hi . The effect of noise can always be modeled as the entanglement of the system with an environment. The hypothesis that the noise is independent corresponds to the fact that the different channels get entangled with orthogonal environments. This can always be realised by separating the channels sufficiently far either in space or in time. Thus one obtains the state N N 1  1  √ √ Ui |ψi |0 = α|ψi |0 + β(W |ψi )|Ei  N i=1 N i=1

(1)

where Ui describes the interaction of channel i with its environment, we have supposed that if the environment of channel i is unchanged then the state propagating in that channel is unchanged, and W is an operator acting on the state. Finally we recombine the channels in such a way that if there is no noise (α = 1, β = 0) the state exits a single output channel. In the presence of noise, the state in the output channel is α|ψ|0 + β(W |ψ)

N 1  |Ei  . N i=1

(2)

One sees that whereas the weight of the first term |α|2 is independent of N , the weight of the second term decreases as 1/N . Thus the probability that the state is affected by noise decreases as 1/N , and in the limit of large N the state is completely unaffected by noise. Our experimental implementation of error filtration [3] is described in Fig. 1. In this implementation a 2 dimensional state, corresponding to 2 time bins propagating in optical fibers, is produced using a short laser pulse and an unbalanced Mach-Zehnder interferometer. Subsequently each time bin is transformed, using a second Mach-Zehnder interferometer, into a superposition of two time bins. This superposition of 4 time bins is then sent from Bob to Alice. Alice encodes  a quantum state using a phase modulator, in such as way to obtain a state of the form |0 + |1 + eiφ |2 + eiφ |3 /2. Corresponding to an encoding when N = 2 and the dimension of each Hilbert space Hi is 2. This state is reflected back to Bob’s site by a Faraday mirror at Alice’s end of the fiber. The decoding of the error filtration and the measurement of the state is carried out using the same Mach-Zehnder interferometers that were used to produce the superposition of 4 time bins to start. Using this setup we were able to transform (the optical part of) a QKD scheme that was too noisy to produce a secure key into a QKD scheme that was secure.

2. String Flipping Coin tossing is a cryptographic primitive in which 2 parties which do not trust each other want to choose a random bit. Any classical communication protocol that does not use a trusted third party is necessarily completely imperfect: one of the parties can cheat perfectly. String flipping is a generalization in which the two mistrustful parties want

6

S. Massar et al. / Three Topics in Quantum Communication l p1 C

id200

c1

p2

2l

PBS

Filtration

p3

pB ΦB

c2

ΦA

⊕

PC

Pulse/delay gener.

Bob

Noise gener.

A Laser

Patterns gener. Conv. : time → num.

FM

pA

c3

Alice

Figure 1. Experimental setup for error filtration: A, Attenuator; C, Circulator; PBS, Polarisation Beam Splitter; FM, Faraday Mirror; φA and φB , Phase Modulators; id200, Single Photon detector (IDQuantique); c1 , c2 , c3 , 50/50 couplers; p1 , p2 , p3 , pA , Polarisation Controllers; l and 2l, delay lines in the two interferometers of length l and 2l.

to choose a string of n random bits. Classical protocols exist which generate strings with high, but not perfect, randomness. In particular one of the parties can always cheat perfectly on a one bit function of the string, so that no contradiction is obtained with the single coin constraint. It is known that using quantum communication two parties can generate a coin with a non zero degree of randomness, thereby doing better than any classical protocol. In [4] we reported on a fiber optics implementation of a string flipping protocol. Very carefull attention was payed to how much a quantum adversary could cheat, and how much he could bias the string. Strict bounds on the quality of the string were obtained. However, as mentioned above, classical protocols exist which can generate strings with a high degree of randomness. It is therefore not clear whether this experiment attained a degree of randomness impossible classicaly.

3. Photon Pair Production in Periodically Poled Twin Hole Fibers Since several years, photon pairs have become an important resource for quantum communication. Lately, effort has been concentrated on generating those pairs in waveguiding structures to avoid collection and insertion losses. For instance, photon pair sources based on parametric fluorescence in periodically poled lithium niobate waveguide or on four-wave mixing in silica fibre have been extensively studied. In 1999, G. Bonfrate et al. reported the observation of quasi-phase matched parametric fluorescence in periodically poled D-shape silica fiber [7]. This suggested another promising photon pair source based on second-order non linearity in fiber. However, since that first demonstration, no further results have been reported on parametric fluorescence in periodically poled silica fiber. Here we report the observation of quasi-phase matched parametric fluorescence in periodically poled twin-hole silica fiber (PPSF). Compared with the periodically poled D-shape fibers used in [7], twin-hole fibers have several advantages: they can be directly spliced to optical fibers so that any photon pair is readily collected. Moreover, the technology for periodic poling in twin-hole fibers is compatible with tens of centimetres of interaction lengths, thus potentially ensuring higher conversion efficiency compared to D-shape fibers. Finally longer interaction length also induces narrower spectral width of

S. Massar et al. / Three Topics in Quantum Communication

7

the created photon pairs which makes quantum communication schemes easier to implement. The twin-hole fiber we used has a slightly elliptical core of diameter 3 × 3.3 μm and a numerical aperture of 0.27 ± 0.01. For poling, gold plated tungsten wires having 25 μm diameters were inserted in the two holes of the twin-hole fiber. The poled area is defined by the region where the electrodes overlapped. The fiber is placed on top of a hot plate and poling was carried out in air by heating the fiber to 250 o C with 4 kV applied. Cooling down to room temperature occurred in a few seconds as the heater was removed from under the fiber. After poling, the wires were extracted from the sample and the device spliced to standard telecom fiber (SMF-28). The periodic nonlinearity for quasi-phase matching was created step by step, by focusing, on the core of the poled fibre, the 5 mW output from a frequency doubled Ar+ -laser (λ = 244 nm, spot size 2w0 = 5 μm× 350 μm) and translating the fiber relative to the focused spot with a stage. The UV light was flashed intermittently in synchronization with the movement of the stage. As mention before, the 8 cm long poled region was spliced to standard single mode optical fiber at both ends to make easier the injection of the pump beam and the collection of the photon pairs. However in this sample, the mode matching the twin-hole fiber and the single mode fiber was not optimized, leading to significant losses at the splices. This prevents us from knowing exactly how much pump power we inject in the fundamental mode of the poled fiber. This same sample has already been used in other experiments based on second harmonic generation[8]. The experimental setup is described in Fig.2. It consists of cw Ti-Sa laser tunable around 775 nm. The polarization of the pump beam is adjusted using a polarizing beam splitter (PBS) and a half-wave plate (HWP). The pump power is chosen by the mean of neutral-density filters (NF). The pump is injected in the fiber through a ×20 microscope objective. Finally, at the output of the fiber, the pump is removed by dielectric long-wave pass filters (LWP) and then sent to an InGaAs/InP avalanche photodiode operating as single photon detector (APD’s - ID Quantique’s id200).

Figure 2. Experimental setup: ISO, isolator; PBS, polarizing beam splitter; NF, neutral density filter; HWP, half-wave plate; X20, microscope objective X20; SMF, single mode fiber; PPSF, periodically poled silica fiber; LWP, long-wave pass filter; APD, avalanche photodiode; TAC, time to amplitude converter

By carefully scanning the wavelength and the polarization of the pump field, we have found the poling resonance to be at 778.2 nm, leading to the generation of a degenerate signal field at 1556.4 nm in the fiber-optic communication band (Fig.3). This has been confirmed by independent measurements based on second harmonic generation (SHG)

8

S. Massar et al. / Three Topics in Quantum Communication

in this same poled fiber [8]. At the maximum gain, the measured signal power is 0.2 pW. The pump power at the output of the single mode fiber was 20 mW which is 15 times smaller than the value reported in Ref.7. Theoretically, at degeneracy and in the low gain condition, the signal power can be approximated by Psignal ≈

¯ ωs h Bω ηSH Ppump 2π

(3)

where ηSH the second harmonic generation efficiency and Bω is the FWHM of the signal spectrum in rad/s. At degeneracy, in a second order approximation, the latter reads  Bω =

2π δ 2 βs δωs2 |ωs0 L

(4)

where βs is the signal wave vector, ωs0 the signal pulsation at degeneracy and L the length of the poled section. δ 2 βs δωs2 |ωs0 has been estimated using the method described in Ref.9 and based on white light interferometry, leading to a signal spectral width of 17 THz. The second harmonic efficiency ηSH has been measured to be 0.02 %/W. Using Eq.3, this lead to a signal power of 8.7 pW at the output of the poled section. The losses induced from the splice (not optimized) and the pump filtration setup have been estimated to -11 dB. Combined with the 10% detection efficiency of our detector, this leads to a predicted output power of 3.6 pW fW in qualitative agreement with parametric fluorescence measured value. The residual discrepancy is attributed to the imprecision on value of the pump power injected in the fundamental mode of the poled fiber. Finally, we estimated the conversion efficiency Psignal /Ppump at 9 · 10−11 . If all the pump power was injected in the fundamental mode, we estimate that the conversion efficiency would be 4 · 10−10 which is almost an order of magnitude higher than the value (6.4 · 10−11 ) reported in Ref.7. The signal was also sent to two single photon detectors via a 3dB fiber coupler. A time to amplitude converter (TAC) allowed us to plot the delay between the detection times of the two APD’s. In the setup, one of the two photon of a pair has to travel 3m of fiber more than the other; it corresponds to a 15 ns delay between the photons arrival times at the detectors. Thus, the presence of a peak at 15 ns in the histogram is a strong sign that the measured signal arises from photon pairs created by parametric fluorescence in the poled fiber. A signal to noise ratio (SNR) of 2 is obtained (Fig.4) improving the 1.5 SNR reported in Ref.7. This could still be significantly improved by reducing the losses of the splices between the poled section and the single mode fiber, and by using an all fiber setup to remove the pump. In conclusion, we show that with lower pump power than previously [7], we were able to observe parametric fluorescence in periodically poled silica fiber and measure a coincidence peak with a SNR of 2. The poled region was spliced to standard single mode fibers which ensures that the source could be easily integrated in fiber-optics quantum communication applications. Finally, today, poled fibers up to 25 cm long and nonlinearity up to four times the one induced here, are available. This promisses large improvements for a photon pair source based on parametric fluorescence in periodically poled twin-hole silica fiber.

S. Massar et al. / Three Topics in Quantum Communication

9

Figure 3. Measured parametric fluorescence power to pump power ratio versus pump wavelength. The periodic poling resonance lies at 778.2 nm.

Figure 4. Number of coincidences measured in 3 hours with 20 mW pump injected into the fiber. (Note that the amount of pump power coupled to the fundamental mode is different than reported in the main text). The presence of a peak in the histogram is a strong sign that the measured signal arises from photon pairs created by parametric fluorescence in the poled fiber.

Acknowledgements We acknowledge the support of the Fonds pour la formation à la Recherche dans l´Industrie et dans l´Agriculture (FRIA, Belgium), of the Interuniversity Attraction Pole program of the Belgian government under Grants IAP5-18 and IAP6-10, and of the EU project QAP.

10

S. Massar et al. / Three Topics in Quantum Communication

References [1] [2] [3]

G. Ribordy, J-D. Gautier, N. Gisin, O. Guinnard and H. Zbinden, Elect. Lett. 34, 2116 (1998). N. Gisin, N. Linden, S. Massar, S. Popescu, Phys. Rev. A, 72, 012338 (2005). L.-P. Lamoureux, E. Brainis, N. J. Cerf, Ph. Emplit, M. Haelterman, and S. Massar, Phys. Rev. Lett. 94, 230501 (2005). [4] L. P. Lamoureux, E. Brainis, D. Amans, J. Barrett, and S. Massar, Phys. Rev. Lett. 94, 050503 (2005). [5] P. Shor, Phys. Rev. A 52, 2493 (1995). [6] C. H. Bennett, et al., Phys. Rev. Lett., 76, 722 (1996). [7] G. Bonfrate, V. Pruneri, P.G. Kazansky, P. Tapster and J.G. Rarity, Appl. Phys. Lett. 75, 2356 (1999). [8] A.Fotiadi, O. Deparis, P. Mégret, C. Corbari, A. Canagasabey, M. Ibsen, P.G. Kazansky, CLEO/QELS 2006 Long Beach 21-26 May 2006 CTuI3 "All fiber frequency doubled Er/Brillouin laser". [9] P. Merritt, R.P. Tatam and D.A. Jackson, J. Lightwave Technol. 7(4), 703 (1989).

Quantum Communication and Security ˙ M. Zukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

11

Entanglement and Eavesdropping in Quantum Cryptography Dmitri HOROSHKO 1 , Sergei KILIN B.I. Stepanov Institute of Physics, Belarus National Academy of Sciences, Minsk 220072 Belarus Abstract. We discuss the importance of entanglement creation for successful eavesdropping in quantum cryptography. We give a definition of asymmetric universal entangling machine which entangles a system in an unknown state to a specially prepared ancilla. We describe explicitly such a machine for any quantum system having finite number of levels and prove its optimality. We show that the asymmetric universal entangling machine is a device, required for optimal individual eavesdropping on the 6-state protocol of quantum cryptography. Keywords. Entanglement, entangling machine, quantum cryptography

Introduction The main topic of interest of the modern quantum cryptography is quantum key distribution (QKD), a technology for generating two identical random sequences of bits at two stations, Alice’s and Bob’s, by means of a quantum channel in such a way that any successful attempt to eavesdrop on the channel is detectable [1,2]. The last property of a QKD line is crucial for the possibility to use the generated sequences as a secure cryptographic key. Therefore, the analysis of possible eavesdropping attacks is absolutely indispensable for determining the security of a given QKD protocol. In a typical realization of QKD line Alice encodes a single photon in one of several possible polarization or phase states and sends it down the optical fibre to Bob, who decodes the state of the photon by quantum measurement, obtaining a bit for his sequence. Let us look at the QKD line from the viewpoint of the eavesdropper Eve, who can get access to the fibre and manipulate photons on their way to Bob. What is the general strategy for Eve? The common answer to this question is: cloning of photons. Indeed, obtaining imperfect clones of photons and storing them in quantum memory, Eve can measure them later at convenient moment and obtain some information about the key. However, building a cloning machine [3,4] is a rather complicated task. Perhaps, the goal can be reached by simpler tools? To answer this question let us look at classical cryptography. In classical cryptography Alice sends a message to Bob by a classical channel, e.g. electrical wire, and the Eve’s primary goal is to get an exact copy of this message for future analysis. From the 1 Corresponding Author: Dmitri Horoshko, B.I.Stepanov Institute of Physics, NASB, Nezavisimosti Ave., 68, Minsk 220072 Belarus; E-mail: [email protected].

12

D. Horoshko and S. Kilin / Entanglement and Eavesdropping in Quantum Cryptography

viewpoint of information theory the copy of message, stored in the memory of Eve’s computer is a "clone" of the message in the channel. However, from the physical viewpoint the state of the memory cell is by no means a "clone" of an electric pulse in the wire. It is more correct to say that the state of the memory cell is correlated to the state of the wire. Therefore, the main goal of Eve is to produce correlation. Coming back to quantum scenario, we conjecture that the Eve’s goal is to reach the maximal possible correlation between the state of the quantum memory cell and the state of photon in the fibre. In the quantum world the maximal correlation is given by entanglement. Therefore, the Eve’s strategy is formulated as: entangling photons to memory. Thus, for the purpose of eavesdropping Eve needs a machine producing entanglement between unknown state of photon and the known initial state of the memory cell. In the present paper we study such a machine from the first principles. Quantum machines generating entanglement in a universal (input state-independent) way have been considered by Bu z˘ ek and Hillery [5] and by Alber, Delgado, and Jex [6]. Both approaches aim at entangling two similar systems (having the same number of levels) in either symmetric [5] or antisymmetric [6] way. The former type of entangling interaction has been recently realized (probabilistically) in an experiment [7]. In the present paper we develop an alternative approach which does not require two systems to be similar to one another (a memory cell may have more levels for quantum encoding than a photon). As a consequence, our approach does not impose any symmetry condition on the output, and the machine of our interest can be called asymmetric universal entangling machine (AUEM). As we will see later, to obtain a non-trivial machine we will need to impose an additional constraint, linking the machine output to its input.

1. Definition of machine We consider a signal system S having a state space H S of d dimensions and initially prepared in an unknown state |ψ S . Another quantum system A with a state space H A of da dimensions is called ancilla; it is initially prepared in a definite state |Blank A . We define quantum entangling machine as a physical device which takes as input these two systems and produces as output two systems S  and A with the same number of dimensions of state space d and d a respectively. In the future we will often omit primes and call the output systems S  and A “signal” and “ancilla” as well, though they are not necessarily the same physical objects which entered the machine. We demand for our machine that the joint state of signal and ancilla at the output is a pure state |Ψ SA , which generally is not a product of two local states, i.e. a state for S  and a state for A . To obtain a universal (input state independent) quantum entangling machine we demand that the degree of entanglement contained in |Ψ SA is independent of the input signal state |ψS . The entanglement for pure states is defined as von Neumann entropy of the signal system alone [8]: E = −T r {ρS log2 ρS } ,

(1)

where ρS is the density operator of the signal at the output of the entangling machine:   ρS = T rA |ΨSA SA Ψ| . (2)

D. Horoshko and S. Kilin / Entanglement and Eavesdropping in Quantum Cryptography

13

The entanglement E defined in Eq. (1) varies within the limits 0 ≤ E ≤ log 2 d, with E = log2 d realized for maximally entangled systems and E = 0 for statistically independent ones. Now the condition of universal entanglement can be formulated as follows: a machine should produce the same amount of entanglement E for any input signal state |ψS . However, this condition alone can be satisfied by a trivial machine with da = d, which discards the input and produces as output the maximally entangled state d of signal and ancilla: |Ψ max SA = √1d k=1 |ψk S |φk A , where |ψk S and |φk A are two sets of orthonormal vectors in the state spaces of signal and ancilla respectively. The entanglement of the output is E = log 2 d and of course it does not depend on the input state which is simply discarded. To obtain a non-trivial machine it is necessary that the output state, but not the degree of its entanglement, be related in some way to the unknown input state of the signal. The most simple and natural way to do this, is to demand some “similarity” between the output and the input of the signal system: the signal output should in some sense “resemble” the input, so that the latter cannot be discarded. A natural measure of similarity of two quantum states is the so-called fidelity [9]. In our case the fidelity between the signal output and the signal input is defined as F = S ψ| ρS |ψS ,

(3)

and we may formulate the condition of universal similarity as follows: a machine should change the signal system in such a way that the fidelity of the signal output with respect to the signal input is constant for any input signal state |ψ S . Thus we define an AUEM as a physical device having as input systems S and A in states |ψS and |BlankA respectively and producing as output systems S  and A in a pure state |ΨSA such that both entanglement Eq. (1) and fidelity Eq. (3) are independent of the state |ψS . We suppose that the entanglement is non-zero and the fidelity satisfies 1 1 d < F < 1. The fidelity equal to or below d is not interesting because in this case the output is not more similar to the input than the totally mixed state with the density matrix I/d, where I is the unity matrix. We expect that E(F ) will be a decreasing function of F , i.e. that we need to “pay” for the entanglement by a degradation of the signal state fidelity. The obvious limiting points are E( 1d ) = log2 d (trivial machine above) and E(1) = 0 (no interaction). The most important question now is if the machine defined in this way is possible to realized by physical means. If AUEM would prove to be possible, another important problem would be to find the optimal machine, producing maximal degree of entanglement for a given degradation of the signal state fidelity.

2. Properties of optimal machine Let us suppose that the entangling machine defined in the previous section is possible and analyze the properties of the optimal one. While deducing the properties of the optimal machine we will find its explicit form and thus prove its existence. 2.1. Purity In the definition of the entangling machine we demanded that the joint output state of signal and ancilla is pure. Let us now show that if this state is mixed, entanglement is

14

D. Horoshko and S. Kilin / Entanglement and Eavesdropping in Quantum Cryptography

not greater. Suppose that the joint state of the signal and the ancilla at the output of the entangling machine is a mixed state ρ SA . The entanglement of this state can be measured by a measure such as the entanglement of formation [10], which is found in the following way. First we unravel the state ρ SA , i.e. represent it as a sum of pure states with some weights, then calculate the entanglement of each pure state according to Eq. (1) and take a weighted sum of them, which will give us the entanglement of that unravelling. The minimum of this quantity over all possible unravelling of a mixed state is called its entanglement of formation. For pure states it coincides with the entanglement given by Eq. (1). It has been proven that the entanglement of formation is the upper bound for all other measures of entanglement [11]. Let us denote the entanglement of formation of ρ SA as E  . Now we wish to show that for the same output signal state ρ S = T rA ρSA we can construct a machine producing no less entanglement than E  , but having pure state at the output. The output state ρ SA , as any mixed state, can be purified on a larger state space: a second ancilla Z can be added and a pure state |Λ SAZ can be found on the state space of the signal and both ancillas, such that ρSA = T rZ {|Λ Λ|}. It can be easily proven from the convexity of von Neumann entropy that E  is not greater than the entanglement between S and AZ in |ΛSAZ (see the second Lemma in Ref. [10]). It means that for any mixed output state ρSA we always can construct another entangling machine with a bigger ancilla and pure output |Λ SAZ , which produces no less entanglement and results in the same transformation of the signal state. 2.2. Output state of the optimal machine Now we analyze the structure of the pure output state of our machine. As any bipartite pure state, it can be written in the form of Schmidt decomposition |ΨSA =

d  k=1

λk |ψk S |φk A ,

(4)

where {|ψk S , k = 1, ..., d} is an orthonormal basis in H S , {|φk A , k = 1, ..., d} is an orthonormal set of vectors in H A , whose dimensionality is d a ≥ d, and λk are some complex numbers (Schmidt coefficients), satisfying the normalization condition d 2 k=1 |λk | = 1. We accept that the vectors are numbered so that |λ 1 | ≥ |λ2 | ≥ ... ≥ |λd |. The input signal state can be decomposed in the basis {|ψ k S , k = 1, ..., d} as: |ψ =

d 

ck |ψk ,

(5)

k=1

 where ck are complex numbers, satisfying the normalization condition dk=1 |ck |2 = 1. Now the fidelity, Eq. (3), and the entanglement, Eq. (1), can be expressed as F =

d 

|λk |2 |ck |2 ,

(6)

k=1

E = H(|λ1 |2 , |λ2 |2 , ..., |λk |2 ),

(7)

D. Horoshko and S. Kilin / Entanglement and Eavesdropping in Quantum Cryptography

15

d where H(x1 , x2 , ..., xd ) = − k=1 xk log2 xk , is Boltzmann’s H-function. Now our task is to find such form of the output state which (i) maximizes E for given F and (ii) maximizes F for given E. We start with solving the first problem. Let us consider F and E as functions on the coordinate space V created by {|λ k |2 } and {|ck |2 }, satisfying the normalization conditions and the ordering of λ’s. Let us define on V a subspace V 0 by |c1 |2 = 1. Now, for given F on V 0 : |λ1 |2 = F and the entanglement is E0 = −F log2 F + H(|λ2 |2 , |λ3 |2 , ..., |λd |2 ).

(8)

The H-function is maximal when all its arguments are equal. Letus denoteby V 1 the one-parameter subspace of V 0 with |λ2 |2 = |λ3 |2 = ... = |λd |2 = 1 − |λ1 |2 /(d − 1). On this subspace E0 reaches its maximum E 0max = hd (F ), where the function h d (F ) is defined as hd (F ) = −F log2 F − (1 − F ) log2

1−F , d−1

(9)

and has the meaning of maximum of the H-function over d arguments summing up to unity, with the fixed maximal argument F . This function is strictly decreasing for 1/d < F < 1, because its derivative h d (F ) = log2 [(1 − F )/(F d − F )] is strictly negative in this region. In the entire space V the relation |λ 1 |2 ≥ F holds (from Eq. (6)) and for any given λ 1 , the entanglement is bounded from above by the value h d (|λ1 |2 ) (from the meaning of the latter). Since h d (F ) is a decreasing function of F , it follows that E ≤ hd (|λ1 |2 ) ≤ hd (F ) = E0max , i.e. E0max is the entanglement maximum for the given fidelity. Now we turn to the second problem. Let us fix the entanglement E 1 satisfying 0 < E1 < log2 d. We define the fidelity F1 by equation h d (F1 ) = E1 , which has a unique solution, since h d (F ) is strictly decreasing on 1/d < F < 1. This fidelity corresponds to a point in the subspace V 1 (see above). Let us prove that F 1 is the fidelity maximum for the given entanglement. Suppose that there is a point in V, giving the fidelity F2 > F1 and entanglement E 2 . The maximal value of E 2 is given by hd (F2 ), as proven above. Since the function h d (F ) is strictly decreasing on 1/d < F < 1, it follows that max(E2 ) < E1 , that is, the value E1 is unreachable for fidelity higher than F 1 . This completes the proof. Summing up, we see that there is a one-parameter subspace (V 1 ), where both conditions (i) and (ii) are satisfied simultaneously. On this subspace |ψ S = |ψ1 S and the output state can be written as |ΨSA =

√

F |ψS |φ1 A +

d 1−F  |ψk S |φk A , d−1

(10)

k=2

where the phases of coefficients are absorbed by {|φ k }. Both the fidelity F and the entanglement E = hd (F ) of the state Eq. (10) are independent of the input state |ψ S , and therefore, a machine transforming |ψ S |BlankA into the state Eq. (10) is an AUEM and an optimal AUEM. We still need to prove that such a machine exist. It will be done in the next subsections by deducing the explicit form of the necessary unitary transformation.

16

D. Horoshko and S. Kilin / Entanglement and Eavesdropping in Quantum Cryptography

2.3. Transformation of signal state Now we look how the optimal AUEM is “seen” by the signal system alone. For the signal the AUEM acts as a quantum channel, which transforms its state from a pure state |ψ ψ| to a mixed state ρS . This transformation can be found by substituting Eq. (10) into Eq. (2), which gives ρS = (1 − πs ) |ψ ψ| +

πs I, d

(11)

where πs is connected to F by the relation F = 1 − π s + πs /d. The quantum channel defined by Eq. (11) is called “depolarizing channel” and the parameter π s varying from 0 to 1 is known as “depolarized fraction”. The depolarizing channel is typically taken as the starting point for the discussion of universal quantum machines, e.g. quantum cloners [3,4]. In contrast, we start with the most general form of channel and show that the depolarizing one is optimal for our purpose. 2.4. Generalized Bell states and generalized Pauli operators In the future it will be useful to implement the formalism of generalized Bell basis and Pauli operators to systems with number of dimensions greater than 2 [4,12]. Let us consider two quantum systems X and Y having state spaces H X and HY respectively of d dimensions each. We denote by |j X and |jY , j = 0, ..., d − 1, the orthonormal bases in HX and HY respectively. Generalized Bell (GB) states on H X ⊗ HY are: d−1

1  2πi(jn/d) |ψmn XY = √ e |jX |j + mY , d j=0

(12)

where the indices m and n take values from 0 to d − 1. Note that here and below the summation in all indices is taken modulo d. The states Eq. (12) are normalized to unity and mutually orthogonal, thus creating an orthonormal basis on H X ⊗ HY . For d = 2 these states coincide with the usual Bell basis. We also introduce on each space H X and HY a set of d2 generalized Pauli operators: Um,n =

d−1 

e2πi(kn/d) |k + m k|,

(13)

k=0

where m and n again run from 0 to d − 1. For d = 2 these operators are proportional to Pauli spin operators: U 0,1 = σz , U1,0 = σx , U1,1 = −iσy . 2.5. Kraus representation We can rewrite the output state of the depolarizing channel Eq. (11) in the so-called Kraus form: ρS =

d−1  d−1  m=0 n=0

where

† Km,n |ψ ψ| Km,n ,

(14)

D. Horoshko and S. Kilin / Entanglement and Eavesdropping in Quantum Cryptography

Km,n =

aU0,0 , bUm,n ,

m, n = 0, 0, m, n = 0, 0,

17

(15)

are Kraus operators and the parameters a and b determine their  relative weights and are connected to the depolarizing fraction by the relations a = 1 − πs + πs /d2 , b = √ πs /d. Kraus representation helps to find the form of the output state of signal and ancilla, namely:

 |ΨSA = Km,n |ψ |φmn  , (16) m,n

where {|φmn } is any set of d2 orthonormal vectors in the state space of ancilla. It is straightforward to verify that substituting Eq. (16) in Eq. (2) gives Eq. (14). We see that we need only d 2 dimensions of ancilla to store the possible transformations of the signal state. Thus we can use for our ancilla a pair of d-level systems X and Y and identify the states {|φm,n } as phase-shifted GB states on HA ≡ HX ⊗ HY :

iϕ m, n = 0, 0, e |ψ00  , (17) |φmn  = e2πi(mn/d) |ψ−m −n  , m, n = 0, 0, where ϕ is a free parameter which will be used for the “fine tuning” of the overall systemancilla transformation. Substituting Eqs. (17), (15) into Eq. (16) after some algebra we get |ΨSXY = M |ψS |ψ00 XY ,

(18)

where the operator M is defined as M = α + βd |ψ00 SX SX ψ00 | , where the complex parameter α = ae iϕ − b and the real parameter β = bd = satisfy the relation 2 |α|2 + Re{α}β + β 2 = 1. d

(19) √ πs

(20)

2.6. Existence of AUEM Eq. (18) allows us to find the explicit form of AUEM and thus prove its existence. First, we prove that M is unitary on a subspace W spanned by possible input states of the machine, namely the states of the form |k S |ψ00 XY , where {|kS , k = 0, ..., d − 1} is some basis in HS . From Eqs. (18), (19) we find: M |kS |ψ00 XY = α |kS |ψ00 XY + β |ψ00 SX |kY .

(21)

Let us denote the subspace spanned by vectors given by Eq. (21) as W  . We can easily calculate with the help of Eq. (20) XY

ψ00 | S k| M † M |lS |ψ00 XY = δkl ,

(22)

18

D. Horoshko and S. Kilin / Entanglement and Eavesdropping in Quantum Cryptography

that is M is unitary on W as required. It means that the orthonormal set of d states on W is transformed into an orthonormal set of d states on W  . We can define a transformation UM : H −→ H so that it acts as M on W and transforms an orthonormal set of d 3 − d states on H \ W into an orthonormal set on H \ W  . This transformation maps one basis on H onto another and therefore is unitary and realizable by physical means. Thus the optimal machine is realized by restricting our ancilla to a pair of d-level systems X and Y , preparing its input state in the GB state |ψ 00 XY and applying to the signal and ancilla the unitary transformation U M , constructed as described above. This completes the proof of existence of AUEM.

3. Entangling machine for one qubit In this section we consider the simplest case of d = 2, where all three systems S, X and Y are represented by two-level systems or “qubits”. We describe the quantum circuit realizing the optimal AUEM and show how AUEM can be applied to eavesdropping on a quantum cryptographic line. 3.1. Quantum circuit A quantum circuit realizing the optimal AUEM for one qubit can be build with the help of the two-qubit circuit depicted in Fig. 1. Horizontal lines represent qubits, vertical lines are two-qubit CNOT gates, and the squares and circles represent one-qubit rotations exp (−iσz ξ/2) and exp (−iσy ξ/2) respectively by the specified angle ξ. It is straightforward to verifythat the four Bell states of the input  qubits, defined as |Φ±  = (|0 |0 ± |1 |1) / (2), |Ψ±  = (|0 |1 ± |1 |0) / (2) are transformed as follows: |Φ+  −→ ei3θ/4 |Φ+ , |Φ−  −→ e−iθ/4 |Φ− , |Ψ±  −→ e−iθ/4 |Ψ± , i.e. they are not mixed with one another, each acquiring a phase shift in such a way that there is a phase difference of θ between |Φ +  and the other three Bell states. This circuit alone realizes an optimal AUEM, if one of its entries is considered as input (qubit S) and the other (qubit X) is prepared in the Bell state |Φ + XY with the third qubit (Y ). The fidelity of the machine is F = (3 + cos θ)/4.

Figure 1. Quantum circuit for AUEM. The Bell states of two qubits pass the gate unchanged, but acquiring a phase shift. The phase of Φ+ state is shifted by 3θ/4 and the phases of the other three Bell states are shifted by −θ/4. Two-qubit gates are CNOT gates, while one-qubit gates are rotations around z (squares) or y (circles) axis by the specified angle.

Other representations of AUEM for one qubit can be obtained by concatenating this circuit with a similar one applied to the qubits X and Y and with θ replaced by ϕ − ϕ 0 (see Fig. 2), where

19

D. Horoshko and S. Kilin / Entanglement and Eavesdropping in Quantum Cryptography

cos ϕ0 = −

1−F . 3F − 1

(23)

For example, the asymmetric cloner [4] may be realized in this way by putting ϕ = 0.

Figure 2. AUEM for one qubit. S is the signal qubit in an unknown state. Qubits X and Y compose the 4-level ancilla and are initially prepared in the Φ+ Bell state. The gate G(θ) is shown in Fig. 1. The angles θ and ϕ0 are determined by fidelity F (see text). ϕ is a free parameter. The output state is a pure entangled state of the three qubits.

The symmetric entangler, acting at the same time as the symmetric cloner, is realized by putting ϕ = 0, θ = arccos (1/3). The circuit depicted in Fig. 2 can be compared to the circuits suggested for the universal (symmetric) cloning machine [13], where both ancillary qubits interact with the signal. Our scheme has the advantage of minimizing the number of qubits involved into the interaction with the signal system. 3.2. Application of AUEM to eavesdropping Let us show that the optimal AUEM for one qubit realizes the interaction necessary for the optimal eavesdropping in the so-called six state protocol of quantum cryptography. In this protocol the value of a bit is encoded into the state of a qubit S, chosen from three bases: the “rectilinear” one, created by two √ and |1, the “diag√ orthonormal vectors |0 ¯ 2, | 1 = (|0 − |1) / 2, and the “circular” onal” one, created by | ¯ 0 = (|0 + |1) / √ √ one: |0  = (|0 + i |1) / 2, |1  = (|0 − i |1) / 2. The protocol of quantum key distribution is similar to BB84 [14], the only difference is that three bases are used instead of two. The advantage of this protocol over BB84, is that the former is more secure against the eavesdropping. It has been shown [15] that the optimal strategy of individual eavesdropping on the six-state protocol is to attach to the qubit S a 4-level ancilla in some state |χ and to make the following transformation: √ √ (24) |0 |χ −→ F |0 |A + 1 − F |1 |B , √ √ |1 |χ −→ F |1 |C + 1 − F |0 |D , (25) where F , as usual, is the channel fidelity for the qubit S, and the four states in the ancilla state space are chosen so that {|A , |C} ⊥ |B ⊥ |D, and Re A| C = 2 − 1/F . For optimal AUEM to be used for entangling the qubit S to the ancilla, we obtain from Eq. (18) for d = 2:   α+β α β |0 Φ+ −→ √ |000 + √ |011 + √ |110 , 2 2 2   α+β α β |1 Φ+ −→ √ |111 + √ |100 + √ |001 , 2 2 2

(26) (27)

20

D. Horoshko and S. Kilin / Entanglement and Eavesdropping in Quantum Cryptography

where the kets are written in the SXY order. It is straightforward to verify that the four states of ancilla entangled with the states of the qubit S satisfy the demands imposed on the states |A, |B, |C, |D for any value of ϕ. That is, the optimal AUEM can be used for optimal individual eavesdropping for the six state protocol of quantum cryptography. As we have seen, the entangling interaction can be designed in such way, that it comprise only two qubits of three, which may be a significant advantage in the practical applications of the eavesdropping techniques.

Conclusions We have given a definition of asymmetric universal entangling machine for a d-level system and have proven its existence. We have shown that such a machine requires a d 2 -level ancilla and have found the transformation producing maximal possible entanglement for a given degradation of the signal system fidelity. The obtained machine could also be called “depolarizing channel purificator”, since it realizes the most general unitary transformation of three d-level systems acting as a depolarizing channel in the state space of one of them. Thus, this machine represents a generic quantum model for studying various universal quantum processes. Besides, we have confirmed our conjecture that the optimal strategy for eavesdropping on a QKD line is entangling the information carriers to the ancillas stored in quantum memory. We have shown that AUEM is optimal for individual eavesdropping on the 6-state protocol of QKD, and that this machine is simpler than the alternative tool for this purpose - the asymmetric cloning machine.

Acknowledgments This work was supported in part by INTAS and in part by Belarussian Republican Foundation for Basic Research.

References [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13]

S. Ya. Kilin, Usp. Fiz. Nauk 169, 507 (1999) [Phys. Usp. 42, 435 (1999)]; S. Ya. Kilin, in Progress in Optics, ed. E. Wolf, 42, 1 (2001). N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Rev. Mod. Phys. 74, 145 (2002). V. Bu˘zek and M. Hillery, Phys. Rev. A 54, 1844 (1996); V. Bu˘zek and M. Hillery, Phys. Rev. Lett. 81, 5003 (1998). N. J. Cerf, Acta Phys. Slov. 48, 115 (1998); N. J. Cerf, Phys. Rev. Lett. 84, 4497 (2000); N. J. Cerf, J. Mod. Opt. 47, 187 (2000). V. Bu˘zek and M. Hillery, Phys. Rev. A 62, 022303 (2000). G. Alber, A. Delgado, and I. Jex, Quant. Inf. Comp. 1, 33 (2001). M. Ricci, F. Sciarrino, C. Sias, and F. De Martini, Phys. Rev. Lett. 92, 047901 (2004). C. H. Bennett, H. J. Bernstein, S. Popescu, B. Schumacher, Phys. Rev. A 53, 2046 (1996). R. Josza, J. Mod. Opt. 41, 2315 (1994). C. H. Bennett, D. P. DiVincenzo, J. A. Smolin, W. K. Wootters, Phys. Rev. A 54, 3824 (1996). M. Horodecki, P. Horodecki, and R. Horodecki, Phys. Rev. Lett. 84, 2014 (2000). D. I. Fivel, Phys. Rev. Lett. 74, 835 (1995). V. Bu˘zek, S. L. Braunstein, M. Hillery, and D. Bruss, Phys. Rev. A 56, 3446 (1997); V. Bu˘zek, M. Hillery, and P. L. Knight, Fortschr. Phys. 46, 521 (1998).

D. Horoshko and S. Kilin / Entanglement and Eavesdropping in Quantum Cryptography

[14]

21

C. H. Bennett and G. Brassard, in Proceedings of IEEE International Conference on Computers, Systems and Signal Processing, Bangalore, India, 175 (IEEE, New York, 1984). [15] D. Bruss, Phys. Rev. Lett. 81, 3018 (1998).

22

Quantum Communication and Security ˙ M. Zukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

Experimental Single Qubit Quantum Multiparty Communication Mohamed BOURENNANE a,1 , Christian SCHMID b , Pavel TROJEK b , e ˇ ˙ BRUKNER d , Marek ZUKOWSKI , and Christain KURTSIEFER c , Caslav b Harald WEINFURTER a Physics Department, Stockholm University, Stockholm, Sweden b Sektion Physik, Ludwig-Maximilians-Universität, D-80797 München, Germany and Max-Planck-Institut für Quantenoptik, D-85748 Garching, Germany c Department of Physics, National University of Singapore, Singapore 117 542, Singapore d Institut für Experimentalphysik, Universität Wien, A-1090, Wien, Austria e Instytut Fizyki Teoretycznej i Astrofizyki, Uniwersytet Gda´nski, PL-80-952 Gda´nsk, Poland

Abstract. We present simple and practical quantum solution for secure multiparty communication protocols, the secret sharing and the communication complexity and their proof-of-principle experimental realizations. In the secret sharing protocol, a secret is split among several parties in a way that its reconstruction requires the collaboration of the participating parties. In the communication complexity problem, the goal is to maximize the success probability of the partners for solving for giving communication resources some N partner communication complexity tasks. Our quantum solution is based on sequential transformations on a single qubit. In contrast with recently proposed schemes involving multiparticle GHZ states. Keywords. Quantum cryptography, communication complexity, quantum information

Introduction Quantum information science breaks limitations of conventional information transfer, cryptography and computation. Here we will consider two multiparty protocols, secret sharing and communication complexity. The communication complexity problems (CCPs) [1] were shown to have quantum protocols, which outperform any classical ones. In a CCP separated parties performing local computations exchange information in order to accomplish a globally defined task, which is impossible to solve singlehandedly. Two types of CCPs can be distinguished: the first one minimizes the amount of information exchange necessary to solve a task with certainty [2,3,4]. The second one maximizes the probability of successfully solving a task with a restricted amount of communication 1 Corresponding

Author: E-mail: [email protected]

M. Bourennane et al. / Experimental Single Qubit Quantum Multiparty Communication

23

[3,5,6]. Such studies aim, e.g., at a speed-up of a distributed computation by increasing the communication efficiency, or at an optimization of VLSI circuits and data structures [7]. In the secret sharing protocol (SSP), the secret is splitted in way that a single person is not able to reconstruct it. Suppose for example that the launch sequence of a nuclear missile is protected by a secret code. Yet, it should be ensured that a single lunatic alone is not able to activate it, but at least two lunatics are required. Solutions for this problem, and its generalization and variations, are studied in classical cryptography [8]. In such problems the aim here is to split information, using some mathematical algorithms, and to distribute the resulting pieces to two or more legitimate parties. However classical communication is susceptible to eavesdropping attacks. Quantum protocols for the CCPs [2,3,4,5,6] and the SSPs [9,10,11,12] involving multiparty entangled states were shown to be superior to classical protocols. However,current methods of production of such states do not work for more than four particles, and suffer from high noise. Here we propose a quantum protocol for the CCPs and SSPs for N parties, in which a sequential single qubit communication between them is used with no need for GHZstates. As our protocol requires only single qubits it is realizable with the current stateof-the-art technologies, they become technologically comparable to quantum key distribution, so far the only commercial application of quantum information.

1. Single qubit secret sharing protocol Here we present An N party SSP [13], where only the sequential communication of a single qubit is used, runs as follows (see Figure 1). The qubit is initially prepared in the state 1 | +x  = √ (| 0  + | 1 ). 2

(1)

During the protocol the qubit is sequentially communicated from partner to partner, each j (ϕj ) ≡ | 0  → | 0  and | 1  → eiϕj | 1  acting on it with the unitary phase operator U with the randomly chosen value of ϕj ∈ {0, π, π/2, 3π/2}. Therefore, having passed all parties, the qubit will end up in the state   N 1 i( ϕj ) j |0  + e |1  . (2) | χN  = √ 2 The last party performs a measurement on the qubit in the basis | ±x  = √12 (| 0  ± | 1 ) leading to the result ±1. As it will be clarified later, for her/him it suffices to choose only between ϕN = 0 or ϕN = π/2. The expectation value of the measurement is ⎞ ⎛ N  E(ϕ1 , . . . , ϕN ) = cos ⎝ ϕj ⎠ . (3) j

Note that this expectation value (Eqn. 3) has the same structure like the correlation function obtained using the GHZ state and can therefore also be used to obtain a shared se-

24

M. Bourennane et al. / Experimental Single Qubit Quantum Multiparty Communication

Figure 1. Scheme for N party single qubit secret sharing. A qubit is prepared in an initial state and sequentially (ϕj ), applying a randomly chosen communicated from party to party, each acting on it with a phase operator U phase ϕj . The last recipient performs a measurement on the qubit leading to the result ±1. In half of the cases the phases add up such that the measurement result is deterministic. These instances can be used to achieve the aim of secret sharing.

cret. For this purpose each participant divides his action for every run into two classes: a class X corresponding to the choice of ϕj ∈ {0, π} and a class Y corresponding to ϕj ∈ {π/2, 3π/2}. Following this classification they broadcast the class of their action for each run, but keep the particular value of ϕj secret. This corresponds in the GHZ scheme to the announcement of φj while keeping kj secret. In our scheme the partners announce their class choice in the reversed order with respect to the order of the qubit transmission [14]. From that procedure they can determine which runs lead to a deterN ministic measurement result, i.e. when cos( j ϕj ) equals to either 1 or -1. Such sets of ϕ’s occur on average in half of the runs. These are valid runs of the protocol. In such cases any subset of N − 1 parties is able to infer the choice of ϕR of the remaining partner, if themselves their values of ϕj . In case that this subset contains the last partner, he/she must reveal the measurement result. Thus, the collaboration of all recipients is necessary. The task of secret sharing is now achieved via local manipulation of phases on a communicated single qubit, and no multiparticle entangled GHZ state is required anymore. In order to ensure the security of the protocol against eavesdropping or cheating the partner PR arbitrarily selects a certain subset (which depends on the degree of security requirements) of valid runs. For these runs the value of ϕR is compared with the one inferred by the recipients. To this end each of the recipients sends the value of his/her phase ϕj . The comparison reveals any eavesdropping or cheating strategy. The security of the presented protocol against a general eavesdropping attack follows from the proven security of the well known BB84 protocol [15,16]. Each communication step between two successive parties can be regarded as a BB84 protocol using the bases x and y. Any set of dishonest parties in our scheme can be viewed as an eavesdropper in BB84 protocol.

2. Single qubit quantum communication complexity problem Let us introduce the CCP analyzed and implemented here, the so-called modulo-4 sum problem [3,4,18]. Imagine N separated partners P1 , . . . , PN . Each of them receives a

M. Bourennane et al. / Experimental Single Qubit Quantum Multiparty Communication

25

two-bit input string Xk , (Xk = 0, 1, 2, 3; k = 1, . . . , N ). The Xk s are distributed such N that their sum is even, i.e. ( k=1 Xk )mod2 = 0. No partner has any information whatsoever on the values received by the others. Next, the partners communicate with the goal that one of them, say PN , can tell whether the sum modulo-4 of all inputs is equal 0 value of a dichotomic, i.e. of values ±1, function or 2. That is, PN should announce the N T (X1 , . . . , XN ) given by T = 1 − ( k=1 Xk mod4). The partners can freely choose the communication protocol, e.g. they can choose between sequential communication from one to the other, or any arbitrary tree-like structure ending at the last party PN . The total amount of communication is restricted to only N − 1 bits (classical scenario). For further convenience, one can introduce a different more handy notation, we put Xk = (1 − yk ) + xk , where yk ∈ {−1, 1}, xk ∈ {0, 1}. For the task B we write Xk = π(1 − yk )/2 + xk , with yk ∈ {−1, 1}, xk ∈ [0, π). Note that, the dichotomic variables yk are not restricted by the probability distributions, p, for the Xk s. Theyare completely N random. The task function T can now be put as T = f (x1 , . . . , xN ) k=1 yk , where −N  p (x1 , . . . , xN ). f : xN k → {1, −1}, and p(X1 , . . . , XN ) = 2 Since T is proportional to the product of all yk s, the answer eN = ±1 of PN is completely random with respect to T , if it does not depend on every yk . Thus, an unbroken communication structure is necessary: the information from all N − 1 partners must directly or indirectly reach PN . Due to the restriction to N − 1 bits of communication each of the partners, Pk , where k = 1, . . . , N − 1, sends only a one-bit message, which for convenience will be denoted as ek = ±1. For a correct answer T eN = 1, otherwise, T eN = −1, and the average success can be quantified with fidelity F = X1 ,...,XN pT eN , or equivalently F = ×

1 2N

 x1 ,...,xN =0,1



y1 ,...,yN =±1

N

k=1

p (x1 , . . . , xN )f (x1 , . . . , xN )

yk eN (x1 , . . . , xN ; y1 , . . . , yN )

(4)

We have shown that the classical fidelity bound is by Bell-like inequality. This classical bound decrease exponentially with N . One has Fc ≤ 2−K+1 , where K = N/2 and K = (N + 1)/2 for even and odd number of parties, respectively [17]. This analytic result confirms the numerical simulations of [18] for small N . For the quantum protocols, we note that the Holevo bound [19] limits the information storage capacity of a qubit to no more than one bit. Thus, we must now restrict the communication to N −1 qubits, or alternatively, to N −1-fold exchange of a single qubit. The solution of task starts with a qubit in the state | ψ0  = 2−1/2 (| 0  + | 1 ). Parties sequentially act on it with the phase-shift transformation | 0  0 | + eiπXk /2 | 1  1 |, in accordance with their local data. After all N phase shifts one has N 1 (5) | ψN  = √ (| 0  + eiπ( k=1 Xk )/2 | 1 ). 2 N Since the sum over Xk is even, the phase factor eiπ( k=1 Xk )/2 is equal to the dichotomic function √ T to be computed. Thus, a measurement of the qubit in the basis (| 0  ± | 1 )/ 2 reveals the value of T with fidelity Fq = 1, that is, always correctly [17].

26

M. Bourennane et al. / Experimental Single Qubit Quantum Multiparty Communication

The classical fidelity Fc or the probability of success Pc decreases exponentially with growing N to the value corresponding to a random guess by PN . I.e., communication becomes useless. In contrast, Pq does not change with N and it equals 1. The simple, one qubit assisted quantum protocol, without any shared multi-particle entanglement (!), clearly outperforms the best classical protocols.

3. Experiment We have experimentally implemented the two SSPs and CCPs. We encoded the protocol qubit in a single photon. The basis states | 0  and | 1  were represented by the polarization states | H  and | V  respectively (horizontal (H) and vertical (V) linear polarization). The single photons were provided by a heralded single photon source. The setup is shown in A pair of polarization entangled photons is created via a spontaneous parametric down conversion (SPDC) process. As the photons of a pair are strongly correlated in time the detection of one photon in DT heralds the existence of the other one which is used for the protocol. A coincidence detection between DT and D+ /D− , within a chosen time window of 4 ns, implies communication of only a single photon. The SPDC process was run by pumping a 2 mm long β-barium borate (BBO) crystal with a blue single mode laser diode (402.5 nm), at an optical output power of 10 mW. Type-II phase matching was used, at the degenerate case leading to pairs of orthogonally polarized photons at a wavelength of λ = 805 nm (Δλ ≈ 6 nm) (see Figure 2. In order to prepare the initial polarization state a polarizer transmitting vertically polarized photons was put in front of the trigger detector DT ensuring that only (initially) horizontally polarized photons can lead to a coincidence detection. This single qubit source will used to implement our two multiparty protocols [13,17]. 3.1. Experimental single qubit N = 6 secret sharing The first partner was equipped with a motorized half-wave plate (HWP1 ) followed by quarter-wave plate (QWP) at an angle of 45 ◦ . By rotation of HWP1 to the angles 0 ◦ , 45 ◦ and 22.5 ◦ , −22.5 ◦ he could transform the horizontally polarized photons coming from the source to | ±y  and | ±x . This corresponds to applying the phase-shifts

Figure 2. Setup for single qubit secret sharing. Pairs of orthogonally polarized photons are generated via a type II SPDC process in a BBO crystal. The detection of one photon from the pair by DT heralds the existence of the other one used in the protocol. The initial polarization state is prepared by placing a polarizer in front of the trigger detector. Each of the recipients (R1 . . . R6 ) introduces one out of four phase shifts, according to the output of a pseudo random number generator (RNG), using half- and quarter wave plate (HWP1 , QWP) or YVO4 crystals (C1 ...C5 ), respectively. The last party analyzes additionally the final polarization state of the photon by detecting it behind a half-wave plate (HWP2 ) and a polarizing beam splitter.

M. Bourennane et al. / Experimental Single Qubit Quantum Multiparty Communication

27

ϕ ∈ {π/2, 3π/2} and ϕ ∈ {0, π} respectively. As the phase-shifts of the other partners had to be applied independently from the incoming polarization state the usage of standard wave plates was not possible. Therefore the unitary phase operator was implemented using birefringent uniaxial 200 μm thick Yttrium Vanadate (YVO4 ) crystals (Ci ). The crystals were cut such that their optic axis lies parallel to the surface and is aligned in such a way that H and V polarization states correspond to their normal modes. Therefore by rotating the crystals along the optic axis for a certain angle a specific relative phase shift was applied independently from the incoming polarization state. An additional YVO4 crystal (Ccomp , 1000 μm thick) was used to compensate for dispersion effects (see fig. 2. The last party performed the measurement behind a half-wave plate (HWP2 ) at an angle of 22.5 ◦ followed by polarizing beam-splitter (PBS). The photons were detected at D+ /D− and DT by passively quenched silicon avalanche photo diodes (Si-APD) with an efficiency of about 35 % [13]. The protocol was repeated ztotal = 25000 times. One run consisted of choosing pseudo-random variables, rotating the crystals accordingly and opening the detectors for a collection time window τ = 200 μs, what took together about 1 s. The requirement of communicating a single photon imposes that only those runs were included into the protocol in which just one coincidence between DT and either D+ or D− (coincidence gate time τc ≈ 7ns) was detected during τ . In these runs a single coincidence detection provided us with the raw key. From happened zraw = 2107 times which N this we extracted N zval = 982 valid runs where | cos( j ϕj )| = 1 (506 times cos( j ϕj ) = 1 and 476 N times cos( j ϕj ) = −1 ) with a quantum bit error rate (QBER) of 2.34 ± 0.48 [13]. 3.2. Experimental single qubit N = 5 communication complexity We implemented the quantum protocols for N = 5 parties, using a our heralded single photon as the carrier of the qubit communicated sequentially by the partners. A halfwave plate (HWP1 ) transforms the qubit to the initial state 2−1/2 (| H  + | V ). The data Xk of each party was encoded on the qubit via a phase shift, using birefringent materials. The last party performed a measurement in the 2−1/2 (| H  ± | V ) basis to obtain the answer eN [17]. For a fair comparison of the quantum protocols with the classical ones, no heralded events are discarded, even if the detection of the protocol photon failed. In such a case

Figure 3. Color online) Set-up for qubit-assisted CCPs. Pairs of orthogonally polarized photons are emitted from a BBO crystal via the type-II SPDC process. The detection of one trigger photon at DT indicates the existence of the protocol photon. The polarization state is prepared with a half-wave plate (HWP1 ) and a polarizer, placed in the trigger arm. Each of the parties introduces a phase-shift by the rotation of a birefringent YVO4 crystal (C1 to C5 ). The last party performs the analysis of a photon-polarization state using a half-wave plate (HWP2 ) followed by a polarizing beam-splitter (PBS).

28

M. Bourennane et al. / Experimental Single Qubit Quantum Multiparty Communication

one can still guess the value of T , but with success rate of only 1/2. Therefore high detection efficiency of the heralded photons, i.e., high coincidence/single ratio for our set-up, is essential for an unambiguous demonstration of the superiority of qubit-assisted protocol [18]. The individual phase shifts of parties are also implemented by rotating 200 μm thick Yttrium-Vanadate (YVO4 ) birefringent crystals (Ci ) along their optic axis. To analyze the polarization state of photons in the desired basis, a half wave-plate (HWP2 ) followed by polarizing beam-splitter (PBS) is used (see Figure 3). The protocols were run many times, to obtain sufficient statistics. Each run took about one second. It consisted of generating a set of pseudorandom numbers obeying the specific distribution, subsequent setting of the corresponding phase shifts, and opening detectors for a collection time window τ . The limitation of communicating one qubit per run requires that only these runs, in which exactly one trigger photon is detected during τ , are selected for the evaluation of the probability of success Pexp . In order to determine the probability of success from the data acquired during the runs we have to distinguish the following two cases. First, the heralded photon is detected, which happens with probability η, given by the coincidence/single ratio. Then, the answer eN can be based on the measurement result. However, due to experimental imperfections in the preparation of the initial state, the setting of the desired phase shifts, and the polarization analysis, the answer is correct only with a probability γ, which must be compared with the theoretical limits given by Pq . Second, with the probability 1 − η the detection of the heralded photon fails. Forced to make a random guess, the answer is correct in half of the cases. This leads to an overall success probability Pexp = ηγ + (1 − η)0.5, or a fidelity of Fexp = η(2γ − 1). Due to a finite measurement sample, our experimental results for the success probability are distributed around the value Pexp as shown in Figure 4. The width of the distribution is interpreted as the error in the experimental success probability. For task A we obtain a quantum success probability of Pexp = 0.711 ± 0.005. The bound Pc = 5/8 for the optimal classical protocol is violated by 17 standard deviations. We have obtained for n = 6692 the values η = 0.452 ± 0.010 and γ = 0.966 ± 0.003.

Figure 4. Histograms of measured quantum success probabilities. The bounds for optimum classical protocols are displayed as well.

M. Bourennane et al. / Experimental Single Qubit Quantum Multiparty Communication

29

Summary In summary, we introduced a new scheme for solving the multi-party secret sharing and communication complexity protocols. Unlike other quantum schemes employing multiparticle entangled states our protocols uses only the sequential communication of a single qubit. As single qubit operations using linear optical elements and the analysis of photon polarization states are quite well accomplishable with present day technology we were therefore able to present the first experimental demonstration of the secret sharing protocol for N = 6 parties. This is to our knowledge the highest number of actively performing parties in a quantum protocol ever implemented. we have experimentally demonstrated the superiority of quantum communication over its classical counterpart for distributed computational tasks by solving two examples of CCPs. In our experiment we have reached higher-than-classical performance even when including all imperfections of state-of-the-art technologies. Thus, by successfully performing a fair and real comparison with the best classical scenario, we clearly illustrate the potential of the implemented scheme in real applications of multi-party quantum communication. In principle we see no experimental barrier to extend the performed protocol to even significantly higher number of participants. Most importantly, our method gives a generic prescription to simplify many multi-party quantum communication protocols.

Acknowledgements This work was supported by Polish MNiI, German DFG, Swedish Research Council (VR) grants, and the European Commission through the IST FET QIPC QAP.

References [1] A. C.-C. Yao, Proceedings of the 11th Annual ACM Symposium on Theory of Computing, ACM Press, NewYork, 209 (1979). [2] R. Cleve and H. Buhrman, Phys. Rev. A 56, 1201 (1997). [3] H. Buhrman, R. Cleve, and W. van Dam, SIAM J. Comput. 30, 1829 (2001). [4] H. Buhrman, W. van Dam, P. Høyer, and A. Tapp, Phys. Rev. A 60, 2737 (1999). [5] L. Hardy and W. van Dam, Phys. Rev. A 59, 2635 (1999). ˇ Brukner, M. Zukowski, ˙ ˙ [6] C. and A. Zeilinger, Phys. Rev. Lett. 89 197901 (2002); Cˇ Brukner, M. Zukowski, J.-W. Pan, and A. Zeilinger, Phys. Rev. Lett. 92, 127901 (2004). [7] E. Kushilevitz and N. Nisan, Communication complexity, Cambridge University Press, England, 1997. [8] B. Schneier,Applied Cryptography, John Wiley & Sons, Inc., 1996. ˙ [9] M. Zukowski, A. Zeilinger, M. A. Horne, and H. Weinfurter, Acta Phys. Pol 93 187, (1998). [10] M. Hillery, V. Bužek, and A. Berthiaume, Phys. Rev. A 59, 1829 (1999). [11] R. Cleve, D. Gottesma, and H.-K. Lo, Phys. Rev. Lett. 83, 648 (1999). [12] A. Karlsson, M. Koashi, and N. Imoto, Phys. Rev. A 59, 162 (1998). ˙ [13] C. Schmid, P. Trojek, M. Bourennane, C. Kurtsiefer, M. Zukowski, and H. Weinfurter, Phys. Rev. Lett. 95, 230505 (2005). ˙ [14] C. Schmid, P. Trojek, M. Bourennane, C. Kurtsiefer, M. Zukowski, and H. Weinfurter, Phys. Rev. Lett. 98 028902 (2007). [15] C. Bennett and G. Brassard, Proc. of IEEE International Conference on Computer, Systems & Signal Processing, Bangalore, India, 175 (1984). [16] N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Rev. Mod. Phys. 74, 145 (2002). ˇ ˙ [17] P. Trojek, C. Schmid, M. Bourennane, Caslav Brukner, M. Zukowski, and H. Weinfurter, Phys. Rev. A 72, 050305(R) (2005).

30

M. Bourennane et al. / Experimental Single Qubit Quantum Multiparty Communication

[18] E. F. Galvão, Phys. Rev. A 65, 012318 (2002). [19] A. S. Holevo, Probl. Peredachi Inf. 9, 3 (1973) [Probl. Inf. Transm. 9, 177 (1973)].

31

Quantum Communication and Security ˙ M. Zukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

Relativistic No-Cloning Theorem Sergey N. MOLOTKOV 1 and D.I. POMOZOV Computer Science Department, Moscow M.V. Lomonosov State University, 119889 Russia Abstract. Whereas quantum cryptography ensures security by virtue of complete indistinguishability of nonorthogonal quantum states, attenuation in quantum communication channels and unavailability of single-photon sources present major problems. Since the restrictions imposed by non-relativistic quantum mechanics and used to formulate key distribution protocols are largely exhausted, new principle is required. The fundamental relativistic causality principle in quantum cryptography can be used to propose a new approach to ensuring unconditional security of quantum cryptography that eliminates these difficulties. Photons represent truly relativistic massless particles (the massless quantized field states) which travel at a maximum permissible speed. That is why in the development and realization of quantum cryptography in open space it would be unnatural to take no advantage of the additional possibilities offered by nature. Keywords. No-cloning, quantum cryptography

Introduction In quantum cryptography security is based on fundamental limitations imposed by the laws of quantum mechanichs, rather than on any assumption about the eavesdropper’s technical or computational resources. In quantum cryptography, any eavesdropping attempt is detected by virtue of the following interrelated fundamental limitations in quantum mechanics.

1. Non-relativistic no-cloning theorem I. The process |ϕ0  ⊗ |A −→ |ϕ0  ⊗ |ϕ0  ⊗ |A0  |ϕ1  ⊗ |A −→ |ϕ1  ⊗ |ϕ1  ⊗ |A1 

(1)

if ϕ0 |ϕ1  = 0. (copying of unknown quantum states) is forbidden by the no-cloning theorem [1]. 1 Corresponding Author: S. N. Molotkov, Computer Science Department, Moscow M.V.Lomonosov State University, 119889 Russia

32

S.N. Molotkov and D.I. Pomozov / Relativistic No-Cloning Theorem

II. No information can be extracted about a nonorthogonal state without perturbing it, i.e. following process is forbidden [2]: |ϕ0  ⊗ |A −→ U (|ϕ0  ⊗ |A) = |ϕ0  ⊗ |A0  |ϕ1  ⊗ |A −→ U (|ϕ1  ⊗ |A) = |ϕ1  ⊗ |A1 

(2)

if |A0  = |A1 , where |A is a detector state, and U is a unitary operator describing simultaneous evolution of the detected and detector states. In essense, these limitation follow from Heisenberg’s uncertainty principle, which rules out simultaneous measurement of observables associated with non commuting operators. For orthogonal states, there are no prohibitions on their cloning or information extraction without their perturbation. In the framework of nonrelativistic quantum mechanics, to the observables ρ 0 = |ϕ0 ϕ0 | and ρ1 = |ϕ1 ϕ1 | there correspond commutative measureming operators, which are orthogonal projectors P 0,1 = |ϕ0,1 ϕ0,1 | ([P0 , P1 ] = 0). Restrictions (1) and (2) follow from geometric properties of the states |ϕ0,1  in Hilbert space corresponding to a quantum system. Unless some additional basic restrictions on the measurability of orthogonal quantum states are employed, they cannot be used for the purposes of quantum cryptography owing to certain distinguishability. The restrictions on the measurability of quantum states imposed by special relativity represent such additional basic restrictions.

2. Relativistic no-cloning theorem For orthogonal states, there is no prohibition against certain distinquishing without their perturbation, or to be more precise, the theorem [2] states nothing about it. The statement that an orthogonal state "passes" through an auxilary system |A, interacts with it during the passage, and changes its state, which is frequently made in the interpretetion of this theorem, does not correspond to the contents of the theorem. The theorem contains nothing of the kind, in the sense that it is purely geometric in nature and states that the state vector of auxilary system |A may be unitarily turned, depending on the input vector |φ0,1 , and transfered to a new state |A 0  or |A1  with no change of the input vector. In this case, it is implicitly assumed that the input vector |φ 0,1  is accessible as a whole - that is, to perform the unitary transformation U requires having access to the entire space H|φ0,1  of states, in which the state carrier is nonzero, otherwise the transformation will not be unitary. The fact that in the proff there appeares only the state vector as an integral object |φ0,1  without inner coordinate "filling" just means that the state vector participates as whole in the transformation. The Hibert space H|ϕ0,1  representing a real physical system is tied to the Minkowskii spacetime, where each state is characterized by a wavefunction amplitude. Access to the Hilbert space of the states implies access to the spacetime domain of nonvanishing state amplitude (wavefunction). If only the domain in space where the state amplitudes do not vanish is accessible, then even orthogonal states cannot be realibly copied or distinquished. This is more or less obvious, because no manipulation (including copying and identification) cannot have an outcome with a probability higher than

S.N. Molotkov and D.I. Pomozov / Relativistic No-Cloning Theorem

33

the partial norm corresponding to the states lying in the accessible spacetime domain, i.e. in the accessible part of the Hilbert space. An orthogonal state to be reliably copied or distinguished must be available instantly and as a whole. So, when the amplitude of a state is nonzero in some finite domain of spacetime, the statement that the state is entirely accessible signifies access to this domain. In nonrelativistic quantum mechanics, which imposes no restrictions on the limiting speed, access to any finite domain may be instantly obtained. In quantum field theory, which imposes restrictions on a limiting speed, access to the state as a whole may be obtained only when the lengthy state is initially unitarily transformed to a state with an amplitude which is nonzero only an arbitrarily small spatial domain. After that, advantage can be taken of the theorem [2]. According to the relativistic causality principle [3], this unitary transformation of the state defined in a finte spatio-temporal domain to a state localized in an arbitrarily small spatial domain may be realized in a finite time only. The minimum required time is determined from the condition that a part of the light cone relevant to the past covers the initial spatial domain in which the state amplitude was nonzero (Fig.1a)). The vertex of a light cone resides in an arbitrarily strongly localized domain (at a point) to which the initial state amplitude is unitarily transformed. Each of the pairs of orthogonal states unitarily transformed to ("collected in") a localized domain may be thereafter be cloned with certainty or distinguished. Since we are dealing with massless states of a quantized field (photons), which propagate at the maximum allowable speed, this unitary transformation and subsequent cloning will result in a shift (delay) of the states in spacetime to those in the case of their free evolution (propagation).

Figure 1.

34

S.N. Molotkov and D.I. Pomozov / Relativistic No-Cloning Theorem

This effect makes it possible to reveal any eavesdropping attemps. Note that relativistic limitations on measurements were exmined by Landau and Peierls in a pioneering study [4] continued by Bohr and Rosenfeld [5]. In other words, for orthogonal states of the massless particles the no-cloning theorem looks like this. Orthogonal states may be cloned with a probability arbitrarily close to unity. The cloning results in production of states with the same amplitude but shifted (translated in spacetime). This is weaker than in the non-relativistic case (1). Therefore, we have |ϕ0  → (UL |ϕ0 ) ⊗ (UL |ϕ0 ),

(3)

|ϕ1  → (UL |ϕ1 ) ⊗ (UL |ϕ1 ). Here UL is the translation operator along the branch of the light cone in spacetime, L = Δ(x − t) is the dimension of the domain in which the state amplitude is nonzero (for brevity we assume that both states are nonzero in the same spatio-temporal domain but differ in amplitude φ 0,1 (x − t)). Similarly modified is the Bennett theorem [2] about distinguishability orthogonal states – only weaker process in comparisson with that in the nonrelativistic case (2) is allowed. |ϕ0 |A → (UL |ϕ0 ) ⊗ |A0 , |ϕ1  ⊗ |A → (UL |ϕ1 ) ⊗ |A1 ,

(4) |A0  = |A1 .

The aforementioned is illustrated by the diagrams given in Figs.1a)-c). Since the amplitude of massless quantum-field states propagating in a certain direction along the x axis depend only on x − t, it will suffice to consider the case in which time is fixed and coordinate is treted as variable (or vice versa). Consider one of the orthogonal states propagating at the speed of light, with amplitude φ(x − t) (c = 1), and index 0 or 1 is omitted for brevity), Suppose that the state is localized within a domain L  in the sense that L |ϕ(x − t0 )|2 dx ≈ 1, where ϕ(x − t0 ) is amplitude at t0 . To determine the values of the state amplitude at t 0 for all x in the localized domain simultaneously, a unitary transformation must be applied to the entire state: U ϕ0,1 (x − t0 ) = ϕ˜0,1 (x − t) (t > t0 ). The new state ϕ(x ˜  − t) has nonzero amplitude within a smaller spatial domain. The minimum domain size in x  at time t is dictated by relativistic causality principle, which was formulated in its final form by Bogolyubov [3]. The unitary operator has nonzero matrix elements only if the points (x, t 0 ) and (x , t ) lie in the past light cone with apex at the point Γ, which contains the domain of nonzero state amplitude at t0 . In any moment that precedes L, the orthogonal state amplitude can be mapped by a unitary transformation to a state amplitude localized in an arbitrary small neighborhood of Γ. It is essential that this state is different from φ(x − t 0 ). By the instant Γ, the values of state amplitude at all x can be accessed instantly. Now, a measurement result can be obtained instantly, and complete information about the state is available with probability one. If the states in the original pair are orthogonal, then unitary transformation can be executed to obtain another pair of orthogonal states at instant Γ and, therefore, one state can be reliably distinguished from the other (by the theorem on complete distinguishability of orthogonal state [2], which is now applicable).

S.N. Molotkov and D.I. Pomozov / Relativistic No-Cloning Theorem

35

It should be emphasized that these orthogonal states differ from the original ones. A state can be recovered or copied by executing the inverse unitary transformation "directed" forward in time. A state amplitude with shape identical to the original one cannot be obtained earlier than dictated by the relativistic causality principle. The state amplitude with amplitude identical to the original one is localized in future light cone with apex at Γ. Moreover, the resulting state also differs from the original one in the sense that it is delayed in time relatively to the original state, which would have traveled the distance L forward along the x axis by the moment L if no copying or informationextraction operations were attempted (see Fig.1a)). These considerations apply to extraction of information about states in a channel with probability one. A similar reasoning is true for extraction of information with probability less than one, in which case the corresponding delay is shorter than L (see Fig.1a)). A similar analysis can be developed in the nonrelativistic case. If limitations imposed by special relativity are ignored, the part of the analysis concerning the light cone should be removed. Formally unitary transformation can be executed instantly, and even the coordinate can be left out of analysis, while it should be kept in mind that any state subject to a unitary transformation can be instantly accessed as a whole (and so is the corresponding spatial domain). Similar reasoning may be employed when a state is unitarily transformed to the state of an auxiliary localized system. An example of such a unitary transformation is provided by the "stopping" of light [6]. This unitary transformation transfers the photon field to a vacuum state due to its masslessness and the impossibility of possessing the zero propagation velocity, while the state of an atomic system is transformed to some new state. Being unitary, the transformation also requires access to all values of the photon packet amplitude at the point of atomic system localization. This access is achieved in the natural way during propagation of the wave packet at the speed of light and its arrival at the localized atomic system ("entry" of the whole packet into the atomic system). When obtaining result with the probability one is involved, this process also requires a time L (the single-photon packet should completely "enter" the atomic system). As this takes place, the photon field finds itself in a new state, depending on the input photon state. By the point in time L with the probability one it is possible to find out what state it is and prepare the same one with a delay L, which is inevitable in this case, unlike the case of free propagation of the initial wave packet (see Fig.1b)). Therefore, any acquisition of information about one of the orthogonal states inevitably leads to their modification – translation in Minkowsii spacetime (delay). It is also important that the evolution of massless quantum field interacting with its environment (other quantum and classical degrees of freedom in communication channel) cannot lead to "contraction" of a state in the sense that the partial norm of the state corresponds to smaller spatial domain extending beyond the light cone as compared to free propagation (see Fig.1c)). Normally, the interaction gives rise to a mixed state, but the support of the density matrix in spacetime cannot be "contracted" and "pushed" out of the light cone (see Fig.1c)). Otherwise, information could be transmitted by using quantum state faster then at speed of light. Indeed, consider one of a pair of orthogonal states. Alice cannot extract classical information from a quantum state before the instant defined be the condition that the state amplitude is covered by the past light cone. After that, classical information can be transmitted to Bob, but not faster than at the speed of light (the partners are connected

36

S.N. Molotkov and D.I. Pomozov / Relativistic No-Cloning Theorem

by a branch of the light cone in Fig.1c)). If a quantum state evolving in channel could be "contracted" so that the cone with apex at point A and with a branch passing through point B when the past light cone contains the state, then Bob could extract classical information from the quantum state before it would have been transmitted at the speed of light to Alice, because the apex of the light cone containing the "contracted" quantum state extends into the spacelike reqion.

Conclusion With regard to quantum cryptography, the analysis developed above implies that the eavesdropper can neither copy quantum state nor extract information about it from a noisy channel before the instants depicted in Figs.1a)-c). This observation is of key importance for security of relativistic quatum cryptography, which remains secure irrespective of arbitrary attenuation. Since the security in question relies on the relativistic causality principle applied to evolution of quantum states, the limitations dictated by relativistic causality cannot be eliminated by any attenuation [7].

Acknowledgments This work was supported in part by INTAS (project 77-7284).

References [1] [2] [3] [4] [5] [6] [7]

Wootters W.K., Zurek W.H., Nature, 299,(1982) 802. Bennett C.H., Phys. Rev. Lett., 68, (1992) 3121. Bogolyubov N.N., Shirkov D.V., Introduction to Quantum Field Theory, Moscow, "Nauka", 1973. Landau L.D., Peierls R., Zeits. für Phys., 69 (1931), 56; Zeits. für Phys., 62, (1930) 188. Bohr N., Rosenfeld L., Math.-Fys. Medd., 12, (1933) 3. Fleischhauer M., Lukin M.D., Phys. Rev. Lett., 84, (2000) 5094. Molotkov S.N., JEPT, 99, (2004) 669.

Quantum Communication and Security ˙ M. Zukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

37

Fast Quantum Key Distribution with Photon Number Decoys Daryl ACHILLES, Ekaterina ROGACHEVA and Alexei TRIFONOV1 MagiQ Technologies, Inc., 11 Ward Street Suite 300, Somerville, MA 02143

Abstract. We investigate the use of photon number states to identify eavesdropping attacks on quantum key distribution (QKD) schemes. The technique is based on the fact that different photon numbers traverse a channel with different transmittivity. We then describe a QKD scheme utilizing this method, which overcomes the upper limit on the key generation rate imposed by the dead time of detectors when using a heralded source of photons. Keywords. Quantum cryptography, nonclassical states

Introduction Quantum key distribution (QKD) is a method of generating a secret key between two parties (Alice, the sender, and Bob, the receiver) that is provably secure assuming that the laws of quantum physics are correct and that any eavesdropper (Eve) must work within the framework of these laws. Introduced in 1984, the BB84 protocol for QKD is based on the use of single photons for encoding the quantum information [1]. The uncertainty principle guarantees the security of the protocol since Eve does not have any a priori information about the basis that Alice used for encoding the information, ensuring the impossibility of a precise measurement of the secure bit due to the Heisenberg uncertainty principle. Sometimes the security is formulated in terms of the no-cloning theorem by Wooters and Zurek [2], which asserts that it is impossible for Eve to generate a precise copy of the unknown photonic information being sent from Alice to Bob without destroying said information. If Alice sometimes sends pulses containing two or more photons, then the situation drastically changes. Eve can now split the photons without destroying the information encoded in the initial state using the photon-number splitting (PNS) attack, the security is no longer protected by laws of quantum mechanics. This fact was acknowledged by the fathers of quantum cryptography [3] and has spurred long-lasting discussions on practical QKD security in the research community [4-10]. 1

Corresponding Author: Alexei Trifonov, MagiQ Technologies, Inc., 11 Ward Street Suite 300, Somerville, MA 02143.

38

D. Achilles et al. / Fast Quantum Key Distribution with Photon Number Decoys

In most of the experimental realizations of the BB84 protocol weak coherent states (attenuated laser pulses) are used as the light source thus making a certain amount of multiphoton pulses available for Eve. There is a trade off in the pulse intensity between security (low mean photon number) and key generation rate (large mean photon number). But even when using so-called “true” single-photon sources, such as those based on a heralded single photon source (HSPS) using parametric downconversion (PDC) [11-13] or single photon emitters such as quantum dots [14] and diamond color centers [15], any practical device will produce multiple photon pulses with some non-zero probability. If the channel loss between Alice and Bob is relatively small, then Eve’s attack on multiple photon pulses can be easily rejected by lowering the mean photon number and re-examining the privacy amplification model. The presence of multiple photons will result in information leakage, but this leakage can be leveraged. The presence of single photons gives enough protection to distill an unconditionally secure key. A simple rule of thumb is: Alice and Bob must ensure that a certain amount of clicks at Bob’s side result from single photon pulses sent by Alice. If in turn the channel loss is high, and this is the most interesting situation from a practical point of view, in addition to photon splitting Eve can take advantage of the channel loss by promoting the quantum states originating from the initial pulses containing two and more photons and suppressing the original single photon pulses [5]. We refer to this attack as the PNS attack with blocking and boosting. Lowering the mean photon number per pulse is no longer a good strategy for Alice and Bob since: 1) the key generation rate will be significantly reduced and 2) Bob’s detector noise may increase the quantum bit error rate up to the level where secure key distillation is no longer possible. Let us stress again that the crucial component of the PNS attack with blocking and boosting is Eve’s ability to use a loss-free channel to boost the channel transmittivity for the quantum states that she can efficiently eavesdrop, while blocking the single photon pulses. To protect against blocking and boosting and maximize both the key generation rates and the possible distance over which BB84 can be used, we must supplement the standard protocol with additional security measures to protect the key. One such method is the introduction into the channel of “decoy states”, which are used to detect an eavesdropper performing blocking and boosting [16-20]. In the original decoy state method by Hwang, the decoys are weak coherent pulses which are equivalent to the pulses used to send the key in all aspects except the mean number of photons. Since Eve can not distinguish between decoy pulses and real QKD pulses, she attacks all pulses; Alice and Bob can then identify blocking and boosting by comparing the gain and quantum bit error rate (QBER) for the different subsets of decoy states. Note that the Ekert protocol is immune to this type of attack since Bell’s inequality is sensitive to the presence of additional photon pairs [21-24]. For this reason utilizing remote state preparation [25, 26] (sometimes referred to as passive state preparation [27]) does not require decoys to identify an eavesdropper because performing a Bell’s inequality test can reveal blocking and boosting. In the same way that single photon states can be conditionally prepared from PDC, higher order number states can also be prepared [28-30]. This requires the use of photon-number resolving detectors, which have recently become available [31-34]. Very recently the decoy state concept has been adapted to utilize higher order number

D. Achilles et al. / Fast Quantum Key Distribution with Photon Number Decoys

39

states to detect an eavesdropper [35, 36]. In a similar fashion, this manuscript investigates the use of nonlinear photon number transmittivities to identify eavesdropping attacks on QKD. We also present a QKD scheme that overcomes the speed limitation imposed when a HSPS is used for both the decoy and key distribution pulses.

1. Generating Photon Number States In the scheme, Alice and Bob will use decoy states that are one- and two-photon number states, which can be prepared by conditional state preparation of PDC with a photon-number-resolving detector (PNRD) [28-30]. Alice uses PDC to generate a twomode squeezed state, described by:

ψ PDC = 1 − λ

2

∞

∑λ

n

n

n =0

A

n B,

(1)

where the two modes are labeled as Alice’s photon (A) and Bob’s photon (B), and λ is the parametric gain of the two-mode squeezed state. She then detects her mode with a PNRD with quantum efficiency η a , which is described by the POVM elements: ∞

ˆ = ∑ B n (η ) n n , Π k k a

(2)

n=k

where the coefficients are given by the binomial distribution

⎛n⎞ Bkn (ηa ) = ⎜ ⎟ηa k (1 − ηa )n −k , ⎝k ⎠

(3)

n is the number of photons in the pulse, and k is the number of photons registered by Alice’s PNRD. This POVM can be written in terms of measurement operators, or

ˆ = Mˆ Mˆ where Kraus operators, as [37] Π k k k †

∞

M k = ∑ Bkn (ηa ) n n .

(4)

n=k

The simplicity of the relation between the Kraus operators and the POVM elements is due to each term of the sum being the form of a projector. The state of the light after the measurement of Alice’s mode is then determined by

ψ' =

Mˆ k ψ PDC ˆ ψ ψ PDC Π k PDC

,

(5)

40

D. Achilles et al. / Fast Quantum Key Distribution with Photon Number Decoys

Figure 1. Possible conditional photon number distributions prepared by Alice as determined by Eqn. (6) for different values of Alice’s detector efficiency and the parametric gain. (a) With a high detector efficiency ( η a = 0.8 ), the parametric gain can be large ( λ = 0.5 ) and the photon number distribution is close to a photon number state. (b) When the detector efficiency is lower ( η a = 0.1 ), the parametric gain must be lowered ( λ = 0.1 ) in order to approximate a photon number state well. (c) The photon number distribution is very different from a photon number state when the efficiency is low ( η a = 0.1 ) and the parametric gain is large ( λ = 0.5 ). Note that for all situations there is no chance the conditionally prepared state contains zero photons.

D. Achilles et al. / Fast Quantum Key Distribution with Photon Number Decoys

41

which gives the photon probability distribution for Bob’s mode conditionally prepared by the registering of k photons by Alice’s PNRD:

P (n | k ) = λ

2( n − k )

(1 − (1 −η ) λ )

2 k +1

a

Note that as

⎛n⎞ n−k ⎜ ⎟ (1 − ηa ) . ⎝k ⎠

(6)

η a → 1 the probability distribution becomes the delta

function P (n | k ) = δ n , k , i.e. Bob is sent exactly the same photon number as Alice measured [38]. The same is true when the parametric interaction is kept weak (λ

2

→ 0 ). The situation when Alice detects a single photon is demonstrated in

Fig. 1. If Alice’s detector efficiency is high, then she will generate photon number states with high fidelity, even with strong parametric gain, as shown in Fig. 1(a). If η a is low, however, she will need to be cautious of how powerful the PDC interaction is and will have to use a low parametric gain to ensure that she generates photon number eigenstates with high fidelity. Fig. 1(b) shows the case where the efficiency is low, but the parametric gain has been lowered to ensure the conditional state is approximately a photon number state. The conditionally prepared state no longer emulates a photon number state when the parametric gain remains high and the efficiency is low, as demonstrated in Fig. 1(c). Qualitatively similar results occur when Alice detects two photons ( k = 2 ) with her PNRD, except in this case there is no chance for a pulse to contain either zero or one. 2. Fock State Transmittivity Estimation The state that Alice sends is, in general, a statistical mixture of Fock states: ∞

ρˆ = ∑ p A (n) n n ,

(7)

n =0

where p A (n) is the probability that Alice emits an n photon state. We will define the transmittivity of a pulse sent by Alice as the probability that the pulse contains at least one photon when it arrives at Bob. Accordingly, each number state has a different transmittivity η

(n)

equal to the probability that all the photons in the pulse are not lost:

η ( n ) = 1 − (1 − ηc ) n ,

(8)

where the channel efficiency ηc is defined as the probability that a single photon arrives at Bob given that Alice emitted a single photon pulse. The one- and two-photon states that will be used to estimate the channel loss have transmittivities

42

D. Achilles et al. / Fast Quantum Key Distribution with Photon Number Decoys

η (1) = ηc

and

η (2) = ηc 2 + 2ηc (1 − ηc ) ≈ 2ηc

(9)

where the approximation is valid for high channel loss ( ηc << 1 ). If Bob also used a PNRD they could overcome an eavesdropper by other methods [39]. However, we will assume that Bob is restricted to using binary detectors, such as avalanche photodiodes operated in Geiger-mode, which only detect the presence or absence of light and cannot resolve photon number. Such detectors will be called single-photon detectors (SPD). Alice knows when she has conditionally prepared one or two photons with her PNRD. Bob will, using classical communication, announce to Alice for which pulses he detected a click with his SPD. After a sufficient amount of data has been taken, Alice can use Bob’s clicking rates to estimate the channel efficiency ηc from the transmittivities η

(k )

. She will have two different

estimates: one based on when she detected one photon and the other from when she detected two photons. If the estimates of ηc give the same result, then it is safe to assume that blocking and boosting is not being performed by Eve. If blocking and boosting were being used, the transmittivities for one and two photons would give different results for the channel efficiency because the attack requires Eve to suppress the single photon pulses and “promote” the transmittivity of the two photon pulses in order for her attack to work. When she observes a two photon state, she splits off one of the photons for herself (which she will store in her quantum memory and measure later) and sends the other through a lossless channel to Bob. Therefore, for typical blocking and boosting, the single photon suppression will be high (1 − κ1 ≈ 1) , where κ1 is the single photon transmittivity when Eve is performing an attack, and the two photon suppression will be low (κ 2 ≈ 1) , where κ 2 is the two photon transmittivity when Eve is attacking. Since κ1 << κ 2 the transmittivities that Alice and Bob observe will obey the relation

η (1) << η (2) . Whereas, if the suppression is being caused by large channel loss the (2) (1) transmittivities obey the relation η = 2η . 3. Fast QKD with Number State Decoys There are several possibilities for how this technique may be used in QKD. Here we present one that overcomes the speed limitations imposed by a passive implementation [36]. The schematic of the setup is shown in Figure 2. Due to the nature of having to combine two different sources, there are many intricacies that must be cared for in order to ensure secure QKD. The actual key distribution is done with WCP in order to ensure high clock rates. We use conditionally prepared PDC to generate photon number states which are used to detect blocking and boosting. Alice decides whether

D. Achilles et al. / Fast Quantum Key Distribution with Photon Number Decoys

43

to send a WCP or a decoy from PDC using an electro-optic switch (switch 3). Since we are using different sources for the decoy states and the WCP, we must ensure that the two are completely indistinguishable in all degrees of freedom so that Eve can not selectively attack the WCP. This is achieved with a calibration step that can be run periodically by Alice during QKD. 3.1. Indistinguishability Calibration The two crucial degrees of freedom that must be indistinguishable in the two sources are timing and spectrum. The best way to calibrate the sources is via interference because a prerequisite for any interference phenomenon is that the different possibilities that lead to a given outcome must be indistinguishable [40]. Since we wish to calibrate two different sources, we will use fourth-order interference in the form of a Hong-Ou-Mandel interferometer (HOMI) [41]. There are two parameters we will adjust to maximize interference: the time delay in the HSPS arm and the variable spectral filter in the WCP arm. To switch to calibration mode, Alice uses electro-optic switches 1 and 2 to direct the two modes towards the 50/50 BS. The two-output ports are monitored with SPDs and the coincidence counts are measured. We wish to minimize the coincidence counts, because the fourth-order interference causes photon bunching at the output of the BS. Perfect interference (100% visibility) will result in zero coincidence counts in the SPDs. For the moment, let us assume that the two modes are both pure single photon wavepackets as described by

ψ

= ∫ dω fi (ω ) ai † (ω ) 0 ,

i

(10)

†

where ai (ω ) is the creation operator for a photon in mode i with frequency ω and 2

fi (ω ) is the spectrum of the single photon. Then the normalized coincidence rate of the detectors Rc , assuming Gaussian spectral amplitudes fi (ω ) , is [42]

Rc =

⎛ (σ σ t ) 2 + 4(ωi − ω s ) 2 ⎞ σσ 1 − 2 1 2 2 exp ⎜ − 1 2 ⎟, 2 2 2 σ1 + σ 2 2( + ) σ σ ⎝ ⎠ 1 2

(11)

44

D. Achilles et al. / Fast Quantum Key Distribution with Photon Number Decoys

Figure 2. The proposed setup for fast clock rate QKD using WCP for distributing the key and conditionally prepared PDC as decoy states. Alice can calibrate the two sources by using electro-optic switches 1 and 2 to interfere the two fields at a beam splitter (BS) with SPDs at the output to measure coincidence counts (&). Otherwise, she chooses whether to send a decoy or a WCP using switch 3. Based on the interference calibration, she can adjust the time delay and spectrum of the WCP so that the two are exactly the same for both the decoy pulse and the WCP. Bob simply makes a random basis choice and detects with SPDs. All classical communication is handled by the control units.

D. Achilles et al. / Fast Quantum Key Distribution with Photon Number Decoys

45

where t is the difference in time when the two photons interact with the BS, σ i is the bandwidth of the ith field, and ωi is the central frequency of the ith field. The visibility is defined as

V=

max( Rc ) − min( Rc ) max( Rc )

(12)

and is clearly maximum when t = 0 , ω1 = ω2 , and σ 1 = σ 2 . Therefore, during the calibration, Alice will adjust the time-delay and spectrum to minimize the coincidence counts and maximize the visibility. For example, assuming the central frequencies of the two spectra have already been equalized, the visibility as a function of the ratio of bandwidths s = σ 1 / σ 2 , as determined by Eqn. (11) and Eqn. (12) is

V=

2s , 1 + s2

(13)

which is shown in Figure 3. 1 0.8

0.6

V 0.4

0.2

0

0

1

2

3

4

5

s

6

7

8

9

10

Figure 3. The visibility (V) of the HOMI (assuming equal central frequencies) as a function of the ratio between the two different bandwidths (s).

In order to perform this calibration, it was assumed that each field was a pure single photon state. There are a couple of subtleties that need to be addressed in order to ensure successful calibration. One of the fields used is a WCP, which is not a single

46

D. Achilles et al. / Fast Quantum Key Distribution with Photon Number Decoys

photon, but by maintaining a low mean photon number the visibility can be kept high [43]. The nice feature of this calibration is that even if the visibility decreases, the maximum is still located at the same place in parameter space; therefore as long as the visibility is maximized, Alice knows she has her parameters optimized. A second, more crucial subtlety is the assumption of purity. In order for the two fields to interfere, each photon wavepacket must be a superposition of all the different frequencies, not a statistical mixture. If they were statistical mixtures, we would be attempting to interfere a photon with one spectrum with a second that most likely has a different spectrum; this would reduce the visibility significantly. In general, most conditionally prepared PDC sources create mixed states due to the frequency entanglement that exists between the two photons. However, by choosing the dispersive properties of the nonlinear material properly, one can create a two-mode squeezed state that is factorizable in frequency and therefore creates pure single photon wavepackets upon detection of one field[44-47]. This spectral engineering is of utmost importance for this QKD protocol as well as all quantum information protocols that utilize conditionally prepared PDC as single photon sources. 3.2. Choice of WCP Intensity Once Alice and Bob have collected enough calibration data the optimal choice of mean photon number μ for her WCP can be determined from the measurement of one- and two- photon transmittivities. This is done by defining a figure of merit D to maximize with respect to the mean photon number:

D = pB (1) − pB (> 1) ,

(14)

where pB (1) is the probability that a pulse sent by Alice containing a single photon still contains a single photon when it arrives at Bob and pB (> 1) is the probability that the pulse that originally contained multiple photons is not a vacuum state when it arrives at Bob. This figure of merit is different from the gain that is most commonly maximized [48] and maximizes the robustness of Alice and Bob’s QKD rather than the key generation rate. The situation for normal channel loss is shown in Figure 4. For perfect channel efficiency, Alice can use mean photon number μ = 0.5 . The optimal mean photon number decreases as the channel efficiency decreases, but it does not tend towards zero; rather, it stays above 0.316 for all possible loss values. This is essentially the same scenario as if Alice were doing a simple PNS attack without blocking single photons and boosting multiple photons. The situation is different when Eve is performing a PNS attack with blocking and boosting. As stated above, the key to the attack is boosting the multiphoton transmittivity κ m while suppressing that of a single photon κ1 . Figure 5 shows the optimal mean photon number’s dependence on the ratio κ1 / κ m based on the same figure of merit as above. The parameter regime for an effective blocking and boosting attack is κ1 << κ 2 , resulting in a small ratio of transmittivities. This requires Alice to

D. Achilles et al. / Fast Quantum Key Distribution with Photon Number Decoys

47

use a very low mean photon number for her WCP. However, if it is found that there is no blocking and boosting but there is simply loss (i.e. the parameters lie on the bold line), the mean photon number of the WCP can be much higher.

Figure 4. The optimal mean photon number μ for Alice’s WCP as a function of the channel loss η c . Note that even as the channel efficiency goes to zero, the optimal mean photon number remains greater than 0.316.

Figure 4 is approximately incorporated in Figure 5 because the ratio

κ1 / κ 2 = (2 − ηc ) −1 , which ranges between 0.5 and 1 for ηc = 0 and ηc = 1 , respectively. The reason the correspondence is approximate is that for a PNS attack with blocking and boosting we assumed that the multiphoton transmittivity is the same for all photon numbers greater than one because Eve selectively boosts the transmittivity of these pulses. In the case of loss, the transmittivity is not the same for all higher photon numbers. Note that an effective PNS attack with blocking and boosting can never be confused with loss because the ratio of transmittivities can never be lower than 0.5 when it is caused by channel loss. Summary In conclusion, we have investigated the technique of using photon number transmittivities as a method of detecting blocking and boosting attacks on QKD. A QKD protocol based on BB84 with multiphoton decoy states were discussed as examples of this method. The scheme allowed the use of fast clock rates by using WCP for key distribution while using conditionally prepared photon number to detect an eavesdropper. Also, the ability to monitor the one- and two-photon transmittivities allows Alice to choose the optimal mean photon number for her WCP such that she minimizes Eve’s information.

48

D. Achilles et al. / Fast Quantum Key Distribution with Photon Number Decoys

Figure 5. The optimal mean photon number is determined by the details of Eve’s blocking and boosting, which is characterized by the single photon transmittivity

κ1

and the multiphoton transmittivity

κm .

The

effective regime for a PNS attack with blocking and boosting is a small value for the ratio of these two numbers.

References [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20] [21] [22] [23] [24] [25] [26] [27] [28]

C. H. Bennett, and G. Brassard, in IEEE International Conference on Computers Systems and Signal Processing, Bangalore, India (IEEE, New York, 1984), pp. 175. W. K. Wootters, and W. H. Zurek, Nature 299, 802 (1982). C. H. Bennett et al., J. Cryptol. 5, 3 (1992). S. Felix et al., J. Mod. Opt. 48, 2009 (2002). N. Lutkenhaus, and M. Jahma, New J. Phys. 4, 44.1 (2002). M. Curty, and N. Lutkenhaus, in quant-ph/0311066 (2003). G. Brassard et al., Phys. Rev. Lett. 85, 1330 (2000). N. Lutkenhaus, Phys. Rev. A 54, 97 (1996). N. Lutkenhaus, Phys. Rev. A 59, 3301 (1999). J. Calsamiglia et al., Phys. Rev. A 64, 043814 (2001). C. K. Hong, and L. Mandel, Phys. Rev. Lett. 56, 58 (1986). S. Fasel et al., New Journal of Physics 6, 163 (2004). A. Trifonov, and A. Zavriyev, J. Opt. B 7, S772 (2005). C. Santori et al., Phys. Rev. Lett. 86, 1502 (2001). E. Wu et al., Opt. Express 14, 1296 (2006). W.-Y. Hwang, Phys. Rev. Lett. 91, 057901 (2003). H.-K. Lo, X. Ma, and K. Chen, Phys. Rev. Lett. 94, 230504 (2005). X. Ma et al., in arXiv:quant-ph/0503005 (2005). J. W. Harrington et al., in arXiv:quant-ph/0503002 (2005). X.-B. Wang, Phys. Rev. Lett. 94, 230503 (2005). A. K. Ekert, Phys. Rev. Lett. 67, 661 (1991). M. Dusek, and K. Bradler, J. Opt. B 4, 109 (2002). D. S. Naik et al., Phys. Rev. Lett. 84, 4733 (2000). V. Scarani et al., Eur. Phys. J. D 32 (2005). C. H. Bennett et al., Phys. Rev. Lett. 87, 077902 (2001). M. Ericsson et al., Phys. Rev. Lett. 94, 050401 (2005). G. Ribordy et al., Phys. Rev. A 63, 012309 (2000). C. A. Holmes, G. J. Milburn, and D. F. Walls, Phys. Rev. A 39, 2493 (1989).

D. Achilles et al. / Fast Quantum Key Distribution with Photon Number Decoys

[29] [30] [31] [32] [33] [34] [35] [36] [37] [38] [39] [40] [41] [42] [43] [44] [45] [46] [47] [48]

49

E. Waks, E. Diamanti, and Y. Yamamoto, New J. Physics 8, 4 (2006). D. Achilles, C. Silberhorn, and I. A. Walmsley, Phys. Rev. Lett. 97, 043602 (2006). D. Achilles et al., Opt. Lett. 28, 2387 (2003). D. Achilles et al., J. Mod. Opt. 51 (2004). J. Kim et al., App. Phys. Lett. 74, 902 (1999). D. Rosenberg et al., Phys. Rev. A 71, 061803 (2005). A. Trifonov, and E. Rogacheva, USA, 2006). W. Mauerer, and C. Silberhorn, in quant-ph/0609195 (2006). M. Nielson, and I. Chuang, Quantum Computation and Quantum Information (Cambridge University Press, 2000). J. Perina, O. Haderka, and J. Soubusta, Phys. Rev. A 64, 052305 (2001). Q.-y. Cai, and Y.-g. Tan, Phys. Rev. A 73, 032305 (2006). R. Feynman, R. Leighton, and M. Sands, The Feynman Lectures on Physics (Addison Wesley, Reading, MA, 1965). C. K. Hong, Z. Y. Ou, and L. Mandel, Phys. Rev. Lett. 59, 2044 (1987). P. P. Rohde, and T. C. Ralph, Phys. Rev. A 71, 032320 (2005). J. G. Rarity, P. R. Tapster, and R. Loudon, J. Opt. B. 7, S171 (2005). M. G. Raymer et al., Phys. Rev. A 72, 023825 (2005). W. P. Grice, A. B. U'Ren, and I. A. Walmsley, Phys. Rev. A 64, 063815 (2001). A. B. U'Ren et al., Phil. Trans. R. Soc. A 361, 1493 (2003). A. B. U'Ren et al., Laser Physics 15, 146 (2005). N. Lutkenhaus, Phys. Rev. A 61, 052304 (2000).

50

Quantum Communication and Security ˙ M. Zukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

Cryptographic Properties of Non-local Correlations Antonio ACÍN a,1 , Nicolas GISIN b, Serge MASSAR c, Stefano PIRONIO a and Valerio SCARANI b a ICFO-Institut de Ciencies Fotoniques, Mediterranean Technology Park, 08860 Castelldefels (Barcelona), Spain b Group of Applied Physics, 20 rue de l’Ecole-de-Médecine, CH-1211 Geneva 4, Switzerland c Laboratoire d’Information Quantique, Université Libre de Bruxelles, Av. Roosevelt 50, 1050 Brussels, Belgium Abstract. A crucial assumption in the security proof of standard Quantum Key Distribution protocols is that the honest parties know how their devices work. However, it is possible to construct schemes whose security proof requires almost no assumption on the devices, but the minimal ones. We present some of these protocols together with the security analysis against individual attacks. All these schemes are based on the existence of non-local correlations, namely correlations that cannot be described by a local model. Keywords. Quantum key distribution, entanglement and quantum Non-locality

Introduction Since its invention in 1984 [1], Quantum Key Distribution (QKD) represents a change of paradigm in the security of cryptographic applications. Previous to QKD, the security of most of the cryptographic schemes was based on mathematical, often unproven, assumptions on the difficulty of a given task, in addition with assumptions on the bounded computational power of the eavesdropper, Eve. QKD offers a new type of security based on physical laws, rather than mathematical assumptions: the honest parties, Alice and Bob, encode the information on quantum particles, and the security stems from the fact that any action by Eve should be within the limits imposed by the quantum formalism. This limits her attack and makes QKD provably secure. Contrary to previous approaches, the security of QKD does not require any assumption on Eve’s capabilities, provided she is not able to break the quantum rules. Although QKD was invented in 1984, it took several years until a general security proof, against any quantum attack by Eve, was given for the most known scheme, the BB84 protocol [2]. After this result, new security proofs for the BB84 and other protocols have constantly appeared, proving the security under less 1 Corresponding Author: Antonio Acín, ICFO-Institut de Ciencies Fotoniques, Mediterranean Technology Park, 08860 Castelldefels (Barcelona), Spain; E-mail:[email protected].

A. Acín et al. / Cryptographic Properties of Non-Local Correlations

51

restrictive situations, e.g. allowing higher error rates or some known imperfections on the devices. All these proofs are very general, but they do of course require some assumptions. For instance, they have to assume the validity of Quantum Mechanics. A second assumption is related to the fact that the honest parties should have a perfect control of their devices or, at least, a small amount of imperfections, for which they have a reasonably good estimation. Indeed, imperfection on the devices open security loopholes. In the recent years, several works have been devoted to the design of new QKD protocols whose security is based on weaker assumption. Clearly, the weaker the assumptions needed for a protocol, the stronger its security. Moreover, these works improve our current understanding of which quantum features are responsible of the security of QKD schemes. In [3], Barrett, Hardy and Kent proposed a QKD protocol secure even against a supra-quantum eavesdropper. This enemy is now able to break the quantum rules, but her action is still limited by a physical principle: the no-signalling condition, or the impossibility of instantaneous communication. More precisely, any correlation between the three parties, Alice, Bob and Eve should not allow any faster-than-light communication. Although the Barrett-Hardy-Kent (BHK) protocol has zero key rate and requires an infinite number of settings by Alice and Bob, it proves that secure key distribution based on physical principles is possible beyond the quantum formalism. A key role in the construction is played by non-local correlations, that is, those correlations that are consistent with the no-signalling principle but cannot be described by a local model à la EinstenPodolsky-Rosen [4]. Actually, if the observed correlations between Alice and Bob are local, no secure key distribution is possible [3]. However, if the correlations are non-local, or violate a Bell’s inequality [5], Alice and Bob share some, possibly non-distillable, secret correlations [6]. Concerning the knowledge of the devices, a series of works [7,8,9,10] have recently appeared studying key distribution schemes that are secure without making any assumption on the devices used for the distribution of correlations [11]. The idea is simple and appealing: Alice and Bob observe some correlation between their measurement outcomes described by a conditioned probability distribution p(a, b|x, y). Here, a and b denote the measurement outcomes of Alice and Bob when they apply the measurements x and y. The goal is to show how to distill a perfect secret key from the raw correlations, p(a, b|x, y), assuming the validity of a a general physical principle, such as Quantum Mechanics or the no-signalling principle, and without caring about the explicit details of the devices employed for the correlation distribution. In contrast, in the standard BB84 scheme, for instance, it is always assumed that a qubit, a two-dimensional quantum particle, is used for the information encoding. This apparently simple assumption is crucial for the security of the protocol. Indeed, by relaxing this assumption, that is by considering that the encoding is done on a quantum particle belonging to a Hilbert space of arbitrary dimension, the protocol becomes insecure [7,12]. This is no longer the case for the protocols of [7,8,9,10], proving that device-independent secure key distribution is possible. In this scenario, the violation of a Bell’s inequality provides a necessary condition for a set of correlations p(a, b|x, y) to be distillable into a secret key [7]. The theoretical analysis of these device-independent schemes is often simpler against a no-signalling eavesdropper, rather than a quantum one. Actually, although not presented in this form, the BHK protocol is an example of a device-independent key distribution scheme. Ex-

52

A. Acín et al. / Cryptographic Properties of Non-Local Correlations

plicit device-independent protocols have been presented in [7,9,8]. Most of the security analysis has been done for individual attacks where Eve applies the same attack and processes her information before any reconciliation takes place. A proof of security for a wider class of attacks has been presented in [10]. Yet, the security analysis of this type of protocols is still at a preliminary stage and we are still far from a complete picture, as we have for standard quantum key distribution. In this work, we first review the main findings of [7,8], where a family of deviceindependent key distribution protocols were presented. For all these protocols the honest parties apply one out of n possible two-outcome measurements. The security analysis is done for the case of individual attacks and assuming that Eve can go beyond the quantum formalism but that she is still bounded by the no-signalling principle. Then, we move to the more realistic situation in which Eve is quantum, that is, where she can only prepare correlations that are achievable by quantum means.

1. The scenario The physical scenario that we consider is the standard one for any Bell test. Two separate parties can choose among m different local measurement with n possible outcomes. The correlations between the measurement results are described by a conditioned probability distribution p(a, b|x, y). By publicly exchanging some of the measurement results Alice and Bob can obtain a good estimation of p(a, b|x, y). The goal for them is to transform this probability distribution, that may be correlated to a third eavesdropping party, into a perfect secret key, where any possible correlation with the eavesdropper is removed. As usual, we conservatively assume that the distribution of the observed correlations is done by Eve. Any attack (recall that all our security analysis here is restricted to the case of individual attacks) consists thus of a three-party distribution p(a, b, e|x, y, z) whose marginal yields p(a, b|x, y):   p(a, b, e|x, y, z) = p(e|z)p(a, b|x, y, z, e). (1) p(a, b|x, y) = e

e

Clearly, key distillation is impossible if no assumption is made on the way the parties, Alice, Bob and Eve, can be correlated. Indeed, Alice and Bob cannot establish any bound on Eve’s information just from the knowledge of p(a, b|x, y), since nothing prevents Eve from having a perfect copy of Alice and Bob’s measurement outcomes. The situation becomes much more interesting if it is assumed that the correlations between the different parties should be consistent with a given physical principle. As we will see in the following, this limits in a non-trivial way the correlations between the honest parties and the eavesdropper. Assume for instance that Alice-Bob-Eve correlations cannot violate the nosignalling principle. Then Eve can only employ in her attack probability distributions that are consistent with this physical principle. This means, for instance, that if we sum over Alice’s results, the resulting probability distribution,  p(a, b, e|x, y, z) = p(b, e|y, z), (2) a

A. Acín et al. / Cryptographic Properties of Non-Local Correlations

53

should be independent of x. Similar constraints apply to the rest of parties, with the result of restricting Eve’s possible attacks. This is indeed the intuition behind the BHK protocol initially proposed in [3]. One can also impose that the observed correlations should not violate the quantum formalism. This assumption limits Eve’s attacks in a stronger way, since there are probability distributions consistent with the no-signalling principle not attainable by quantum means [13]. Under the quantum assumption, Eve’s attack, specified by her choice of states and measurements, has to be such that p(a, b, e|x, y, z) = tr(|ΨΨ|ABE Max ⊗ Mby ⊗ Mez ),

(3)

where |ΨABE  is the global pure quantum state of the three parties, while M ax , Mby and Mez define measurements on Alice, Bob and Eve’s spaces. Note that contrary to standard QKD, no constraint on the dimension of the local Hilbert spaces or on the measurements by Alice and Bob is imposed. Eve can apply any quantum attack, provided it is consistent with the correlations observed by Alice and Bob. To summarize, for a given probability distribution p(a, b|x, y), Alice and Bob should conclude whether they can distill a secret key exploiting the assumption that the eavesdropper is limited by a general physical principle, but without making any assumption on the details of the devices used for the correlation distribution. Note however that the protocol does require the following general assumptions: the secrecy and freedom of the choice of measurements, x and y, by the honest parties and no information leakage of the obtained measurement outcomes, a and b, from their laboratories .

2. Secrecy content of non-local correlations Once the device-independent formalism has been presented, it is quite straightforward to realize that no secret key can be distilled from correlations compatible with a local model, i.e. that can be written  p(a, b|x, y) = p(λ)pA (a|x, λ)pB (b|y, λ), (4) λ

where λ denotes a classical random variable, while p A (a|x, λ) and pB (b|y, λ) are the local response functions by Alice and Bob. This argument was initially presented in [3], and better formalized in [7]. The idea is rather simple: if some correlations are local, they can be created from a classical random variable λ coming from a source. However a perfect copy of λ can go to Eve as well. Thus, Alice and Bob cannot conclude that they share any secret correlations if p(a, b|x, y) does not violate a Bell’s inequality. This argument is valid already against a classical eavesdropper, provided Alice and Bob want to establish the key from the observed correlations without making any assumption on the devices. Interestingly, it was shown in [6] that, under the no-signalling principle, some given correlations can be infinitely shared if and only if they are local. In other words, any non-local correlations cannot be arbitrarily shared and, thus, have some monogamy constraints that are potentially useful for cryptographic applications. Actually, a connection between Bell violation and secret correlations was also pointed out in [6]. For a given probability distribution p(a, b, e), the so-called intrinsic information I↓ = I(A : B ↓ E) gives a measure of its secret correlations. More precisely,

54

A. Acín et al. / Cryptographic Properties of Non-Local Correlations

the distribution p(a, b, e) can be generated by local operations and public communication if, and only if, the intrinsic information is zero. The explicit form of this function, intro¯ the minimization running duced in [14], reads I(A : B ↓ E) = min E→E¯ I(A : B|E), ¯ over all the channels E → E. Here, I(A : B|E) denotes the mutual information between Alice and Bob conditioned on Eve. That is, for each value of Eve’s variable, E = e, the correlations between Alice and Bob are described by the conditioned probability distribution p(a, b|e). The conditioned mutual information I(A : B|E) is equal to the mutual information of these probability distribution averaged over p(e). As shown in [6], if a given conditioned probability distribution is non-local, all possible non-signalling extensions to a third party have positive intrinsic information. That is, the violation of a Bell inequality witnesses the presence of some secrecy. Note that this does not mean that the observed secret correlations can be distilled into a perfect secret key. However, the violation of a Bell inequality is a necessary condition for a secure key distribution independent of the devices.

3. Security analysis under individual attacks This section contains the main results of this work: it provides the security analysis of different device-independent schemes against no-signalling and quantum eavesdroppers, under the assumption of individual attacks. It follows from the previous discussion that all the presented protocols should exploit the non-local correlations present in the quantum states, i.e. they are built from quantum probability distributions that violate a given Bell’s inequality. As we have said, Eve is assumed to prepare the observed correlations. She does this by choosing different probability distributions compatible with a given physical law, either the no-signalling principle or the whole quantum formalism. That is, she can prepare elements from the space of probability distributions compatible with (2) or (3). These two spaces are convex. For a finite number of measurements, m, and outcomes, n, the space of probability distributions consistent with the no-signalling principle, S ns has a finite number of extreme points, so it defines a polytope. In the quantum case, the set Sqm is again convex, but it has an infinite number of extreme points. Finally, a third interesting convex set is given by those probability distributions that can be described by a local model (4), or equivalently shared randomness, S lm . This again defines a polytope in the space of probability distributions, see Fig. 1. Note that S lm ⊂ Sqm ⊂ Sns , the first inequality following from the quantum violation of Bell’s inequalities [5], while the second inequality is due to the existence of non-quantum probability distributions that do not violate the no-signalling principle [13]. In the case of individual attacks, we can restrict our considerations to attacks where Eve prepares extreme points of Alice and Bob’s convex set. Indeed, consider an attack that uses non-extreme probability distributions. These terms can be expressed as a convex combination of extreme points  p(a, b|x, y, z, e) = Pi (a, b|x, y, z, e)p(i). (5) i

Giving the knowledge of i to Eve, one has an attack consisting of extreme points that is, at least, as good as the previous one, since, c.f. (1),

A. Acín et al. / Cryptographic Properties of Non-Local Correlations

55

Figure 1. Pictorial representation of Alice-Bob correlations p(a, b|x, y) for binary inputs and outputs. The closed thick line defines one of the facets of the polytope of local correlations, corresponding to the CHSH inequality. All the extreme points lying on this facet are also extreme points of the more general polytope of nonsignalling correlations. Only one extreme no-signalling point is on top of the CHSH facet, given by the non-local machine. The curved line schematically represents the region of points achievable using quantum states. In the optimal eavesdropping attack, Eve simulates Alice and Bob’s correlation, the square point, by the mixture (i.e. convex combination) of extreme points of the corresponding convex set (either quantum or no-signalling).

p(a, b|x, y) =



p(e, i|z)Pi (a, b|x, y, z, e, i).

(6)

e,i

In fact, Eve can always transform the attack consisting of extreme points into the original one by forgetting i. The theoretical analysis of device-independent QKD protocols turns out to be simpler in the case of a no-signalling eavesdroppers, as compared to the quantum case. This is because, as mentioned, the space of probability distributions consistent with the nosignalling principle defines a polytope, that is, a convex set with a finite number of extreme points, while the quantum set has an infinite number of extreme points. Actually, for a fixed number of measurement and outcomes, very little is known about the boundary of the quantum region, although some progress in this problem has recently been obtained in [16]. In the following, we provide examples of these attacks for different protocols and compare the derived secret-key rates. 3.1. No-signalling eavesdroppers A Bell’s inequality violation is necessary for security in the device-independent scenario. Then, the simplest protocol one can imagine is based on the simplest Bell inequality, the CHSH inequality [17], p(a0 = b0 ) + p(a0 = b1 ) + p(a1 = b0 ) + p(a1 = b1 ) ≤ 3,

(7)

where p(aj = bk ) = p(a = b = 0|x = j, y = k) + p(a = b = 1|x = j, y = k). This was the purpose of [7], where the security of the so-called CHSH protocol under individual attacks by a no-signalling eavesdropper was proven. In this protocol Alice and Bob can choose between two different measurement of two outcomes. The security analysis is simplified by the small number of measurement and outcomes. Indeed, the space of no-signalling probability distributions of two measurement of two outcomes was completely characterized in [15], see also Fig. 1. All the extreme

56

A. Acín et al. / Cryptographic Properties of Non-Local Correlations

points of the polytope of local probability distributions are also extreme points of the no-signalling polytope. On top of these, there exist the so-called non-local machines, originally derived by Popescu and Rohrlich [13], which are such that a + b = xy,

(8)

where the sum is modulo 2, and the outcomes have marginal probabilities equal to 1/2. This means that while the values of the bits a and b are random, a and b are perfectly (anti-) correlated when xy = 0 (xy = 1). This point gives the largest violation of the CHSH inequality, equal to 4. Although our security analysis can be applied to any probability distribution p(a, b|x, y), we study here the physically relevant case of isotropic correlations [6], which read 1 + (−1)xy δ 1 − (−1)xy δ 1 − (−1)xy δ 1 + (−1)xy δ , , , ), (9) 2 2 2 2 √ where the interesting quantum non-local regime corresponds to 1/4 ≤ δ ≤ 1/(2 2). For instance, these √ are the correlations that Alice and Bob can obtain from a noisy singlet, with p = 2 2δ, p(a, b|x, y) = (

11 (10) ρ(p) = p|Φ+ Φ+ | + (1 − p) , 4 √ where |Φ+  = (|00 + |11)/ 2, when performing those measurements maximizing the violation of the CHSH inequality. Recall however that the protocol is independent of the physical devices used for the correlation distribution. In the CHSH protocol, then, Eve should reproduce Alice-Bob correlations (1) by combining local points and non-local machines. The optimization is relatively easy and the obtained rates were derived in [7]. The key point is that if Alice-Bob correlations are non-local, Eve is forced to send sometimes the non-local machine, where she cannot be correlated at all [15], while a and b are random but correlated. These events open the way for Alice and Bob to distill a secure key. Interestingly, there exist probability distributions p(a, b|x, y) achievable by quantum means that give a positive key rate. The generalization of this protocol to Bell’s inequalities with a larger number of outcomes, the so-called Collins-Gisin-Linden-Massar-Popescu inequalities [18] was later given in [9]. The study of the CHSH protocol is very useful since it points out the relevant concepts and techniques needed in the security analysis of this kind of schemes. Nevertheless, the protocol can be easily improved. Note, for instance, that even in the ideal noisefree situation, where Alice and Bob observe the maximal quantum violation of the CHSH inequality given by the Tsirelson bound [19], there is no choice of measurements such that the outcomes are perfectly correlated. Improved device-independent protocols secure against no-signalling eavesdroppers, under individual attacks, were later presented in [8]. There, a family of protocols consisting of m + 1 measurements by Alice and m by Bob, of n = 2 outcomes, was introduced. Now, m of the measurements by Alice, together with the measurements by Bob, are used to check the violation of the so-called chained inequality with m settings [20]. The observed violation is used to establish a bound on Eve’s information (see also the related

A. Acín et al. / Cryptographic Properties of Non-Local Correlations

57

SecretŦkey rate (bits)

1

0.8 K10

0.6

K

QM

0.4

K

3

K

4

K 0.2

2

KAGM 0 1

0.95

0.9

0.85

0.8

Noise(p) Figure 2. Key rate for different protocols versus amount of noise (represented by the purity p of the state Eq. 10). KAGM denotes the key rate for the protocol of [7]. Km represents the key rate for the family of protocols with m settings. Note that K2 is uniformly better than KAGM , that K3 is uniformly better than K2 , and that for large m (illustrated by m = 10), and in the absence of noise (p = 0), the key rate tends to 1. Finally, the dashed line depicts the key rate against a quantum eavesdropper.

work [21]). The extra (m + 1)-th measurement by Alice is added to obtain better correlations between the honest parties (that are perfect in the noise-free case), but it is useless from the point of view of non-locality. Again, the analysis applies to any correlations but here, for the sake of simplicity and because of their physical relevance, we focus on those probability distributions resulting from Alice and Bob having a noisy singlet and performing the optimal measurements for the chained Bell inequality with m settings. These correspond to measurements in the bases {|0 ± e iφ(x) |1}, with φ(0) = π/2m and φ(x) = πx/m for x = 1, . . . , m for Alice, while Bob has a choice between m measurements y = 0, . . . N − 1 corresponding to the bases {|0 ± e −iφ(y) |1}, where φ(y) = π(y + 1/2)/m. The analysis of the protocol was again simplified by the fact that the structure of the polytope of no-signalling correlation, for the case of an arbitrary measurement of two outcomes, had been characterized in [22]. Using similar techniques as in Ref. [7], it is possible to compute secret-key rates secure against no-signalling eavesdroppers. The obtained key rates, see [8] for the technical details, are given in Fig. 2, and read     π  1+p − m 1 − p cos , (11) K ≥1−h 2 2m where h(p) denotes the binary entropy. Note that for each amount of noise there exists a number of measurements, and chained inequality, that provides the best bound on Eve’s information. In general, a large number of measurements is good for low noise, while chained inequalities involving few measurements give better bound on Eve’s information for larger values of the noise. In the absence of noise, the key rate can be arbitrarily close to one.

58

A. Acín et al. / Cryptographic Properties of Non-Local Correlations

3.2. Quantum eavesdroppers Finally, we present here the security analysis of a device-independent protocol against a quantum eavesdropper, that is, an eavesdropper that has access to those points compatible with the quantum formalism (for instance, she cannot prepare the non-local machine, see Fig. 1). In particular we consider the previously described protocol of Ref. [8], with m = 2. That is, as for the simplest CHSH protocol, Alice and Bob bound Eve’s information through the violation of the CHSH inequality. However, a third measurement is added on Alice’s side to improve the classical correlations between the honest parties, which guarantees perfect correlations in the noise-free case. As we have said, we can assume that Eve prepares the correlations p(a, b|x, y) of Alice and Bob as a convex sum of extremal correlations, p(a, b|x, y) = i pi Pi (a, b|x, y). The mutual information between Bob and Eve is then given, as in [8], by  I(B : E) = H(B) − pi Hi (B|E) , (12) i

where Hi (B|E) = h(Pi (b|y = 0)). The decomposition of Eve is constrained by the fact that it should, at least, reproduce the observed violation of the CHSH inequality, β, that  is β ≤ i pi βi . Now, the aim is to show that Eve has always interest to use only local correlations and correlations saturating the Tsirelson bound in her decomposition. To show this, suppose that Eve replaces the correlations P j (a, b|x, y) = Pj by a mixture of Tsirelson correlations PT and local correlations P L : Pj → qPT + (1 − q)PL , while keeping the other P i (i = j) fixed. Alice-Bob correlations p = where p stands for p(a, b|x, y), now becomes  p → p = pi Pi + pj [qPT + (1 − q)PL ] .

(13)  i=j

pi Pi + pj Pj , (14)

i=j

Note that p is in general different than p  , because an arbitrary quantum correlation P j generally can not be written as P j = qPT + (1 − q)PL (in particular if the marginal probability distribution derived from P j are not uniform). This is not, however, a problematic issue. The reason is that in the protocol of [8], Alice and Bob base their security analysis on the observed violation β of the CHSH inequality and not on the precise form of p. They may thus, without in any way affecting their key rate, allow Eve to produce any distribution p  as long as it gives the same CHSH violation than the correlations p. This last condition amounts to the constraint βj = qβT + (1 − q)βL ,

(15)

or q=

βj − βL . βT − βL

(16)

Eve has interest to do the replacement (14) if I(B : E) ≤ I  (B : E), or equivalently, using (12), if H j (B|E) ≥ qHT (B|E) + (1 − q)HL (B|E) = q, that is, if

A. Acín et al. / Cryptographic Properties of Non-Local Correlations

Hj (B|E) ≥

βj − βL . βT − βL

59

(17)

After some patient algebra, one concludes that the condition (17) is satisfied for all β j , and thus Eve has interest to do the replacement of Eq. (13). Repeating the argument for all Pi , we conclude that it is advantageous for Eve to write the correlations of Alice and Bob as a sum of Tsirelson correlations and local correlations. At this point, it now suffices to follow the same analysis as the one of [8], replacing the non-local machine, that √ gives a CHSH violation of 4, by a “Tsirelson machine", that gives a CHSH violation of 2 2. The obtained key rate as a function of p, where p is defined according to (10), is given by √   2 1+p − (1 − p) √ . (18) K ≥1−h 2 2−1 Figure 2 compares this key rate to the one obtained against a no-signalling Eve.

4. Discussion Contrary to standard QKD schemes, it is possible to construct cryptographic protocols whose security proof only requires the essential assumptions on the devices: the secrecy and freedom of the choice of measurements, x and y, by the honest parties and no information leakage of the obtained measurement outcomes, a and b from their laboratories. The essential ingredient for these protocols are non-local correlations, those correlations that cannot be described by a local model. When moving to a practical situation, these protocols require that the observed data allows one to rule out any local description. That is, these protocols require a loophole-free Bell test, which has not been performed yet [23]. The detection loophole, then, becomes an interesting problem for a practical information task.

Acknowledgements We thank N. Brunner and L. Masanes for discussion. This work is supported by the EU project QAP, the Spanish MEC under contracts FIS 2005-04627 and Consolider QOIT.

References [1] [2] [3] [4] [5] [6] [7] [8]

C. H. Bennett and G. Brassard, Proc. IEEE Int. Conf. Computers, Systems and Signal Processing, New York, 175 (1984). D. Mayers, Jornal of the ACM 48 no 3, 351 (2001); also available at quant-ph/9802025. J. Barrett, L. Hardy and A. Kent, Phys. Rev. Lett. 95, 010503 (2005). A. Einstein, B. Podolsky and N. Rosen, Phys. Rev. 47, 777 (1935). J. S. Bell, Physics 1, 195 (1964). L. Masanes, A. Acín and N. Gisin, Phys. Rev. A 73, 012112 (2006). A. Acín, N. Gisin and L. Masanes, Phys. Rev. Lett. 97, 120405 (2006). A. Acín, S. Massar and S. Pironio, New J. Phys. 8, 126 (2006).

60

A. Acín et al. / Cryptographic Properties of Non-Local Correlations

[9] V. Scarani, N. Gisin, N. Brunner, L. Masanes, S. Pino and A. Acín, Phys. Rev. A 74, 042339 (2006). [10] L. Masanes and A. Winter, quant-ph/0606049. [11] There exist several previous work studying how the use of untrusted devices affects the security of QKD schemes, see for instance D. Mayers and A. Yao, Quant. Inf. Comp. 4 no. 4, 273 (2004). [12] F. Magniez, D. Mayers, M. Mosca and H. Ollivier, quant-ph/0512111. [13] S. Popescu and D. Rohrlich, Found. Phys. 24, 379 (1994). [14] U. Maurer and S. Wolf, IEEE Trans. Inf. Theory 45, 499 (1999). [15] J. Barrett, N. Linden, S. Massar, S. Pironio, S. Popescu and D. Roberts, Phys. Rev. A 71, 022101 (2005). [16] M. Navascués, S. Pironio and A. Acín, Phys. Rev. Lett. 98, 010401 (2007). [17] J. F. Clauser, M. A. Horne, A. Shimony and R. A. Holt, Phys. Rev. Lett. 23, 880 (1969). [18] D. Collins, N. Gisin, N. Linden, S. Massar and Sandu Popescu, Phys. Rev. Lett. 88, 040404 (2002). [19] B. S. Cirel’son, Lett. Math. Phys. 4, 93 (1980). [20] S. L. Braunstein and C. M. Caves, Ann. Phys. (N.Y.) 202, 22 (1990). [21] J. Barrett, A. Kent and S. Pironio, Phys. Rev. Lett. 97, 170409 (2006). [22] J. Barrett and S. Pironio, Phys. Rev. Lett. 95, 140401 (2005); N. Jones and L. Masanes, Phys. Rev. A 72, 052312 (2005). [23] The locality loophole was closed in A. Aspect, J. Dalibard and G. Roger, ibid 49, 1804 (1982); W. Tittel et al., ibid 81, 3563 (1998); G. Weihs et al., ibid 81, 5039 (1998). Recently, the detection loophole has been closed in M. Rowe et al., Nature 409, 791 (2001). There has been no loophole-free Bell test.

2. Theory of Quantum Information

This page intentionally left blank

Quantum Communication and Security ˙ M. Zukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

63

A Coarse-grained Schrödinger Cat ˇ Johannes KOFLER 1 and Caslav BRUKNER Institut für Quantenoptik und Quanteninformation, Österreichische Akademie der Wissenschaften, Boltzmanngasse 3, 1090 Wien, Austria; Fakultät für Physik, Universität Wien, Boltzmanngasse 5, 1090 Wien, Austria Abstract. We show that under coarse-grained measurements there is no observational difference between a quantum superposition of macroscopically distinct states (“Scrödinger-cat states”) and a classical mixture of these states. Since normally our observations in every-day life are of limited accuracy, no quantum features can be observed. Remarkably, the information gain in such classical coarsegrained measurements is only half of the maximal information gain in sharp quantum measurements. This suggests a novel approach to macroscopic realism and classical physics within quantum theory. Keywords. Schrödinger cat, coarse-grained measurements, information, randomness

Introduction Quantum physics is in conflict with a classical world view both conceptually and mathematically. The assumptions of a genuine classical world — local realism and macroscopic realism — are at variance with quantum mechanical predictions as characterized by the violation of the Bell and Leggett–Garg inequality, respectively [1,2]. Does this mean that the classical world is substantially different from the quantum world? When and how do physical systems stop to behave quantumly and begin to behave classically? Questions like this date back to Schrödinger’s “burlesque” Gedankenexperiment of a cat in a “hell machine” which becomes entangled with the microscopic state of a radioactive atom [3]. If, as was Schrödinger’s point, quantum mechanics also applies for all macroscopic pieces of the apparatus together with the unfortunate cat, the superposition also includes the cat’s states of “dead” and “alive”. In order to explain the fact that we do not see such macroscopic superpositions in our every-day experience, the opinions in the physics community still differ dramatically. Various views range from the mere experimental difficulty of sufficiently isolating any system from its environment (decoherence) [4] to the principal impossibility of superpositions of macroscopically distinct states due to the breakdown of quantum physical laws at some quantum-classical border (collapse models) [5]. Assuming that quantum physics is universally valid, could the quantum features of a Schrödinger cat state be lost, even if the cat is arbitrarily well isolated from its 1 Corresponding Author: Johannes Kofler, Institut für Quantenoptik und Quanteninformation, Österreichische Akademie der Wissenschaften, Boltzmanngasse 3, 1090 Wien, Austria; E-mail: johannes.kofl[email protected]

64

ˇ Brukner / A Coarse-Grained Schrödinger Cat J. Kofler and C.

surrounding such that decoherence effects are negligible? Inspired by the thoughts of Peres [6], we give an affirmative answer, putting the stress on the limited observability of quantum phenomena, which is due to the restricted accuracy of the apparatuses used to measure the cat. To show quantum features of larger and larger objects better and better measurement accuracy is needed. But due to the finiteness of resources in any laboratory the accuracy of measurement devices is limited. The larger the objects the harder it is to distinguish between macroscopic superpositions and classical mixtures. If the required measurement precision is not met, the classical world emerges as a coarse-grained view onto a fully quantum world [7]. In this work we will illustrate our approach using the example of a Schrödinger kitten — a coherent superposition state of a spin of length j = 10. 1. Coarse-grained measurements Any (pure or mixed) spin-j density matrix can be written in the diagonal representation [8]  ρˆ = P (ϑ, ϕ) |ϑ, ϕϑ, ϕ| d 2 Ω , (1) Ω

solid angle element and P a not necessarily with d2 Ω ≡ sin ϑ dϑ dϕ the infinitesimal  positive real function (normalization Ω P (ϑ, ϕ) d2 Ω = 1). The spin-j coherent states |ϑ, ϕ =

j   m=−j

 2j 1/2 j+m

cosj+m ϑ2 sinj−m ϑ2 e−imϕ |m

(2)

are the eigenstates of the spin operator pointing in the (ϑ, ϕ)-direction, whereas |m 1 , e.g., denotes the eigenstates of the spin operator’s z-component. Choosing P = 4π would result in the totally mixed state. Without loss of generality we make a measurement of the spin’s z-component. The probability for an outcome m in a Jˆz measurement in the state (1) is denoted by p(m). At the coarse-grained level of classical physics only the probability for  a “slot” outcome m ¯ (containing many neighboring m) can be measured, i.e., p¯(m) ¯ ≡ m∈{m} ¯ p(m) with {m} ¯ the set of all m belonging to m. ¯ This can be well approximated by [7]  p¯(m) ¯ = 0

2π ϑ2 ϑ1

P (ϑ, ϕ) sin ϑ dϑ dϕ ,

(3)

where ϑ1 and ϑ2 are the borders of the polar angle region corresponding to a projection onto m. ¯ We will show that p¯(m) ¯ can be obtained from a positive probability distribution of classical spin vectors which emerges from the P -function. Consider the Q-function  2j + 1 2  Q(ϑ, ϕ) ≡ P (ϑ , ϕ ) cos4j Θ (4) 2 d Ω 4π  Ω with d2 Ω ≡ sin ϑ dϑ dϕ and Θ = 2 arccos{ 21 [1 + cos ϑ cos ϑ + sin ϑ sin ϑ cos(ϕ − ϕ )]}1/2 the angle between the directions (ϑ, ϕ) and (ϑ  , ϕ ). The Q-function is positive

ˇ Brukner / A Coarse-Grained Schrödinger Cat J. Kofler and C.

65

because it is, up to a normalization factor, the expectation value Tr[ˆ ρ |ϑ, ϕϑ, ϕ|] of the state |ϑ, ϕ (see Ref. [9]). In the case of large spins the factor cos 4j Θ 2 in the integrand is sharply peaked around vanishing√relative angle Θ and significant contributions arise only from regions where Θ  1/ j. The normalization factor 2j+1 4π in eq. (4) is the inverse size of the solid angle element for which the integrand contributes significantly  and makes Q normalized: Ω Q(ϑ, ϕ) d2 Ω = 1. The probability for having an outcome m ¯ can now be expressed only in terms of the classical distribution Q [7]: 

2π ϑ2

p¯(m) ¯ = 0

ϑ1

Q(ϑ, ϕ) sin ϑ dϑ dϕ .

(5)

The equivalence of eqs. (3) and (5) is shown by substituting eq. (4) into (5) under √ the ¯ is much larger than 1/ j. constraint that the angular spread ΔΘ ∼ ϑ 2 − ϑ1 of the slot m √ Hence, for coarse-grained measurements with angular inaccuracy ΔΘ  1/ j, a full description of the (quantum) situation is given by an ensemble of classical spins with the positive and normalized probability distribution Q [7].

2. A Schrödinger spin kitten Let us consider a superposition of two spin-j coherent states, |ψsup = c (|ϑ1 , ϕ1  + eiα |ϑ2 , ϕ2 ) .

(6)

Asthe spin coherent states are overcomplete, the normalization constant reads c = 1/ 2 (1 + Re(eiα ϑ1 , ϕ1 |ϑ2 , ϕ2 ). For comparison reasons we also consider the statistical mixture of the two coherent states ρˆmix =

|ϑ1 , ϕ1 ϑ1 , ϕ1 | + |ϑ2 , ϕ2 ϑ2 , ϕ2 | . 2

(7)

Using eq. (2), the density matrices ρˆsup = |ψsup ψ| and ρˆmix can now be easily written in the form ρˆ =

j 

j 

cm,m |mm | ,

(8)

m=−j m =−j

where the coefficients c m,m depend on the given angles (ϑ 1 , ϕ1 ; ϑ2 , ϕ2 ) and differ of course for the states (6) and (7). The P -function reads [9] P (ϑ, ϕ) =

2j  k 

ρkq Ykq (ϑ, ϕ)

k=0 q=−k

Here, Ykq are the spherical harmonics and

(−1)k−q

 (2j − k)! (2j + k + 1)! √ . 4π (2j)!

(9)

ˇ Brukner / A Coarse-Grained Schrödinger Cat J. Kofler and C.

66

Psup

Pmix

5105 2Π 3Π2

0 5105 0

Π

Π4

Π2 



Π2 3Π4

10

2Π 3Π2

0 0

Π

Π4

Π2 

Π 0

Qsup

Π2 3Π4

Π



0

Qmix

1

1 2Π 3Π2

0.5 0 0

Π

Π4

Π2 

Π2 3Π4



2Π 3Π2

0.5 0 0

Π

Π4

Π 0

Π2 

Π2 3Π4

Π



0

Figure 1. (Top left) The P -function Psup of the superposition state (6) for j = 10, α = 0, ϑ1 = π4 , ϕ1 = 3π , 2 π ϑ2 = 3π , ϕ = . Is is wildly oscillating with very large positive and negative regions. (Top right) The 2 4 2 P -function Pmix of the corresponding statistical mixture (7). (Bottom left and right) If the angular measurement √ resolution of our apparatuses, ΔΘ, is much weaker than 1/ j, we cannot distinguish anymore between the states (6) and (7), as both lead to the same (positive) Q-functions Qsup = Qmix . Under such coarse-grained measurements both states can be seen as an ensemble of classical spin vectors in which half of the spins are pointing into the direction (ϑ1 , ϕ1 ) and the other half into (ϑ2 , ϕ2 ).

ρkq =

 j  √ 2k + 1 (−1)j−m cm,m−q m=−j

 j k j , −m + q −q m

(10)

where the last bracket denotes the Wigner 3j symbol. The Q-function can be either found through integration of P , i.e. eq. (4), or via the representation [9] √ 2j k 2j + 1   (−1)k−q 4π (2j)! Q(ϑ, ϕ) = ρkq Ykq (ϑ, ϕ)  . 4π (2j − k)! (2j + k + 1)!

(11)

k=0 q=−k

Let us choose the size of our Schrödinger kitten (6), i.e. the spin length, as j = 10 (the numerical computation of P and Q for much larger values of j is extremely time consuming). Furthermore, we set α = 0 and choose the angles ϑ 1 = π4 , ϕ1 = 3π 2 , π ϑ2 = 3π , ϕ = such that the two coherent states |ϑ , ϕ  and |ϑ , ϕ  point into 2 1 1 2 2 4 2 opposite directions. The P -function of this superposition, P sup , is shown in Fig. 1 at the

ˇ Brukner / A Coarse-Grained Schrödinger Cat J. Kofler and C.

67

top left. Is is wildly oscillating with very large positive and negative regions (note the scale in the plot). We show at the top right the P -function P mix of the corresponding statistical mixture (7) which shows two pronounced peaks at (ϑ 1 , ϕ1 ) and (ϑ2 , ϕ2 ) and slightly negative regions. resolution of our apparatuses, ΔΘ, is much weaker than √ If the angular measurement √ 1/ j, i.e. ΔΘ  1/ j, we cannot distinguish anymore between the states (6) and (7), i.e. between a superposition and a statistical mixture, as both lead to the same Qfunctions, denoted as Q sup and Qmix , respectively, which are shown in Fig. 1 at the bottom. Under such coarse-grained measurements both states can be seen as an ensemble of classical spins with the unique (positive) distribution Q sup = Qmix . The latter shows just two peaks, centered at the directions (ϑ 1 , ϕ1 ) and (ϑ2 , ϕ2 ), corresponding to a classical mixture in which half of the spins are pointing into the direction (ϑ 1 , ϕ1 ) and the other half into (ϑ2 , ϕ2 ). Interestingly, it is the heavily oscillating regions of the P sup -function which vanish in the coarse-graining procedure. Its two small peaks along (ϑ 1 , ϕ1 ) and (ϑ2 , ϕ2 ) cannot be seen on this scale. Going to larger and larger values of j, i.e. from kittens to cats, makes it more and more difficult to observe the quantum nature of superposition states like eq. (6). The angular resolution which is necessary to√ distinguish a superposition from the corresponding classical mixture is of the order of 1/ j.

3. Information and randomness If we consider measurements of the spin operator’s z-component in the state (6), coarsegrained measurements correspond to the fact that we cannot resolve individual eigenval√ ues m but only whole bunches of size Δm. The “classicality condition” ΔΘ  1/ j √ corresponds to Δm  j. In a measurement with perfect resolution an individual out of the 2j + 1 ≈ 2j possible results carries log 2 (2j) = 1 + log2 j bits of information. Under coarse-grained bunch √ measurements the finding that an outcome lies in a certain √ ) = 1 − log c + 1 log j bits of size Δm = c j with c  1 carries only log 2 ( c2j 2 2 2 j of information. For large j, i.e. j  c  1, the information gain in a sharp quantum measurement is approximately log 2 j bits, whereas in the classical case it is only half of that, namely 12 log2 j bits. Finally, we note that — given coarse-grained measurements — it is objectively random which of the two directions, (ϑ 1 , ϕ1 ) or (ϑ2 , ϕ2 ), one will find in a spin measurement in the Schrödinger cat state (6). Classical physics emerges out of the quantum world but the randomness in the classical mixture is still irreducible. Which possibility becomes factual is objectively random and does not have a causal reason.

Acknowledgements ˙ We thank Marek Zukowski for his great hospitality in Gdansk and the invitation to contribute to these proceedings. This work was supported by the Austrian Science Foundation, Proj. SFB (No. 1506), the Europ. Commission, Proj. QAP (No. 015846), and the British Council in Austria. J. K. is recipient of a DOC fellowship of the Austrian Academy of Sciences at the Institute for Quantum Optics and Quantum Information.

ˇ Brukner / A Coarse-Grained Schrödinger Cat J. Kofler and C.

68

References [1] [2] [3] [4] [5] [6] [7] [8] [9]

J. S. Bell, Physics (New York) 1, 195 (1964). A. J. Leggett and A. Garg, Phys. Rev. Lett. 54, 857 (1985); A. J. Leggett, J. Phys.: Cond. Mat. 14, R415 (2002). E. Schrödinger, Die Naturwissenschaften 48, 807 (1935). W. H. Zurek, Phys. Today 44, 36 (1991); W. H. Zurek, Rev. Mod. Phys. 75, 715 (2003). G. C. Ghirardi, A. Rimini, and T. Weber, Phys. Rev. D 34, 470 (1986); R. Penrose, Gen. Rel. Grav. 28, 581 (1996). A. Peres, Quantum Theory: Concepts and Methods (Kluwer Academic Publishers, 1995). ˇ Brukner, quant-ph/0609079. J. Kofler and C. F. T. Arecchi, E. Courtens, R. Gilmore, and H. Thomas, Phys. Rev. A 6, 2211 (1972). G. S. Agarwal, Phys. Rev. A 24, 2889 (1981); G. S. Agarwal, Phys. Rev. A 47, 4608 (1993).

69

Quantum Communication and Security ˙ M. Zukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

Measures of Multiparticle Entanglement Marek KUS´ Center for Theoretical Physics, Polish Academy of Sciences, Al. Lotników 32/46, 02-668 Warszawa, Poland Abstract. We developed an approach to a quantitative characterization of entanglement properties of, possibly mixed, bi- and multipartite quantum states of arbitrary finite dimension. Particular emphasis was given to: 1) the derivation of reliable estimates which allow for an efficient evaluation of entanglement measures, 2) construction of measures of entanglement useful in the monitoring of the time evolution of multipartite correlations under incoherent environment coupling and experimental production of entangled states, 3) construction of quantities characterizing entanglement which are directly measurable (defined in terms of physically realizable operators). To this end we proposed generalizations of concurrence for multipartite quantum systems that can distinguish qualitatively distinct quantum correlations (generalized multipartite and multidimensional concurrences). We derived a lower bound for the concurrence of mixed quantum states valid in arbitrary dimensions. As a corollary, a weaker, purely algebraic estimate was found, which can be used to detect mixed entangled states with a positive partial transpose. We discussed also the monotonicity of the constructed quantities under local operations and classical communication (LOCC). We provided a condition for the monotonicity of generalized multipartite concurrences which qualifies them as legitimate entanglement measures. The constructed quantities can be, in principle, accessible in experiments to directly quantify the pure-state entanglement via a measurement of a physical observable. Keywords. Quantum correlations, entanglement, multipartite systems

Introduction In the rapidly developing theory of quantum information a special role is played by correlations of genuinely quantum character among subsystems of a composite quantum systems absent on the classical level. An N -partite system is described by a Hilbert space H that decomposes into a tensor product of N subspaces H = H 1 ⊗ · · · ⊗ HN of the dimensions of n 1 , . . . , nN , dim(H) =: n = n1 . . . nN . A multipartite state acting on H is separable [1], if it can be written as a convex sum of direct products of sub-system states =

 i

(i)

(i)

p i  1 ⊗ · · · ⊗ N ,

pi > 0 .

(1)

In such a state all correlations among any of the subsystems are of classical nature. States which are not expressible in the above form, ie. these which exhibit non-classical corre-

70

M. Ku´s / Measures of Multiparticle Entanglement

lations are called entangled. The definition of separability is here stated for an arbitrary mixed state . For pure states, which are represented by one-dimensional projections ψ = |ψψ|,

(2)

where ψ is a normalized vector in H, the above definition reduces to |ψ = |ψ1  ⊗ . . . ⊗ |ψ2 ,

(3)

where |ψi  is a normalized vector in H i . The definition (1) of separability provides no constructive way of checking whether a given state is separable or entangled, hence a characterization and quantification of entangled states is of a paramount theoretical challenge. In a series of papers [2,3,4,5], on which this presentation is based, we proposed a systematic way of constructing and analyzing measures of entanglement. The constructed measures are expressible in terms of expectation values of some Hermitian operators and, as such, are in principle directly measurable in experiments.

1. Two-partite entanglement in arbitrary dimension Let us start with the simplest situation of pure states of a two-partite system. In this case one defines the concurrence c(ψ) =



|ψ|ψ|2 − Tr2r

(4)

where the reduced density matrix  r is obtained by tracing over one subsystem, r := Tr2 |ψψ|.

(5)

It is clear that c vanishes exactly for pure separable states. The definition of the concurrence is extended to mixed states  by the convex roof construction c() = inf



pi c(ψi ),

(6)

i

 where the infimum is taken over all decompositions  = i pi |ψi ψi |, pi ≥ 0 into pure states |ψi . The definition is justified by the obvious fact that a mixed ρ is separable if and only if it is decomposable in this way into pure separable states. For later developments it is now crucial to observe that the concurrence of a pure state |ψ can be expressed as c (ψ) =



ψ ⊗ ψ|A|ψ ⊗ ψ

(7)

where where A is a linear operator A : H ⊗ H → H ⊗ H with the matrix elements   φl ⊗ φm |A|φj ⊗ φk  = φl |φj φm |φk  − Tr1 Tr2 |φj φl | · Tr2 |φk φm | .

(8)

M. Ku´s / Measures of Multiparticle Entanglement

71

Remembering that,  in fact, H  = H 1 ⊗H2, it is now easy to show that A is proportional to the projection on H1 ∧ H1 ⊗ H2 ∧ H2 , where Hi ∧ Hi is the antisymmetric subspace of the tensor product H i ⊗ Hi . It can be shown [6] that there exist no linear operator acting on H for which the expectation value in the state |ψ gives the concurrence of |ψ. Observe that we circumvented this obstacle barring a direct measurement of c in terms of the expectation value of some observable at the price of squaring the dimension of the relevant Hilbert space, as our operator A acts on H ⊗ H. This suggests that a direct measurement might be possible if we have at our disposal two copies of the state |ψ. Such a scheme for a direct measurement of the concurrence was proposed and successfully realized in a recent experiment concerning entangled states of photons [7]. The definitions (4) and (6) are equivalent to the original definition of the concurrence given by Wootters [8], but rewriting them using (7) allows to find an effective lower bound of c for mixed states. To this end let us first make the following construction (which is, in fact, the so-called Jamiođkowski isomorphism [9])  ∈ End(End(H)) End(H ⊗ H)  A → A    |ΨΨ|, A= I⊗A

|Ψ :=

n 

|l ⊗ |l,

(9)

l=1

where End denotes the space of linear endomorphisms of the relevant Hilbert space and {|l}nl=1 is an orthonormal basis in H. It is known [10] that if A is a positive (which happens in our case since A is a  admits a Kraus representation projection) then A s 

 = Aσ

τ (α) στ (α)† ,

(10)

α=1

for an arbitrary σ ∈ End(H). In this case s = rank(A) = n 1 (n1 − 1)n2 (n2 − 1)/4. The operators τ (α) ∈ End(H) can be easily calculated for an arbitrary choice of the basis {|l}nl=1 . Let now ρ ∈ End(H), ρ† = ρ ≥ 0 be a state on H with the spectral decomposition ρ=



|φi φi |,

(11)

i

where the eigenvectors |φ i  are normalized in such a way that the square norm of each is equal to the respective eigenvalue of ρ. Let us define the matrices T (α) , α = 1, . . . , s (α)

Tij

= φi |τ (α) |φj ,

(12)

where |φj  is the complex conjugation of the vector |φ j  taken in the basis {|l} nl=1 . Then it is shown [2] that one can estimate from below the concurrence c(ρ) (6) c(ρ) ≥ max{0, λn −

n−1  i=1

λi }.

(13)

72

M. Ku´s / Measures of Multiparticle Entanglement

Here {λk }nk=1 are the eigenvalues (in the increasing order) of T T † , where T is a lins (α) α ear combination of the matrices T , T := α=1 zα T , with arbitrary complex cos 2 efficients zα fulfilling α=1 |zα | = 1. This estimate can be simplified by taking only one nonvanishing coefficient z α leading thus to a simple algebraic and easily computable estimation of c(ρ) or sharpened by further optimization over z α on the unit sphere in Cs . Both ways proved to be useful in detecting entangled states not detectable by other methods (eg. so called partial transposition criterion - for details see [2]).

2. Multi-partite entanglement Our aim here is to give a generalization of the above constructions to the case of multipartite systems. This was done in [3] by defining, in analogy with (7), the N -partite concurrence for pure states  cN (ψ) = 2 ψ| ⊗ ψ|A|ψ ⊗ |ψ,

(14)

where now A is, as previously, a linear operator on H ⊗ H defined as an arbitrary convex (i) (i) combination of tensor products of projections P − (resp. P+ ) on antisymmetric, H i ∧ Hi , (resp. symmetric, H i ∨ Hi ,) subspaces of Hi ⊗ Hi , A=

 s1 ,...,sN

) ps1 ,...,sN Ps(1) ⊗ Ps(2) ⊗ · · · ⊗ Ps(N , 1 2 N

ps1 ,...,sN ≥ 0.

(15)

The summation is performed over s i ∈ {−, +} with an even, nonzero number of − signs [3], so we may put equal to zero the coefficients p s1 ,...,sN not fulfilling these restrictions. It is straightforward to check that so defined c N (ψ) vanishes exactly for pure separable states. Through the arbitrariness of the choice of the p {si } we have actually a continuous, multiparameter family of concurrences. As in the two-partite case c N can be expressed in terms of partial traces cN (ψ) = 21−N/2

 

2 αS Tr (TrS |ψψ|) ,

(16)

S

where the summation is performed over all subsets S of N = {1, . . . , N }, and the prefactors αS are given in terms of the p s1 ,...,sN via αS =

 s1 ,...,sN

ps1 ,...,sN



si .

(17)

i∈S

The extension to arbitrary mixed states is again achieved by the convex roof construction (6). Observe that, since formally the definition of the multipartite concurrences mimics the one for the two-partite systems, we can repeat the procedure of obtaining an estimate of c(ρ) outlined in the previous section producing thus an effective method of discriminating various types entangled states, and further allows quantitative comparison of entanglement properties of states, dynamics of decoherence (ie. the loss of entanglement) in systems interacting with environment, and the robustness of systems against

73

M. Ku´s / Measures of Multiparticle Entanglement

decohering interactions [4]. The fact that c N is defined in terms of the expectation value of a Hermitian operator again gives possibilities of direct measurements [11]. For an arbitrary choice of the coefficients p {si } the concurrence c N is, by construction, invariant under local unitary transformations (ie. transformations in form of the tensor product of unitaries each acting only in each space H i ). Sometimes it is desirable to choose a measure of entanglement with special transformation properties under some larger class of quantum operations performed on the whole system. Thus for example the so called LOCC operations consisting of completely positive transformations in each subsystem supplemented with classical exchange of information between the subsystems about the results of local operations, do not increase the amount of entanglement in the whole system. Hence, the monotonic decrease under LOCC (or, in other words, being an entanglement monotone) is a very useful property of an entanglement measure allowing to decide whether one state can be obtained from another one by LOCC [12]. In [5], using the methods provided in [13], we were able to prove that c N is an entanglement monotone if α S ≤ 0 for all S = ∅, N. For example, in a tri-partite system, entanglement monotones are given in terms of (1)

(2)

(3)

(1)

(2)

(3)

(1)

(2)

(3)

A = p+−− P+ ⊗P− ⊗P− +p−+− P− ⊗P+ ⊗P− +p−−+ P− ⊗P− ⊗P+

(18)

with p+−− + p−+− ≥ p−−+ ,

p−+− + p−−+ ≥ p+−− ,

p+−− + p+−− ≥ p−+− . (19)

Summary We presented a construction of family of entanglement measures for multipartite quantum system possessing many desirable formal and practical features. The constructed monotonous measures of multipartite entanglement, being for pure states always bilinear in the components of the state, cannot completely characterize all classes of entangled states equivalent under LOCC. A natural question thus arises how to extend the present construction (eg. by including more than two copies of a state) to allow finding a complete set of invariants characterizing entanglement up to local transformations. On the other hand the already constructed measures possess crucial merits – the relative ease of a quantitative evaluation or estimation, as well as the direct experimental accessibility.

Acknowledgements The present outline was based on the results of collaboration with Andreas Buchleitner, André R. R. Carvalho, Rafađ Demkowicz-Dobrza n´ ski, and Florian Mintert to whom I wish to express my gratitude for allowing me to present our common achievements.

References [1] [2]

R. F. Werner, Phys. Rev. A 40, 4277 (1989). F. Mintert, M. Ku´s, A. Buchleitner, Phys. Rev. Lett. 92, 167902 (2004).

74 [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13]

M. Ku´s / Measures of Multiparticle Entanglement

F. Mintert, M. Ku´s, and A. Buchleitner, Phys. Rev. Lett. 95, 260502 (2205). F. Mintert, A. R. R. Carvalho, M. Ku´s, and A. Buchleitner, Phys. Rep. 415, 207 (2005). R. Demkowicz-Dobrza´nski, A. Buchleitner, M. Ku´s, and F. Mintert, Phys. Rev. A 74, 052303 (2006). P. Badzi¸ag, P. Deuar, M. Horodecki, P. Horodecki, and R. Horodecki, J. Mod. Opt. 49, 1289 (2002). S. P. Walborn, P. H. Souto Ribeiro, L. Davidovich, F. Mintert, and A. Buchleitner, Nature 440, 1022 (2006). W. K. Wootters, Phys. Rev. Lett. 80, 2245 (1998). A. Jamiođkowski, Rep. Math.Phys. 3, 275 (1972). M.-D. Choi, Lin. Alg. Appl. 10, 285 (1975). L. Aolita and F. Mintert, Phys. Rev. Lett. 97, 50501 (2006). G. Vidal, J. Mod. Opt. 47, 355 (2000). M. Horodecki, Open Syst. Inf. Dyn. 12, 231 (2005).

75

Quantum Communication and Security ˙ M. Zukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

Bell inequalities based on equalities Adán CABELLO 1 Departamento de Física Aplicada II, Universidad de Sevilla, 41012 Sevilla, Spain Abstract. We show that bipartite Bell inequalities based on the Einstein-PodolskyRosen criterion for elements of reality and derived from the properties of some hyper-entangled states: (a) Allow feasible experimental verifications of the fact that the impossibility of elements of reality grows exponentially with the size of the subsystems, and (b) significantly reduces the minimum detection efficiency required to experimentally refute elements of reality without the fair sampling assumption. Keywords. Einstein-Podolsky-Rosen elements of reality, Bell inequalities, loopholefree Bell experiment

1. EPR- vs CHSH-Bell inequalities Bell’s theorem states that quantum mechanics cannot be reproduced by any “local realistic theory” [1]. A Bell inequality is a constraint imposed by local realistic theories on the values of a linear combination βˆ of the averages (or probabilities) of the results of experiments on two or more separated systems. It takes the form βˆ ≤ β,

(1)

where the bound β is the maximal possible value of βˆ allowed by the local realistic theories. There are two types of Bell inequalities depending on how we define “local realistic theories”. 1.1. CHSH-Bell inequalities The most common Bell inequalities belong to the Clauser-Horne-Shimony-Holt (CHSH) type [2,3], in which local realistic theories are defined as those in which: (i) the probabilities of the outcomes of all local observables are predetermined, and (ii) these probabilities cannot be affected by spacelike separated measurements. For two separated systems 1 and 2, in any CHSH-Bell inequality, βˆ takes the following general form βˆ =

n m  

(i)

(j)

c(i, j)A1 B2 ,

(2)

i=1 j=1

where c(i, j) are certain constant coefficients, i and j are indices (discrete or continuous) (i) (j) distinguishing the possible experiments on system 1 and 2, respectively, and A 1 B2  1 E-mail:

[email protected].

76

A. Cabello / Bell Inequalities Based on Equalities

is a correlation function (the average of the product of the observables measured on 1 (i) (j) and 2). If A1 and B2 are spacelike separated experiments, from assumptions (i) and (ii) follow that the correlation must take the form  (i) (j) (i) (j) A1 B2  = f1 (A1 , λ)g2 (B2 , λ)p(λ), (3) λ (i)

(j)

(i)

where f1 (A1 , λ) [g2 (B2 , λ)] is a function which gives the value of the experiment A 1 (j) (B2 ) on subsystem 1 (2), and λ is a summation (or integration) parameter which allows the description to have a probabilistic nature; p(λ) is the distribution of the parameter. 1.2. EPR-Bell inequalities

However, Bell’s original inequality [1] is not a CHSH-Bell inequality [4,5,6,7,8]. The premise of the original Bell inequality is the Einstein-Podolsky-Rosen (EPR) criterion for the existence of elements of reality: “if, without in any way disturbing a system, we can predict with certainty (i.e., with probability equal to unity) the value of a physical quantity, then there exists an element of physical reality corresponding to this physical quantity” [9]. The EPR criterion establishes two conditions for the existence of elements of reality. Firstly, perfect predictability: it must be possible to predict them with certainty. Secondly, locality: the prediction must be based on a measurement that exerts no disturbing influence upon them. Bell’s original inequality is based on an equality: it is based on the fact that, for the two-qubit singlet state, the results of measuring the same observable B on both qubits are perfectly anticorrelated, BB = −1.

(4)

Bell uses this equality in two ways: to guarantee that all local observables are EPR elements of reality, and in the derivation of the inequality.

2. Motivating EPR-Bell inequalities for higher-dimensional systems What makes EPR-Bell inequalities so attractive is that the EPR criterion seems almost unavoidable: EPR do not assume that all local experiments should have predefined values; the existence of predefined values is assumed to explain why they can be predicted from remote measurements. On the other hand, the advantage of the CHSH-Bell inequalities is that they do not depend on the properties of a particular state. The problem for testing Bell’s original inequality, and one motivation for deriving CHSH-Bell inequalities, were the difficulty of having perfect correlations in actual experiments. However, some recent developments in quantum technologies can renewed the interest in EPR-Bell inequalities. 2.1. Almost perfect predictability and the EPR criterion The first one is the possibility of preparing two-particle states with almost perfect correlations. This almost perfect remote predictability opens the door for two possible approaches for testing of the EPR-Bell inequalities: we can either (i) relax the EPR cri-

77

A. Cabello / Bell Inequalities Based on Equalities

terion and define elements of reality as those that can be predicted with almost perfect certainty, as proposed by Eberhard and Rosselet [10]. Then, the Bell inequality is valid for all pairs; or (ii) adopt the original EPR criterion and assume that the Bell inequality is valid only for a fraction of pairs. 2.2. Hyper-entanglement and detection efficiency Other interesting development is the possibility of preparing pairs of photons in hyperentangled states, i.e. entangled in several degrees of freedom [11,12,13,14,15]. This is interesting because if we have 2N qubits encoded in 2N particles; then, to measure 2N EPR elements of reality we would need to activate 2N single-particle detectors, something that occurs with probability η 2N , being η the efficiency of each of the singleparticle detectors. However, if we have 2N qubits encoded in 2 particles; then, to reveal 2N EPR elements of reality we would only need to activate 2 single-particle detectors, something that occurs with probability η 2 . The interest of this is related to the fact that the main obstacle for a loophole-free test of Bell inequalities is that η is very low for photons. 2.3. Higher-dimensional entanglement and simultaneous EPR elements of reality In addition, the experimental capability of entangling higher-dimensional subsystems allows us to define simultaneous EPR elements of reality on the same subsystem, since it can so happen that, for certain quantum states, Bob can remotely predict with certainty the results of measuring more than one of Alice’s local observables. Therefore, while the βˆ corresponding to bipartite CHSH-Bell inequalities takes the same form (2) irrespective of the dimension of the Hilbert space describing the local subsystems, the βˆ corre(1) (2) (1) sponding to bipartite EPR-Bell inequalities can contain terms like A 1 A1 B2 , and the general form of βˆ is βˆ =

m  i=1

...

p n   j=1 k=1

...

q 

(i)

(j)

(k)

(l)

c(i, . . . , j, k, . . . , l)A1 . . . A1 B2 . . . B2 ,

(5)

l=1

where all of the local observables are EPR elements of reality (for certain states), and all the local observables appearing in the same average are compatible. Examples of bipartite EPR-Bell inequalities have been introduced in [16,17,18,19] and experimentally tested in [13,14]. In the following sections we discuss how bipartite EPR-Bell inequalities can be used to solve two still-open experimental problems in the foundations quantum mechanics: (a) Performing experiments showing that the impossibility of elements of reality grows with the “size” of the system, and (b) performing experiments which refute elements of reality without the “fair sampling” assumption, but with non-perfect photo-detectors.

3. Growing-with-size impossibility of elements of reality Mermin [20] showed that the correlations found by n spacelike separated observers that share n qubits in a Greenberger-Horne-Zeilinger (GHZ) state [21] violate a n-party (with

78

A. Cabello / Bell Inequalities Based on Equalities

n ≥ 3) Bell inequality by a factor that increases exponentially with n. An experimental verification of this exponentially growing impossibility of elements of reality using GHZ states is difficult because it requires n spacelike separated measurements, and because n-party GHZ states’ sensitivity to decoherence also grows with n [22]. The ratio βEXP /βEPR , where βEXP is the experimental value of βˆ (which is supposedly similar to βQM ), and βEPR is the maximal possible value of βˆ allowed by the local realistic theories of the EPR-type, is a good measure of the impossibility of elements of reality, since it is related both to the number of bits needed to communicate nonlocally in order to emulate the experimental results by a local realistic theory, and also to the minimum detection efficiency needed for a loophole-free experiment (as explained below). In all known bipartite CHSH-Bell inequalities this ratio is almost constant with the number of internal levels of the local subsystems. However, this is not the case in the following EPR-Bell inequality. Consider two particles 1 and 2 prepared in the state |Ψ =

N 

|ψ(j) ,

(6)

j=1

where |ψ(j) =

1 (|001 |002 + |011 |012 + |101 |102 − |111 |112 ). 2

(7)

The state |Ψ is a state of 4N qubits in two particles. Consider the following single qubit observables: (j)

Xk = σx ⊗ 1I, (j)

(8)

= σy ⊗ 1I,

(9)

Zk = σz ⊗ 1I,

(j)

(10)

(j)

(11)

(j)

(12)

(j)

(13)

Yk

x1 = 1I ⊗ σx , y2 = 1I ⊗ σy , z2 = 1I ⊗ σz ,

where k denotes particle k, σ x is the Pauli matrix in the x direction, and 1I is the identity matrix in a two-dimensional Hilbert space. For the state |Ψ, each and every one of these (j) (j) (j) (j) (j) (j) (j) 7N single qubit observables X 1 , Y1 , x1 , X2 , Y2 , y2 , and z2 can be regarded as an EPR element of reality, since it satisfies the following 7N equalities representing perfect correlations: (j)

(j) (j)

X1 X2 z2  = 1, (j)

(j) (j)

Y1 Y2 z2  = −1, (j)

(j) (j)

x1 Z2 x2  = 1, (j) (j)

(j)

X1 z1 X2  = 1,

(14) (15) (16) (17)

79

A. Cabello / Bell Inequalities Based on Equalities (j) (j)

(j)

Y1 z1 Y2  = −1, (j) (j) (j) Z1 y1 y2 

(18)

= −1,

(j) (j) z1 z2 

(19)

= 1.

(20)

Therefore, we can define (1)

(1) (1)

(N −1)

β = X1 X2 z2 . . . X1

(N −1) (N −1) (N ) (N ) (N ) z2 X1 X2 z 2 

X2

(1)

(1) (1)

(N −1)

(1)

(1) (1)

(N −1)

(1)

(1) (1)

(N −1)

(1)

(1) (1)

(N −1)

−X1 X2 z2 . . . X1 +X1 X2 z2 . . . X1 +X1 X2 z2 . . . X1 −X1 X2 z2 . . . Y1 (1) (1)

(1) (1)

(N −1) (N −1) (N ) (N ) (N ) z2 Y1 Y2 z2 

X2

(N −1) (N −1) (N ) (N ) (N ) (N ) z2 X1 x1 Y2 y2 

X2

(N −1) (N −1) (N ) (N ) (N ) (N ) z2 Y1 x1 X2 y2 

X2

(N −1) (N −1) (N ) (N ) (N ) z2 X1 X2 z 2 

Y2

(N ) (N ) (N ) (N ) x1 X2 y2 ,

+Y1 x1 X2 y2 . . . Y1

+ ... (21)

(1) (1)

(N ) (N )

which contains 4 N expectation values. For measuring, e.g., X 1 x1 . . . X1 x1 on particle 1, we use an analyzer that separates the two possibilities of each of the 2N qubit (1) (1) (N ) (N ) observables X1 , x1 , . . . , X1 , x1 . This analyzer is backed up by 4 N particle detectors, one for each of the possible outcomes. Therefore, each particle detection gives the value of 2N observables. Each observer can choose between the 4 N local experiments. The choice of experiment and the detection of particle 1 are assumed to be random and spacelike separated from those of particle 2. As can be easily checked, in any EPR-type local realistic theory, β EPR = 2N , while the value predicted by quantum mechanics is β QM = 4N , which violates the EPR bound by an amount which grows as β QM /βEPR = 2N , assuming perfect states and measurements. The remarkable point is that this exponentially growing with size violation of EPR’s local realism can be demonstrated by actual experiments if we use two-particle hyper-entangled states. In practice, we do not have perfect correlations but (1) (1)

(N ) (N ) (1) (1) (N ) (N ) x1 Y2 y2 . . . Y2 y2 

X1 x1 . . . X1

= 1 − ,

(22)

where  ≈ 0.15. In a worst-case scenario, each of the terms in βˆ is affected by a similar error. Since the number of terms in βˆ is 4N , then we should take into account that our value for βEPR could be increased to  βEPR ≈ 2N + 4N 0.15.

(23)

Also, we must take into account the imperfection in the preparation of the state which, in practice, is not |Ψ, but ρ = p|ΨΨ| + (1 − p)ρ  , with p ≈ 0.98, and the specific form of the term ρ depends on the physical procedure used to prepare and distribute the state. Therefore, the expected experimental value of βˆ is  βQM ≈ 0.98 × 4N + 0.02.

(24)

 still provides a significant violation of the inequality The interesting point is that β QM  ˆ β ≤ βEPR , violation which exhibits a growing with size violation of EPR’s local realism.

80

A. Cabello / Bell Inequalities Based on Equalities

4. Impossibility of elements of reality without the fair sampling assumption Experiments to test CHSH-Bell inequalities have fallen within quantum mechanics and, under certain additional assumptions, seem to exclude local realistic theories [23,24,25,26,27,28,29,30,31,32,33,34]. A particularly relevant loophole is the so-called detection loophole [35]. It arises from the fact that, in most experiments, only a small subset of all the created pairs are actually detected, so we need to assume that the detected pairs are a fair sample of the created pairs (fair sampling assumption). Otherwise, it is possible to build a local model reproducing the experimental results. Closing the detection loophole in a two-photon experiment to test the CHSH inequality [2] requires an overall photo-detection efficiency η > 0.83 [36], while testing the Clauser-Horne inequality [3] requires η > 0.67 [37,38]. The highest overall photo-detection efficiency currently available is η ≈ 0.33, although there is a promising attempt to solve this problem [39,40]. Garg and Mermin suggested that “It is possible that n × n [i.e., bipartite n-level] experiments with n larger than 2 can refute local realism with lower detector efficiencies” [36]. Nevertheless, this conjecture has not been proven to be true with bipartite CHSHBell inequalities. However, this effect can be observed by using EPR-Bell inequalities. Let us calculate the minimum detection efficiency required for a loophole-free test based on the bipartite EPR-Bell inequality introduced in the previous section. If N (AB = 1) is the number of pairs in which the product of the results of measuring, e.g., (1) (1) (N ) (N ) (1) (1) (N ) (N ) A = X1 x1 . . . X1 x1 on particle 1 and B = Y 2 y2 . . . Y2 y2 on particle 2 is 1, and N is the total number of emitted pairs, then the corresponding correlation is AB = [N (AB = 1) − N (AB = −1)] /N . If η is the detection efficiency of each and every one of the 4 N particle detectors behind each analyzer, then the number of detected pairs in which the product of the results of measuring A on particle 1 and B on particle 2 is ±1, is related with the theoretical number by NEXP (AB = ±1) = η 2 N (AB = ±1).

(25)

On the other hand, N = NEXP (AB = 1) + NEXP (AB = −1) +NEXP (A = ±1, B = 0) + NEXP (A = 0, B = ±1) +NEXP (A = 0, B = 0),

(26)

where NEXP (A = ±1, B = 0) is the number of pairs in which when A is measured on particle 1 and B is measured on particle 2, and one detector corresponding to particle 1 is activated, but no detector corresponding to particle 2 is activated. We usually do not know NEXP (A = 0, B = 0), because we cannot know N ; however, the relation between them is NEXP (A = 0, B = 0) = (1 − η)2 N .

(27)

The probability that two or more detectors corresponding to the same particle are activated simultaneously is assumed to be negligible. What we obtain in an experiment is

A. Cabello / Bell Inequalities Based on Equalities

81

ABEXP = [NEXP (AB = 1) − NEXP (AB = −1)] −1

× [N − NEXP (A = 0, B = 0)]

.

(28)

Therefore, substituting (25) and (27) in (28), we obtain ABEXP =

η2 AB. 1 − (1 − η)2

(29)

Therefore, taking into account the detection efficiencies, the EPR-Bell inequalities becomes η2 βQM ≤ βEPR , 1 − (1 − η)2

(30)

where βQM and βEPR must be replaced by (24) and (23), if we take the errors in the state and the measurements into account. The remarkable point is that the minimum η required for a loophole-free test is a function of the ratio β QM /βEPR , irrespective of the particular form of the EPR-Bell inequality. This can be used to calculate the minimum detection efficiency required for a loophole-free test based on different EPR-Bell inequalities for different hyper-entangled states (see Table 1). Table 1. Minimum detection efficiencies required for a loophole-free Bell test based on: (a) the EPR-Bell inequality which is a “product” of CHSH inequalities and a hyper-entangled state which is the product of Bell states, (b) the EPR-Bell inequality described in section 3 and the state (6). n is the number of qubits encoded in each photon. The lower bound for the efficiency is calculated assuming that the EPR-Bell inequality is valid for all pairs, even if we do not have perfect correlations. The upper bound is calculated assuming that the EPR-Bell inequality is only valid for the fraction of pairs for which we have perfect correlations (0.85) and the other fraction (0.15) conspires in order to simulate the quantum prediction.

n

η(a)

1

0.83 − 0.96

η(b) ...

2

0.67 − 0.89

0.67 − 0.79

3 4

0.52 − 0.87 0.40 − 0.92

... 0.40 − 0.57

5

...

...

6 7

... ...

0.22 − 0.43 ...

8 9

... ...

0.12 − 0.35 ...

10

...

0.06 − 0.31

These results suggest that EPR-Bell inequalities derived for some specific hyperentangled states can be useful to experimentally refute elements of reality without the fair sampling assumption, even when using non-perfect photo-detectors.

Acknowledgments ˙ The author thanks Marek Zukowski for stimulating conversations over the years, and acknowledges support from Spanish MEC Project No. FIS2005-07689.

82

A. Cabello / Bell Inequalities Based on Equalities

References [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20] [21] [22] [23] [24] [25] [26] [27] [28] [29] [30] [31] [32] [33] [34] [35] [36] [37] [38] [39] [40]

J. S. Bell, Physics (Long Island City, NY) 1, 195 (1964). J. F. Clauser, M. A. Horne, A. Shimony, and R. A. Holt, Phys. Rev. Lett. 23, 880 (1969). J. F. Clauser and M. A. Horne, Phys. Rev. D 10, 526 (1974). M. L. G. Redhead, Incompletness, Nonlocality, and Realism (Oxford University Press, New York, 1987), p. 97. E. R. Loubenets, Phys. Rev. A 69, 042102 (2004). C. Simon, Phys. Rev. A 71, 026102 (2005). E. R. Loubenets, J. Phys. A 38, L653 (2005). ˙ M. Zukowski, Found. Phys. 36, 541 (2006). A. Einstein, B. Podolsky, and N. Rosen, Phys. Rev. 47, 777 (1935). P. H. Eberhard and P. Rosselet, Found. Phys. 25, 91 (1995). P. G. Kwiat, J. Mod. Opt. 44, 2173 (1997). P. G. Kwiat and H. Weinfurter, Phys. Rev. A 58, R2623 (1998). C. Cinelli, M. Barbieri, R. Perris, P. Mataloni, and F. De Martini, Phys. Rev. Lett. 95, 240405 (2005). ˙ T. Yang, Q. Zhang, J. Zhang, J. Yin, Z. Zhao, M. Zukowski, Z.-B. Chen, and J.-W. Pan, Phys. Rev. Lett. 95, 240406 (2005). J. T. Barreiro, N. K. Langford, N. A. Peters, and P. G. Kwiat, Phys. Rev. Lett. 95, 260501 (2005). A. Cabello, Phys. Rev. Lett. 87, 010403 (2001). P. K. Aravind, Found. Phys. Lett. 15, 397 (2002). A. Cabello, Phys. Rev. Lett. 95, 210401 (2005). A. Cabello, Phys. Rev. A 72, 050101(R) (2005). N. D. Mermin, Phys. Rev. Lett. 65, 1838 (1990). D. M. Greenberger, M. A. Horne, and A. Zeilinger, in Bell’s Theorem, Quantum Theory, and Conceptions of the Universe, edited by M. Kafatos (Kluwer Academic, Dordrecht, Holland, 1989), p. 69. M. Hein, W. Dür, and H.-J. Briegel, Phys. Rev. A 71, 032350 (2005). S. J. Freedman and J. F. Clauser, Phys. Rev. Lett. 28, 938 (1972). E. S. Fry and R. C. Thompson, Phys. Rev. Lett. 37, 465 (1976). A. Aspect, P. Grangier, and G. Roger, Phys. Rev. Lett. 47, 460 (1981). A. Aspect, P. Grangier, and G. Roger, Phys. Rev. Lett. 49, 91 (1982). A. Aspect, J. Dalibard, and G. Roger, Phys. Rev. Lett. 49, 1804 (1982). Z. Y. Ou and L. Mandel, Phys. Rev. Lett. 61, 50 (1988). Y. H. Shih and C. O. Alley, Phys. Rev. Lett. 61, 2921 (1988). Z. Y. Ou, S. F. Pereira, H. J. Kimble, and K. C. Peng, Phys. Rev. Lett. 68, 3663 (1992). P. G. Kwiat, K. Mattle, H. Weinfurter, A. Zeilinger, A. V. Sergienko, and Y. Shih, Phys. Rev. Lett. 75, 4337 (1995). G. Weihs, T. Jennewein, C. Simon, H. Weinfurter, and A. Zeilinger, Phys. Rev. Lett. 81, 5039 (1998). M. A. Rowe, D. Kielpinski, V. Meyer, C. A. Sackett, W. M. Itano, C. Monroe, and D. J. Wineland, Nature (London) 409, 791 (2001). D. L. Moehring, M. J. Madsen, B. B. Blinov, and C. Monroe, Phys. Rev. Lett. 93, 090410 (2004); 93, 109903 (2004). P. M. Pearle, Phys. Rev. D 2, 1418 (1970). A. Garg and N. D. Mermin, Phys. Rev. D 35, 3831 (1987). P. H. Eberhard, Phys. Rev. A 47, R747 (1993). J.-Å. Larsson and J. Semitecolos, Phys. Rev. A 63, 022117 (2001). R. Rangarajan, E. R. Jeffrey, J. B. Altepeter, and P. G. Kwiat, in Proc. of the 8th Int. Conf. on Quantum Communication, Measurement and Computing (Tsukuba, Japan, 2006). J. B. Altepeter, E. R. Jeffrey, R. Rangarajan, and P. G. Kwiat, in Proc. of the 8th Int. Conf. on Quantum Communication, Measurement and Computing (Tsukuba, Japan, 2006).

Quantum Communication and Security ˙ M. Zukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

83

A quantum de Finetti theorem for the unitary group Matthias CHRISTANDL 1 , Robert KÖNIG 2 , Graeme MITCHISON 3 and Renato RENNER 4 Centre for Quantum Computation, DAMTP, University of Cambridge, Cambridge CB3 0WA, UK Abstract. When n−k systems of an n-partite permutation-invariant state are traced out, the resulting state can be approximated by a convex combination of tensor product states. This is the quantum de Finetti theorem. In this paper, we summarise the results that we have obtained in section II of [1]: we show that an upper bound 2 , where d is the dimenon the trace distance of this approximation is given by 2kd n sion of the individual system, thereby improving previously known bounds. Our result follows from a more general approximation theorem for representations of the unitary group: Consider a pure state that lies in the irreducible representation Uμ+ν ⊂ Uμ ⊗ Uν of the unitary group U(d), for highest weights μ, ν and μ + ν. Let ξμ be the state obtained by tracing out Uν . Then ξμ is close to a convex combination of the coherent states Uμ (g)|vμ , where g ∈ U(d) and |vμ  is the highest weight vector in Uμ . Keywords. General properties, structure, and representation of Lie groups; quantum information theory

Introduction There is a famous theorem about classical probability distributions, the de Finetti theorem [2], whose quantum analogue has stirred up some interest recently. The original theorem states that a symmetric probability distribution of k random variables, P X1 ···Xk , that is infinitely exchangeable, i.e. can be extended to an n-partite symmetric distribution PX1 ···Xn for all n > k, can be written as a convex combination of identical product distributions, i.e. for all x 1 , . . . , xk  PX1 ···Xk (x1 , . . . , xk ) = PX (x1 ) · · · PX (xk )dμ(PX ), (1) where μ is a measure on the set of probability distributions, P X , of one variable. In the quantum analogue [3,4,5,6,7,8] a state ρ k on H⊗k is said to be infinitely exchangeable if it is symmetric (or permutation-invariant), i.e. πρ k π † = ρk for all π ∈ Sk and, for 1 [email protected] 2 [email protected] 3 [email protected] 4 [email protected]

84

M. Christandl et al. / A Quantum de Finetti Theorem for the Unitary Group

all n > k, there is a symmetric state ρ n on H⊗n with ρk = trn−k ρn . The theorem then states that  k ρ = σ ⊗k dm(σ) (2) for a measure m on the set of states on H. However, the versions of this theorem that have the greatest promise for applications relax the strong assumption of infinite exchangeability [9,10]. For instance, one can assume that ρk is n-exchangeable for some specific n > k, viz. that ρ k = trn−k ρn for some symmetric state ρn . In that case, the exact statement in equation 2 is replaced by an approximation ρk ≈



σ ⊗k dm(σ),

(3)

as proved in [9], where it was shown that the error is bounded by an expression propor6 tional to √kd , where d = dim H. n−k In this paper we summarise the results that have been obtained in [1, section II]. In the next section we state the improved bounds for the size of the error in equation 3. We then discuss lower bounds on the optimal error bound and summarise upper and lower bounds in a table. Subsequently, we explain how our result and the notion of a de Finetti theorem can be generalised to states whose extensions lie in some unitary representation Uλ characterised by the Young diagram λ.

1. Improved bounds for conventional quantum de Finetti theorems We say a (mixed) state ξ n on H⊗n is permutation-invariant or symmetric if πξ n π † = ξ n , for any permutation π ∈ S n . Here, the symmetric group S n acts on H⊗n by permuting the n subsystems, i.e. every permutation π ∈ S n gives a unitary π on H ⊗n defined by π|ei1  ⊗ · · · ⊗ |ein  = |eiπ−1 (1)  ⊗ · · · ⊗ |eiπ−1 (n) 

(4)

for an orthonormal basis {|e i }di=1 of H ∼ = Cd . Note that, as a unitary operator, π † −1 corresponds to the action of π ∈ Sn . In order to quantify the quality of the approximation in equation 3 we use the trace distance, which is induced by the trace norm A := 12 tr|A| on the set of hermitian operators. We start with a definition.  Definition 1.1. Let P k = P k (H) be the set of states of the form σ ⊗k dm(σ), where m is a probability measure on the set  of (mixed) states on H. Furthermore let P (k) (H) denote the set of states of the form dm(φ)|φφ|⊗k , where m is a probability measure on the set of pure states on H. The following is our main result and, as discussed in the introduction, significantly improves previously known bounds on the size of the error in equation 3.

85

M. Christandl et al. / A Quantum de Finetti Theorem for the Unitary Group

Theorem 1.2 (Approximation of symmetric states by product states). Let ξ n be a permutation-invariant density operator on (C d )⊗n and k ≤ n. Then ξ k := trn−k (ξ n ) is 2 ε-close to P k (Cd ) for ε := 2 dnk . That is, there exists a probability measure m on the set of (mixed) states on C d such that  k ξ − σ ⊗k dm(σ) ≤ ε . The proof of this theorem consists of two steps. First, we prove the theorem for pure states that obey a stronger notion of symmetry than permutation-invariance. This is Bose-symmetry, defined by the condition that π|Ψ = |Ψ for every π ∈ S n . We denote by Symn (H) the space spanned by all Bose-symmetric pure states in H ⊗n . Theorem 1.3 (Approximation of Bose symmetric states by pure product states). Let |Ψ be a pure Bose-symmetric state in (C d )⊗n , and let ψ k := trn−k (|ΨΨ|), k ≤ n. Then ψ k is ε-close to P(k) (Cd ), for ε := 2 dk n . The proof of this theorem uses representation-theoretic methods and emerges from a more general framework as we will explain in section 3. Second, we use the following lemma which reduces the general permutationinvariant case to the Bose-symmetric case. Lemma 1.4. Let ξ n be a permutation-invariant state on H ⊗n , where H ∼ = Cd . Then there exists a purification |Ψ ξ  of ξ n in Symn (K ⊗ H) with K ∼ H. = Theorem 1.2 now follows directly from Lemma 1.4 and Theorem 1.3.

2. Optimality 2

6

k The error bound we obtain in Theorem 1.2 is of size dnk , which is tighter than the √dn−k bound obtained in [9]. Is there scope for further improvement? For classical probability distributions, Diaconis and Freedman [15] showed that, for n-exchangeable distributions, k(k−1) the error, measured by the trace distance, is bounded by min{ dk n , 2n }, where d is k(k−1) the alphabet size. This implies that there is a bound, 2n , that is independent of d. The following example shows that there cannot be an analogous dimension-independent bound for a quantum de Finetti theorem.

Example 2.1. Suppose n = d, and define a permutation-invariant state on (C n )⊗n by ξn =

1  sign(π)sign(π  )π|12 · · · n12 · · · n|π † n!  π,π

n n where projector onto n n{|i}i=1 is an orthonormal basis of C . This is just the normalised (C ), the completely antisymmetric (fermionic) subspace in (C n )⊗n . Tracing out  n − 2 systems gives the projector onto 2 (Cn ), i.e. the state

ξ2 =

2 n(n − 1)

 1≤i<j≤n

|ij − jiij − ji|,

(5)

86

M. Christandl et al. / A Quantum de Finetti Theorem for the Unitary Group

Table 1. Upper and lower bounds on the optimal that is only dependent on k, n and d. A function f (x) is in O(g(x)) (in Ω(g(x))) if, for some nonnegative constant c, f (x) is less (greater) than cg(x) for all sufficiently large x.

Lower bounds (fixed d)

Classical

Quantum

Bose symmetry

k Ω( n )

k Ω( n )

k Ω( n )

d ) Ω( n

Lower bounds (fixed k) Lower bounds (unbounded d) Upper bounds

2 Ω( kn ) 2 , kn }) O(min{ kd n

Ω(

√

d ) n

Ω(1)

Ω(1)

O( kd ) n

O( kd ) n

2

which has trace distance at least 1/2 from P 2 (Cn ). We must therefore expect our quantum de Finetti error bound to depend on d, as is 2 indeed the case for the error term kdn in Theorem 1.2. This example shows that some aspects of the de Finetti theorem cannot be carried over from probability distributions to quantum states. Other aspects, however, carry over to the quantum case: for instance a lower bound of the order of nk which has been derived by Diaconis and Freedman for d = 2. A summary of upper and lower bounds is given in Table 1.

3. A generalisation to the unitary group In order to state the general approximation result for the unitary group we need to introduce some notation from Lie group theory [12]. Let U(d) be the unitary group and fix a basis |1, . . . , |d of Cd in order to distinguish the diagonal matrices with respect to this basis as the Cartan subgroup H(d) of U(d). A weight vector with weight λ = (λ1 , . . . , λd ), where each  λi is an integer, is a vector |v in the representation U of U(d) satisfying U (h)|v = hλi i |v, where h1 , . . . , hd are the diagonal entries of h ∈ H(d). We can equip the set of weights with an ordering: λ is said to be (lexicographically) higher than λ  if λi > λi for the smallest i with λi = λi . It is a fundamental fact of representation theory that every irreducible representations of U(d) has a unique highest weight vector (up to scaling); the corresponding weights must be dominant, i.e. λi ≥ λi+1 . Two irreducible representations are equivalent if and only if they have identical highest weights. It is therefore convenient to label irreducible representations by their highest weights and write U λ for the irreducible representation of U(d) with highest weight λ. It will also be convenient to choose the normalisation of the highest weight vector |vλ  to be vλ |vλ  = 1 in order to be able to view |v λ vλ | as a quantum state. Given two irreducible representations U μ and Uν with corresponding spaces U μ and Uν we can define the tensor product representation U μ ⊗ Uν acting on Uμ ⊗ Uν by (Uμ ⊗ Uν )(g) = Uμ (g) ⊗ Uν (g), for any g ∈ U(d). In general this representation is reducible and decomposes as U μ ⊗ Uν ∼ =

 λ

cλμν Uλ .

M. Christandl et al. / A Quantum de Finetti Theorem for the Unitary Group

87

The multiplicities cλμν are known as Littlewood-Richardson coefficients. It follows from the definition of the tensor product that |v μ  ⊗ |vν  is a vector of weight μ + ν, where (μ+ν)i = μi +νi . By the ordering of the weights, μ+ν is the highest weight in U μ ⊗Uν and |vμ  ⊗ |vν  is the only vector with this weight. We therefore identify |v μ+ν  with |vμ  ⊗ |vν  and remark that U μ+ν appears exactly once in U μ ⊗ Uν . The result in this section is an approximation theorem for states in the spaces of irreducible representations of U(d). Consider a normalised vector |Ψ in the space U μ+ν of the irreducible representation U μ+ν . By the above discussion we can embed U μ+ν uniquely into the tensor product representation U μ ⊗ Uν . This allows us to define the reduced state of |Ψ on U μ by ξμ = trν |ΨΨ|. It is our main result that the reduced state on Uμ is approximated by convex combinations of rotated highest weight states: Definition 3.1. For g ∈ U(d), let |vμg  := Uμ (g)|v μ  be the rotated highest weight  vector in Uμ . Let Pμ (Cd ) be the set of states of the form |vμg vμg |dm(g), where m is a probability measure on U(d). Here, the states |vμg , with g ∈ U(d), are coherent states in the sense of [13]. For d = 2 and μ = (k, 0) ≡ (k), these states are the well-known SU(2)-coherent states. Theorem 3.2 (Approximation by coherent states). Let |Ψ be in U μ+ν which we consider to be embedded into U μ ⊗ Uν as described above. Then ξ μ = trν |ΨΨ| is ε-close dim Uν to Pμ (Cd ), where ε := 2(1 − dim Uμ+ν ). That is, there exists a probability measure m on U(d) such that  ξμ − |vμg vμg |dm(g) ≤ ε . This theorem generalises Theorem 1.3, which is a corollary when setting μ = (k, 0, . . . , 0) and ν = (n − k, 0, . . . , 0) and bounding  appropriately. By convexity of the trace distance Theorem 3.2 remains true for mixed states supported on U μ+ν . We would like to point out that the theorem also holds true relative to an additional system. For details see [1].

Acknowledgements We thank Henriette Steiner for helping to prepare this manuscript. This work was supported by the EU project RESQ (IST-2001-37559) and the European Commission through the FP6-FET Integrated Project SCALA, CT-015714. MC acknowledges the support of an EPSRC Postdoctoral Fellowship and a Nevile Research Fellowship, which he holds at Magdalene College Cambridge. GM acknowledges support from the project PROSECCO (IST-2001-39227) of the IST-FET programme of the EC. RR was supported by Hewlett Packard Labs, Bristol.

References [1]

M. Christandl, R. König, G. Mitchison and R. Renner, to appear in Comm. Math. Phys. (2007), quantph/0602130.

88 [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12]

M. Christandl et al. / A Quantum de Finetti Theorem for the Unitary Group

B. de Finetti, Ann. Inst. H. Poincaré 7, 1 (1937). E. Størmer, J. Funct. Anal. 3, 48 (1969). R. L. Hudson and G. R. Moody, Z. Wahrschein. verw. Geb. 33, 343 (1976). D. Petz, Prob. Th. Rel. Fields. 85 (1990). C. M. Caves, C. A. Fuchs, and R. Schack, J. Math. Phys. 43, 4537 (2002). C. A. Fuchs and R. Schack, (2004), quant-ph/0404156. C. A. Fuchs, R. Schack, and P. F. Scudo, Phys. Rev. A 69, 062305 (2004). R. König and R. Renner, J. Math. Phys. 46, 122108 (2005). R. Renner, Security of Quantum Key Distribution, PhD thesis, ETH Zurich, 2005, quant-ph/0512258. R. F. Werner, Phys. Rev. A 40, 4277 (1989). R. Carter, G. Segal, and I. MacDonald, Lectures on Lie Groups and Lie Algebras, London Mathematical Society Student Texts Vol. 32, 1 ed. (cup, 1995). [13] A. Perelomov, Generalized coherent states and their application Texts and Monographs in Physics (Springer-Verlag, Berlin, 1986). [14] H. Weyl, The Theory of Groups and Quantum Mechanics (Dover Publications, Inc., New York, 1950). [15] P. Diaconis and D. Freedman, The Annals of Probability 8, 745 (1980).

89

Quantum Communication and Security ˙ M. Zukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

Production of Information and Entropy in Measurement of Entangled States Constantin V. USENKO

1

National Taras Shevchenko University of Kyiv, Physics Faculty, Department of Theoretical Physics Abstract. Problem of classification of the set of all entangled states is considered. Invariance of entangled states relative to the transformations from a group of symmetry of qubit space leads to classification of all states of the system through irreducible representations from that group. Excess of entropy the of a subsystem over the entropy of the whole system indicates the presence of entaglement in the system. Keywords. Irreducible representation, entaglement, entropy

Introduction One of the most interesting phenomena in quantum physics is the ability of quantum system to create information, for instance, in measurement [1,2,3] of electron spins for an EPR-pair. This property is actively used in different areas of quantum physics and its applications, like Quantum Key Distribution. States of quantum system with such peculiarity are known as entangled states. Recently a lot of entangled states have been studied and there exists an urgent problem of classification of the set of all entangled states. Subject of the talk deals with the idea of the invariance of entangled states relative to transformations from a group of symmetry [12,13,14,11,15]. Each state of quantum system is invariant relative to phase coefficient thus composite system is to be invariant relative to transformations from the group of symmetry of each subsystem. These groups form the group of symmetry of the whole system so the set of all states of the system can be clasified through irreducible representations of that group. In this work it is shown that almost each space of irreducible representation consists of the entangled states only. Entropy of substates from each space with nontrivial representation exceeds entropy of whole state. Excess of entropy the of a subsystem over the entropy of the whole system indicates that the system is entagled.

1 prosp.

akad. Glushkova, 2, b.1, Kyiv, Ukraine, e-mail: [email protected]

90

C.V. Usenko / Production of Information and Entropy in Measurement of Entangled States

1. Measurability of Entanglement 1.1. General entangled system Let the system S has two parts A and B and is prepared in common state ρ sys . Of course each part is in its own state: part A is in the state ρˆA and part B is in the state ρˆB . They can be combined into ρˆsys in different ways: 1. If ρˆsys = ρˆA ⊗ ρˆB , parts of the system are indepent.  ρA,k ⊗ ρˆB,k ), the system is a mixture of its parts. 2. If ρˆsys = pk (ˆ 3. All the other states of the system are entangled. Common example of an entangled state is the EPR (Einstein-Podolsky-Rosen) one which is a singlet state of an electron pair. In accordance with the principle of identity this state is a linear superposition of states "‘spin-up – spin-down"’ and "‘spin-down – spin-up"’ 1 | EP R = √ (|↑ ⊗ |↓ − |↓ ⊗ |↑) . 2 Another example is Schrödinger Cat state being a linear superposition of a photon pair with same polarisations 1 | Cat = √ (| ⊗ | + |↔ ⊗ |↔) . 2 1.1.1. Unitary symmetry Schrödinger Cat state shows special type of unitary symmetry. First we denote as |0)A and |1)A transformed basis of subsystem A: |0A = cos θ |0)A + eiφ sin θ |1)A ; |1A = −e−iφ sin θ |0)A + cos θ |1)A . If the basis of subsystem B is transformed to |0) B and |1)B by |0B = cos θ |0)B + e−iφ sin θ |1)B ; |1B = −eiφ sin θ |0)A + cos θ |1)B , Schrödinger Cat remains non-transformed 1 1 √ (|0A ⊗ |0B + |1A ⊗ |1B ) = √ (|0)A ⊗ |0)B + |1)A ⊗ |1)B ) . 2 2 Thus, the Schrödinger Cat state has group of symmetry U (2) – group of unitary transformations of two-dimensional space of states. Similarly, EPR-state has the same group of symmetry. Systems having larger subsystems can have entangled states with larger group of symmetry U (N > 2) but each such group includes U (2) as subgroup, so invariance to group U (2) is essential property of entangled state.

C.V. Usenko / Production of Information and Entropy in Measurement of Entangled States

91

1.1.2. States of subsystem Now we describe the state of a part of the system (or system as a whole). Under supposition that space of states has finite dimension we describe a state by the density matrix ρˆ =

N 

ρn,m |n  m|; 1 ≥ ρ1,1 ≥ . . . ≥ ρN,N ≥ 0.

(1)

n,m=1

As a result of finite dimension we have the solution of eigenvalue problem for the density matrix. In the case of basis composed of eigenvectors of density  matrix,  ρ n=m = 0, ˆ we can describe the density matrix as polynomial function ρˆ = ρ Sz of momentum operator    n − N2+1 |n  n|; Sˆz = N n=1  N Sˆ+ = n=1 n (N − n) |n + 1  n|; N ˆ S − = n=1 (n − 1) (N − n + 1) |n − 1  n|; Sˆ+ Sˆ− = 2Sˆz .

(2)

Now we involve into consideration associate ladder operators Sˆ± because arbitrary operator on space of the states has representation as polynom over ladder operators ˆ= O

N −1 

m ˆn Om,n Sˆ+ S− .

(3)

m,n=0

More exactly each space of subsystem states, as well as the space of states of the whole system, is unitarily equivalent to the space of irreducible representation of angular momentum j = N2−1 . 1.1.3. States of the composite system Space of the states of the system is direct multiplication H = H A ⊗ HB of subsystem spaces HA and HB . Even if subsystems are identical and have unitarily equivalent spaces H A ∝ HB ∝ 2 H = C N , the common space of states is H = H ⊗ H = C N . Generally, dimension of the space of the system states H is Nsys = NA NB . It is significant that system space can be fibred by means of group of symmetry of subsystem U (2) into direct sum of irreducible representations of that group. Dimension of each irreducible representation takes values up to the sum of subspace dimensions, not the product of those. ˆ ˆ Now we denote as S A and S B momentum operators for subsystems A and B respectively. So, we can define set of irreducible representations H j by rule of addition of an gular momentum. Let N A − NB = d ≥ 0, thus subspaces C d , C d+1 , . . . , C NA +NB −1 contain the irreducible multiplets. 1.2. Reconstruction of state Now we suppose that we have representative set of measured values reflecting various properties of system and of both of its parts, and we are going to determine if the sys-

92

C.V. Usenko / Production of Information and Entropy in Measurement of Entangled States

tem is entangled or not. First we examine the set according to its adequacy for the full determination of state of each subsystem. 1.2.1. Observables State of the system is determined under the condition that all the components ρ m,n of the density matrix are given, thus set of measured values is to be large enough for calculation of all the components. Process of measurement takes place as count by the set of independent detectors. Independence implies that each time only one detector counts. Completeness and purity of detectors is essential as well. Purity implies that projection of a state of the system on each detected state is one-dimensional; independence – that these projections are orthogonal, and completeness – that these projections give resolution of identity. ˆ k : independence and purity D ˆn = D ˆ kD ˆ k δk,n ; In terms of a detector operator D  ˆ ˆ completeness ∀k Dk = I. Set of measured values is a set of probabilities for each detector   ˆ m ρˆ = m |ˆ pm = T r D ρ| m = ρm,m . We can assign to each detector an observable value O k and so we define an observable through its decomposition  ˆ k def ˆ Ok D → O. ∀k

Different sets of observable values define various observables forming a class of commutable observables. Typical example is Sˆz given by Eq. (2). 1.2.2. Ladder basis Any class of commutable observables can be represented as polynomial of typical element of the class. We can represent each such example by the power of ladder operators (m) m Sˆ± = Sˆ± ,

(4) (m)

(m)

(m) (m) or as Sˆ+ Sˆz ± Sˆz Sˆ− . Thus we can ! describe all sets (m) (m) of observables by two sequences Sˆ+ Sˆz ± Sˆz Sˆ− , m = 0 . . . N − 1 or by real and ! (m) imaginary parts of the sequence Sˆ+ Sˆz , m = 0 . . . N − 1 . Since each class of commutable observables is represented by a polynomial funcn  (m) ˆ p,k ˆn,m = Sˆ+ tion there exist 2N 2 observables O Sz with matrix elements On,m = "  n  #   (m) p  Sˆ+ Sˆz  k . " #   ˆ n,m = T r O ˆ n,m ρˆ for a given state ρˆ depend The values of those observables O on the coefficients of the density matrix and lead to a linear system of equations for these coefficients

as sum or difference Sˆ+ ± Sˆ−

N  p,k=1

# " p,k ˆ n,m . On,m ρp,k = O

(5)

C.V. Usenko / Production of Information and Entropy in Measurement of Entangled States

93

1.3. Measurement of composite system Interrelation between both parts of the system brings up correlations of measured values. We suppose that each count of detector measuring subsystem A is accompanied by a count of some detector measuring subsystem B. We can interprete each pair of detectors {B} ˆ n{A} and D ˆm ˆ {sys} with number k being a function k (m, n) D as a composite detector D k of numbers of detectors of parts. Hence we can describe the composite system by its set of sequences of counts and obtain its density matrix  {sys} ρˆ{sys} = ρk,p | k  p | . (6) ∀k,p

1.3.1. Definition of covariance matrix Another way to describe a composite system is to supplement independent descriptions of each part with an account of correlation between observables of different parts. Correlation has description by covariance matrix with coefficients obtained as estimation of mutual sampling rate limit $

NkA &mB NkA NmB (7) − → ck,m : k = 1 . . . NA , m = 1 . . . NB . Nf ull Nf ull Nf ull Here we have coefficients of covariance matrix of observables from different parts only. Such coefficients for observables from one part are not measurable because arise from different series of measurements. Thus counts N kA &mB and Nf ull belong to one common series, for each coefficient of covariance matrix Eq. (7) originates from its own series and complete measurement of correlation between two parts of a given system needs a complete set of N A · NB measurement series. 1.3.2. Determination of covariance matrix For a given state of two-part system the covariance matrix is determined by average value {1} {2} of common observable Sˆn Sˆm being the product of corresponding observables of each part " # # # " " {2} {2} C (n, m) = Sˆn{1} − Sˆn{1} Sˆm . (8) − Sˆm 1.4. Decomposition of state of composite system Description of states of composite system can be performed in the composite basis {| k}, as in Eq. (6), and in the basis {|m ⊗ |n)} of the direct product of the subsystem states as well. Relationship between those bases is similar to the relationship between the basis of total angular momentum {| j, m j } and the direct product of the bases of orbital angular momentum and spin {|l, m ⊗ |m s )}. There exists a set of well-known rules of correspondence between the states of total angular momentum and the states of combinations of orbital momentum and spin   | j, mj  = Cj,mj ;ml ,ms |l, ml  ⊗ |ms ) , ml =−l...l ms =− 12 , 12

94

C.V. Usenko / Production of Information and Entropy in Measurement of Entangled States

where Cj,mj ;ml ,ms j are Clebsch–Gordan coefficients. In general case we have similar rules of correspondence for composition of two parts with momenta l and s ≤ l given by   | j, mj  = Cj,mj ;ml ,ms |l, ml  ⊗ |s, ms ) . (9) ml =−l...l ms =−s...s

1.4.1. Invariant states Invariance of the states of composite system under group U (2) transformation is realized through diagonalization of the density matrix in the basis of irreducible representations. Therefore we have the representation of the density matrix   ρˆsys = ρj,mj | j, mj   j, mj |. (10) j=jmin ...jmax mj =−j...j

Using decomposition of irreducible states by pure states of subsystems we have representation of the density matrix of the whole system as a combination of the density matrices of subsystems ρˆsys = 

ρj,mj Cj,mj ;ml ,ms Cj,mj ;nl ,ns |l, ml   l, nl | ⊗ |s, ms )  (s, ns |

j,mj ,ml ,ms ;nl ,ns

Main result of this decomposition is in representation of density matrices of subsystems obtained by averaging over the states of another subsystem    2 ρˆA = ml ρ C j,m j j,mj ;ml ,ms |l, ml   l, ml | j,mj ;ms  (11)   2 ρˆB = ms j,mj ;ml ρj,mj Cj,mj ;ml ,ms |s, ms )  (s, ms | We see that each irreducible part of density matrix of composite system has its own term in density matrices of subsystems and all these parts are diagonal because of the special properties of Clebsch–Gordan coefficients. 1.4.2. States of subsystems Each pure state of the whole system being irreducible representation has its own density matrices of each subsystem % &   {A} 2 ρˆj,mj = Cj,mj ;ml ,ms |l, ml   l, ml |; ml

{B} ρˆj,mj

=

ms

%   ms

ml

& 2 Cj,m j ;ml ,ms

|s, ms )  (s, ms |.

We denote {A}

ρj,mj ;ml =

 ms

{B}

2 Cj,m ; ρj,mj ;ms = j ;ml ,ms

 ml

2 Cj,m j ;ml ,ms

(12)

C.V. Usenko / Production of Information and Entropy in Measurement of Entangled States

95

and obtain diagonal representation of the density matrices of each subsystem for each pure irreducible state of whole system {A}

ρˆj,mj =

 ml

{A}

{B}

ρj,mj ;ml |l, ml   l, ml |; ρˆj,mj =

 ms

{B}

ρj,mj ;ms |s, ms )  (s, ms |.

(13)

Almost each one of the pure irreducible states of the whole system consists of more than one product of states of subsystems like complete angular momentum of electron m j formed by two orbital substates with orbital momenta m j − 1/2 and mj + 1/2. Only two extreme states with momenta m j = ±j are formed as products of orbital and spin states and only two extreme states with m j = ± (l + s) are states of independent subsystems. The density matrices Eq. (13) are diagonal in common basis so the density matrix of any part for whole mixed system Eq. (6) is diagonal as well: ρˆ{A} =

 j,mj

ρˆ{B} =

 j,mj

{sys} {A}

ρj,mj ρˆj,mj = {sys} {B}

ρj,mj ρˆj,mj =

 ml j,mj

 ms j,mj

{sys} {A}

ρj,mj ρj,mj ;ml |l, ml   l, ml | {sys} {B}

ρj,mj ρj,mj ;ms |s, ms )  (s, ms |

Diagonal elements of these density matrices are ρ{A} ml = ρ{B} ms =

 j,mj

 j,mj

{sys} {A}

ρj,mj ρj,mj ;ml ; {sys} {B}

ρj,mj ρj,mj ;ms

(14)

(15)

They are equal only in the case of same dimensions of state spaces of both parts. ˆ z , Sˆz and Jˆz are measurable jointly, so joint probabilities of their Observables L measurement exist.

2. Entropy Information that can be obtained in measurement of a system is given by Shannon entropy and is limited from above by von Neumann entropy: SS = −



pk log2 pk ; SN = −T r(ˆ ρ log2 ρˆ).

∀k

While the space of system states has finite dimensionality, basis diagonalizing density matrix always exists. Thus it is not needed to distinguish between Shannon and von Neumann entropies. The basis {|k , ∀k} is composed of eigenvectors of the density " # ˆ k of detectors D ˆk = matrix ρˆ |k = pk |k and gives probabilities p k as averages D |k  k|.

96

C.V. Usenko / Production of Information and Entropy in Measurement of Entangled States

2.1. Entropy of the whole system Existence of a group of symmetry of each subsystem of given system leads to fibering of space of states of the whole system to direct sum of subspaces containing irreducible representations of the group. In addition, the density matrix of the given system must be diagonal in respective basis  ρˆ = ρj,mj | j, mj   j, mj |, j,mj

thus von Neumann entropy of the whole system is equal to Shannon entropy.  ρj,mj log2 ρj,mj . Ssys = SN = − j,mj

2.2. Entropies of subsystems of pure system For pure system with density matrix ρˆ = | j, m j   j, mj | states of each subsystem Eq. (13) are mixed and have equal entropies given by  {A}  {B} {P } {A} {B} Sj,mj = − ρj,mj ;ml log2 ρj,mj ;ml = − ρj,mj ;ms log2 ρj,mj ;ms ml

ms

To this expression the name of entropy of entanglement is given in [1,4,5] since it has the meaning of entropy produced by the disentangling of entangled system. The values of entropy of both subsystems are equal even if the spaces of subsystems have different dimensions. 2.3. Entropies of subsystems of mixed system Now we can obtain the entropies for each of the subsystems of a given mixed system by means of diagonal coefficients Eq. (14) and Eq. (15) of respective density matrices   {A} {B} {B} S {A} = − ρ{A} =− ρ{B} (16) ml log2 ρml ; S ms log2 ρms ml

ms

Substitution of elements of density matrices leads to S {A} = − S {B} = −

 j,mj



{sys}

ρj,mj

{sys} j,mj ρj,mj

 ml



{A}

ρj,mj ;ml log2

{B} ms ρj,mj ;ms



log2

J,mJ J,mJ

{sys} {A}

ρJ,mJ ρJ,mJ ;ml {sys} {B}

ρJ,mJ ρJ,mJ ;ms

(17)

With account of inequality  {P }  {P }  {sys} {P } {P } {P } − ρj,mj ;ms log2 ρJ,mJ ρJ,mJ ;ms ≥ − ρj,mj ;ms log2 ρj,mj ;ms = Sj,mj ms

ms

J,mJ

we obtain inequalities giving the lower bounds for the entropies of subsystems S {A} ≥ S {B} ≥

 j,mj j,mj

{sys}

{A}

{sys}

{B}

ρj,mj Sj,mj ; ρj,mj Sj,mj .

(18)

C.V. Usenko / Production of Information and Entropy in Measurement of Entangled States

97

Similarly, entropy of each subsystem has as its lower bound the entropy of the whole system  {sys} {sys} S {A,B} ≥ − ρj,mj log2 ρj,mj = S {sys} . (19) j,mj

Upper bounds of entropies of subsystems result from the finite dimensionalities of spaces of states of subsystems and are equal to log 2 NA,B . 2.4. Production of entropy The difference between the density matrix of the whole system and the direct product of the density matrices of its subsystems leads to the difference between entropy of the whole system and the sum of entropies of the subsystems. The process of the measurement of the subsystems, of one or both, divides the system into two parts, thus the entropy of system turns into sum of entropies of the subsystems. The sum is always larger than initial entropy so the process of measurement of any part of a composite system produces entropy of the system. Resulting entropy of the subsystem remains smaller than the entropy of the whole system or equal to it if the system is mixed. Only in the case of the whole system or its part being entangled the resulting entropy exceeds the entropy of the whole system. Only in the case of whole system or its part being entangled resulting entropy exceeds entropy of the whole system and one can “gain some more information” [4,5].

3. Qubit and qutrit entanglement Let the system have two nonequivalent parts - qubit and qutrit. Subsystem A is similar to the angular subsystem with the angular momentum l = 1, and subsystem B is similar to the subsystem of electron spin. Space of states of the whole system has dimension 3 ⊗ 2 = 6 = 2 + 4. The model of spin-orbit coupling provides physical interpretation of bases being ˆ z and sˆz operators. eigenvectors of L States of subsystems Nondiagonal elements of part A are present in pairs with the nondiagonal elements of part B only, so averaging over the states of one part leads to the state of another part with diagonal elements only. { 12 } { 12 } {1} {1} Entropies of subsystems for pure states S 3 ,± 3 = S 3 ,± 3 = 0. S 1 1 = S1 1 = ,± 2 2 2 2 2 2 2 ,± 2 1 1     {2} {1} 1 1 1 S 3 ,± 1 = S 3 ,± 1 = − 3 log2 3 − 1 − 3 log2 1 − 3 ≈ 0.918. 2 2 2 2 Six parameters of mixed states ρ 23 ,± 32 , ρ 32 ,± 12 , ρ 12 ,± 12 . denote probabilities of each given pure state. 1 Entropies of subsystems S { 2 } = −p log2 (p) − (1 − p) log2 (1 − p) and S {1} = −p− log2 (p− ) − p0 log2 (p0 ) − p+ log2 (p+ ) depend on given probabilities by means of cumulation p = 23 ρ 12 ,+ 12 + 13 ρ 12 ,− 12 + 13 ρ 32 ,+ 12 + 23 ρ 32 ,− 12 + ρ 32 ,− 32 and p− = 23 ρ 12 ,− 12 + 1 1 1 2 2 2 3 1 3 3 1 1 1 1 3 1 3 1 1 1 3 ρ 2 ,− 2 + ρ 2 ,− 2 , p0 = 3 ρ 2 ,+ 2 + 3 ρ 2 ,− 2 + 3 ρ 2 ,+ 2 + 3 ρ 2 ,− 2 , p+ = 3 ρ 2 ,+ 2 + 1 3 1 3 3 3 ρ 2 ,+ 2 + ρ 2 ,+ 2

98

C.V. Usenko / Production of Information and Entropy in Measurement of Entangled States

2 2 j=3/2

j=1/2 S

S

1

1

0

0.2

0.4

p

0.6 A B sum sys

0.8

1 0

0.2

0.4

p

0.6

0.8

1

A B sum sys

Figure  1 11.Entropy of3 entangled  system "sys" and its subsystems A,B. Left graph shows mixing of states  ,± , right –  , ± 1 . 2

2

2

2

Summary • Invariance to group U (2) is an essential property of an entangled state. • The process of measurement of any part of a composite system produces entropy of the system and creates an information about the system. • The excess of entropy of a subsystem over entropy of the whole system indicates the presence of entaglement in the system.

References [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15]

V. Vedral and M.B. Plenio, Phys.Rev. A 57 (1998) 1619-1633: quant-ph/9707035. W.K. Wootters and B.D. Fields, Ann. Physics, 191, 363(1989). G. Björk, J. L. Romero, A. B. Klimov and L. L. Sánchez-Soto, quant-ph/0608173. R. Horodecki, M. Horodecki, Phys.Rev. A 54, 1838 (1996). R. Horodecki, M. Horodecki, quant-ph/9709010. A. Miranowicz, M. Piani, P. Horodecki, R. Horodecki, quant-ph/0605001. C.H.Bennett, D.P.DiVincenzo, J.Smolin and W.K.Wootters, Phys.Rev.A 54, 3814 (1997). S. Mancini, V. I. Man’ko, E. V. Shchukin, P. Tombesi, J. Opt. B: Quant. Semiclass. Opt. 5, S333 (2003). P.Horodecki, Phys.Lett.A 232, 333 (1997). P.Horodecki, M.Horodecki and R.Horodecki, Phys.Rev.Lett. 80, 5239 (1998). K.K.Manne and C.M.Caves, quant-ph/0506151. W.K.Wootters, Phys.Rev.Lett. 80, 2245 (1998). B. M. Terhal and K. G. H. Vollbrecht, Phys. Rev. Lett. 85, 2625 (2000). K. G. H. Vollbrecht and R. F. Werner, Phys. Rev. A 64, 062307 (2002). J. Schliemann, Phys. Rev. A 68, 012309 (2002).

Quantum Communication and Security ˙ M. Zukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

99

Better Bell Inequalities Richard D. GILL Mathematical Institute, Snellius Bldg, Leiden University, Niels Bohrweg 1, 2333 CA Leiden, Netherlands; also E URANDOM, Eindhoven, NL Abstract. I explain quantum nonlocality experiments and discuss how to optimize them. Statistical tools from missing data maximum likelihood are crucial. New results are given on CGLMP, CH and ladder inequalities. Open problems are also discussed. Keywords. Bell inequality, Tsirelson inequality, quantum nonclassicality, so-called quantum nonlocality

1. The Name of the Game QM vs. LR: John Bell’s (1964) theorem states that quantum physics (a.k.a. quantum mechanics, QM) is incompatible with classical physics. His proof exhibits a pattern of correlations, predicted in a certain situation by quantum physics, which is forbidden by any physical theory having a certain basic (and formerly uncontroversial) property called local realism (LR). Subject to LR, correlations must satisfy a Bell inequality, which quantum correlations can violate. Local realism, = locality + realism, is closely connected to causality; a precise mathematical formulation will follow later. As we will see then, a further basic (and also uncontroversial) assumption called freedom needs to be made as well. Bell-type experiments: We are going to study the sets of all possible joint probability distributions of the outcomes of a Bell-type experiment, under two sets of assumptions, corresponding respectively to local realism and to quantum physics. Bell’s theorem can be reformulated as saying that the set of LR probability laws is strictly contained in the QM set. Here is a description of a p × q × r Bell experiment. The experiment involves a diabolical source, Lucifer, and a number p of players or parties, called Alice, Bob, and so on. Lucifer sends a package to Alice and each of her friends by FedEx. After the packges have been handed over by Lucifer to FedEx, but before each party’s package is delivered at his or her laboratory, each of the parties commits herself to using one particular measurement-device out of a particular set, available at that laboratory, with which to open their packages. Suppose, for simplicity, that each party can choose from the same number, q, of measurements or settings. When the packages arrive, each of the parties opens their own package with the measurement setting that they have chosen. What happens precisely now is left to the reader’s imagination; but we suppose that the possible outcomes for each of the parties

100

R.D. Gill / Better Bell Inequalities

can all be classified into one of r different outcome categories, labelled from 0 to r − 1. There is not necessarily any connection between the outcome category labelled x of different measurements for the same or different parties. It is merely for ease of exposition that we suppose that the number of outcomes is the same for each measurement of each party (much more complicated still, multi-stage experimental protocols, are sometimes considered; but not in this paper). Given that Alice chose setting a, Bob b, and so on, there is some joint probability p(x, y, . . . |a, b, . . . ) that Alice will then observe outcome x, Bob y, . . . . We suppose that the parties chose their settings a, b, . . . , at random from some joint distribution with probabilties π(a, b, . . . ); a, b, · · · = 1, . . . , q. Altogether, one run of the whole experiment has outcome (a, b, . . . ; x, y, . . . ) with probability p(a, b, . . . ; x, y, . . . ) = π(a, b, . . . )p(x, y, . . . |a, b, . . . ). If the different party’s settings are independent, then each party could in practice generate their own setting in their own laboratory according to its marginal distribution. In general however we need a trusted, independent, referee, who we will call Marek, who generates the settings of all parties simultaneously and makes sure that each one receives their own setting in separate, sealed envelopes. The classical polytope Local realism and freedom can be taken mean the following: “measurements which were not done also have outcomes; and both actual and potential measurement outcomes are independent of the measurement settings actually used by all the parties”. The outcomes of measurements which were not actually done are obviously counterfactual. I am not claiming the actual existence in physical reality of these outcomes, whatever that might be supposed to mean (see EPR for one possible definition). I am just supposing that a mathematical model for the experiment does allow the existence of such variables. This is certainly a characteristic of all non-quantum but otherwise modern physical models. For ease of notation, consider briefly a two party experiment. Let X 1 , . . . , Xq and Y1 , . . . , Yq denote the counterfactual outcomes of each of Alice’s and Bob’s possible q measurements (taking values in {0, . . . , r − 1}. We may think of these in statistical terms as missing data or latent variables, in physical terms as so-called hidden variables. Denote by A and B Alice’s and Bob’s random settings, each taking values in {1, . . . , q}. The actual outcomes observed by Alice and Bob are therefore X = X A and Y = YB . The data coming from one run of the experiment, A, B, X, Y , has joint probability distribution with mass function p(a, b; x, y) = π(a, b)p(x, y, |a, b) = π(a, b) Pr(X a = x, Yb = y). Now the joint probability distribution of the X a and Yb can be arbitrary, but in any case it is a mixture of all possible degenerate distributions of these variables. Consequently, for fixed setting distribution π, the joint distribution of A, B, X, Y is also a mixture of the possible distributions corresponding to degenerate (deterministic) hidden variables. Since there are only finitely many degenerate distributions when p, q and r are all fixed, we see that under local realism and freedom, the joint probability laws of the observable data lie in a closed, convex polytope, whose vertices correspond to degenerate – completely deterministic – hidden variables. We call this polytope the classical polytope.

R.D. Gill / Better Bell Inequalities

101

The quantum body The basic rule for computation of a probability distribution in quantum mechanics is Born’s law: take the squared lengths of the projections of the state vector into a collection of orthogonal subspaces corresponding to the different possible outcomes. Simultaneous measurement of several (compatible) observables corresponds to simultaneous, commuting, decompositions of the Hilbert space. By purification and Naimark construction, this also applies to mixed states and to generalized (POVM) measurements if the Hilbert spaces can be taken arbitrarily large. The following facts are not entirely trivial, but can be proven using the just mentioned mathematical devices: the collection of all possible quantum probability laws of A, B, X, Y (for fixed setting distribution π) forms a closed convex body, containing the local polytope. Beyond the 2 × 2 × 2 case very little indeed is known about this convex body. The no-signalling polytope: The two convex bodies so far defined are forced to live in a lower dimensional  affine subspace, by the basic normalization properties of probability distributions: x,y p(a, b; x, y) = π(a, b) for all a, b. Moreover, probabilities are necessarily nonnegative, so this restricts us further to some convex polytope. However, physics (manifest locality, or if you prefer, causality) implies another collection of equality constraints, putting us into  a still smaller affine subspace. These constraints are called the no-signalling constraints: y p(a, b; x, y) should be independent of b for each a and x, and vice versa. It is easy to check that both the local realist probability laws, and the quantum probability laws, satisfy no-signalling. Quantum mechanics is certainly a local theory as far as manifest variables are concerned (non-locality only comes into the picture when we insist on introducing hidden variables of a classical nature). The set of probability laws satisfying no-signalling is therefore another convex polytope in a low dimensional affine subspace; it contains the quantum body, which in turn contains the classical polytope. Bell and Tsirelson inequalities: “Interesting” faces of the classical polytope, i.e., faces which do not correspond to the positivity constraints, generate (generalized) Bell inequalities, that is, linear combinations of the joint probabilities of the observable variables which reach a maximum value at the face. Similarly, “interesting” supporting hyperplanes to the quantum body correspond to (generalized) Tsirelson inequalities. These latter inequalities can be recast as inequalities concerning expectation values of certain observables called Bell operators. The original Bell (more precisely, CHSH — Clauser, Horne, Shimony, Holt, 1969) and Tsirelson (1980) inequalities concern the 2 × 2 × 2 case. Bell’s theorem is classically proven by deriving a face of the classical polytope, and then exhibiting a quantum point “on the wrong side” of this face. However one can also prove Bell’s theorem — the quantum body is strictly larger than the local polytope — in the 3 × 2 × 2 case, by the logical paradox of Greenberger, Horne and Zeilinger (1989). This famous example shows that if certain probabilities are equal to 1, then, in the classical world, another has to be equal to 1 also. However in the quantum world one can have this latter probability equal to 0 despite the others being 1. This shows that there exists a point of the quantum body outside of the classical polytope. Because the local polytope is closed, GHZ’s quantum point must be strictly outside the classical polytope. By convexity, it lies outside of the hyperplane containing some face of the classical polytope. Hence it violates a generalized Bell inequality.

102

R.D. Gill / Better Bell Inequalities

GHZ experiment This brings me to the point of the paper: how should one design good Bell experiments; and what is the connection of all this physics with mathematical statistics? Indeed there are many connections — as already alluded to, the hidden variables of a local realist theory are simply the missing data of what statisticians call a nonparametric missing data problem; or the latent variables of econometric and psychometric theories of human behaviour. In the laboratory one creates the state |ψ, replacing Lucifer by a source of entangled photons, and the measurement devices of Alice and Bob by assemblages of polarization filters, beam splitters and photodetectors, implementing hereby the measurements corresponding to appropriate orthogonal decompositions of various Hilbert spaces, etc. One also settles on a joint setting probability π. One repeats the experiment many times, hoping to indeed observe a quantum probability law lying outside the classical polytope, i.e., violating a Bell inequality. The Aspect et al. (1982) experiment implemented this program in the 2 × 2 × 2 case, violating the CHSH inequality by a large number of standard deviations. What is being done here is statistical hypothesis testing, where the null hypotheses is local realism, the alternative is quantum mechanics; the alternative being true by design of the experimenter and validity of quantum mechanics. Dirk Bouwmeester recently carried out the GHZ experiment; the results were published in Nature (Pan et al, 2000). He claimed in a newspaper interview that this experiment is of a rather special type: only a finite number of repetitions are necessary since the experiment exhibits events which are impossible under classical physics, but certain under quantum mechanics. However, the events which are supposed to be certain or impossible, are only certain or impossible conditional on some other events being certain. Which is not proved for sure, in any finite number of trials. Anyway, since the experiment is not perfect, Bouwmeester observed some “wrong” outcome patterns, thereby destroying by his own logic the conclusion of his experiment. Fortunately his data does statistically significantly violate the accompanying GHZ inequality and publication in Nature was justified! The point is: all these experiments are statistical in nature; they do not prove for sure that local realism is false; they only give statistical evidence for this proposition; evidence which only become overwhelming as N , the number of repetitions, goes to infinity. How to compare different experiments: Because of the dramatic zero-one nature of the GHZ experiment, it is felt by many physicists to be much stronger or better than experiments of the original 2 × 2 × 2 CHSH type. The original aim of the research described here was to supply objective and quantitative evaluation of such claims. Now the geometric picture above naturally leads one to prefer an experiment where the distance from the quantum physical reality is as far as possible from the nearest local realistic or classical description. Much research has been done by physicists focussing on the corresponding Euclidean distance. However, it is not so clear what this distance means operationally, and whether it is comparable over experiments of different types. Moreover the Euclidean distance is altered by taking different setting distributions π (though physicists usually only consider the uniform distribution). It is true that Euclidean distance is closely related to noise resistance, a kind of robustness to experimental imperfection. As one mixes the quantum probability distribution more and more with completely random, uniform outcomes, corresponding to pure noise in the photodetectors, the quantum probability distribution shrinks towards the center of the classical polytope, at some point passing through one of its faces. The amount of noise which can

R.D. Gill / Better Bell Inequalities

103

be allowed while still admitting violation of local realism is directly related to Euclidean distance, in our picture. Van Dam, Gill and Grünwald (2005) however  propose to use relative entropy or Kullback-Leibler divergence, D(q : p) = abxy q(abxy) log2 (q(abxy)/p(abxy)), where q now stands for the “true” probability distribution under some quantum description of reality, and p stands for a local realist probability distribution. Their program is to evaluate supq inf p D(q : p) where the supremum is taken over parameters at the disposal of the experimenter (the quantum state |ψ, the measurement projectors, the setting distribution π; while the infimum is taken over probability distributions of outcomes given settings allowed by local realism (thus q and p in supremum and infimum actually stand for something different from the probability laws q and p lying in the quantum body and classical polytope respectively; hopefully this abuse of notation may be excused). They argue that this relative entropy or divergence gives direct information about the number of trials of the experiment required to give a desired level of confidence in the conclusion of the experiment. Two experiments which differ by a factor 2 are such that the one with the smaller divergence needs to be repeated twice as often as the other in order to give an equally convincing rejection of local realism. Moreover, optimizing over different sets of quantum parameters leads to various measures of “strength of non-locality”. For instance, one can ask what is the best experiment based on a given entangled state |ψ? Experiments of different format can be compared with one another, possibly discounting the relative entropies according to the numbers of quantum systems involved in the different experiments in the obvious way (typically, a p party experiment involves generation of p particles at a time, so a four party experiment should be downweighted by a factor 2 when comparing with a two party experiment). We will give some examples later. Finally, that paper showed how the interior infimum is basically the computation of a nonparametric maximum likelihood estimator in a missing data problem. Various algorithms from statistics can be succesfully applied here, in numerical rather than analytical experimentation; and progams developed by Piet Groeneboom (developed for solving non-trivial problems in AIDS epidemiology, among others) played a vital role in obtaining the results which we are now going to display.

2. CHSH and CGLMP The 2 × 2 × 2 case is particularly simple and well researched. In a later section, I want to compare the corresponding two particle CHSH experiment with the three particle GHZ. In another section I will discuss properties of 2 × 2 × d experiments, which form a natural generalization of CHSH and have received much attention both by theorists and experimenters in recent years. We will see that many open problems exist here and some remarkable conjectures can be posed. Preparatory to that, I will therefore now describe the so-called CGLPM inequality, the generalization from 2 × 2 × 2 to 2 × 2 × d of CHSH. For the 2 × 2 × d case an important step was made by Collins, Gisin, Linden, Massar and Popescu (2002), in the discovery of a generalized Bell inequality (i.e., interesting face of the classical polytope), together with a quantum state and measurements which violated the inequality. The original specification of the inequality is rather complex, and its derivation also took two closely printed pages. Here I offer a new and extremely short

104

R.D. Gill / Better Bell Inequalities

derivation of an equivalent inequality, found very recently by Stefan Zohren; (see Zohren and Gill, 2006), which further simplifyies an already very simple version of my own. Proof of equivalence with the original CGLMP is tedious! Recall that a Bell inequality is the face of a classical polytope of the form  abxy cabxy p(abxy) ≤ C. Now since we are only concerned with probability distributions within the no-signalling polytope, the probabilities p(abxy) necessarily satisfy a large number of equality constraints (normalization, no-signalling), which allows one to rewrite the Bell inequality in many different forms; sometimes remarkably different. A canonical form can be obtained by removing, by appropriate substitutions, all p(abxy) with x and y equal to one particular value from the set of possible outcomes, e.g., outcome 0, and involving also the marginals p(ax) and p(by) with x and y non zero. This is not necessarily the “nicest” form of an inequality. However, in the canonical form the constant C does disappear (becomes equal to 0). To return to CGLMP: consider four random variables X 1 , X2 , Y1 , Y2 . Note that X1 < Y2 and Y2 < X2 and X2 < Y1 implies X1 < Y1 . Consequently, X < 1 ≥ Y 1 implies X1 ≥ Y2 or Y2 ≥ X2 or X2 ≥ Y1 , and this gives us Pr(X1 ≥ Y1 ) ≤ Pr(X1 ≥ Y2 ) + Pr(Y2 ≥ X2 ) + Pr(X2 ≥ Y1 ). This is a CGLMP inequality, when we further demand that all four variables take values in {0, . . . , d − 1}. The case d = 2 gives the CHSH inequality (though also in an unfamiliar form). CGLMP describe a state and quantum measurements which generate quantum probabilities which violate this inequality. Take Alice and √ Bob’s Hilbert space each to be dd−1 dimensional. Consider the states |ψ = x=0 |xx/ d, where |xx = |x⊗|x, and |x for x = 0, . . . , d−1 is an orthonormal basis of d . Alice and Bob’s settings 1, 2 are taken to correspond to angles α 1 = 0, α2 = π/4, and β1 = π/8, β2 = −π/8. When Alice or Bob receives setting a or b, each applies the diagonal unitary operation with diagonal elements exp(ixθ/d), x = 0, . . . , d − 1, to their part of the quantum system, where θ stands for their own angle (setting). Next Alice applies the quantum Fourier transform Q to her part, and Bob its inverse (and adjoint) Q ∗ ; Qxy = exp(ixy/d), Q∗xy = exp(−ixy/d). Finally Alice and Bob “measure in the computational basis”, i.e., projecting onto the one-dimensional subspaces corresponding to the bases |x, |y. Applying a unitary U and then measuring the projector Π M is of course the same as measuring the projector ΠU ∗ M ; with a view to implementation in the laboratory it is very convenient to see the different measurements as actually “the same measurement” applied after different unitary transformations of each party’s state have been applied. In quantum optics these operations might correspond to use of various crystals, applying an electomagnetic field across a light pulse, and so on. That these choices gives a violation of a CGLMP inequality follows from some computation and we desperately need to understand what is going on here, as will become more obvious in a later section when I describe conjectures concerning CGLMP and these measurements.

R.D. Gill / Better Bell Inequalities

105

3. Comparing some classical experiments: GHZ vs CHSH First of all, let me briefly report some results from van Dam et al. (2005) concerning the comparison of CHSH and GHZ. It is conjectured, and supported numerically, but not yet proved, that the best 2 × 2 × 2 experiment in the sense of Kullback-Leibler divergence is the CGLMP experiment with d = 2 described in the last section, and usually known as the CHSH experiment. The setting probabilities should be uniform, the state is maximally entangled, the measurements are those implemented by Aspect et al. It turns out that D is equal to 0.0423.... For GHZ, which is be conjectured to be the best 3 × 2 × 2 experiment, one finds D = 0.400, with setting probabilities uniform over the four setting patterns involved in the derivation of the paradox; zero on the other four. So this experiment is apparently almost 10 times better. By the way, D = 1 would be the strength of the experiment when one repeatedly throws a coin which always comes up heads, in order to disprove the theory that Pr(heads) = 1/2. So GHZ is less than half as good as an experiment in which one compares probabilities 1 and 1/2; and infinitely worse than an experiment comparing impossible with certain outcomes! However in practice the GHZ experiment is not performed exactly in optimal fashion. To begin with, in order to produce each triple of photons, Bouwmeester generated two maximally entangled pairs of photons, let two interfere with one another, measured the polarization of one of the four, and finally accepted the remaining set of three when the measured polarization was favourable, which occurs in half of the times. Since we need two pairs of photons for each triple, and discard the result half the times, the figure of merit should be divided by four. Next, the optimal setting probabilities are uniform over half of the eight possible combinations. In practice one generates settings at random at each measurement station, so that half of the combinations are actually useless. This means we have to halve again, resulting in a figure of merit for GHZ which is barely better than CHSH, and very far from the “infinity” which would correspond to an “all or nothing” experiment. Actually things are even worse since the pairs of photon pairs are generated at random times and one has to be quite lucky to have two pairs generated close enough in time to one another that one has four photons to start with. Then there are the inevitable losses which further degrade the experiment . . . (more on this later). Bouwmeester needs to carry on measuring for hours in order to achieve what can be done with CHSH in minutes. (Which is not to say that his experiment is not a splendid achievement.)

4. CGLMP as d → ∞ In Acin, Gill and Gisin (2005) a start is made with studying optimal 2 × 2 × d experiments, and some remarkable findings were made, though almost all conclusions depend on numerics, and even on numerics depending on conjectures. Let me first describe one rather fundamental conjecture whose truth would take us a long way in understanding what is going on. In general nothing is known about the geometry of the classical polytope. An impossible open problem is to somehow classify all interesting faces. It is not even known if, in general, all faces which are not trivial (i.e., correspond to nonnegativity constraints) are “interesting” in the sense of being violable by quantum mechanics. As the numbers

106

R.D. Gill / Better Bell Inequalities

grow, the number and type of faces grow explosively, and exhausitive enumeration has only been done for very small numbers. Clearly there are many many symmetries — the labelling of parties, measurements and outcomes is completely arbitrary. Moreover, there are three ways in which inequalities for smaller experiments remain inequalities for larger. Firstly, by merging categories in the larger experiment one obtains a smaller one, and the Bell inequalities for the smaller can be lifted to the larger. Next, by simply omitting measurements one can lift Bell inequalities for smaller experiments to larger. Finally, by conditioning on a particular outcome of a particular measurement of a particular party, one reduces a larger experiment to one with less parties, and conversely can lift a smaller inequality to a larger. With the understanding that interesting faces for smaller polytopes can be lifted to interesting faces of larger in three different ways, the following conjecture seems highly plausible: All the faces of the 2 × 2 × d polytope are boring (nonnegativity) or interesting CGLMP, or lifted CGLMP, inequalities. This is certainly true for d = 2, 3, 4 and 5 but beyond this there is only numerical evidence: numerical search for optimal experiments using the maximallly entangled state |ψ has only uncovered the CGLMP measurements, violating the CGLMP inequality. Moreover this is true both using Euclidean and relative entropy distances. The next, stunning, finding is that the best state for these experiments is not the maximally entangled state at all! Rather, it is a state of the form x cx |xx where the Schmidt coefficients cx are symmetric around x = (d − 1)/2, first decreasing (as x increases from 0) and then increasing. This “U-shape” become more and more pronounced as d increases. Moreover the shape is found for both figures of merit, though it is a different state for the two cases (even less entangled for divergence than for Euclidean, i.e., less entangled for statistical strength than for noise resistance). Rather thorough numerical search takes us up to about d = 20 and has been replicated by various researchers. Taking as a conjecture a) that all faces are CGLMP, b) that the best measurements are also CGLMP and the state is U -shaped, we only need to optimize over the Schmidt coeffficients cx . Numerically one can quite easily get up to about d = 1000 in this way. However with some tricks one can go to d = 10 000 or even 100 000. Note that we are solving supq inf p D(q : p) where the infimum is over the local realist polytope, the supremum is just over the cj . Now a solution must also be a stationary point for both optimizations. Differentiating with respect  to the classical parameters, and recalling the form of D, one finds that one must have abxy (ˆ qabxy /ˆ pabxy )(pabxy − pˆabxy ) = 0 for classical probabilities p on the face of the classical polytope passing through the solution pˆ. But this face is a CGLMP inequality! Hence the coefficients, qˆabxy /ˆ pabxy are the coefficients involved in this inequality, i.e., up to some normalization constants  they are already known! However, the quantity we want to optimize, D itself, is abxy qabxy log2 (ˆ qabxy /ˆ pabxy ) and this is optimal over q at q = qˆ (i.e., this the accompanying Tsirelson inequality, or supporting hyperplane to the quantum body at the optimum). Since the terms in the logarithm are known (up to a normalization constant) we just have to optimize the mean of an almost known Bell operator over the state. This is a largest eigenvalue problem, numerically easy up to very very large d. All this raises the question what happens when d → ∞. In particular, can one attain the largest conceivable violation of CGLMP, namely when the probability on the left is

R.D. Gill / Better Bell Inequalities

107

1 and the three on the right are all 0, with infinite dimensional Hilbert spaces, and if so, are the corresponding state and measurements interesting and feasible experimentally? Strongly positive evidence and further conjectures are given in Zohren and Gill (2006). Some recent numerical results on d = 3and4 are given by Navascues et al. (2006). We think of this conjectured “perfect passion at a distance” as the optimal solution of a variant of the infamous game of Polish Poker, played in a Moscow bar between a Polish traveller and a local drinker, with the inevitable outcome that the Pole always gets all the Roubles... . Our heroes Alice and Bob are now a team, playing against Marek, who this time is the bad guy (though all he does is toss truly fair coins, just like a trusted referee). Alice and Bob are to think up real numbers, labelled 1 and 2. Marek chooses between labels 1 and 2 for Alice and 1 and 2 for Bob. Neither Alice nor Bob knows which label Marek assigns the other (they are in isolated booths, though they were allowed to take in with them real dice, or PC’s with the same data on the hard disks, or whatever). Alice and Bob’s aim is to achieve that x 1 < y2 whenever Marek assigns “1” to Alice and “2” to Bob; they want y 2 < x2 when Marek assigns them “2” and “2”; they want x2 < y1 when . . . ; and they want y 1 < x1 when . . . . If they choose their real numbers by any classical means (real dice or PC’s), and even only after hearing their own (but not their friend’s) label, they will fail one time in four in the long run; Marek will make big money from them. However, according to Zohren and Gill’s conjecture, with quantum dice (each takes with them into the booth a bunch of photons kindly provided by of Lucifer, together with some quantum optics work-bench stuff) they can succeed every time with probability arbitrarily close to one, by exploiting large enough Hilbert space (it can be seen that even Lucifer can’t help them to succeed with certainty). There remains the question: why are the CGLMP measurements optimal for the CGLMP inequality? Where do these angles come from, what has this to do with QFT? There are some ideas about this and the problem seems ripe to be cracked.

5. Ladder proofs Is the CHSH experiment the best possible experiment with two maximally entangled qubits? This seemed a very good conjecture till quite recently. However the conjecture certainly needs modification now, as I will explain. There has been some interest recently, starting with Hardy (1993), in so-called ladder proofs of Bell’s theorem. These appear to allow one to use less entangled states and get better experiments, though that dream is shown to be fallacious when one uses statistical strength as a figure of merit rather than a criterion connected to “probability zero under LR, but positive under QM” (conditional on certain other probabilities equal to zero). Exactly as for GHZ, the size of this positive probability is not very important, the experiment is about violating an inequality, not about showing that some probability is positive when it should be zero. Let me explain the ladder idea. Consider the inequality Pr(X1 ≥ Y1 ) ≤ Pr(X1 ≥ Y2 ) + Pr(Y2 ≥ X2 ) + Pr(X2 ≥ Y1 ). Now add to this the same inequality for another pair of hidden variables: Pr(X2 ≥ Y2 ) ≤ Pr(X2 ≥ Y3 ) + Pr(Y3 ≥ X3 ) + Pr(X3 ≥ Y2 ).

108

R.D. Gill / Better Bell Inequalities

The intermediate “horizontal” 2—2 term cancels and we are left only with cross terms 1—2 and 2—3, and “end” terms 1—1 and 3—3. With a ladder built from adding four inequalities involving X 1 to X5 and Y1 to Y5 , out of the 25 possible comparisons, only the two end horizontal terms and eight crossing terms survive, 10 out of the total. (I would call this a “cat’s cradle” rather than a “ladder”, but the name is now fixed). Numerical optimization of D for longer and longer ladders, shows that actually the optimal state is always the maximally entangled state. Moreover, much to my surprise, the best D is obtained with the ladder of X 1 to X5 and Y1 to Y5 , and it is much better than the original CHSH! However, it has a uniform distribution over 10 out of 25 combinations. If one would implement the same experiment with the uniform distribution over all 25, it becomes worse that CHSH. So the new conjecture is that CHSH is the optimal 2 × 2 × 2 experiment with uncorrelated settings. These findings come from new unpublished work with Marco Barbieri; we are thinking of actually doing this experiment.

6. CH for Bell In a real CHSH experiment an annoying feature is that some photons are not registered at all. This means that there are really three outcomes of each measurement, with a third outcome “no photon”; however, the outcome “no photon, no photon” is not observed at all. One has a random sample size, and the sample is taken from the conditional distribution given that there is an event in at least one of the two laboratories of Alice and Bob. It is better to realise that the original, complete sample size is actually also random, and typically Poisson, hence the observed counts of the various events are all Poisson. But can we create useful Bell inequalities for this situation? The answer is yes, using the possibility of reparametrization of inequalities using the equality constraints. In a 2 × 2 × 3 experiment one can rewrite any Bell inequality as an inequality involving only the p abxy with one of x or y not zero, as well as the marginal probabilities pax , pby with x and y nonzero. The constant term in the inequality becomes 0. So one gets a linear inequality involving only observed, Poisson distributed, random variables. “Poisson statistics” allows one to supply a valid standard error even though the “total sample size” was unknown. Applying this technique in the 2 × 2 × 2 case gives a known inequality, the ClauserHorne (CH) inequality, useful (in principle, but not in practice, since no one has yet beaten the detection loophole) when one has binary outcomes but one of the two outcomes is not observable at all; i.e., the outcomes are “detector click” and “no detector click”. How to find a good inequality for 2 × 2 × 3? I simply add a certain probability of “no event”, independent on both sides of the experiment, to the quantum probabilities belonging to the classical CHSH set-up. Next I solve the problem inf p D(q : p) using Piet Groeneboom’s programs. I observe the values of q/ˆ p which define the face of the local polytope closest to q. I rewrite the inequality in its classical form. The result is a new inequality (not quite new: Stefano Pironio informs me it is known to N. Gisin and others) which takes account of “no event” and which is linear in the observed counts. The linearity means that the inequality can be studied using martingale techniques to show that the experiment is “insured” against time dependence and time trends, as

R.D. Gill / Better Bell Inequalities

109

long as the settings are chosen randomly; cf. Gill (2003a, b). It turns out to be essentially equivalent to some rather non-linear inequalities developed by Jan-Åke Larsson, which were till now the only known way to deal with “non-events”. We intend to pursue this development in the near future combining treatment of the detection, coincidence and memory loopholes (Gill, 2005; Larsson and Gill, 2004).

Conclusions I did not yet mention that studying the boundary of the 2 × 2 × 2 quantum body and some different generalizations led Tsirelson into some deep mathematics and connections with fundamental questions involving Grothendieck’s mysterious constant, see Tsirelson (1980), Fishburn and Reeds (1994), Acin et al (2006). Bell experiments offer a rich field involving many statistical ideas, beautiful mathematics, and offering deep and exciting challenges. Moreover it is a hot topic in quantum information and quantum optics. Much remains to be done.

References [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13]

[14]

[15] [16] [17] [18] [19] [20] [21]

A. Acin, N. Gisin, B. Toner, Phys. Rev. A 73, 062105 (2006). A. Acin, R. D. Gill, and N. Gisin, Phys. Rev. Lett. 95, 210402(4) (2005). A. Aspect, P. Grangier, and G. Roger, Phys. Rev. Lett. 47, 460 (1981). J. S. Bell, Physics 1, 195 (1964). J.F. Clauser, M.A. Horne, A. Shimony, and R.A. Holt, Phys. Rev. Lett. 23, 880 (1969). J.F. Clauser, and M.A. Horne, Phys. Rev. D 10, 526 (1974). B. S. Cirel’son, Lett. Math. Phys. 4, 93 (1980). D. Collins, N. Gisin, N. Linden, S. Massar and S. Popescu, Phys. Rev. Lett. 88, 040404 (2002). W. van Dam, R. D. Gill, and P.D. Grünwald, IEEE – Trans. Inf. Theory 51, 2812 (2005). A. Einstein, B. Podolsky, N. Rosen, Phys. Rev. 47, 777 (1935). P. C. Fishburn, and J. A. Reeds, SIAM J. Discr. Math. 7, 48 (1994). R. D. Gill, Time, finite statistics, and Bell’s fifth position, in: Foundations of Probability and Physics 2 (Växjö, 2002), vol.5 of Math. Model. Phys. Eng. Cogn. Sci., p. 179, Växjö Univ. Press, Växjö (2003). R. D. Gill, Accardi contra Bell (cum mundi): The Impossible Coupling, in: Mathematical Statistics and Applications: Festschrift for Constance van Eeden (M. Moore, S. Froda, and C. Léger, eds.), vol. 42 of IMS Lecture Notes – Monographs, pp. 133–154, Institute of Mathematical Statistics, Beachwood, Ohio (2003). R. D. Gill, The chaotic chameleon, in: Quantum Probability and Infinite Dimensional Analysis: from Foundations to Applications (M. Schürmann and U. Franz, eds.), vol. 18 of QP–PQ: Quantum Probability and White Noise Analysis, p. 269, World Scientific, Singapore (2005). D.M. Greenberger, M. Horne, and A. Zeilinger, Going beyond Bell’s theorem, In M. Kafatos, editor, Bell’s Theorem, Quantum Theory, and Conceptions of the Universe, pp. 73, Kluwer, Dordrecht (1989). P. Groeneboom, G. Jongbloed, and J.A. Wellner, math.ST/0405511. L. Hardy, Phys. Rev. Lett. 71, 1665 (1993). J.-Å. Larsson R.D. Gill, Europhysics Letters 67, 707 (2004). M. Navascues, S. Pironio, and A. Acin, quant-ph/0607119 J.W. Pan, D. Bouwmeester, M Daniell, H. Weinfurter, A. Zeilinger, Nature 403, 515 (2000). S. Zohren, and R. D. Gill, quant-ph/0612020.

This page intentionally left blank

3. Production of Entangled States, Experimental Techniques

This page intentionally left blank

Quantum Communication and Security ˙ M. Zukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

113

The Entanglement of the Symmetric Four-photon Dicke State Christian SCHMID a,b,1 , Nikolai KIESEL, a,b Wiesđaw LASKOWSKI, c c ˙ Enrique SOLANO, d,f Geza TÓTH, e Marek ZUKOWSKI, and a,b Harald WEINFURTER a Department für Physik, Ludwig-Maximilians-Universität, D-80797 München b Max-Planck-Institut für Quantenoptik, Hans-Kopfermann-Str. 1, D-85748 Garching, Germany c Instytut Fizyki Teoretycznej i Astrofizyki, Uniwersytet Gda´nski, PL-80-952 Gda´nsk, Poland d Sección Física, Dpto. de Ciencias, Pontificia Universidad Católica del Perú, Apartado 1761 Lima, Peru e Research Institute for Solid State Physics and Optics, HAS, P.O. Box 49, H-1525 Budapest, Hungary f Physics Department, ASC, and CeNS, Theresienstrasse 37, 80333 Munich, Germany Abstract. We present an experimental and theoretical characterization of the sym(2) metric four-qubit entangled Dicke state with two excitations D4 . We investigate the state’s violation of local realism and study its characteristic properties with respect to quantum information applications. For the experimental observation of the state we used photons obtained from parametric down conversion. This allowed, in a simple experimental set-up, quantum state tomography yielding a fidelity as high as 0.844 ± 0.008. Keywords. Multi-particle entanglement, quantum information

Introduction Entanglement in bipartite quantum systems is well understood and can be easily quantified. In contrast, multipartite quantum systems offer a much richer structure and various types of entanglement. Thus, crucial questions are how strongly and, in particular, in which way a quantum state is entangled. Consequently, different classifications of multipartite entanglement have been developed [1,2,3], and quantum states with promising properties have been identified and studied experimentally [4,5,6,7,8,9]. The ongoing effort in this direction leads to a deeper understanding of multipartite entanglement and its applications in quantum communication. In the following, we present an experimental and theoretical examination of an in(2) teresting four-qubit entangled state: D 4 – the four-qubit Dicke state with two excita1 Corresponding Author: Christian Schmid, Max-Planck-Institut für Quantenoptik, Hans-Kopfermann-Str. 1, D-85748 Garching, Germany; E-mail: [email protected].

114

C. Schmid et al. / The Entanglement of the Symmetric Four-Photon Dicke State

(2)

Figure 1. Experimental setup for the analysis of the four-photon polarization-entangled state D4 . It is observed after the symmetric distribution of four photons onto the spatial modes a,b,c and d via non-polarizing beam splitters (BS). The photons are obtained from type-II collinear spontaneous parametric down conversion (SPDC) in a 2 mm β-Barium Borate (BBO) crystal pumped by 600 mW UV-pulses. The phases between the four output modes are set via pairs of birefringent Yttrium-Vanadate-crystals (YVO4). Half and quarter wave plates (HWP, QWP) together with polarizing beam splitters (PBS) are used for the polarization analysis.

tions that is symmetric under all permutations of qubits. Generally, a symmetric N -qubit (M) Dicke state [10,11,12] with M excitations, | D N , is the equally weighted superposition of all permutations of N -qubit product states with M logical 1’s and (N − M ) logical 0’s. The Dicke states naturally appear as the common eigenstates of the total spinsquared and the spin z-component (where z is assumed to be the quantization direction) operators in spin one-half particle systems. Besides the state studied here, another well known example for a Dicke state is the N -qubit W state | W N  (in the present notation (1) (2) | DN ) [5]. While other symmetric Dicke states have maximum overall spin, D 4 is the eigenstate which has minimum spin component along the quantization axis. As we shall see, this fact leads to a set of interesting properties.

1. Experiment As photons are well suited to emulate spin one-half systems, we use them as the quantum system of choice for the experimental observation and characterization of the Dicke state. (2) Applying polarization encoding, the state D 4 has the form: 1 (2) | D4  = √ (| HHV V  + | HV HV  + | V HHV  + 6 | HV V H  + | V HV H  + | V V HH )

(1)

C. Schmid et al. / The Entanglement of the Symmetric Four-Photon Dicke State

115

with, e.g., | V V HH  = | V a ⊗ | V b ⊗ | H c ⊗ | H d , where | H  and | V  denote linear horizontal (H) and vertical (V ) polarization of a photon in the spatial modes (a, b, c, d) (Fig. 1). It can be seen as the superposition of the six possibilities to distribute two horizontally and two vertically polarized photons into four modes. Accordingly, we create four indistinguishable photons with appropriate polarizations in one spatial mode and distribute them with polarization independent beam splitters (BS) (Fig. 1) [13]. If (2) one photon is detected in each of the four output modes we observe the state D 4 . For ideal 50:50 BS this occurs with a probability of p ≈ 0.094 and experimentally we find p ≈ 0.080 [14]. As source of the four photons we use the second order emission of collinear type II spontaneous parametric down conversion (SPDC). UV pulses with a central wavelength of 390 nm and an average power of about 600 mW from a frequency-doubled modelocked Ti:sapphire laser (pulse length ≈130 fs) are used to pump a 2 mm thick BBO (β-Barium Borate, type-II) crystal. This results in two horizontally and two vertically polarized photons with the same wavelength. Dichroic UV-mirrors serve to separate the UV-pump beam from the down conversion emission. A half-wave plate together with a 1 mm thick BBO crystal compensates walk-off effects (not shown in Fig. 1). Coupling the four photons into a single mode fiber exactly defines the spatial mode. The spectral selection is achieved with a narrow bandwidth interference filter (Δλ = 3 nm) at the output of the fiber. Birefringence in the non-polarizing beam splitter cubes (BS) is compensated with pairs of perpendicularly oriented 200 μm thick birefringent Yttrium-Vanadate crystals (YVO4 ) in each of the four modes. Altogether, the setup is stable over several days. Measurement time is thus mainly limited by misalignment effects in the pump laser system which, however, affects rather the count rate than the quality of the state. Polarization analysis is performed in all of the four outputs. For each mode we choose the analysis direction with half (HWP) and quarter wave plates (QWP) and detect the photons behind polarizing beam splitters using single photon detectors (Si-APD). The detected signals are fed into a multi-channel coincidence unit which allows to simultaneously register any possible coincidence between the inputs. The rates for each of the 16 characteristic four-fold coincidences were corrected for the different detection efficiencies in each polarization analysis. This experimental scheme allowed the observation of the state with about 60 four-fold coincidences per minute. This count rate was high enough to perform a full quantum state tomography out of which we can determine the experimental state’s Fidelity to be F = 84.4 ± 0.08% (see Figure 2). The state tomography provides all the necessary data for any further analysis of the state. 2. Analysis of the state 2.1. Correlations and violation of local realism For a given sate, there exists a single generalized Bell-type inequality which is the sufficient and necessary condition on the local realistic description of the correlation function E [15,16,17]. For four qubits we have        1 k1 k4   s ...s E( a (k ),  a (k ),  a (k ),  a (k )) 1 1 2 2 3 3 4 4  ≤ 1. 1 4  4 2 s ,...,s =±1   k ,...,k =0,1 1 4 1 4 

(2)

116

C. Schmid et al. / The Entanglement of the Symmetric Four-Photon Dicke State

Figure 2. (a) Plot of the density matrix for the ideal state ρ

(2)

D4

derived from the measurement data.

and (b) the Real part of the density matrix

This condition corresponds to the experimental situation, in which the observers can choose between two dichotomic observables with the eigenstates a i (ki ) = cos(θi + ki π4 )|Hi + eiφi sin(θi + ki π4 )|V i , (i = 1, 2, 3, 4). The above inequality is satisfied if and only if [17] 



max

α1 ,...,α4

l1 ,...,l4 ={x,y}

π π  |Tl1 l2 l3 l4 | sin(α1 + l1 )... sin(α4 + l4 ) ≤ 1, 2 2

(3)

where Tˆ is the correlation tensor in any set of local Cartesian coordinate systems. The components of Tˆ are given by T l1 l2 l3 l4 = E(xl1 , xl2 , xl3 , xl4 ), where xlk , (lk = 1, 2, 3) (2) represent some set of (local) basis vectors for the kth observer. For the state D 4 the correlation tensor has the following non-vanishing coefficients in the standard basis: Txxxx = Tyyyy = Tzzzz = 1; Txxyy = Txyxy = Txyyx = Tyxxy = Tyxyx = Tyyxx = 1/3; Txxzz = Txzxz = Txzzx = Tzxxz = Tzxzx = Tzzxx = −2/3; Tzzyy = Tzyzy = Tzyyz = Tyzzy = Tyzyz = Tyyzz = −2/3.

(4)

(2)

Ideally, D4 violates inequality (3) by a factor 2.1213. However, the state observed in an experiment is never pure. Therefore it is interesting how robust the state is with (2) (2) respect to admixture of white noise. With the corresponding state, v|D 4 D4 | + (1 − v)11/16, we can derive a measure for that robustness, which is called the critical visibility v crit . That means that for v > v crit (2) no local realistic description of the state exists. For (2) D4 we

obtain

v crit (2) D4

D4

= 0.4714. This result was found using a numerical procedure. In

addition we used also the more general method of linear optimization [18] to test the possibility of the quantum probabilities to be describable by a local realistic model. The critical visibility obtained in this method is equal to the 4-digit approximation of v crit (2) D4

C. Schmid et al. / The Entanglement of the Symmetric Four-Photon Dicke State

117

obtained from (3). In [19], it was shown that the amount of the violation of the Bell inequality [20] can be used for the detection of N -particle entanglement in a multi-qubit quantum system. In the case of inequality (3) the threshold for four-particle entanglement is equal to 2. If any quantum state violates this inequality by a factor larger than 2, then it contains true four-particle entanglement. In the experiment, for a spectral filtering of the photons to a bandwidth of 3 nm, a violation of inequality (3) was achieved of 1.75±0.08, which is not sufficient to proof four-partite entanglement. By stronger filtering of the photons to a width of 2 nm we reach a violation of 2.03 ± 0.21, which is just at the limit. However, one can use a more sensitive inequality introduced in [21]. This inequality assumes a rotational invariant form of the quantum correlation function. For four qubits it has a form: (EHV , E) ≤ 44 Emax ,

(5)

where (, ) represents the scalar product of a real Hilbert space of square integrable functions, EHV is a local realistic correlation function, E is the quantum correlation function and Emax is the maximal possible value of the correlation function E for a given state. In the case of local and realistic theories, the correlation function for four qubits must be given by:  EHV (a1 (α1 ), ..., a4 (α4 )) =

dλρ(λ)

4 

Ii (αi ),

(6)

i=1

where ρ(λ) is a certain distribution function of some hidden parameters λ, and I i = ±1 is a function, that predetermines the values of the experimental results that can be performed on the given local system. Finally α i is a certain parametrization of the local setting ai . The four qubit quantum correlation function, which has a rotationally invariant form, can be expressed in the following way E(a1 , ..., a4 ) = Tˆ ◦ (a1 ⊗ ... ⊗ a4 ),

(7)

where Tˆ is the correlation tensor for a quantum state, ρ. By the symbol ◦ we represent the scalar product in R 12 . If we constrain the measurement settings of each observer to one plane the measurement direction vectors can be expressed by a i (αi ) = cos αi yˆi + sin αi x ˆi , where x ˆi , yˆi are two basis vectors of R 3 (which can be individually defined by each observer). In such a case, the correlation function is a scalar given by:  π Ti1 i2 i3 i4 sin (α1 + (i1 − 1) ) E(α1 , ..., αN ) = 2 i ...i =1,2 1

4

π × ... sin (α4 + (i4 − 1) ). 2

(8)

The inequality (5) can be violated by the quantum value equal to (E, E) = π 4

 i1 ,...,i4 ={x,y}

Ti21 i2 i3 i4

(9)

118

C. Schmid et al. / The Entanglement of the Symmetric Four-Photon Dicke State

The violation factor is equal to v = (E, E)/(E HV , E). In [22] it was shown that the threshold, above which four-partite entanglement is confirmed equals to 4(π/4) 4 ≈ 1.52202. For the experimental data taken with a 2 nm interference filter we obtain v = 1.66 ± 0.13, which is sufficient to show that the state contains four-qubit entanglement. Consequently if one aims at obtaining information on the violation of local realism and true multi-partite entanglement simultaneously the latter type of Bell inequality is preferable. 2.2. Genuine four qubit entanglement The well-established tool for the test of genuine multi-partite entanglement are usually witness operators, albeit they do not provide any information concerning the local realistic description of a state. One might use the generic form W g [23] in which the corresponding expectation value depends directly on the observed fidelity: T r(W g ρexp ) = (2) 2 3 − Fexp = −0.177 ± 0.008 and is positive for all biseparable states. For D 4 , 21 measurement settings, instead of a complete tomography, are sufficient to determine this value. They correspond to the 21 non-vanishing coefficients of Tˆ in the standard basis (see equation (4)). Due to the high symmetry of this state, genuine four-partite entanglement can be detected with only two settings via a measurement of the collective spin squared in xand y- direction (J x2  and Jy2 ). For biseparable states it can be proven that [24,25] W4s  = Jx2  + Jy2  ≤ 7/2 +

√ 3 ≈ 5.23,

(10)

 k with e.g., σx3 = 11 ⊗ 11 ⊗ σx ⊗ 11. This can be interpreted where Jx/y = 1/2 k σx/y 2 2 also by rewriting J x  + Jy  = J 2  − Jz2  where J = (Jx , Jy , Jz ). As for symmetric √ states J 2  = (N/2 + 1)N/2 our criterion requires J z2  ≥ 5/2 − 3, i.e. the collective spin squared of biseparable symmetric states in any direction cannot be arbitrarily small (2) [26]. For the state D 4 , however, J z2  = 0 and thus the expectation value of the witness operator in Eq. 10 reaches the maximum of 6. Via measurement of all photons in (±45)and (L/R)-basis respectively we find experimentally the value T r[W 4s ρexp ] = 5.58±0.02 clearly exceeding the bound of biseparable states. Multipartite entanglement is, thus, detected by studying only a certain property of the state. This makes the entanglement witness much more efficient. In principle, the witness works even without individual addressing of qubits. In particular for experiments on multi-photon entanglement, one relies on coincidence detection and therefore usually suffers from low count rates caused by limited detection efficiencies. Thus economic tools, like the two-setting witness operator, which offer a maximum gain of information on a quantum state by a minimal number of measurement settings are important. 2.3. Residual state after loss or measurement of single qubits (2)

Let us continue the investigation of properties that make D 4 special in comparison with the great variety of other four-qubit entangled states. The various states show great differences in the residual three-qubit state dependent on the measurement basis and/or result: for example, | GHZ 4  [7] can either still render tripartite GHZ like entanglement

C. Schmid et al. / The Entanglement of the Symmetric Four-Photon Dicke State

119

or become separable, | W 4  as well, but the tripartite entanglement will always be W type. Entanglement in the cluster state | C 4  [6] cannot be easily destroyed and at least (2) bipartite entanglement remains. However, | Ψ (4)  [9,27] and, as described next, D 4 yield genuine tripartite entangled states independent of the measurement result and basis, i.e. also under loss of the qubit. Let us compare the projection of the qubit in mode d onto either | V  or | −  for the (2) state D4 : 1 (2) |D4  = √ (| HHV  + | HV H  + | V HH ), 3 1 (2) d  − |D4  = √ (| HHV  + | HV H  + | V HH  6

d V

−| HV V  − | V HV  − | V V H ).

(11)

The first is the state | W3  [4] and the second one is a so-called G state (| G 3  Ref. [28]). Experimentally we observe these states with fidelities F W3 = 0.882 ± 0.015 and FG3 = 0.897 ± 0.019 . Comparable values are observed for measurements of photons in other modes. The criterion (10) adopted to the three-qubit case, can now be used to detect the tripartite entanglement around | W 3  and | G3  with the bound W 3s  = Jx2  + Jy2  ≤ √ ( ' 2 + 5/2 ≈ 3.12. Our results for | W 3  and | G3  are T r W3s ρG3 = ( ' smeasurement 3.34 ± 0.03 and T r W3 ρW3 = 3.33 ± 0.03 respectively, which proves both states contain genuine tripartite entanglement.

3. Possible applications What kind of tripartite entanglement do we observe? The answer to that question takes us directly to a possible application of the Dicke sate. Fascinatingly, the class of tripartite entanglement depends on the measurement basis. While the W state represents the W class, the state | G3  belongs to the GHZ class. This is remarkable: GHZ and W class states cannot be transformed into one another via SLOCC [1] and not even by (2) entanglement catalysis [29]. D 4 , however, can be projected into both classes by a local operation, i.e., via a simple von Neumann measurement of one qubit. This also implies (2) that there is no obvious way how to obtain D 4 out of either of those three-qubit states via a 2-qubit interaction with an additional photon, as this would directly give a recipe to transform one class of three-qubit entanglement into the other. As the experimentally observed states are not perfect we also have to test whether the observed state | G 3  is GHZ class. To do so, we construct an entanglement witness from the generic one for pure GHZ states, WGHZ3 = 34 11 − | GHZ3  GHZ3 |, by applying local filtering operations F = A ⊗ B ⊗ C. The resulting witness operator is then W  = F † WGHZ3 F [30,5]. Here A, B and C are 2 × 2 complex matrices determined through numerical optimization to find an optimal witness for the detected state. Note, that W  still detects GHZ type entanglement as F is an SLOCC operation. In the measurement GHZ type entanglement is indeed detected with an expectation value of T r(ρ G W  ) = −0.029 ± 0.023 proving that the observed state is not W class.

120

C. Schmid et al. / The Entanglement of the Symmetric Four-Photon Dicke State (2)

Entanglement in D 4 is not only persistent against projective measurements but also against loss of photons. The state ρ abc after tracing out qubit d is an equally weighted mixture of | W3  and | W3 , which is also tripartite entangled. Applying witness W 3s we ( ' obtain T r W3s ρabc = 3.30 ± 0.01, proving clearly the genuine tripartite entanglement. The fidelity with respect to the expected state is F abc = 0.924 ± 0.006, similar values are reached for the loss of the photons in modes a, b and c. As we have seen, the loss of one photon results in a three-qubit entangled W class state. Thus, the persistency against the loss of a second photon should also be high [27]. It is known that the state | W4  is the symmetric state with the highest persistency against loss of two photons with respect to entanglement measures like the concurrence [1,11]. (2) In contrast, it turns out that for D 4 the remaining two photons have the highest possible maximal singlet fraction [31] (MSF D(2) = 2/3, experimentally MSF exp = 0.624 ± 4 0.005). This means that the residual state is as close to a Bell state as possible. It was already pointed out in Refs. [27,31] that this is a hint for the applicability of a state in (2) telecloning [32]. Four parties that share the state D 4 can use the quantum correlations in each pair of qubits as a quantum channel for a teleportation protocol. Thus, each party can distribute an input qubit to the other parties with a certain fidelity, which depends (2) on the MSF. Using D 4 as quantum resource this so-called 1 → 3 telecloning works with the optimal fidelity allowed by the no-cloning theorem. Averaged over arbitrary input states the fidelity is Fclone 1→3 = 0.788 and the optimal so-called covariant cloning cov fidelity is F1→3 = 0.833 for all input states on the equatorial plane of the Bloch sphere (i.e. all states √12 (| H  + exp(iφ)| V )). Assuming perfect cloning machines, the fidelity obtained by using the experimentally observed state for the protocol would be F expclone ≈ 1→3 0.75 and Fexpcov ≈ 0.79 in the covariant case. Note that for the experimentally observed 1→3 state also the latter value is not independent of φ and varies between 0.81 and 0.77 for φ ∈ [0, 2π]. What if the receiving parties decide that one of them should get a perfect version of the input state? Probabilistically this is still possible, if the other two parties abandon their part of the information by a measurement of their qubit in the same direction, say (H/V). In case they find orthogonal measurement outcomes the sender and the )only remaining (2)

receiver share a Bell state cd  HV |D4  = √13 (| HV  + | V H ) = 23 | ψ + ab . This enables perfect teleportation in 2/3 of the cases and therefore, as each party could be the receiver, an open destination teleportation (ODT) [8]. The experimentally obtained ψ+ fidelity of the two photon states in this case was F H = 0.883 ± 0.028. For other c Vd measurement directions different Bell states can be obtained. For example for projections + − onto the (±45)- and (L/R)-basis we found F +φc −d = 0.721 ± 0.043 and FRφc Ld = (2)

0.712 ± 0.042. Note that, in contrast to the deterministic GHZ based ODT protocol, D 4 allows to choose between telecloning and ODT. (2) Finally, as another possible application, we also note that D 4 is the symmetric Dicke state which can be used in certain quantum versions of classical games [33]. In these models it might offer new game strategies compared to the commonly used GHZ state.

C. Schmid et al. / The Entanglement of the Symmetric Four-Photon Dicke State

121

Conclusion In conclusion we have presented the experimental observation and analysis of a quan(2) tum state D4 , obtained with a fidelity of 0.844 ± 0.008 and a count rate as high as 60 counts/minute. The setup and methods used are generic for the observation of symmetric Dicke states with higher photon numbers as well. Our analysis focused on the state’s violation of local realism and the particular properties that make the Dicke state suitable for several quantum information applications. As was shown, the two inequivalent classes of genuine tripartite entanglement can be obtained from the Dicke state after projection of one qubit in different bases. The possibility to project two photons into a Bell state (2) makes D4 a resource for an ODT protocol. Further, the state has a high entanglement persistency against loss of two photons. In this case, the singlet fraction of the remaining photons is maximal and from this we inferred applicability of the state for quantum telecloning. We believe that due to the extraordinary properties of the state other applications are likely in the future.

Acknowledgements We acknowledge the support of this work by the Bavarian High-tech Initiative, the Deutsche Forschungsgemeinschaft, the European Commission through the EU Projects QAP and RESQ and the EU Grants MEIF-CT-2003-500183 and MERG-CT-2005029146 and EuroSQIP and DFG SFB 631 prospects, the National Research Fund of Hungary OTKA (Contract No. T049234) and the DAAD/MNiSW exchange program. W.L. is supported by FNP.

References [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20]

W. Dür et. al., , Phys. Rev. A 62, 062314 (2000). F. Verstraete et al., , Phys. Rev. A 65, 052112 (2002). L. Chen and Y. Chen, quant-ph/0605196v1. N. Kiesel et al., J. Mod. Opt. 50, 1131 (2003); M. Eibl et al., Phys. Rev. Lett. 92, 077901 (2004). H. Häffner et al., Nature 438, 643(2005). N. Kiesel et al., Phys. Rev. Lett., 95, 210502 (2005); P. Walther et al., Nature 434 , 169(2005). A. Zeilinger et al., Phys. Rev. Lett. 78, 3031 (1997); J. Pan et al., Phys. Rev. Lett. 86, 4435 (2001). Zhao, Z. et al., Nature, 430, 54-58 (2004). M. Eibl et al., Phys. Rev. Lett., 90, 200403 (2003); S. Gaertner et al., J. App. Phys. B 77, 803 (2003); R.H. Dicke, Phys. Rev. 93, 99 (1954). J.K. Stockton et. al.,Phys. Rev. A 67, 022112 (2003). A. Retzker, E. Solano, and B. Reznik, Phys. Rev. A 75, 022312 (2007). A similar scheme was proposed for other purposes by T. Yamamoto et al., Phys. Rev. A 66, 064301 (2002). Nikolai Kiesel, Ph.D. thesis, to be published. ˙ H. Weinfurter and M. Zukowski, Phys. Rev. A 64, 010102(R) (2001). R. F. Werner and M. W. Wolf, Phys. Rev. A 64, 032112 (2001). ˆ Brukner, Phys. Rev. Lett. 88, 210401 (2002). ˙ C. M. Zukowski, ˙ D. Kaszlikowski, P. Gnaci"nski, M. Zukowski, W. Miklaszewski and A. Zeilinger, Phys. Rev. Lett. 85, 4418 (2000). D. Collins, N. Gisin, S. Popescu, D. Roberts, V. Scarani, Phys. Rev. Lett. 88, 170405 (2002). N. D. Mermin, Phys. Rev. Lett. 65, 1838 (1990).

122 [21] [22] [23]

[24] [25] [26] [27] [28] [29] [30] [31] [32] [33]

C. Schmid et al. / The Entanglement of the Symmetric Four-Photon Dicke State

˙ K. Nagata, W. Laskowski, M. Wie´sniak, and M. Zukowski, Phys. Rev. Lett. 93, 0230403 (2004) ˙ W. Laskowski and M. Zukowski, Phys. Rev. A 72, 062112 (2005) M. Bourennane et. al., Phys. Rev. Lett. 92, 087902 (2004), M. Horodecki et al., Phys. Lett. A 223, 1 (1996); B.M. Terhal, Phys. Lett. A 271, 319 (2000); M. Lewenstein et al., Phys. Rev. A 62, 052310 (2000); D. Bruß et al., J. Mod. Opt. 49, 1399 (2002); O. Gühne and P. Hyllus, Int. J. Theor. Phys. 42, 1001 (2003). G. Tóth and O. Gühne, Phys. Rev. A 72, 022340 (2005). G. Tóth, quant-ph/0511237. J.K. Korbicz et al., Phys. Rev. Lett. 95, 120502 (2005). M. Bourennane et. al., Phys. Rev. Lett. 96, 100502 (2006). A. Sen(De) et al., Phys. Rev. A 68, 032309 (2003). I. Ghiu et. al., Phys. Lett. A 287, 12(2001). O. Gühne, (private communication); W. Dür and J. I. Cirac, J. Phys. A 34 6837 (2001). M. Horodecki et al., Phys. Rev. A 60, 1888 (1999). M. Murao et. al., Phys. Rev. A 59, 156 (1999). J. Shimamura et al., Phys. Lett. A 328, 20 (2004).

Quantum Communication and Security ˙ M. Zukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

123

Security of Quantum Key Distribution Protocol Based on Ququarts Alexander P. SHURUPOV 1 , and Sergei P. KULIK Faculty of Physics, Moscow M.V. Lomonosov State University Abstract. We discuss the security of QKD protocol with four-state system based on single spatial and frequency non-degenerate down converted photons. Simple schemes for biphoton generation and their deterministic measurements are analyzed. Three main incoherent attacks (intercept-resend, intermediate basis and optimal attack) on QKD protocol in Hilbert space with dimension D = 4 using three mutually unbiased bases were analyzed. It has been shown that QKD protocol with four-dimensional states belonging to three mutually unbiased bases provides better security against the noise and eavesdropping than protocols exploiting two bases with qubits and ququarts. Keywords. Biphotons, quantum key distribution, security

Introduction Quantum Key Distribution (Quantum Cryptography) allows one to organize key sharing, security of which is guaranteed by principal laws of physics - quantum mechanics [1,2,3]. Extended BB84 protocols The idea of QKD using 4 states belonging to 2 mutually unbiased bases was proposed in [2]. The first extension of this protocol to higher dimension D > 2 was proposed by Peres and Bechmann-Pasquinucci in [4]. According to [4] quantum states, in which information is encoded, belong to four mutually unbiased bases, each containing three elements. By definition vectors belonging to mutually unbiased basis satisfy the following conditions: 1. |ei |ej |2 = 1/D, when |ei  and |ej  are members of different bases. 2. |ei |ej |2 = 0 when i = j and |e i |ei |2 = 1 for members of the same basis. It was shown, that for three-level systems, full protocol requires 12 states and fourlevel protocol requires 20 states. In case of D = 4 it was found, that in practice one can relatively easily prepare 12 states based on the polarization states of two-photon field and belonging to three mutually unbiased basis [5,6]. Considering this fact, we analyze the protocol with M = 3 mutually unbiased bases in four-dimensional Hilbert space. 1 E-mail:

[email protected].

124 A.P. Shurupov and S.P. Kulik / Security of Quantum Key Distribution Protocol Based on Ququarts

1. Eavesdropping analysis To identify the eavesdropping attempt Alice and Bob open small part of their raw key for comparison. Results of such comparison allow one to estimate the error rate. Errors may be caused either by physical noise and/or by presence of eavesdropping. We concentrate our attention on incoherent attacks; namely, we assume that the eavesdropper interacts with a single four-dimensional quantum system at a time. In most cases Eve wants to make her attack symmetric, so the disturbance is not distinguishable from the environmental noise. In our work three incoherent attacks are analyzed: intercept-resend strategy, attack in the intermediate basis [7] and optimal attack [8]. Briefly summarizing our results, we can say that the intercept-resend strategy is the most simple one and can by applied to any QKD protocol, but it does not give very much information, while producing considerable noise. Attack in the intermediate basis gives eavesdropper probabilistic information, it causes less disturbance, but such strategy cannot be applied for protocols, that use more than two mutually unbiased bases. Last examined strategy is the optimal one with respect to the mutual information shared between Alice and Eve, I AE , for some given disturbance D. Finally we will compare the robustness against eavesdropping for the various protocols.

Figure 1. Effectiveness of optimal eavesdropping strategy for various protocols.

Protocol remains secure as far as the mutual information shared between legitimate users IAB is greater than the information accessible to eavesdropper I AE . Figure 1 shows that protocol with 3 mutually unbiased basis is more secure, because Eve introduces more disturbance to gain the same amount of information. Figure 2 presents key distribution rate vs. disturbance, introduced with optimal strategy. Disturbance D c , corresponding to zero rate, is critical for given protocol. When estimated error rate in raw key D e exceeds Dc , the secrecy of key can no longer be guaranteed.

A.P. Shurupov and S.P. Kulik / Security of Quantum Key Distribution Protocol Based on Ququarts

125

Figure 2. Key distribution rate.

The greater number of bases is used, the larger part of raw key is discarded in initial key clean-up phase. This figure also shows that the higher the dimension and the more mutually unbiased bases are used the greater critical disturbance is [9]. This allows one to use noisy channel for QKD and not to be afraid of being compromised.

2. Discussions 2.1. Two qubits ?= ququart Consider two qubits Ψ 1 = a1 |0 + b1 |1 and Ψ2 = a2 |0 + b2 |1 coexisting together. Their wave function is given by superposition of four orthogonal vectors existing in fourdimensional Hilbert space:

Ψ = Ψ1 ⊗ Ψ2 = a1 a2 |00 + a1 b2 |01 + b1 a2 |10 + b1 b2 |11 It is obvious that in the general case arbitrary four level system (pure) state is not factorized, i.e. represents an entangled pure state of two qubits: Ψ = c1 |00 + c2 |01 + c3 |10 + c4 |11 = Ψ1 ⊗ Ψ2

(1)

Factorizing criterion of Eq. (1) is equality of c 1 c4 and c2 c3 (c1 c4 = c2 c3 ). From a practical point of view, generation of an arbitrary entangled state of two qubits is much more complicated than generation of two independent qubits. That is why in work [5] simple method to generate 12 states of ququarts was proposed.

126 A.P. Shurupov and S.P. Kulik / Security of Quantum Key Distribution Protocol Based on Ququarts

3. Polarization ququarts for QKD protocol The complete QKD protocol with four-dimensional polarization states exploits five mutually unbiased bases with four states in each. In terms of biphoton states, the first three bases consist of product polarization states of two photons and the last two bases consist of two-photon entangled states: I. |H1 H2 ; |H1 V2 ; |V1 H2 ; |V1 V2 , II. |D1 D2 ; |D1 D2 ; |D1 D2 ; |D1 D2 , III. |R1 R2 ; |R1 L2 ; |L1 R2 ; |L1 L2 , IV. |R1 H2  + |L1 V2 ; |R1 H2  − |L1 V2 ; |L1 H2  + |R1 V2 ; |L1 H2  − |R1 V2 , V. |H1 R2  + |V1 L2 ; |H1 R2  − |V1 L2 ; |H1 L2  + |V1 R2 ; |H1 L2  − |V1 R2 .

(2)

Here |H ≡ |1, |V  ≡ |0, |D ≡ √12 (|1 + |0), D ≡ √12 (|1 − |0), |R ≡ √12 (|1 + i|0), |L ≡ √12 (|1 − i|0) indicate horizontal, vertical, +45 linear, -45 linear, right- and left-circular polarization modes respectively. Lower indices numerate the frequency modes of the two photons. It has been proved [10,11] that it is sufficient to use only first two or three bases for the efficient QKD. Using an incomplete set of bases one sacrifices the security but enhances the key generation rate. Since the fulfilment of Bell measurements for the last two bases requires a big experimental effort on both preparation and measurement stages of a protocol, we will restrict ourselves to first three bases. The states from the first three bases can be prepared with the help of a single non-linear crystal and local unitary transformations so it is quite easy to do in experiment. This is a fundamental difference in comparison with biphotons-qutrits [12], for which SU(2) transformations between states from mutually unbiased bases are prohibited. Another advantage of the ququarts is possibility to distinguish the states belonging to one basis deterministically thus allowing its implementation in QKD protocol with polarization ququarts. 3.1. Experimental procedure. The sketch of the experimental setup for the generation of ququart states that belong to the first three bases (2) is shown in Fig. 3.

Figure 3. Setup for preparation of ququarts which can be used in QKD. Wave plates DP1, DP2 oriented at 45◦ degrees with respect to the vertical axis serve as the dichroic retardation plate with variable optical thickness which is controlled by tilting angle θ. Two zero-order plates ZP1, ZP2 allow one to choose the basis.

A.P. Shurupov and S.P. Kulik / Security of Quantum Key Distribution Protocol Based on Ququarts

127

As an example let us consider , the preparation of state |H 1 V2  from initial state |V1 V2 . This transformation can be done by a so-called dichroic wave plate which acts at different wavelengths. In particular it introduces a phase shift of 2π for a vertically polarized photon, and a phase shift of π for the conjugated photon. The wave plate is oriented at 45 ◦ to the vertical direction. Since such wave plates are not readily available and the result of transformation is extremely sensitive to small variations of thickness, one can use the following method to achieve the desired thickness. Two quartz plates (DP1) and (DP2) with the orthogonally oriented optical axes are placed consecutively in the biphoton beam. The consecutive action of these two wave plates corresponds to the action of quartz wave plate with an effective thickness. If then one can tilt these wave plates towards each other by a finite angle θ, then the optical thickness of the effective wave plate, formed by DP1 and DP2 will change, and, at a certain value of θ, the desired transformation will be achieved. In order to change the basis from I to II(III), zero order half- (quarter)- wave plates ZP 1 (ZP 2) oriented at 22.5 ◦ (45◦ ) were used. This procedure is repeated for the generation of any of the states. At the same time there is a method which allows one to distinguish unambiguously all biphoton states forming chosen bases. The measurement set-up that solves this problem and that has been already tested in our experiments is shown in Fig. 4.

Figure 4. Measurement part at Bob’s station.

It consists of the dichroic mirror, separating the photons with different wavelengths, and a pair of polarization beam-splitters, separating photons with orthogonal polarizations. The four-input double-coincidence scheme linked with the outputs of singlephoton detectors registers the biphotons-ququarts. For example, for the first basis the scheme works as follows, provided that Bob’s guess of the basis is correct: if the state |H1 H2  comes, then detectors D4, D2 will fire, if the state |H1 V2  comes, then detectors D4, D1 will fire, if the state |V1 H2  comes, then detectors D3, D2 will fire, if the state |V1 V2  comes, then detectors D3, D1 will fire. The same holds for any of the remaining correctly guessed bases, since the quarter- and half- wave plates transform the polarization into HV basis in which the measurement is performed. The registered coincidence count from a certain pair of detectors contributes to the corresponding diagonal component of the density matrix. So if the basis is guessed correctly, then the reg-

128 A.P. Shurupov and S.P. Kulik / Security of Quantum Key Distribution Protocol Based on Ququarts

istered coincidence count deterministically identifies the input state. The main obstacle for the practical implementation of free-space QKD protocol based on ququarts is that one needs o perform fast polarization transformation at the selected wavelengths. There are different ways of overcoming this problem and we will discuss them elsewhere. In this section we mention briefly the possible ways. Since it is not practical to tune the tilting wave plates every time one wants to encode a ququart value, we suggest either using a polarization modulator that operates on two wavelengths or splitting the photons with dichroic mirrors and perform these transformations on halves of a biphoton independently in a Mach-Zehnder-like configuration. It is important to note that interferometric accuracy in Mach-Zehnder interferometer is not needed, since it is used only for spatial separation of photons. The practical solution would be to couple the down converted photons in a single mode fiber to ensure a perfect spatial mode overlap and then to split them with wavelength division multiplexer (WDM). Then, the switching between the states can be done with the polarization modulators that introduce a π or 2π phase shifts for the selected wavelength. The choice of basis on Alice’s side is done by a zero order quarter- and half- wave plates, which be realized within Pockel (Liquid Crystal) cell driven by randomly selected voltage. Free space communication is proposed since it is not practical to distribute a polarization state within an optical fiber. On Bob’s side, the random choice of basis (RNG) is performed in the same way as on Alice’s side. Then the photons are spatially separated with the help of WDM or a dichroic mirror and each of the photons is sent to Brown-Twiss scheme with a polarizing beam-splitter that projects an arrived photon on H or V state as it is shown in Fig. 4. Moreover, registering coincidences allows one to circumvent the problem of the detection noise that is common for single-photon based protocols. If the coincidence window is quite small, it is possible to assure a lower level of accidental coincidences for the usual dark count rate of single photon detectors. This point is discussed in the next section. The question arises, whether one can use for QKD single photon states obtained independently and propagating in same spacial mode instead? It can be shown, that such method of key generation is similar to utilizing two BB84 protocols. Indeed the scheme presented on Fig. 4is just a combination of two Bob’s measurement schemes used typically for polarization version of BB84 protocol. In particular this can be done for increasing key generation rate (as compared to single protocol), but there is no gain in secrecy. Schematic presentation of time scale for two independent photon sources is shown in Fig. 5. Each dot visualizes the presence of photon in appropriate time window.

Figure 5. Two photons packets propagate independently. Mean photon number μ ∼ 0.1

For the dimension of Hilbert space to be four, only results when both photons are detected must be kept on measuring stage, and all other results should de discarded. Only that case when the pair of independent photons appears in given time slot and proposed

A.P. Shurupov and S.P. Kulik / Security of Quantum Key Distribution Protocol Based on Ququarts

129

above biphoton are equivalent. But the main problem is that there are no readily available single photon sources at the moment. In most cases faint laser pulses with small mean photon number (μ ∼ 0.1) are used. However when such single photon sources are used the probability to create simultaneously (or in two predefined time windows) two photons from different sources is extremely small (p ∼ μ 2 ∼ 10−2 ). This context makes such photon pairs practically useless for quantum key distribution in four-dimensional case. Schematic presentation of time scale for biphoton source is shown in Fig. 6. Each dot pair visualizes presence of a biphoton in the corresponding time window.

Figure 6. Biphotons packets propagatation. Mean biphoton number μ ∼ 0.1

3.2. Coincidence scheme Some remarks about the measurement scheme should be made. The most practical choice for single photon detector is an avalanche photodiode, working in gated mode. In rough approach APD can be characterized only by two parameters: η - quantum efficiency and p - dark count probability for one strobe with length τ . Standard biphoton measuring setup based on the Brown-Twiss scheme is shown in Fig. (7). This setup allows one to split two orthogonal polarization states of biphoton, namely |H1  and |V2  ones. To distinguish completely between other polarization states belonging to the bases introduced above it is sufficient to insert either half- or quarter wave plates in front of the polarization beam-splitter.

Figure 7. Biphoton measuring scheme.

In the simplest case the coincidence scheme can be considered as logical "AND" element. Output signal appears only when both detectors fire in a fixed time window T c . Owing to the fact that the probability distribution of the number of biphotons per pulse is given by Poissonian distribution, the mean biphoton number per pulse should be made rather small, for example, μ = 0.1 like in the standard QKD single-photon sources. Now we can introduce some crucial parameters and make several estimations: • Biphoton registration probability P S = μη 2 .

130 A.P. Shurupov and S.P. Kulik / Security of Quantum Key Distribution Protocol Based on Ququarts

• Probability to get signal, caused by dark counts coming from both detectors, simultaneously PSN = (1 − μ)p2 . The typical value is about of p ∼ 10 −4 , so this probability is negligibly small. • Probability of "half" biphoton registration, when one detector clicks (η), another misses photon (1 − η) but still the dark count arises (p). Such probability is given by PSN = μ · η(1 − η) · p. This event gives us some information about biphoton, but for some purpose we can also consider it as a noise. (1)

The same values for simple single photon measuring scheme are given by P S = μη (1) and PS = (1 − μ)p. Now we can calculate signal-to-noise ratio for single-photon measurement and μη and for twobiphoton schemes. For single-photon scheme we get (S/N ) 1 = (1−μ)p η photon scheme we get (S/N ) 2 = (1−η)p . One can notice that the second value increases to very great numbers when detectors quantum efficiency tends to unity. This happens because only coincidence events are counted. Now we can estimate how much signal-tonoise ratio for two-photon scheme exceeds the same value for single-photon scheme: 1 . 1−μ (S/N )2 · = (S/N )1 μ 1−η Fig. 8 shows the ratio versus detectors quantum efficiency. It is seen clearly that the ratio grows with η remaining to be larger than unit even for small values of η. For typical values of η=0.1 the signal-to-noise ratio for two-photon four-state protocol still exceeds the single-photon ratio as much as one order of magnitude that demonstrates the advantage of high-dimensional systems for QKD purposes.

Figure 8. Relation of signal-to-noise ratios for two-photon and one-photon schemes when μ = 0.1.

3.3. Mapping onto a two-dimensional key In this section we will follow the logic of the paper [10]. Let’s encode four quarts in pairs of bits, for example, α = 00, β = 01, γ = 10, and δ = 11. Like in [10] we give

A.P. Shurupov and S.P. Kulik / Security of Quantum Key Distribution Protocol Based on Ququarts

131

an example showing that Alice and Bob have to be careful about when they perform the translation from high dimension alphabet into the lower dimensional one and vice versa. Suppose that protocol with three mutually unbiased bases in four-dimensional Hilbert space was used and the eavesdropper has used the intercept-resend algorithm. In this case Eve will get each quart correctly with probability 1/2 . This means that on average Eve will have one half of quarts correctly. At the same time she does not know which ones she got correctly and which ones were wrong. Suppose that Alice has sent the following string of α, β, γ, and δ: αβγδβγβαββδα... but that Eve has the string αγγδβδβββδαγ... One can see that 6 out of 12 are wrong in Eve‘s string or that she has 12 , i.e half quarts correct. Let us now assume that Alice and Bob want to map the four-dimensional key onto a binary one. Using the encoding given an above example Alice has s new string: 00 01 10 11 01 10 01 00 01 01 11 00... Performing the same operations with her sequence of quarts, Eve extracts 00 10 10 11 01 11 01 01 01 11 00 10... 8 This string contains 24 bits to be wrong, or two out of three bits correct. It happens because the errors occurring in Eve‘s string are no longer independent, but depend on each other in the respective blocks. That is why Alice and Bob have to perform error correction and privacy amplification processes with the higher alphabet. Final decoding into the bits must be done after finishing these processes in order to prevent extracting information by eavesdropper.

Conclusion Utilization of biphotons as quantum information carriers in many-state QKD protocols allows one to increase key generation rate as well as robustness of protocols against possible attacks. To do this one can approach the simplest (from experimental point of view) choice of product biphoton states belonging to three mutually unbiased bases.

Acknowledgments Stimulating discussions with H.Zbinden and H.Weinfurter are gratefully acknowledged. This work was supported in part by Russian Foundation of Basic Research (project 0602-16769a) and Leading Russian Scientific Schools (project 4586.2006.2).

References [1] S. Wiesner, SIGACT News 15, 78 (1983). [2] C.H. Bennett, G. Brassard, Int. Conf. on Computers, Systems and Signal Processing, Bangalore, India (IEEE, New York, 1984), p. 175. [3] W.K. Wootters, W.H. Zurek, Nature 299, 802 (1982). [4] H. Bechmann-Pasquinucci, A. Peres, Phys. Rev. Lett. 85, 3313 (2000).

132 A.P. Shurupov and S.P. Kulik / Security of Quantum Key Distribution Protocol Based on Ququarts

[5] Yu.I. Bogdanov, E.V. Moreva, G.A. Maslennikov, R.F. Galeev, S.S. Straupe, S.P. Kulik, Phys. Rev. A 73, 063810 (2006). [6] G.A.Maslennikov, E.V.Moreva, S.S.Straupe, and S.P.Kulik, Phys. Rev. L 97, 023602 (2006). [7] C. Bennett, F. Bessette, G. Brassard, et al., J. Cryptology 5, 3 (1992). [8] F. Caruso, H. Bechmann-Pasquinucci, C. Macchiavello, Phys. Rev. A 72, 032340 (2005). [9] N. Cerf, M. Bourennane, A. Karlsson, N. Gisin, Phys. Rev. Lett. 88, 127902 (2002). [10] H. Bechmann-Pasquinucci, W.Tittel, Phys. Rev. A 61, 062308 (2000). [11] M. Bourennane, A. Karlsson, G.Björk, Phys. Rev. A 64, 012306 (2001); N. Cerf, M. Bourennane, A. Karlsson, N. Gisin, Phys. Rev. Lett. 88, 127902 (2002); F. Caruso, H. Bechmann-Pasquinucci, C. Macchiavello, Phys. Rev. A 72, 032340 (2005). [12] Yu. Bogdanov, M. Chekhova, L. Krivitsky, S.P. Kulik, L.C. Kwek, M.K. Tey, C.Ch.Oh, A.A. Zhukov, Phys. Rev. A 70, 042303 (2004).

Quantum Communication and Security ˙ M. Zukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

133

Linear-optics Manipulations of Photon-loss Codes Konrad BANASZEK 1 , Wojciech WASILEWSKI Institute of Physics, Nicolaus Copernicus University, Toru´n, Poland Abstract. We discuss codes for protecting logical qubits carried by optical fields from the effects of amplitude damping, i.e. linear photon loss. We demonstrate that the correctability condition for one-photon loss imposes limitations on the range of manipulations than can be implemented with passive linear-optics networks. Keywords. Quantum error correction, photon loss, amplitude damping

Introduction Quantum states encoded in optical fields are an obvious way to implement quantum communication protocols [1]. The optical approach offers also a route towards scalable quantum computing, with the particularly promising linear-optics scheme of Knill, Laflamme, and Milburn [2]. Optical fields are distinguished from standard qubit models of quantum information processing in two ways. First, photons are bosons that can occupy field modes in arbitrary numbers. Although a qubit can be implemented as a superposition of a single photon in two orthogonal modes, the entire Hilbert space describing optical fields has plenty of room to go beyond this standard, dual-rail representation. Secondly, most important error mechanisms that affect optical fields have a specific form. This enables one to optimize strategies for shielding quantum information from their deleterious effects. The above features can be illustrated with the example of photon loss, also referred to in literature as amplitude damping. Such a mechanism can be modeled as a transmission of optical fields through a partly reflecting beam splitter. This attenuates the transmitted field, leading to a random removal of photons from the initial state. The effects of photon loss can be dealt with by adopting the strategy of quantum error correction [3], which consists in designing so-called code subspaces in which qubits are protected from dominant errors. Such codes can be constructed from states that contain more than one photon per mode [4], which makes them more efficient in terms of required numbers of photons and modes. A natural method to manipulate optical codes is to use linear optics networks [5]. In the simplest scenario, such networks are passive, i.e. they do not involve auxiliary photons, conditional detection, or feed-forward operations. In this contribution we review 1 Corresponding author: Konrad Banaszek, ul. Grudziadzka ˛ 5, PL-87-100 Toru´n, Poland; E-mail: kbanasz@fizyka.umk.pl.

134

K. Banaszek and W. Wasilewski / Linear-Optics Manipulations of Photon-Loss Codes

the recent proof [6] that even the simplest codes, which correct for just a single photon loss, cannot be universally processed using passive linear optics only. As we will see below, the same properties that make the codes correctable for photon loss, also prohibit a range of linear-optics manipulations.

1. Photon-loss codes Logical qubits can be protected from the effects of errors by preparing more complex states of physical systems [3]. Such states span the so-called code subspace, within which an arbitrary quantum superposition remains preserved despite the occurrence of an error from a certain class. In the most elementary case, the subspace is spanned by two orthogonal states which we shall denote by |L and |H. The specific scenario we shall consider here is shielding logical qubits carried by optical fields from amplitude damping by encoding them in suitable multiphoton states. Let us restrict our attention to errors induced by the loss at most one photon from the field. If we make two assumptions: • the code is constructed in a subspace with a fixed total photon number, • the damping parameter is identical for all the modes involved, then the necessary and sufficient conditions for a code constructed in a system of bosonic modes to be robust against one-photon loss are given by [4]: H|ˆ a†i a ˆj |L = 0,

H|ˆ a†i a ˆj |H = L|ˆ a†i a ˆj |L

(1)

ˆ †i denote respectively the annihilation and creation operators of the field where a ˆi and a modes, and the indices i, j = 1, . . . , N run over all of N bosonic modes. The action of an operator a ˆ j on the code states can be interpreted as an event when a third party has observed in the leaked portion of the field one photon in the jth mode. The third party belongs to the external environment, and her actions, as well as the outcome of her measurement are of course unknown to the owner of the qubit. The equation H|ˆ a †i a ˆj |L = 0 implies a simple constraint: it must not be possible to pass between two orthogonal code states by moving just one photon between the modes, i.e. annihilating it from the mode a ˆ j and creating one in the mode a ˆ i . Starting from this observation, it is easy to construct two elementary examples of photon-loss codes using four photons distributed between two modes [4]: 1 |L = √ (|04 + |40), 2

|H = |22,

(2)

and using three photons distributed between three modes [6]: 1 |L = √ (|003 + |030 + |300), 3

|H = |111.

(3)

It is straightforward to verify that the correctability conditions are satisfied, and furthermore that all the states a ˆ 1 |L, a ˆ1 |H, a ˆ2 |L, a ˆ2 |H, . . . are mutually orthogonal and have identical norms. A code subspace can be conveniently characterized with the help of the corresponding projection operator PˆC , which in our two-dimensional case takes the form

K. Banaszek and W. Wasilewski / Linear-Optics Manipulations of Photon-Loss Codes

135

PˆC = |LL| + |HH|. Then the correctability conditions can be written in a very compact form as [7]: PˆC a ˆ†i a ˆj PˆC = Gij PˆC ,

(4)

where G = (Gij ) is a certain N × N matrix. This matrix is hermitian, which is easily proven by considering the hermitian conjugation of Eq. (4).

2. Linear optics transformations A general passive linear optics transformation of a system of N modes can be written as: a ˆi =

N 

Γik ˆbk

(5)

k=1

where the operators a ˆ i describe the input representation, the operators ˆbj refer to the output representation, and Γ = (Γ ij ) is a unitary N × N matrix. The unitarity of the matrix Γ guarantees the preservation of commutation relations for the field operators. Any linear-optics transformation can be reversed, therefore the labels of input and output representations are purely conventional. Let us now write the correctability condition given in Eq. (4) in the representation of the output modes ˆbk . A straightforward calculation shows that PˆC ˆb†k ˆbl PˆC = (ΓT GΓ∗ )kl PˆC ,

(6)

where ΓT and Γ∗ denote respectively the transposition and the complex conjugation of the matrix Γ. This means that after the application of the network Γ the subspace PˆC remains a photon-loss code, and that the only change is the transformation of the matrix G on the right hand side of the correctability condition. This property reflects the fact that in our error model the correctability condition is independent of the specific modal decomposition. Indeed, the third party monitoring the leaked field can decompose it in an arbitrary basis of modes and measure them individually for the presence of a photon. Because the damping coefficients are assumed to be identical for all the modes, such a procedure performed on the leaked field does not alter the error model. The fact that the photon-loss code is preserved by passive linear-optics transformations has important implications for encoding and decoding. Suppose that we start from a qubit in the standard, dual-rail representation, with the aim of mapping it onto the encoded subspace. A simple way to accomplish this would be to combine it with auxiliary modes prepared in a certain state and apply a passive linear optics transformation. However, the reversed version of the argument presented above implies that if the output is a photon-loss code, then the input needs to be such a code as well. This means that the input qubit itself is protected against photon loss, which obviously is not the case for the dual-rail representation. The same applies to decoding: if we know a priori that no photon loss occurred, we cannot convert the encoded qubit back into the dual-rail representation using a passive network. Therefore, there cannot exist a passive network that would work more universally for the input affected by errors and provide a decoded qubit with the error syndrome contained in the state of auxiliary modes.

136

K. Banaszek and W. Wasilewski / Linear-Optics Manipulations of Photon-Loss Codes

3. Single-qubit gates We will now consider single-qubit gates operating on the encoded qubit that can be implemented with passive networks. Thus we are looking for networks that do not mix the code subspace PˆC with the remaining complement of the Hilbert space. Let us consider a linear-optics transformation of the annihilation operators given by Eq. (5). The transˆ formation of the modes induces a certain unitary operator R(Γ) in the Hilbert space of ˆ the multimode bosonic system. The condition that the operator R(Γ) does not take us beyond the code subspace can be written as: ˆ PˆC = PˆC R(Γ) ˆ PˆC . R(Γ)

(7)

The set of all networks that preserve the code subspace forms a group. Let us now suppose that this group is continuous. This means that we can find a one-parameter subgroup composed of elements Γ s parameterized with a real parameter s according to: Γs = exp(−isΛ)

(8)

where Λ = (Λij ) is an N × N hermitian matrix. Mathematically, Λ is an element of the Lie algebra associated with the Lie group of unitary N × N matrices. ˆ s ) can then be written as: The unitary operator R(Γ ˆ s ) = exp(−isR(Λ)) ˆ R(Γ

(9)

ˆ where R(Λ) is the representation of the matrix Λ for the multimode bosonic system. It is given by a bilinear combination of the creation and annihilation operators [8]: ˆ R(Λ) =

N  i,j=1

Λij a ˆ†i a ˆj .

(10)

The correctness of this expression can be verified by considering operators a ˆ i (s) = ˆ ˆ exp(isR(Λ))ˆ ai exp(−isR(Λ)) and writing differential equations for dˆ a i (s)/ds, whose solution recovers Eq. (5) with the transformation matrix given by Eq. (8). ˆ s ) = Iˆ − Let us now consider an infinitesimal transformation of the form R(Γ ˆ isR(Λ). The second term, given explicitly in Eq. (10), comprises a sum of expressions of the form a ˆ †i a ˆj that appear also in the correctability condition given in Eq. (4). It is easy to see that: ˆ PˆC R(Λ) PˆC =

N  i,j=1

Λij PˆC a ˆ†i a ˆj PˆC =

N 

Λij Gij PˆC = λPˆC ,

(11)

i,j=1

where we introduced a real coefficient λ = Tr(ΛG T ). Inserting this result to Eq. (7) yields: ˆ s )PˆC = PˆC R(Γ ˆ s )PˆC = PˆC − isPˆC R(Λ) ˆ R(Γ PˆC = (1 − isλ)PˆC

(12)

ˆ s ) we have This means that for general, not necessarily infinitesimal, operators R(Γ −isλ ˆ ˆ ˆ ˆ R(Γs )PC = e PC . Therefore the operator R(Γs ) restricted to the code subspace generates only an irrelevant, uniform phase factor. Consequently, there does not exist a continuous group of linear transformations that would produce non-trivial gates on the encoded qubit.

K. Banaszek and W. Wasilewski / Linear-Optics Manipulations of Photon-Loss Codes

137

4. Examples We demonstrated in the preceding section that groups of transformations which can be implemented on photon-loss codes using passive networks must be discrete. For two examples of codes presented in Section 1 these groups can be found analytically. In the case of the four-photon code defined in Eq. (2), one can use the parameterization of special unitary 2 × 2 matrices in terms of Euler angles to show easily that all gates preserving the code subspace are generated by two transformations given, up to overall phase factors, by: 1 Γ2 = √ 2



1 1 −1 1

 ,

Γ2 =



10 0i

 .

(13)

The above transformations are realized respectively by a balanced beam splitter and a π/2 phase shift. In order to gain an insight into the structure of the set of gates, it is  helpful to consider transformations of the state |H = |22. 2 and Γ2 √ The application of Γ√ generates two other states given, up to phase factors, by ( 3|L − |H)/2 and ( 3|L + |H)/2, which together form an equilateral triangle in the Bloch sphere of the encoded qubit, shown in Figure 1(a). Gates that can be implemented with passive linear optics form the rotation group of this triangle. A more lengthy, but still elementary reasoning [6] shows that for the three-photon code defined in Eq. (3) the transformations preserving the code subspace are obtained from two generators: ⎛ ⎞ 1 1 1 1 ⎝ 1 e2πi/3 e−2πi/3 ⎠ , Γ2 = √ 3 1 e−2πi/3 e2πi/3

⎛

⎞ 10 0 Γ3 = ⎝ 0 1 0 ⎠ 0 0 e2πi/3

(14)

which correspond respectively to a tritter [9] and a 2π/3 phase shift on one of the modes. Starting from the initial state |H = |111, these transformations generate a regular tetrahedron in encoded qubit, with vertices √ of the √ √ corresponding to the √ the Bloch sphere states |H, ( 2|L − |H)/ 3, and ( 2|L − e±2πi/3 |H)/ 3, shown in Figure 1(b). As before, passive networks realize the rotation group of this solid.

Conclusions We have shown that restrictions on manipulating photon-loss codes with linear optics are intimately linked to the correctability condition itself. The invariance of the correctability condition with respect to unitary transformations realized by passive networks prohibits their use for encoding and decoding. Furthermore, passive linear-optics networks are ˆj that either move one photon obtained from infinitesimal generators of the form a ˆ †i a between modes, or introduce linear phase shifts. However, in the code subspace these expressions need to reduce to c-numbers to ensure correctability, which severely limits available manipulations on encoded qubits.

138

K. Banaszek and W. Wasilewski / Linear-Optics Manipulations of Photon-Loss Codes

Figure 1. The Bloch spheres of the logical qubit for (a) the four-photon code defined in Eq. (2) and (b) the three photon code defined in Eq. (3). The points represent states that can be produced from the logic state |H using passive networks, and dashed lines depict rotations that are generated by unitary transformations defined respectively in Eqs. (13) and (14).

Acknowledgements This work has been supported by the European Commission under the Integrated Project Qubit Applications (QAP) funded by the IST directorate as Contract Number 015848, Polish MNiSW grant 1 P03B 011 29 and AFOSR under grant number FA8655-06-13062.

References [1] [2] [3]

N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Rev. Mod. Phys. 74, 145 (2002). E. Knill, R. Laflamme, and G. J. Milburn, Nature 409, 46 (2001). A. R. Calderbank and P. W. Shor, Phys. Rev. A 54, 1098 (1996); A. M. Steane, Phys. Rev. Lett. 77, 793 (1996); A. Ekert and C. Macchiavello, ibid. 77, 2585 (1996). [4] I. L. Chuang, D. W. Leung, and Y. Yamamoto, Phys. Rev. A 56, 1114 (1997). [5] P. van Loock and N. Lütkenhaus, Phys. Rev. A 69, 012302 (2004); P. Kok, W. J. Munro, K. Nemoto, T. C. Ralph, J. P. Dowling, and G. J. Milnurn, Rev. Mod. Phys. 79, 135 (2007). [6] W. Wasilewski and K. Banaszek, quant-ph/0702075. [7] D. Kribs, R. Laflamme, and D. Poulin, Phys. Rev. Lett. 94, 180501 (2005). [8] R. Gilmore, Lie Groups, Lie Algebras, and Some of Their Applications (Wiley, New York, 1974). ˙ [9] M. Zukowski, A. Zeilinger, and M. A. Horne, Phys. Rev. A 55, 2564 (1997).

Quantum Communication and Security ˙ M. Zukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

139

Long Distance Quantum Communication: From Practical QKD to Unpractical Quantum Relays Hugo ZBINDEN1, Alexios BEVERATOS, Nicolas GISIN, Olivier LANDRY, Rob THEW, Valerio SCARANI, Damien STUCKI, Jeroen van HOUWELINGEN Group of Applied Physics, University of Geneva, Switzerland Abstract: We present recent work of our group in the field of long distance quantum communication. First, we present a feasibility experiment of a simple one-way scheme which is robust to photon number splitting attacks. Then, we show results on a rapid upconversion photon detector, which could increase the maximum rates of quantum key distribution (QKD). Finally, we present a teleportation experiment over a commercial fiber network. This would be an ingredient of a future quantum relay, which could increase the reach of QKD Keywords: Quantum key distribution, quantum cryptography, single photon counting, quantum teleportation

Introduction Quantum Key Distribution (QKD) has left the research laboratories and a couple of companies start to commercialize it. Research is mainly concentrating on new protocols using efficiently faint laser pulses, like the so called decoy-state protocol. On the more experimental side, work on better photon counters continues. Some groups start to work with superconducting detectors, which are useful for record breaking experiments in the lab. In particular their very low noise makes it possible to distribute keys over, say, 150 km. Of course, these detectors are hard to implement in a commercial environment, since they ask for temperatures as low as 4K or even some hundreds of mK, depending of the applied technology. However, if one wants to considerably increase the reach of QKD to 1000 or more kilometers one needs a quantum repeater. Several research teams are working on quantum memories and long distance entanglement swapping. But at present a practical quantum repeater remains science fiction. In this paper, we present work of our group in three mentioned directions above: A novel QKD-protocol, an up-conversion detector using silicon avalanche photon diodes, and a teleportation experiment over a real telecom network.

1

Corresponding Author: Hugo Zbinden, Group of Applied Physics, University of Geneva, Switzerland

140

H. Zbinden et al. / Long Distance Quantum Communication

1. Fast and simple one-way QKD In our coherent one-way protocol quantum cryptography protocol, logical bits are encoded in time. A sequence of weak coherent pulses is tailored from a CW-laser with an external intensity modulator (see Figure 1). The emitter, Alice, sends a sequence of empty or μ-pulse with a mean number of photons of μ<1 and a pulse separation of T. The logical bit 0L (1L) corresponds to a sequence 0-μ (μ-0). For security reason, we also send μ-μ or decoy sequences. The receiver, Bob, registers the time-of-arrival of the photons on detectors DB for the data line and DM for the monitoring line. The monitoring detector is placed after the unbalanced interferometer with a difference in path equal to T. The security is guaranteed by checking of detections on DM, for decoy sequence and logical sequence 1L0L. The time-of-detection on DB give the raw key from which Alice and Bob extract the net key after a reconciliation process.

Figure 1. Schematic setup of the coherent one-way protocol

Beside the simple experimental setup, the protocol has two other important advantages: First, the data is acquired just by measuring the arrival time of photons. There is no polarization measurement or interferometric phase measurement to be done, whose limited visibility could introduce bit errors. The interferometer is just used to estimate the information of the eavesdropper. Second, due to the fact that the coherence between adjacent qubits is checked, this protocol becomes resistant to photon number splitting attacks (PNS). Indeed, if the eavesdropper removed light from a qubit (the two pulses corresponding to one logical bit) with more than one photon, he would destroy the coherence between adjacent qubits. Certainly, an eavesdropper possessing a lossless line can split off the portion of light corresponding to the loss in the fiber link between Alice and Bob. But he cannot selectively block qubits with only one photon and remove one photon from qubits with two or more photons, which of course makes the power of PNS attacks. Fig. 2 shows how this protocol compares with standard BB84 protocol, with and without decoy states. For more detail and first experimental results, see Reference 1.

H. Zbinden et al. / Long Distance Quantum Communication

141

Figure 2. FIG. 2. An estimate of the secret key rates (Eq. 4 in Ref. 1) for the present protocol and for BB84 with and without decoy states, as a function of the losses on the line l (t=10íl/10). Parameters: Ș =10%, pd=10í5, tB=1, and f =0.1. Visibility: V=1 (full lines, identical for the two first protocols), V=0.9 (dashed lines), and V=0.8 (dotted lines; Rsk=0 for BB84 without decoy states).

2. Photon Counting at Telecom Wavelengths Using Upconversion and Rapid Silicon APD’s High bit rate QKD systems need photon counters with high maximum count rates and high timing resolution. Moreover for long distances, detector noise is the limiting factor. Modern InGaAs single-photon avalanche diodes (SPADs) feature reasonable timing jitter of down to 100ps, however afterpulsing limits the maximum count rates to the order of 100kHz. Detector noise limits the maximum reach to about 100km. For these reasons several groups started to work with superconducting detectors or rapid Silicon SPAD’s. We have developed a hybrid single photon detection scheme for telecom wavelengths based on nonlinear sum-frequency generation and silicon (Figure 3.) [2].

Figure 3. Experimental scheme of near-IR photo detection using upconversion in a PPLN waveguide and Si-APD (W/G).

142

H. Zbinden et al. / Long Distance Quantum Communication

The SPAD devices employed have been designed to have very narrow temporal response, i.e. low jitter of about 40 ps (Figure 4), which we can exploit for increasing the pulse rate for quantum key distribution. The maximum count rates are in the order of 10MHz.

Figure 4. - Detection peaks for two different APD’s from Politecnico di Milano and idQuantique featuring timing jitter (FWHM) of as low as 40 ps

The wavelength conversion is obtained using periodically poled lithium niobate (PPLN) waveguides (W/Gs). The inherently high efficiency of these W/Gs allows us to use a continuous wave laser to seed the nonlinear conversion so as to have a continuous detection scheme (Figure 5).

Figure 5 - Upconversion efficiency (solid line) and total detection efficiency (green dotted line) as a function of pump power. Inherent 100% conversion efficiency can be obtained with a moderate pump power of about 350 mW. In practice the total efficiency is limited by the bad coupling into the waveguide (50%), the different losses in the waveguide and filters and the quantum efficiency of the Si-APD (ca. 25%)

The main problem of this detection scheme is the noise introduced by some parasite non-linear process. In Figure 6 one can see that with increasing pump power, not only the total efficiency increases but also the total measured noise. Note that the

H. Zbinden et al. / Long Distance Quantum Communication

143

darkcount rate of the Si-APD of 100 counts per second or less can be neglected. The low noise and the wide spectral detection range are therefore the main advantages of SSPD’s with respect to this hybrid detection scheme.

Figure 6. - Total quantum efficiency and dark counts vs pump power

3. Teleportation Over a Telecommunication Network In previous experiments, teleportation was demonstrated inside a laboratory or in the field but without prior entanglement distribution. The Bell-state measurement always took place before the third photon was distributed to Bob. On the other hand, in all these experiments, the same laser pulse was used to create both the entangled pair and the photon to be teleported. These two points limit the feasibility of a practical quantum relay and open conceptual loopholes. Here we present an experiment where teleportation occurs long after entanglement distribution and the photons involved originate from two crystals excited by different pulses from the same laser [3]. The experimental setup is shown in Fig. 2. In the laboratory, a mode-locked Ti:sapphire laser (Mira 900) creates fs pulses at a central wavelength of 711 nm with a repetition frequency of 75 MHz. The pulses are spilt in two parts using a beam splitter. The transmitted light is sent through an unbalanced Michelson interferometer then sent on a nonlinear crystal (LBO) cut for type-I phase matching, which creates a time-bin entangled photon pair in the _M+² state by spontaneous parametric downconversion. The created photons have wavelengths of 1310 and 1555 nm and are easily separated using a wavelength division multiplexer (WDM). The 1310 nm photon is sent in a 180 m spool of fiber, serving as a rudimentary quantum memory. The 1550 nm photon leaves the laboratory. The photon to be teleported is prepared using the light pulse reflected from the beam splitter. A pair of photons is created in the same type of crystal as above and then separated. The 1555 nm photon is in order to herald the photon to be teleported. The 1310 nm photon is stored in a 177 m spool of fiber. (The 3 m difference

144

H. Zbinden et al. / Long Distance Quantum Communication

to the other fiber spool corresponds to the spacing between two subsequent pulses of the laser.

Figure 7: Schematic showing the Real-world teleportation experiment performed over the Swisscom telecommunication network in Geneva, Switzerland.

This means that this photon is produced from a different pulse of the laser than the entangled photons.) To encode a qubit on the “sender” photon, it is sent after the spool to an unbalanced fiber interferometer. Note that only now the qubit created and at this time, the “receiver” photon is already 177 m away from the laboratory. Then, a Bell state measurement is performed on the “sender” photon and on the 1310 nm photon from the entangled pair. The Bell-state analyzer consisting of a beam splitter (50/50)and two detectors. For this purpose both photons need to arrive at the beamsplitter within their coherence time and be indistinguishable. A detection of the _\-² state occurs when two photons arrive on different detectors with a time difference of one time bin, i.e. the 1.2 ns time delay introduced by the unbalanced interferometers) in our setup. When a heralded photon and _\-² state has been successfully detected by the coincidence electronics (&), an optical pulse is sent over a second optical fiber to the acquisition electronics at the other side, a Swisscom substation at a flight distance of 550 m from the laboratory (Plainpalais). Here, the entangled photon is stored in a fiber spool of 250 m unless the information on the Bell measurement arrives. Then the photon is analyzed by another imbalanced interferometer. (photons that do not correspond to a successful _\-² state measurement are discarded) By scanning the analyzing interferometer, the visibility of the interference is measured, in order to extract the fidelity of the teleported state.

H. Zbinden et al. / Long Distance Quantum Communication

145

Figure 8. Four-fold coincidences per 6h as a function of the phase in analyzing interferometer

We measure interference of the four-fold coincidence with a raw visibility (i.e. without subtracting noise) of 87±7 % (see Figure 8), this means the state is teleported with a fidelity Fraw=0.93±0.04. This value is higher than what could be obtained by optimal cloning of the photon (F= 5/6). In conclusion, we have performed a teleportation in field conditions with an independent, remotely controlled receiver setup. The teleported qubit was created only after the distribution of entanglement.

Acknowledgments This work has been supported by the European Commission under the Information Society Technologies Integrated project “Qubit Applications” (QAP) and by the Swiss National Centers of Competence in Research project “Quantum Photonics.”

References [1] [2] [3]

D.Stucki, N. Brunner, N. Gisin, V. Scarani, H. Zbinden, App. Phys. Lett. 87, 194108 (2005). T Thew, S Tanzilli, L Krainer, S C Zeller, A Rochas, I Rech, S Cova, H Zbinden and N Gisin, New J. Phys. 8, 32 (2006). O. Landry, J. Houwelingen, A. Beveratos, H. Zbinden, N. Gisin, J. Opt. Soc. Am. B24 (2), 398 (2007).

146

Quantum Communication and Security ˙ M. Zukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

Generating triggered single and entangled photons with a semiconductor source Robert J. YOUNG a,1 , R. Mark STEVENSON a, Andy HUDSONa, Paola ATKINSON b, Ken COOPER b, David A. RITCHIE b, Andrew J. SHIELDS a a Toshiba Research Europe Ltd., 260 Cambridge Science Park, CB4 0WE, UK b Cavendish Laboratory, Cambridge University, CB3 0HE, UK Abstract. For scalable applications of optical quantum information it is desirable to have a well controlled source of photons, producing single photons or entangledpairs on-demand. The finite delay following decay of an exciton confined in a quantum dot makes them a good source of single photons, we demonstrate this, triggering the emission with a pulsed laser. Currently the most widely used techniques for generating entangled photon pairs are nonlinear optical processes, such as parametric down conversion, which produces a probabilistic number of pairs per excitation cycle. Such a source is of limited use in quantum information/processing applications where a regular stream of single entangled photon pairs is preferable. We produced such a triggered source from a semiconductor device for the first time, using the two-photon cascade from a biexciton confined in a single quantum dot. We demonstrate a fidelity of 70% for the emission from the biexciton cascade to the expected bell state. Single quantum dots could prove to be the first robust and compact triggered source of entangled photons. Keywords. Quantum Dots Photoluminescence Entangled Photons

1. Introduction Classical sources of light, such as laser pulses, contain a distribution in the number of photons per pulse obeying Poissonian statistics. This distribution is undesirable for scaleable quantum information applications [1]. No matter how much a laser pulse is attenuated a finite chance of multiple photon emission remains. Pulses containing more than one photon potentially limit the security of quantum cryptography as they allow an eavesdropper to attempt a photon number splitting attack [2]. Single quantum dots are analogous to atoms in many physical ways; they provide three dimensional confinement of excitons which results in an energy spectrum consisting of discrete levels. Exciton complexes containing differing numbers of electrons and holes typically have unique emission energies as a result of the Coulomb interactions between the confined carriers. Single photon emission is possible from exciton complexes which are optically active as there is a finite time delay following radiative decay before re-excitation is possible, thus the simultaneous emission of multiple photons is greatly suppressed. The left-hand side of figure 1 shows a simplified energy level diagram for a 1 Corresponding

Author: Robert J. Young, [email protected]

147

R.J. Young et al. / Generating Triggered Single and Entangled Photons

0

-1

L

L +1

X

R

Emission Intensity

R

X2 X2

X

0

8960

8990

9020

Wavelength (Å) Figure 1. The panel on the right shows a photoluminescence spectrum collected from a single quantum dot under pulsed non-resonant excitation. Emission from the neutral exciton (X) and biexciton (X2 ) states dominate the spectrum and are labelled. A simple level diagram on the left shows the biexciton cascade through the two bright exciton states. The total angular momentum of each of the states and the polarisation of the photons which couple them are labelled, R (L) indicates right-(left-) hand circular polarisation.

quantum dot, including only the neutral single exciton (X) and biexciton levels (XX or X2 ). The photoluminescence spectrum on the right-hand side of the figure shows emission from these exciton states in a single quantum dot. The radiative decay from the exciton (X) state was the first transition used to demonstrate single photon emission from a quantum dot [3,4,5]. Single photon emission has since been demonstrated from other exciton complexes, including the biexciton and charged exciton [4]. Quantum dots can also be used to generate multiple photons, each separated in energy, in a single excitation cycle. The simplest example of such emission is the biexciton cascade illustrated on the left-hand side of 1; following excitation the biexciton decays to the ground state via the intermediate exciton level emitting a pair of photons [6]. In a similar fashion the cascade from the tri-exciton state has been shown to produce three photons per excitation [7] cycle. The vector sum of the heavy-hole and electron’s angular momenta allow the neutral exciton state to have four differing total angular momenta (m=±1, ±2) though we only focus on two of these, the ’bright’ exciton states with m=±1 as the m=±2 ’dark’ states are typically not optically active. Experimentally the bright exciton states are found to be hybridised and separated in energy via the anisotropic exchange interaction [8,9]. With this splitting present it has been shown that the biexciton cascade is a source of polarisation-correlated photons [10,11,12]. Entangled photons may allow long distance quantum communication using quantum repeaters [13] and could also greatly reduce the resources required for linear optical quantum computing [14]. For these applications, the number of photon pairs generated per cycle is of importance, since emission of multiple photon pairs introduces errors due to the possibility of two individual photons not being entangled. The most widely used technique to generate entangled photon pairs is currently parametric down conversion [15], producing only a probabilistic numbers of photons pairs per excitation cycle.

148

R.J. Young et al. / Generating Triggered Single and Entangled Photons

Figure 2. An illutration of the planar cavity sample design used in this study. A low density layer of quantum dots (green) is sandwiched between a pair of distributed Bragg reflectors. The lower (upper) mirror is comprised of fourteen (two) repeats of a λ/4 (64.9nm) thick layer of GaAs (blue) (n3.5) followed by a λ/4 (76.1nm) thick layer of AlAs (red) (n3). A 1-λ GaAs cavity (218.nm) surrounds the dot layer.

The biexciton decay was proposed as a source of polarization-entangled photon pairs [16] with the condition of indistinguishability between the two decay paths. In a similar fashion to single photon emission from an exciton complex, the biexciton cascade can decay no more than once per excitation cycle and thus generates exactly two photons per excitation cycle. Such a device could find future applications in quantum optics therefore, with the added benefit that it might be realised in a simple LED structure [17,18]. In this paper we show optical measurements from a single quantum dot with no exciton level splitting embedded in a semiconductor planar cavity. Emission from a quantum dot is measured with a microscope objective which is only capable of collecting light emitted into a small solid angle. Embedding quantum dots in a mismatched planar cavity, designed to preferentially channel emission in the direction of the collection optics increases the collection efficiency by an order of magnitude [19]. The cavity has an optical mode with finite width which, when centred on the dot emission, helps to limit the background light collected, as it is emitted by layers other than the quantum dot and usually at a different energy. In previous work background emission from the InAs wetting layer was the major limiting factor in the proportion of both the amount of entangled light measured from the biexciton cascade and the suppression of multiple photon emission from the exciton decay in a quantum dot with a degenerate exciton level. We show that by limiting the amount of such emission being collected using a planar cavity we are able to produce a high quality source of single photons with a zero-delay second order correlation function for the exciton transition of less than 0.1. We also show a degree of √ entanglement in the expected (|RXX LX > +|LXX RX >)/ 2 state for the biexciton cascade of over 70%.

R.J. Young et al. / Generating Triggered Single and Entangled Photons

149

Figure 3. A schematic of the experimental setup used to measure second order correlation between excitons photons emitted by single quantum dots. Spectrometer S1 is used to select the exciton photons which are detected by the two Avalanche Photo Diodes APD 1 and APD 2.

2. Experimental details and sample design The wafer used in this study was grown by molecular beam epitaxy (MBE); a low density (∼1/μm2 ) layer of InAs quantum dots was grown in the middle of a 1-λ thick GaAs cavity above fourteen pairs of AlAs/GaAs distributed Bragg reflector (DBR’s) [20] and below two repeats of the same DBR mirror structure. The central wavelength for the fundamental cavity mode was designed to be at 885nm. This wafer design is illustrated in figure 2. Photoluminescence (PL) from this sample was measured at ∼10K, with excitation provided non-resonantly using a red laser diode emitting pulses with a width of 100ps and an 80MHz repetition rate. A microscope objective lens focussed the laser onto the surface of the sample, and collected the emitted light. Single quantum dots were isolated using a metal mask containing circular apertures around 2μm in diameter. A quantum dot lying under one of these holes can be studied with ease. The photoluminesce spectrum shown in figure 1 shows emission from a single quantum dot isolated in such a way. Very little background from the InAs wetting layer is visible as it is suppressed by the stop-band of the cavity. The cavity also gives a notable enhancement in the PL collected from the quantum dots.

3. Single photon source To measure the statistics of the photons emitted following exciton decay a HanburyBrown and Twiss arrangement was used as illustrated in figure 3. A spectrometer was first employed to select photons from the exciton transition. Following this a 50/50 beam splitter then divided the emission between a pair of thermo-electrically cooled silicon Avalanche PhotoDiodes (APD’s). The time delay between counts in the two detectors was recorded by a time interval analyzer, these were then binned over the repetition period of the pump laser and a histogram of the photon distribution is shown in figure 4. The strong suppression measured at zero-delay is indicative of single-photon emission. The area of the zero-delay peak indicates that the exciton state is emitting ∼14 times fewer pulses containing multiple photons than a source emitting a Poissonian distribution of photons with the same average intensity. The non-zero area of the zero-delay

R.J. Young et al. / Generating Triggered Single and Entangled Photons

2nd order correlation

150

1.0

0.5

0.0 -10

-5 0 5 Delay period (/12.5ns)

10

Figure 4. Second order correlation between photons emitted from the exciton state of a single quantum dot. The dotted line indicates the expected value for a source emitting photons with a Poissonian distribution, such as an attenuated laser. Error bars span two standard deviations.

bin is attributed to two mechanisms; dark counts from the imperfect detector and emission from other exciton-confining layers in the sample emitting at the same energy as this exciton. The narrow mode widths of microcavities help directly to reduce the latter and the increased collection efficiencies they afford reduce the relative contribution of the former, enabling better zero-delay suppressions [21].

4. Entangled photon source A striking dependence of the energy separation between the bright exciton states and the recombination wavelength of the exciton is shown in figure 5. In the figure the bright exciton splitting was measured for a large number of dots. The splitting is found to pass through zero at ∼885nm [22]. Here the splitting is defined as positive when the horizontally [110] polarised component of the exciton is higher in energy than the vertically [1-10] polarised component. This relationship allows the selection of quantum dots with no exciton level splitting within the homogeneous linewidth of the transition. It has also been shown that rapid thermal annealing [23,24], or the application of an in-plane magnetic [25], electric [26,27] or strain field [28] can be used to tune the splitting of bright exciton splitting in a controlled fashion. To analyse the properties of photon pairs emitted by a selected quantum dot, we measure the polarisation and time dependent correlations between the biexciton and exciton photons. The exciton photon was selected with a spectrometer in the same way as detailed in the previous section. A second spectrometer was introduced to the arrangement to select the biexciton photon. The biexciton photons were then measured by a third APD after passing through a linear polariser. The insertion of appropriately oriented quarter-wave or half-wave plates preceding each of the two spectrometers allows any polarisation measurement basis to be selected. The time intervals between detection events on different APD’s were measured using a pair of single photon counting mod-

151

R.J. Young et al. / Generating Triggered Single and Entangled Photons

Exciton splitting (μeV)

80 60 40 20 0 -20 8800

9000 Wavelength (Å)

9200

Figure 5. The bright exciton level splitting S (defined in the text) as a function of the exciton recombination energy for a large number of single quantum dots. The grey line is a linear fit to the data shown as a guide to the eye.

ules, to determine the second order correlation functions. This arrangement is illustrated for clarity in figure 6. For cross-correlations between biexciton and exciton photons, the probability of detecting a pair of coincident photons, relative to the probability of detecting photons separated by a number of excitation cycles, is proportional to the inverse of the probability of generating an exciton photon per cycle. Thus, the relative probability of detecting coincident photons is dependent on the excitation rate, which fluctuates during the integration time of our experiments. However, the correlations of the biexciton detection channel with each of the orthogonally polarised exciton detection channels are measured simultaneously with the same excitation conditions, and thus can be compared directly. Additionally, we verify that the time averaged biexciton and exciton emission from this quantum dot is unpolarised within experimental error, so the number of coincident photon pairs can be normalised relative to the average number of photon pairs separated by at least one cycle, which compensates for the different detection efficiencies (2) of the measurement system. The degree of polarisation correlation is defined as (gXX,X (2)

(2)

(2)

(2)

gXX,X )/(gXX,X +gXX,X ), where the second order correlation functions, gXX,X and (2)

gXX,X are the simultaneously measured, normalised coincidences of the biexciton photon with the co-polarised exciton and orthogonally-polarised exciton photons respectively. The degree of polarisation correlation is plotted in figure 7 as a function of the delay between the biexciton and exciton photons in the rectilinear, diagonal-linear and circularly polarised bases for two differing quantum dots; the first has negligible splitting between its bright exciton states and the second has a large splitting. The results for the two dots are strikingly different. For the quantum dot with a large splitting, correlation is only seen in the rectilinear basis, this result has been reported previously in quantum dots with large exciton level splittings [10,11,12]. The dot with no exciton level splitting has a large degree of circular anti-correlation at zero-delay, this is expected and is

152

R.J. Young et al. / Generating Triggered Single and Entangled Photons

Figure 6. A schematic of the experimental setup used to measure polarised cross correlation between the photoluminescence (PL) from the exciton and biexciton states, which differ in emission energy. Quarter-Wave Plates (QWP 1 and 2) and Half-Wave Plates (HWP 1 and 2) were inserted in front of the entrance slits to the two spectrometers (S1 and S2). The Avalanche Photodiodes are labelled APD 1-3 and Single Photon Counting Modules SPCM.

illustrated in the level diagram in figure 1. The bell state of the polarisation-entangled photon pairs emitted by biexciton cascade with no exciton level splitting should be √ (|RXX LX > +|LXX RX >)/ 2, this can be re-written in the rectilinear basis as √ (|HXX HX > +|VXX VX >)/ 2 (H=horiztonal, V=vetical) or in the diagonal-linear √ basis as (|DXX DX > +|AXX AX >)/ 2 (D=diagonal, A=anti-diagonal). Correlation is therefore predicted in these linear bases for a dot with no exciton splitting and the results shown in figure 7 support this prediction strongly. To fully characterise the two photon state emitted by the zero-split dot, the two photon density matrix can be constructed from correlation measurements, using quantum state tomography [29]. The measurements pairs required are the combinations of the V, H, L, and D biexciton polarisations, with the rectilinear, diagonal and circular polarised exciton detection bases. The resulting density matrix is shown in [31], the fidelity of the measured state to the expected bell state is 0.702 ± 0.022. This proves that the photon pairs we detect are entangled, since for pure or mixed classical states, the fidelity cannot exceed 0.5. Other tests for entanglement include the Tangle [32] which must be >0 to prove entanglement, it is measured to be 0.194±0.026 for the density matrix shown and the Peres test [33] which must be <0 to prove entanglement, we measure -0.219±0.021, again unambiguously demonstrating that a quantum dot with no exciton level splitting does emit entangled photons.

R.J. Young et al. / Generating Triggered Single and Entangled Photons

153

Figure 7. The rectilinear (top), diagonal-linear (middle) and circular (bottom) degrees of polarization correlation are plotted as a function of coincidence delay on the left for a quantum dot with no exciton level splitting and on the right for a dot with a large exciton level splitting. The degree of correlation is defined in the text.

5. Conclusions To conclude we have demonstrated that quantum dots could be a useful source of nonclassical light; we showed that emission from the exciton state has sub-Poissonian statistics and that after selecting a quantum dot with no exciton splitting, on-demand polarisation entangled photons are emitted by the biexciton cascade. Semiconductor quantum dots integrated into device structures such as the ones studied in this paper are compact and robust, making them extremely promising candidates as inexpensive elements in future quantum information processing applications. We show that embedding a planar cavity into such devices increases the collection efficiency through standard microscope objective by an order of magnitude, the cavity’s stop band has the additional effect of helping to suppress unwanted background emission. Another key advantage of the use of a planar cavity is that it requires no further processing steps over traditional cavity-free samples, as the cavity can be grown in-situ by MBE.

6. Acknowledgements This work was partially funded by the EU projects QAP and SANDiE, and by the EPSRC.

References [1] D. F. Walls and G. J. Bilburn: Quantum Optics. (Springer, Berlin 1994)

154 [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20] [21] [22] [23] [24] [25] [26] [27] [28] [29] [30] [31] [32] [33]

R.J. Young et al. / Generating Triggered Single and Entangled Photons

D. Bouwmeester, A. K. Ekert, A. Zeilinger, The Physics of Quantum Information. (Springer, Berlin 2000). P. Michler, A. Imamoglu, M. D. Mason, P. J. Carson, G. F. Strouse, S. K. Buratto, Nature 406, 968 (2000). R. M. Thompson, R. M. Stevenson, A. J. Shields, I. Farrer, C. J. Lobo, D. A. Ritchie, M. L. Leadbeater, M. Pepper, Phys. Rev. B(R) 64, 201302 (2001). V. Zwiller, T. Aichele, W. Seifert, J. Persson, O. Benson, Appl. Phys. Lett. 82, 1509 (2003). E. Moreau, I. Robert, L. Manin, V. Thierry-Mieg, J. M. Gérard, I. Abram, Phys. Rev. Lett. 87 183601 (2001). J. Persson, T. Aichele, V. Zwiller, L. Samuelson, O. Benson, Phys. Rev. B 69, 233314 (2004). H. W. van Kasteren, E. C. Cosman, W. A. J. A. van der Poel, C. T. B. Foxon, Phys. Rev. B 41, 5283 (1990). E. Blackwood, M. J. Snelling, R. T. Harley, S. R. Andrews, C. T. B. Foxon, Phys. Rev. B 50, 14246 (1994). R. M. Stevenson, R. M. Thompson, A. J. Shields, I. Farrer, B. E. Kardynal, D. A. Ritchie, M. Pepper, Phys. Rev. B(R) 66, 081302 (2002). C. Santori, D. Fattal, M. Pelton, G. S. Solomon, Y. Yamamoto, Phys. Rev. B 66, 045308 (2002). S. M. Ulrich, S. Strauf, P. Michler, G. Bacher, A. Forchel, Appl. Phy. Lett. 83, 1848 (2003). H.-J. Briegel, W. Dür, J. I. Cirac, P. Zoller, Phys. Rev. Lett. 81 5932 (1998). T. B. Pittman, B. C. Jacobs, J. D. Franson, Phys. Rev. A 64, 062311 (2001). Y. H. Shih, C. O. Alley, Phys. Rev. Lett. 61, 2921 (1988). O. Benson, C. Santori, M. Pelton, T. Yamamoto, Phys. Rev. Lett. 84, 2513 (2000). Z. Yuan, B. E. Kardynal, R. M. Stevenson, A. J. Shields, C. J. Lobo, K. Cooper, N. S. Beattie, D. A. Ritchie, M. Pepper, Science 295, 102 (2002). A. J. Bennett, D. C. Unitt, P. See, A. J. Shields, P. Atkinson, K. Cooper, D. A. Ritchie, Appl. Phys. Lett. 86, 181102 (2005). H. Benisty, H. De Neve, C. Weisbuch, IEEE J. Quantum Electrin, 34, 1612 (1998). M. Born, E. Wolf, Principles of Optics (7th Ed.) (Cambridge University Press 2002). A. J. Bennett, D. C. Unitt, P. Atkinson, D. A. Ritchie, A. J. Shields, Optics Express 13, 7772 (2005). R. J. Young, R. M. Stevenson, A. J. Shields, P. Atkinson, K. Cooper, D. A. Ritchie, K. M. Groom, A. I. Tartakovskii, M. S. Skolnick, Phys. Rev. B 72 113305 (2005). R. Seguin, A. Schliwa, T. D. Germann, S. Rodt, K. Pötschke, A. Strittmatter, U. W. Pohl, D. Bimberg, M. Winkelnkemper, T. Hammerschmidt, and P. Kratzer, Appl. Phys. Lett. 89, 263109 (2006). D. J. P. Ellis, R. M. Stevenson, R. J. Young, A. J. Shields, P. Atkinson, and D. A. Ritchie, Appl. Phys. Lett. 90, 011907 (2007). R. M. Stevenson, R. J. Young, P. See, D. Gevaux, K. Cooper, P. Atkinson, I. Farrer, D. A. Ritchie, A. J. Shields, Phys. Rev. B 73, 033306 (2006). K. Kowalik, O. Krebs, A. Lemaître, S. Laurent, P. Senellart, P. Voisin, and J. A. Gaj, Appl. Phys. Lett. 86, 041907 (2005). B. D. Gerardot, S. Seidl, P. A. Dalgarno, R. J. Warburton, D. Granados, J. M. Garcia, K. Kowalik, O. Krebs, K. Karrai, A. Badolato, and P. M. Petroff, Appl. Phys. Lett. 90, 041101 (2007). S. Seidl, M. Kroner, A. Högele, K. Karrai, R. J. Warburton, A. Badolato, and P. M. Petroff, Appl. Phys. Lett. 88, 203113 (2006). D. F. V. James, P. G. Kwiat, W. J. Munro, A. G. White, Phys. Rev. A 64, 052312 (2001). R. M. Stevenson, R. J. Young, P. Atkinson, K. Cooper, D. A. Ritchie, Nature 439, 179 (2006). R. J. Young, R. M. Stevenson, P. Atkinson, K. Cooper, D. A. Ritchie, New J. Phys. 8, 29 (2006). V. Coffman, J. Kundu, W. K. Wooters: Phys. Rev. A 64, 052306 (2000). A. Peres: Phys. Rev. Lett. 77, 1413 (1996).

Quantum Communication and Security ˙ M. Zukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

155

Quantum Memory via Coherent Scattering of Light by Optically Thick Atomic Medium Oksana S. MISHINA, Dmitriy V. KUPRIYANOV 1 Dept. of Theoretical Physics, St.-Petersburg State Polytechnic University, 195251 St.-Petersburg, Russia Abstract. We discuss the quantum memory protocol based on a polarizationsensitive control of the field and atomic spin subsystems in the process of offresonant coherent Raman scattering of light by spatially extended and optically thick atomic sample. The protocol can be adjusted for atoms, which spin angular momentum ≥ 1, and applied for deterministic quantum memory storage and retrieval schemes. The proposed protocol involves just a single pass of light through atomic ensemble without the need for elaborate pulse shaping or quantum feedback. As a practically relevant example we consider the interaction of a light pulse with hyperfine components of D1 line of 87 Rb. Keywords. Quantum memory, Raman process, spin subsystem

Introduction The quantum description of correlations in coherent forward scattering of light and particularly in the Raman process is the subject of many discussions in literature [1]-[4]. At the present time this process became specifically interesting because of its potential quantum information applications. In particular this concerns the quantum network operating in the system of continuous variables where this process can be adjusted as a quantum memory protocol. The idea of the quantum memory scheme based on coherent Raman process was for the first time proposed and discussed in Ref.[5]. Independently similar memory scheme utilizing the idea of two photon resonance in two-mode Λ-type interaction under the conditions of electromagnetic induced transparency was proposed and tested in Refs.[6,7]. In spite of clear physical evidence of the Raman process, its practical realization, with reliable verification of the write-in and retrieval steps, is still challenging problem for experiment and theory. In our previous study Ref.[8] the coherent Raman process was considered for practically important configuration of alkali atoms in terms of the polarization multipoles for their ground state: orientation (gyrotropy) , alignment (linear birefringence). In the present report we shall apply general results of Ref.[8] and discuss 1 Corresponding Author: Dmitriy V. Kuprianow, Dept. of Theoretical Physics, St.-Petersburg State Polytechnic University; E-mail: [email protected]

156

O.S. Mishina and D.V. Kupriyanov / Quantum Memory via Coherent Scattering of Light

Figure 1. Schematic diagram showing the geometry of the proposed experiment on quantum memory and the scheme of relevant excitation transitions, see text for details.

the potential feasibilities for the Raman-type memory protocol under conditions of optically thick and spatially extended atomic medium. An important advantage of the memory scheme in such a scenario is in that it needs only a single pass of light through the atomic sample without any feedback channel, which makes its experimental realization more feasible.

1. Quantum swapping in the coherent Raman process As a relevant example let us consider the experimental situation shown in figure 1. For this experimental scheme a 100% right-hand circular polarized classical light pulse interacts with an ensemble of ultracold spin-oriented atoms. For an off-resonant right-hand polarized pulse, such that incoherent scattering losses do not frustrate the spin polarization, there will be no interaction between the light and atoms. However if a small portion of a left-hand polarized quantum informative light prepared in an unknown quantum state is admixed to the classical coherent pulse, the coherent scattering channel will be open. The portion of the weak quantum light will be coherently scattered into the strong classical mode. In this coherent Raman process the polarization quantum subsystem of the probe light and the spin subsystem of atoms can effectively swap their quantum states. The quantum state can be mapped into the alignment-type fluctuations of the spin subsystem and further stored in the form of a certain standing spin wave for relatively long time. It can be read on demand with a second probe light pulse. In spite of clear physical evidence of this swapping process, which is often considered as background for various quantum memory protocols, there are certain difficulties for practical realization of the Raman scheme. If the sample were optically thin then the protocol could be realized for the case of single photon memory under conditional verification that the photon’s state is actually mapped onto the spin subsystem. The efficiency of this process would be quite low to be further effectively applied as a memory cell in the quantum network or to be generalized and adjusted for the system of continuous

O.S. Mishina and D.V. Kupriyanov / Quantum Memory via Coherent Scattering of Light

157

variables. The efficiency could be considerably enhanced if the coherent Raman process were organized in an optically thick and spatially extended atomic sample. For such a situation the swapping by the quantum states of the light and spin subsystems should be properly described as a spin polaritonic wave created in the sample, see Refs.[5,8]. For optimal experimental conditions it can be expected that in the system of continuous variables the protocol could even deterministically work without verification. As shown in Ref.[8] in an ideal conditions the interaction of the light and spin subsystems in the Heisenberg picture can be expressed by the following input-output transformation for the Stokes polarization components in the light subsystem +1/2   −AL  1/2 ˆ in  ΞI (t ) 2 [−AL(t − t dt J )] 1 t − t 0  L   1/2 ˆ in ¯ TI (z) −2Ξ2 dz J0 2 [−A(L − z)t] 

t

ˆ in ˆ I (L, t) = Ξ Ξ I (t) −



0

*

+1/2   −AL  1/2 ˆ in  ΞIII (t ) 2 [−AL(t − t dt J )] 1 t − t 0  L   ¯2 +2Ξ dz J0 2 [−A(L − z)t]1/2 TˆIIIin (z) 

t

ˆ in (t) − ˆ III (L, t) = Ξ Ξ III



*

(1)

0

and for the multipole alignment components of the spin subsystem +1/2   −AT 1/2 ˆ in  TI (z ) J1 2 [−AT (z − z  )]  z−z 0  T   1/2 ˆ in ¯ ΞI (t) +¯ c13 Fz dt J0 2 [−A(T − t)z] 

TˆI (z, T ) = TˆIin (z) −

z

dz 

0

*

+1/2   −AT  1/2 ˆ in  TIII (z ) 2 [−AT (z − z dz J )] 1 z − z 0  T   ˆ in (t) −¯ c13 F¯z dt J0 2 [−A(T − t)z]1/2 Ξ (2) III 

TˆIII (z, T ) = TˆIIIin (z) −

z



*

0

ˆ III and Ξ ˆ I after local unitary transformation can be For the light subsystem the variables Ξ expressed by the pair of complementary Stokes components with respect to the basis of linear polarizations x/y and to alternative basis rotated at π/4-angle ξ/η, see figure 1. These components are distributed in space and in time as a wave process and Eqs.(1) give the Heisenberg operators modified up to any time t after one passage of the sample of length L. The spin subsystem has similar description in terms of wave-type fluctuations of macroscopic birefringence (alignment) with respect to the same Cartesian bases. The spin operators TˆI and TˆIII are unitary equivalent to the fluctuating alignment components responsible for linear birefringence of the sample with respect to these two bases. The transformations (2) give the modified Heisenberg operators of the spin subsystem at any spatial point z after one round of interaction with duration T . The kernels of integral transforms (1) and (2) are expressed by the cylindrical Bessel functions of the zeroth J0 (. . .) and first J1 (. . .) order.

158

O.S. Mishina and D.V. Kupriyanov / Quantum Memory via Coherent Scattering of Light

The input-output transformations (1) and (2) are governed by the following external parameters. The microscopic coupling of the light-matter subsystems can be expressed by dimensionless alignment polarizability constant  responsible for single Raman-type scattering event by any atom of ensemble, which depends on spectral detuning and internal atomic structure. Algebraic constant c 13 ∼ 1 depends on the value of atomic angular momentum in the ground state. The average photon flux in the classical mode is ¯ 2 , indicating strong preference of rightdescribed by the averaged Stokes components Ξ handed circular polarized classical mode, see figure 1, such that the total number of pho¯ 2 T . The atomic system is similarly tons in the interaction cycle is given by N P = Ξ described by the total atomic angular momentum F Σ = F¯z L = F0 NA , where F¯z is the average atomic orientation per unit length, F 0 is the atomic angular momentum in the ground state and N A is the number of atoms in the sample. The macroscopic efficiency of the interaction is quantified by cooperative coupling constant ¯ 2 F¯z A = −2¯ c13 2 Ξ

(3)

For an atomic medium of the length L and for a light pulse of the duration T , the dimensionless combination AT L ∼ − 2 NA NP , characterizing the overall coupling strength between light pulse and atomic ensemble, scales the efficiency of the Raman process in natural units. If −ALT   1 then for the fluctuations of the Stokes components at frequencies lower than −AL/T the contribution of their input noise, given by the upper lines of (1), will be effectively suppressed. Similarly for the spatial fluctuations of the alignment components the input  noise, given by upper lines of (2), will be suppressed for wavenumbers less than −AT /L. Thus for one step memory protocol the swapping mechanism can effectively work in the low frequency domain of spatial and temporal spectra. After one interaction cycle the low frequency quantum fluctuations of each subsystem will be expressed by the input fluctuations of complementary subsystem.

2. Retrieval stage and the optimization problem The optimization of the quantum memory protocol in the multimode configuration is a quite delicate problem for theory and experiment. For quantum states of different types such as a single photon, coherent or squeezed the different requirements for optimization can be found. For example, if the quantum light is in a squeezed state then the combination of the classical and quantum light in two orthogonal circular modes, as shown in figure 1, can be referred to as a polarization squeezed light. Such a state of light can be reliably observed with balanced optical homodyne detection in two complementary linear polarizations. For particular bases of linear polarizations x, y and ξ, η the balance signal can be either stronger or weaker than standard quantum (poissonian) limit. The homodyne scheme should be optimized for write-in and retrieval stages of the protocol by relevant selection of the detected spectral modes. In the retrieval stage of the memory protocol the projection of the original state of the quantum probe onto its recovered counterpart can be written as the following transformation  T  ˆ out ˆ in Ξ (t ) = dt K(t , t) Ξ (4) i i (t) + . . . 0

O.S. Mishina and D.V. Kupriyanov / Quantum Memory via Coherent Scattering of Light

159

where i = I, III. The dots stand for the contribution of other operators and indicate the imperfection of this transform. The time arguments for arriving probe pulse t ∈ (0, T ) and for retrieved pulse t  ∈ (0 , T  ), without decoherence, caused by relaxation and atomic motion, can be separated by arbitrary long delay. The kernel of integral transform (4) is given by  L     1/2 1/2 K(t , t) = A J0 2 [−A(T − t)z] (5) dz J0 2 [−A (L − z)t ] 0 

Here A and A are the coupling constants respectively defined for the write-in and retrieval steps of the memory protocol. In the case of a spatially extended sample and for a rather long interaction time the double integral transformation given by Eqs.(4), (5) has the following important property. At the write-in step of the protocol (integration over t in (4)) it effectively couples the field fluctuations of the high frequency modes Ω with the spin fluctuations of long spatial modes q such that −AL −AT Ω> , q< (6) T L At the retrieval stage of the protocol (integration over z in (5)) the low frequency fluctuation modes Ω for outcoming light are effectively reproduced by the short scaled spatial modes q  of the spin subsystem such that −A T  −A L   , Ω < (7) q > L T With setting the same pulse duration for the write-in and for the retrieval steps T  = T and taking into account that q  = q the representative part of spatial modes will be accessible for the whole quantum memory cycle if A   A. This inequality states that the number of coherent photons N P on retrieval step should be less than the number of photons N P on write-in step. If this condition is fulfilled than the transformation (4) re-scales the informative fluctuations in input spectral modes Ω above  bounding level  −AL/T to the fluctuations of output modes Ω  below bounding level −A L/T as Ω =

A Ω A

(8)

Then the accessible variation of the mode frequency, where quantum information can be encoded, is limited by bounds (6) and (7). This recommendation is only asymptotically valid if the smallest of two dimensionless coupling strengths −A  T  L approaches infinity. In practice for finite value of this parameter the optimization should establish the best spectral or temporal profile for both the input probe and its recovered counterpart.

3. Numerical simulations As an example we consider the Raman scattering of the broadband and spectrally flat squeezed light by an ensemble of spin oriented atoms of 87 Rb nearby the hyperfine tran-

160

O.S. Mishina and D.V. Kupriyanov / Quantum Memory via Coherent Scattering of Light

Figure 2. The spectral variances of the Stokes components (left panel) and of the atomic alignment components (right panel) before and after the interaction with the broadband squeezed light for cooperative parameter AT L = −10 (squares) and AT L = −40 (triangles). The black solid lines indicate the original fluctuation spectra in the light and spin subsystems. The gray lines in each of the panels indicate the original spectra for a complementary system.

sition F0 = 1 → F = 1 of its D1 line. Such a light probe has infinite spectral resource of squeezing and in accordance with above discussion is perfectly adjusted to demonstrate the quantum swapping. In figure 2 we show how the spectral variances of the polarization components of light and atoms are modified after sending the broadband squeezed light through the atomic sample. The graphs clearly display the swapping mechanism at the write-in stage of the memory protocol. The graphs are normalized to the vacuum state variance and the deviations from it are expressed by the respective Mandel parameters 1 + ξi for i = I, III, which depend on either frequency Ω (for light) or wave number q (for atoms). The input squeezed state is described by two spectrally independent parameters in 1 + ξIII = 10 and 1 + ξIin = 0.1. The suppression of the correlations in the low frequency domain of the temporal spectrum of light is compensated by the enhancement of the correlations in the atoms for the low frequency part of the spatial spectrum. The dominant role of the collective modes in this process is a result of the broadband approximation. The data, presented in these graphs, corresponds to the red detuning of light near the D1 -line of 87 Rb atoms populating the hyperfine level F 0 = 1 and for two selected values of the cooperative interaction parameter AT L = −10, −40. The first value corresponds to the detuning −205 MHz from F 0 = 1 → F = 1 resonance and yields up to ten percent of losses caused by incoherent scattering. The second number is achievable for the detuning of a few thousand MHz in the red wing of the F 0 = 1 → F = 1 transition and for approximately the same level of losses. Figure 3 shows the spectral variances of the polarization components for the atoms and light at the retrieval stage of the protocol. The figure shows how well the recovered state can reproduce the input. The parameters are chosen such that A  T  L = −2 corresponding to AT L = −10 and A  T  L = −8 corresponding to AT L = −40. As follows from these results and in accordance with above discussion the retrieved quantum state of light can reproduce the input state only in certain parts of the fluctuation spectrum. For weak coupling there is only low fidelity reproduction of the input squeezed state near the collective mode of the recovered pulse. For stronger coupling there is a certain spectral resource for constructing the optimal mode. It is noteworthy to point out that the Fourier modes calculated and displaced in the plots of figure 3 are strongly correlated.

O.S. Mishina and D.V. Kupriyanov / Quantum Memory via Coherent Scattering of Light

161

Figure 3. The spectral variances of the alignment components of the atoms (left panel) and of the retrieved Stokes components of the light (right panel) after the readout of the state stored in the atoms at the write-in stage of the memory protocol, see Fig.2. The values of cooperative parameter A T  L = −2 (squares) and A T  L = −8 (triangles) are coordinated with the data of Fig.2. The black solid lines indicate the original fluctuation spectra in the spin and light subsystems. The gray lines in each of the panels indicate the original spectra for the complementary system.

Further optimization should allow for identification of the best temporal mode, where the retrieval of the original squeezed state would be optimal.

Conclusion In this paper we have discussed the quantum memory protocol based on off-resonant coherent Raman process developing in an optically thick and spatially extended atomic medium. The protocol reveals an example of the swapping mechanism between the atomic and field subsystems. The quantum information, which is originally encoded in the spectral and polarization components of the light wave, can be mapped onto the spin standing wave associated with atomic alignment components. Because of the multimode nature of the interaction process the quantum information can be spread among a number of spatial spectral modes of the spin subsystem. We have discussed how the protocol, particularly at the final retrieval stage, can be optimized.

Acknowledgements These materials were reported on the NATO Advanced Research Workshop "Quantum communication and security" (Gdansk, 10-13 September 2006). The work was supported by the Russian Foundation for Basic Research (RFBR-05-02-16172-a) and by INTAS (project ID: 7904). O.S.M. would like to acknowledge financial support from the charity Foundation "Dynasty". D.V.K. would like to acknowledge financial support from the Delzell Foundation, Inc.

References [1]

M.G. Raymer, J. Mostowski, Phys. Rev. A 24, 1980 (1981); M.G. Raymer, I.A. Walmsley, J. Mostowski, B. Sobolevska, Phys. Rev. A 32, 332 (1985).

162 [2] [3] [4] [5] [6] [7] [8]

O.S. Mishina and D.V. Kupriyanov / Quantum Memory via Coherent Scattering of Light

A. Dantan, A. Bramati, M. Pinard, Phys. Rev. A 71, 043801 (2005). W. Wasilevski, M.G. Raymer, Phys. Rev. A 73, 063816 (2006). J. Nunn, I.A. Walmsley, M.G. Raymer, K. Surmacz, F.C. Waldermann, Z. Wang, D. Jaksch, quantph/0603268 (2006). A.E. Kozhekin, K. Mølmer, E.S. Polzik, Phys. Rev. A 62, 033809 (2000). M. Fleischhauer and M.D. Lukin, Phys. Rev. Lett. 84, 5094, (2000). A.V. Gorshkov, A. André, M. Fleischhauer, A.S. Sørensen, M.D. Lukin, quant-ph/0604037v1. O.S. Mishina, D.V. Kupriyanov, J.H. Müller, E.S. Polzik, quant-ph/0611228

Quantum Communication and Security ˙ M. Zukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

163

Exponential Superradiance and Macroscopic Entangled States Valery N. GORBACHEV, Alexander Ya. KAZAKOV 1 , Andrey I. TRUBILKO Laboratory for Quantum Information & Computation, AeroSpace University, St.-Petersburg 190000, Bolshaya Morskaia 67, Russia Abstract. An interaction between an ensemble of two-level atoms and a classical resonance wave and two quantized modes is considered. Using the effective Hamiltonian describing a parametric down conversion process we consider the dynamics of the system when one of the modes is in coherent state and another one is in vacuum state initially. We found a regime of generation in which the both quantized modes have the macroscopic photon numbers and their state is entangled. Keywords. Superradiance, macroscopic entanglement

Introduction Entangled states are main resource of quantum information processing and they are often used in many protocols to accomplish various tasks of the quantum information theory. For real communications these states are generated in optical parametric down conversion processes and the achieved light has a week power as usual. This week light is fragile and there is a problem of sharing it with parties spatially separated by a long distance. The problem arises from the decoherence and particulary from absorbtion in the real quantum channels and it results in the destruction of entanglement. One of the solutions is referring to various methods like quantum repeaters [1] and distillation protocols [2], that allow to reproduce entanglement, and decoherence-free subspaces [3], which states have immunity to decoherence, particulary to a collective decay [4]. As another solution of the problem one finds a bright entangled light, that is robust to loss of particles because of a macroscopic number of photons. Indeed, this light can be generated in the Tavis - Cummings model including an interaction between an ensemble of two-level atoms and a classical wave and two quantized modes of electromagnetic fields [5], [6]. It is assumed in these papers that both quantized modes are in vacuum state initially, and an particular feature of this physical system is that the generated modes are in entangled state and number of photons for both modes grows exponentially with number of atoms and time. In this paper we consider a more general case assuming that one of the modes is in coherent state initially. The aim of this paper is to study the dependence of the parameters of the generated modes and its entanglement on the initial coherent state. Similar problems has been considered in [7] - [9]. 1 Corresponding Author: Alexander Ya. Kazakov, Laboratory for Quantum Information & Computation, AeroSpace University, St.-Petersburg 190000, Bolshaya Morskaia 67, Russia; E-mail: [email protected]

164

V.N. Gorbachev et al. / Exponential Superradiance and Macroscopic Entangled States

We assume in what follows that Rabi frequency of the classical wave, which interacts with atoms, far exceeds the effective Rabi parameters of the both quantized modes. It enables us to split the dynamics of the combined systems into fast and slow parts and to derive a master equation for slow evolution of the quantized modes using a standard perturbation theory. With help of similar considerations a stimulated one-photon superradiance and the so-called exponential two-photon superradiance have been considered [11],[12] and their statistical properties have been examined [14], [15].

1. Single atom We start from the single atom problem including an interaction between a two-level atom and classical wave and two quantized modes of electromagnetic field. In the dipole and rotating wave approximation the Hamiltonian of the problem reads   H = ω1 a+ a + ω2 b+ b + κJ0 + ζ a+ b+ J− + abJ+ + (1) +μ [J− exp(iΩt) + J+ exp(−iΩt)] , where a+ , a, b+ , b , ω1 , ω2 are operators of creation and annihilation of photons of the modes and its frequencies, Ω is a frequency of the classical wave, μ and ζ are the effective coupling between atom and classical wave and modes, atomic operators have the form   00 . J0 = diag{1, −1}, J− = JT+ = 10 We are interested in the dynamics of the combined system, which wave function satisfies the Schrodinger equation with Hamiltonian (1). In our problem there is a set of the specific frequencies parameters, namely the Rabi frequency  of the classical wave R and effective Rabi parameters of quantized modes R q,k ∼ ζ nk (t), k = 1, 2, where nk (t) are the numbers of occupation of modes (photon numbers). We suppose Ω, ω1 , ω2 >> R >> Rq,k , k = 1, 2.

(2)

Indeed, the number of occupation n k (t) we get after solving the dynamical problem that is why we should check condition (2) a posteriori. In accordance with (2) we perform two averaging procedures. One of them is separation of the optical frequencies, that can be achieved using the standard transformation ' ( Ψ(t) = exp −it(ω1 a+ a + ω2 b+ b + (ω1 + ω2 )J0 /2) Φ(t). (3) Then by neglecting any fast oscillation terms the equation for Φ(t) takes the form i

 ( ' ∂ Φ = (κ − (ω1 + ω2 )/2)J0 + ζ a+ b+ J− + abJ+ + ∂t

(4)

+μ [J− exp [−i(ω1 + ω2 − Ω)t] + J+ exp [i(ω1 + ω2 − Ω)t]]} Φ. Let a matrix Ξ(t) will be a classical part of the problem in a sense that it is a solution of the initial problem Ξ(0) = I, where I is a unit 2×2− matrix,

V.N. Gorbachev et al. / Exponential Superradiance and Macroscopic Entangled States

i

∂ Ξ = {(κ − (ω1 + ω2 )/2)J0 + μ[J− exp[−i(ω1 + ω2 − Ω)t] ∂t + J+ exp[i(ω1 + ω2 − Ω)t]]}Ξ.

165

(5)

The matrix Ξ(t) has a simple analytic form [5], we omit the corresponding details. We find the solution of (4) in the following form Φ(t) = Ξ(t)ϕ(t),

(6)

where ϕ(0) = Ψ(0). We assume, that the parameters μ and Δ = κ − (ω 1 + ω2 )/2 are close,  so they are of the same value as the Rabi frequency of the classical wave R = Δ2 + μ2 . In accordance with (2) relation (6) means, that the wave function is a product of "fast" and "slow" factors. Then using (5) for function ϕ(t) we get i

' ( ∂ ϕ(t) = ζΞ(t)−1 a+ b+ J− + abJ+ Ξ(t)ϕ(t). ∂t

(7)

In this equation we apply an averaging over fast variables (which arise due to interaction between atom and classical wave) and obtain i

,    ∂ ϕ(t) = ζ Ξ(t)−1 a+ b+ J− + abJ+ Ξ(t) ϕ(t), ∂t

(8)

where brackets ... denote discarding all fast terms whose frequencies are of the order of R. If |ω1 + ω2 − Ω| /2 = |ν| << R, then the averaging procedure for equation (8) results in an effective Hamiltonian   H1 = ζμ(R − Δ)D−1 a+ b+ e2iνt + abe−2iνt UJ0 U−1 .

(9)

Note, that there is another case for which averaging leads to a non-trivial result. It corresponds to the condition | R ± (2ω − Ω)/2 |<< R. The effective Hamiltonian in this situation coincides with Hamiltonian for the two-photon Jaynes-Cummings model. From the physical point of view it means, that the number of excitations in the system is conserved and the system becomes closed or conservative. In contrast the Hamiltonian H 1 describes the open system, in which the total number of excitations can vary, and the classical wave plays a role of source of the radiation in the quantized modes. The effective Hamiltonian (9) includes atomic operator UJ 0 U−1 , which eigenvectors ek , k = 1, 2 can be easily found [5] and eigenvalues are ε k = (−1)k+1 . In the basis ek one finds that dynamics of the system can be described by two identical Schrodinger equations with the Hamiltonian of the form   (10) H2 = ρ a+ b+ e2iνt + abe−2iνt , where ρ = ζμ(R − Δ)/D and one of the equation reads i

  ∂ϕ = ρ a+ b+ e2iνt + abe−2iνt ϕ. ∂t

(11)

166

V.N. Gorbachev et al. / Exponential Superradiance and Macroscopic Entangled States

To solve the problem (11) we use the Fock-Bargman representation, for which ϕ −→ ϕ(t, x, y) and a+ −→ x, a −→ Dx , b+ −→ y, b −→ Dy , where Dx , Dy are operators of differentiation over the complex variables x, y [16]. The equation (11)reads iϕt = ρ [exp (2iνt) xyϕ + exp (−2iνt) ϕxy ] .

(12)

Initial state of modes, that is a product of a coherent state and a vacuum one, has the form ϕ(0, x, y) = exp(Ax) up to normalization condition. In Appendix we present the solution ϕ(t, x, y) in the explicit form, which allows the calculation of all desired characteristics, details of such calculations can be found in [5], [15]. For the photon number occupations of the modes n a (t) = a+ a , nb (t) = b+ b we have  ρ2 sin2 ( ν 2 − ρ2 t) , (13) na (t) =| A |2 +(| A |2 +1) ν 2 − ρ2  ρ2 sin2 ( ν 2 − ρ2 t) 2 nb (t) = (| A | +1) , (14) ν 2 − ρ2 where we assume, that | ν |>| ρ |. In the opposite case the corresponding result can be achieved by analytical continuation. Note, that when | ν |<| ρ | one finds an exponential growth of the photon numbers for both quantized modes. But the last condition is not easy for implementation. The reason is that the parameter ρ depends on the coupling between atom and quantized modes and has the same order of magnitude as this coupling. In the same time parameter ν depends on the frequencies of classical wave and modes, so this condition requires a subtle agreement between classical wave and quantized modes. Below we consider an atomic ensemble for which the corresponding condition is not so delicate. To examine the statistics of modes and its entanglement we introduce the quadrature operators Xa (θa ) = a† exp(iω1 t + iθa ) + h.c. Xb (θb ) = b† exp(iω2 t + iθb ) + h.c,

(15)

that can be rewritten with the help of canonical operators of momentum and position a = xa + ipa , b = xb + ipb . These quadrature operators are well known in quantum optics and they can be measured in the homodyne detection scheme, in which the signal is mixed with a local field oscillator by a 50% beamsplitter and the difference of photocurrents from two detectors is measured. By varying the difference of phases between the signal and the local field oscillator one performs a measurement of the position or momentum operator. The state is called squeezed if a variance of the quadrature operator, say momentum or position, over this state is less, than the variance over the coherent state. Entangled state of an EPR pair of continuous variables is eigenvector of the operator of the relative position Q and total momentum P of two modes [17], Q = x a − xb , P = pa + pb . From the point of view of quantum optics the EPR pair is a squeezed state because the operators P and Q have its variances equal to zero, that is less, then for coherent state, which have equal variances (ΔQ) 2 coh = (ΔP)2 coh = 1/2, (ΔZ)2 = Z 2 − Z 2 , Z = Q, P and (ΔQ)2 coh + (ΔP)2 coh = 1. This observation leads to the criteria of entanglement, namely, a quantum state of continuous variables is entangled if [18]

167

V.N. Gorbachev et al. / Exponential Superradiance and Macroscopic Entangled States

(ΔQ)2 + (ΔP )2 < 1.

(16)

For Gaussian field, whose Wigner function has a Gaussian form, the presented criterion is necessary and sufficient. In our case, taking into account explicit description of the solution ϕ(t, x, y) given in Appendix, we get

 

2ρ sinh t ρ2 − ν 2 2 − ν2 + (ΔQ)2 + (ΔP )2 = 1 + ρ sinh t ρ ρ2 − ν 2

!    ν sinh t ρ2 − ν 2 cos (2νt) − ρ2 − ν 2 cosh t ρ2 − ν 2 sin (2νt) . (17) Note, that this value does not depend on the parameter A.

2. Ensemble of atoms Here we consider an ensemble of N identical atoms and the corresponding dynamics of the quantized modes. We assume here, that the interaction between each two-level atom and classical wave and two quantized modes is the same as before. In this case the wave function of a physical system is an element of Hilbert space which is a product L = F1 ⊗ F2 ⊗ C 2 ⊗ C 2 ... ⊗ C 2 , where F1 , F2 are the Fock spaces of the quantized modes, and C 2 is an atomic two-dimensional space. (m) (m) (m) Introducing operators for mth atom J 0 , J− , J+ , Um and Ξ(m) (t), 1 ≤ m ≤ N, one can present the corresponding Hamiltonian in the following form: HN = ω1 a+ a + ω2 a+ a + κ

N 

(m)

J0

m=1

+μ

+ζ

N 

(m)

(m)

a+ b+ J− + abJ+

! + (18)

m=1

N

 (m) (m) J− exp(iΩt) + J+ exp(−iΩt) . m=1

We are interested in the wave function Ψ(t), which obeys the Schrodinger equation with Hamiltonian (18). Using the suitable variant of transformation (3) we cut off the terms with optical frequencies: % &. N  (m) + + Ψ(t) = exp −it ω1 a a + ω2 b b + (ω1 + ω2 ) J0 /2 Φ(t). m=1

Then we get equation for Φ(t) / N N

  ∂Φ(t) (m) (m) (m) = (κ − (ω1 + ω2 )/2) a+ J− + aJ+ + J0 + ζ i ∂t m=1 m=1 μ

N  m=1

(m) J−

exp (i(Ω − ω1 − ω2 )t) +

(m) J+

exp (i(ω1 + ω2 − Ω)t)

0

Φ(t).

168

V.N. Gorbachev et al. / Exponential Superradiance and Macroscopic Entangled States

Operators Ξ(m) (t), m = 1, 2, ..., N, commute with each other and we assume Ξ N (t) = N (m) (t). Choosing Φ(t) = ΞN (t)ϕ(t), we obtain the next equation for ϕ(t): m=1 Ξ i

N

 ∂ϕ(t) (m) (m) = ζΞ−1 a+ b+ J− + abJ+ ΞN (t)ϕ(t). N (t) ∂t m=1

(19)

This expression contains fast (with frequencies like R, where R is the Rabi frequency of classical wave) and slow oscillating terms and we use the averaging procedure as before in order to describe the slow dynamics. As result we get N

 ∂ϕ(t) (m) (m) −1 i = ζΞN (t) a+ b+ J− + abJ+ ΞN (t)ϕ(t) . ∂t m=1

We suppose, that condition | ω 1 + ω2 − Ω |= 2 | ν |<< R is fulfilled, so one finds: N ' ( (m) Um J0 U−1 Hav = ρ a+ b+ exp (2iνt) + ab exp (−2iνt) m ,

(20)

m=1

where ρ is defined in the previous section. The obtained Hamiltonian describes a slow evolution of modes and atoms, "dressed by classical field". Let introduce the basis | N (m) ek1 , ek2 , ..., ekN , consisting of eigenvectors of operator m=1 Um J0 U−1 m . Then the wave function can be chosen as  ϕ(t) = ησ (t) | ek1 , ek2 , ..., ekN , σ

where σ denotes a set of N numbers k 1 , k2 , ..., kN , each of which is 1 or 2, and the sum is over all different sets σ. For one of such sets η σ (t) we have ' ( ∂ησ (t) = ρSσ a+ b+ exp (2iνt) + ab exp (−2iνt) ησ (t), (21) ∂t N where Sσ = m=1 (−1)km +1 and the sum includes all numbers k m , that form the set σ. Note that only factor S σ depends on the set σ in equation (21). As for single atom problem let initial state of modes be a product of coherent state and vacuum state, and all atoms are in the same state v ∈ C 2 initially, where v = e1 cos χ + e2 sin χ. Expanding the wave function in the Fock-Bargmann representation we have the initial state in the form i

N −k

ησ (0, x, y) = (cos χ)

k

(sin χ) ) exp (Ax),

where k is the number of ”2” in the set σ. Let us denote this number | σ | for a given set N −k k (sin χ) ϕσ (t, x, y), and the function ϕ σ (t, x, y) can σ. Then ησ (t, x, y) = (cos χ) be obtained from the solution ϕ(t, x, y) given in Appendix replacing ρ → ρS σ . Note, by  N different sets σ with the if | σ |= k, then Sσ = N − 2k, and for given k there is k same value of | σ |. Then for any Fock operator G we have G = ϕ(z, t), Gϕ(z, t) =

V.N. Gorbachev et al. / Exponential Superradiance and Macroscopic Entangled States

 N   N k=0

k

(cos χ)

2N −2k

2k

(sin χ)

Gσ ||σ|=k .

169

(22)

where Gσ is the value of operator G in one-dimensional space which corresponds to σ. Here we use the fact that coefficients η σ (z, t) are equal if they have the same value S σ . Let us calculate the photon numbers of the modes n a (t) = a+ a , nb (t) = b+ b . Substituting σ into (22) we get: na (t) =| A | +(1+ | A | ) 2

2

N    N k=0

ρ (N − 2k)

2k

× (sin χ)

2

2

ρ2

2

(N − 2k) − ν 2

k

2N −2k

(cos χ)

)  2 sinh2 ρ2 (N − 2k) − ν 2 t .

(23)

Calculation of the sum in the right hand side of this equation is a non-trivial problem and we consider here a particular case, when atomic initial states are identical and coincide with e1 or e2 ). These states depend on the parameters of the classical wave and hence we suppose, that these parameters and initial atomic states are compatible. Then in the sum (23) there is only one non-zero term, either sin χ or cos χ is equal zero. Then na (t) =| A |2 +nb (t) =| A |2 +(1+ | A |2 )

  ρ2 N 2 2 2 N 2 − ν 2 t , (24) sinh ρ ρ2 N 2 − ν 2

With the help of (22) we can find variance D(t) = (ΔQ) 2 + (ΔP )2 for the quantized modes: D(t) = 1 +

2 sinh [N ρt sin τ ] {sinh [N ρt sin τ ] + sin2 τ

cos τ sinh [N ρt sin τ ] cos (2N ρt cos τ ) − sin τ cosh [N ρt sin τ ] sin (2N ρt cos τ )}, (25)  where cosτ = ν/(N ρ), sin τ = 1 − ν 2 /(N ρ)2 . The typical temporal behavior of variance D(t) in scaled time s = tN ρ sin τ is presented in Fig. 1.

3. Discussion Under condition N | ρ |>| ν | the right hand side of equation (24) is an exponential function of time and number of atoms N [13], [5]. Because of the factor N this condition differs from its analogue in the single atom problem | ρ |>| ν |. From the physical point of view such exponential growth is a results of the cooperative dynamics of the atoms, "dressed by classical field". It follows from the Fig. 2 that in the case (N ρ) 2 > ν 2 the variance D(t) has an exponential growth with oscillations whose minima are close to zero. In accordance with the criterion of entanglement (16) the state of our modes are entangled in the neighborhood of the minima. Relation (24) means that the photon numbers for the quantized modes are exponentially large at the same time points. Note, that we can treat photon number as macroscopic if N ρt > M , where M ∼ 10.

170

V.N. Gorbachev et al. / Exponential Superradiance and Macroscopic Entangled States

Figure 1. Temporal behavior of the dispersion of the quadrature component D(s); s = N ρt, cos τ = ν/(N ρ), τ = 5.

Now we discuss the influence of the parameter A. It corresponds to the photon number of the initial coherent mode n a (0) ∼| A |2 . If this value is macroscopic, then, in accordance with relation (24), both modes are macroscopic at N ρt > 0.5. This condition is much easier for implementation than the corresponding one N ρt > M for the initial vacuum state. A close model of source of bright entangled states generated in Raman type laser operation has been discussed in [9].

Appendix In order √ to separate variables √ in the equation (12) we use the substitution u, v: x = (u + v)/ 2, y = (u − v)/ 2. Assuming ϕ(t, x, y) = Θ(t, u)Π(t, v) we have Θ(t, u) = exp (λ(t) + ζ(t)u + γ(t)u2 ), Π(t, v) = exp (ζ(t)v − γ(t)v 2 ), where   2A ν 2 − ρ2 exp (iνt) ρχ(t) exp (2iνt) , γ(t) = − , χ(t) = 2i sin(t ν 2 − ρ2 ), ζ(t) = σ(t) 2σ(t)     σ(t) = (ν + ν 2 − ρ2 ) exp (it ν 2 − ρ2 ) − (ν − ν 2 − ρ2 ) exp (−it ν 2 − ρ2 ), √

one can also have a corresponding formula for λ(t).

V.N. Gorbachev et al. / Exponential Superradiance and Macroscopic Entangled States

171

Figure 2. Detailed behavior of the dispersion of the quadrature component near the its minimum.

References [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18]

H.-J. Briegel, W. Dür, J.I. Cirac,P. Zoller, Phys. Rev. Lett. 81, 5932 (1998); W. Dür, H.-J. Briegel, J.I. Cirac, P. Zoller, Phys. Rev. A, 59, 169 (1999). C.H. Bennett, D.P. DiVincenzo, J.A. Smolin, W.K. Wootters, Phys. Rev. A, 54, 3824 (1996). P. Zanardi, M. Rasetti, Phys. Rev. Lett. 79, 3306 (1997). A.M. Basharov, V. N. Gorbachev, A. A. Rodichkina Phys. Rev. A 74, 042313 (2006). V.N. Gorbachev, A.Ya.Kazakov, A.I. Trubilko, Journ. Opt. B, 6, 517 (2004). V.N.Gorbachev, A.Ya.Kazakov, A.I.Trubilko, Opt.& Spectrosc. 99, 307 (2005). Ch.Silberhorn et al., Phys.Rev.Lett. 86, 4267 (2001). W.P.Bowen, N.Treps, R.Schnabel, P.K.Lam, Phys.Rev.Lett. 89, 253601 (2002). H.Xiong, M.O.Scully, M.S.Zubairy, Phys.Rev.Lett. 94, 023902 (2002). E.T.Jaynes, F.W.Cummings, Proc. IEEE 51, 89 (1963). R.A.Ismailov, A.Ya.Kazakov, JETP 89, 454 (1999). R.A.Ismailov, A.Ya.Kazakov, JETP 91, 691 (2000). R.A.Ismailov, A.Ya.Kazakov, JETP 93, 1017 (2001). A.Ya.Kazakov, Journ. Opt. B, 2001, V.3, P.97. A.Ya.Kazakov, Intern. Journ. Theoret. Phys., Group Theory and Nonl. Opt. 8, 75 (2002). A.M.Perelomov, Generalized Coherent States and Their Applications. Nauka, Moscow, 1987, SpringerVerlag, New York, 1986. S.L. Braunstein, H.J. Kimble, Phys. Rev. Lett., 80, 869 (1998). L.-M. Duan, G. Giedke, J.I. Cirac, P. Zoller, Phys. Rev. Lett. 84, 2722 (2000); R. Simon, Phys. Rev. Lett. 84 2726 (2000).

This page intentionally left blank

4. Quantum Communication and Computation

This page intentionally left blank

Quantum Communication and Security ˙ M. Zukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

175

Quantum Cryptography: A Practical Information Security Perspective Kenneth G. PATERSON, Fred PIPER, Rüdiger SCHACK 1 Department of Mathematics, Royal Holloway, University of London, Egham, Surrey TW20 0EX, UK Abstract. Quantum Key Exchange (QKE, also known as Quantum Key Distribution or QKD) allows communicating parties to securely establish cryptographic keys. It is a well-established fact that all QKE protocols require that the parties have access to an authentic channel. Without this authenticated link, QKE is vulnerable to man-in-the-middle attacks. Overlooking this fact results in exaggerated claims and/or false expectations about the potential impact of QKE. In this paper we present a systematic comparison of QKE with traditional key establishment protocols in realistic secure communication systems. Keywords. Quantum cryptography, information security

Introduction It is impossible to obtain information about a physical system without disturbing it in a random, uncontrollable way. This fundamental quantum-mechanical law guarantees the security of QKE protocols by enabling the communicating parties to put an upper bound on how much an eavesdropper can know about the key. QKE protocols such as BB84 [1] have been proved to be secure under the assumption that the known laws of quantum physics hold [2]. Given this assumption, QKE is secure even in the presence of an adversary with unlimited computational power. See [3] for an overview of QKE and other aspects of quantum cryptology. Following common usage, we will call unconditionally secure any protocol whose security does not depend on assumptions about the computational power of a potential adversary. Although QKE requires the use of (currently expensive) special purpose hardware and/or networks, secure communications systems based on QKE appear to enjoy an advantage over most systems based on public key cryptography. For the latter would become insecure if progress in algorithms for integer factorization or discrete logarithms were made, and in particular if a quantum computer were built [4]. Because of this, unconditionally secure QKE is often portrayed as being the ideal solution to the problem of distributing cryptographic keys. We will now show that this view only tells part of the story and has led to exaggerated claims and/or false expectations about the advantages of systems using QKE (e.g., see [5]). 1 Corresponding Author: Rüdiger Schack, Department of Mathematics, Royal Holloway, University of London, Egham, Surrey TW20 0EX, UK

176

K.G. Paterson et al. / Quantum Cryptography: A Practical Information Security Perspective

At least two other components are required in addition to the basic QKE protocol in order to make a secure communications system. Firstly, QKE requires that the parties have access to an authentic channel (which need neither be quantum nor secret). Any QKE protocol that does not fulfill this requirement is vulnerable to a man-in-the-middle attack. For previous discussions of authentication in QKE, see [6,7]. The authentication mechanism used to provide the authentic channel may or may not be unconditionally secure. We refer to the combination of authentication mechanism and QKE protocol as the key exchange sub-system. The key exchange sub-system will only be unconditionally secure if the authentication mechanism and QKE protocol are. Secondly, the keys that are exchanged in the QKE protocol are in turn used to protect communication of data using an encryption algorithm. The encryption algorithm may or may not be unconditionally secure. The overall QKE-based communications system will only be unconditionally secure if the authentication mechanism, QKE protocol and encryption algorithm all are. It is common for vendors of QKE-based systems to offer the option of combining an unconditionally secure key exchange sub-system with a conventional encryption algorithm such as 3DES or AES [8,9]. Of course, an overall communications system constructed in this way cannot be unconditionally secure. We call such systems hybrid systems. Typically, a QKE protocol forms only one component of a complete communications system. Such a system can (in general) only be as secure as its weakest component. Thus, in assessing the security offered by a system using QKE, one must examine the entire system and not rely just on a claim of unconditional security for the QKE protocol component. These issues appear to be well-known in the quantum cryptography community. Yet to our knowledge there has been no systematic analysis, from the point of view of practical information security, of how these issues impact on the applicability of QKE. Similarly, little has been done to examine how QKE compares to more traditional approaches to establishing secure communications in terms of practicality, cost, and security levels (both those offered by the different approaches and those actually needed in applications). The present paper intends to provide such an analysis. Our analysis is driven by an examination of the need to provide an authentication channel in QKE systems. In the next two sections, we show that an unconditionally secure key exchange sub-system making use of QKE requires the pre-establishment of a symmetric key between the communicating parties. We then examine the practical consequences of this in the last section. In what follows, we make a division between systems using public-key authentication and systems using pre-established symmetric keys for authentication. Furthermore, among the latter systems, we will distinguish between hybrid systems and unconditionally secure systems.

Systems using public key authentication In such systems, public key cryptographic mechanisms, e.g., digital signatures, are used to provide the authentic channel needed for QKE. The key exchange sub-system, and

K.G. Paterson et al. / Quantum Cryptography: A Practical Information Security Perspective

177

hence the overall communications system, will be no more secure than the public key authentication mechanism on which it is based. For example, if RSA digital signatures are used for authentication, a system of this type would become insecure if quantum computers became available. Hence such a system does not offer unconditional security. Moreover, any system using QKE requires a quantum channel (e.g., an optical fiber) between the communicating parties. Commercial QKE products can use existing telecom fiber optics networks to provide the quantum channel [8,9]. Nevertheless, a system of this type may still offer some security advantages over traditional (i.e. non QKE-based) approaches. In particular, in any successful attack on such a system, the public key authentication mechanism would have to be broken before or during the execution of the QKE protocol. This is in contrast to a system using only classical information and traditional key-establishment techniques, where the messages exchanged in order to establish a key can be stored by the adversary and analyzed at some point in the future, possibly using more advanced cryptanalytic techniques than are available at the time of key establishment. It follows from the above that, if the authentication mechanism is unbroken at the time of key establishment, and if the one-time pad is used as the encryption algorithm, then transmitted data remain secure indefinitely. Thus, in order to guarantee the longterm security of communications, one would only need to be concerned about the capabilities of attackers today rather than in the future. This could be an attractive solution for protecting government secrets, for example. Similarly, if the authentication mechanism is unbroken at the time of key establishment, and if an encryption algorithm such as AES is used, then the data remain secure as long as that encryption algorithm remains secure. Such a system would also be resilient to attacks in which an adversary was able to learn the private keys of the communicating parties and then mounted a passive eavesdropping attack on subsequent exchanges. Naturally, such a system would not resist active attacks subsequent to private key compromise. It should be mentioned that there exist proposals for quantum public key protocols, where the quantum state of a string of qubits (quantum bits) is used as a key [10]. Storage, distribution and manipulation of these quantum keys, however, require quantum information processing capabilities beyond the reach of current technology. Using public quantum keys for authentication is thus not an option now or in the foreseeable future.

Systems using symmetric key authentication If the communicating parties already share a secret, symmetric key, then they can use that key to establish the authentic channel needed to support QKE. In essence, both parties attach cryptographic tags to their messages on that channel, the tags depending both on the message transmitted and on the shared key. Such an authentication mechanism can offer either conditional or unconditional security. The classic approach to providing an unconditionally secure authentic channel is to make use of a message authentication code (MAC) due to Wegman and Carter [11]. In this approach, the parties use the Wegman-Carter MAC together with the pre-established key to authenticate all their messages. The key can be much shorter than the messages being authenticated. All currently existing authentication schemes which offer unconditional security are similar to the Wegman-Carter approach in that they depend on a pre-established symmetric key.

178

K.G. Paterson et al. / Quantum Cryptography: A Practical Information Security Perspective

A key exchange system using QKE and symmetric key authentication differs from a traditional key exchange system using public key cryptography in two main respects. Firstly, as we have already mentioned, it requires a quantum channel between the communicating parties. Secondly, it requires the initial establishment and management of secret keys between the communicating parties. This is certainly feasible, even on a large scale; a good example is provided by GSM mobile communications systems. In a GSM system, a user’s Subscriber Identity Module (SIM) contains a 128 bit symmetric key which is shared with the subscriber’s network service provider. This key is used in an authentication protocol, one product of which is a fresh, symmetric data encryption key. In mid-2003, GSM systems were in operation in 205 countries, with more than 1 billion subscribers [12]. Such symmetric hierarchical systems pre-date the advent of public key cryptography and have a long and successful history of use in telecommunications and finance. We now further subdivide our study of systems using pre-established symmetric keys for authentication. Hybrid systems QKE can be used as a component in a hybrid system, where the secret bits resulting from the QKE protocol are used as keying material in a symmetric encryption algorithm such as 3DES or AES. Such a hybrid communications system using QKE can offer security advantages over conventional alternatives. For example, it may provide unconditionally secure refresh of cryptographic keys if an unconditionally secure authentication mechanism is used. However, the security of the overall communications system will be limited by the security of the symmetric encryption algorithm used. The overall security offered by this approach is therefore only conditional. Unconditionally secure systems Here the communicating parties must establish an authentic channel with unconditional security and use an unconditionally secure encryption algorithm. An unconditionally secure encryption algorithm is provided only by the one-time pad. In order to achieve this level of security for encryption, as many key bits as there are message bits must be established by the QKE protocol. This may be a problem in some practical applications, as the key bit rates of current QKE systems are relatively small. In a traditional one-time pad system (not making use of QKE), the pre-established key must be at least as long as the data to be communicated. A QKE system has an advantage here in that the preestablished key can be relatively short, as it is used only to authenticate an initial run of the QKE protocol, with part of the keying material exchanged in that run being used to authenticate subsequent runs. To summarize, by combining an unconditionally secure authentication scheme with a QKE protocol, one can produce a key exchange sub-system which enjoys a level of security that can be established unconditionally, assuming only the validity of the laws of quantum physics. If the one-time pad is used as the encryption algorithm, then the overall communications system can also be made unconditionally secure.

K.G. Paterson et al. / Quantum Cryptography: A Practical Information Security Perspective

179

Discussion It is likely that using QKE with public key authentication (and therefore not requiring pre-establishment of a symmetric key) has security benefits when the long-term security of data is of importance. There may also be some security advantages in using QKE in hybrid systems as described above. However, QKE loses much of its appeal in these settings, as the overall system security is no longer guaranteed by the laws of quantum physics alone. To obtain an overall communication system with unconditional security, an unconditionally secure key exchange sub-system is required. From our analysis, it is evident that to obtain such a subsystem, a pre-established secret key is required. We note that this requirement is seldom emphasized by proponents of QKE. It is now also clear that QKE, when unconditionally secure, does not solve the problem of key distribution. Rather, it exacerbates it, by making the pre-establishment of symmetric keys a requirement. The often-made comparison between the unconditional security of QKE and the conditional security offered by public key cryptography overlooks this requirement of QKE. The establishment and subsequent management of symmetric keys is a significant undertaking, and any comparison of QKE and public key cryptography should take this fact into account. The pre-established symmetric keys needed to provide authentication in an unconditionally secure QKE protocol could instead be used directly in a symmetric encryption algorithm, or as the basis for a symmetric hierarchical system like that employed in GSM and many other systems. Thus a complete evaluation of the purported benefits of QKE should also compare the level of security offered by QKE to the level that can be achieved using conventional symmetric techniques alone. For a well-designed symmetric encryption algorithm, the best attack should require the attacker to expend an amount of effort equivalent to that of an exhaustive key search in order to break the algorithm, even if large amounts of plaintext and ciphertext are available to the attacker. With the key lengths available today in algorithms like AES, an exhaustive key search is simply not a realistic attack. Furthermore, all known attacks against such algorithms using quantum computers would be easily countered simply by doubling the key length. Thus the only applications where using an unconditionally secure QKE protocol appears justified are those for which the level of security offered by the best available symmetric encryption algorithm is judged insufficient because of the risk that the algorithm turns out not to be well-designed and there are advances made in the cryptanalysis of that algorithm. In such applications, the QKE protocol should only be used with the one-time pad for encryption, since any advance in cryptanalysis of symmetric algorithms may also compromise the encryption algorithm used in a hybrid QKE system. We suggest that this set of applications is in fact rather limited: we do not foresee many commercial uses where the expense associated with such a degree of security would be warranted. Adding to this the fact that conventional techniques have no requirements for special-purpose hardware or dedicated networks, we believe that the traditional symmetric approach has much to offer in comparison with unconditionally secure QKE. Whilst it is certainly worthwhile to study the impact that the advent of quantum computing might have on conventional cryptography, it is not true that largescale quantum computing would bring about the death of all conventional cryptographic approaches. Rather, it would serve to enhance the value of long-established symmetric key management techniques.

180

K.G. Paterson et al. / Quantum Cryptography: A Practical Information Security Perspective

Acknowledgment We thank Burt Kaliski for useful discussions on the content of this paper.

References [1]

C. H. Bennett and G. Brassard, Quantum cryptography: public key distribution and coin tossing, in Proceedings of the IEEE international conference on computers, systems and signal processing (IEEE, Bangalore, India, 1984), p. 175. [2] D. Mayers, Journal of the ACM 48, 351 (2001). [3] D. Gottesman and H.-K. Lo, Physics Today 53(11), 22 (2000). [4] See, e.g., the end of section II.B.2 of N. Gisin, G. Ribordy, W. Tittel and H. Zbinden, Rev. Mod. Phys. 74, 145 (2002). [5] E. Klarreich, Nature 418, 270 (2002). [6] C. H. Bennett, G. Brassard and A. K. Ekert, Scientific American 267 (3), 26 (1992). [7] M. Dušek, O. Haderka, M. Hendrych and R. Myška, Phys. Rev. A 60, 149 (1999). [8] idQuantique SA, Geneva, Switzerland, http://www.idquantique.com. [9] MagiQ Technologies, New York, USA, http://www.magiqtech.com. [10] D. Gottesman and I. Chuang, e-print quant-ph/0105032. [11] M. N. Wegman and J. L. Carter, Journal of Computer and System Sciences 22, 265 (1981). [12] For further information about global deployment of GSM systems, see http://www.gsmworld.com/news/statistics/index.shtml.

Quantum Communication and Security ˙ M. Zukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

181

Biased Reconstruction: Homodyne Tomography b ˇ ˇ ´ CEK Dmitri MOGILEVTSEV a , Jaroslav REH A and Zdenˇek HRADIL b,1 a Institute of Physics, Belarus National Academy of Sciences, F. Skarina Ave. 68, Minsk 220072 Belarus b Department of Optics, Palacky University, 17. listopadu 50, 772 00 Olomouc, Czech Republic

Abstract. Any successful reconstruction schemes hinges upon the choice of measurement, estimation scheme and representation of the signal. The intrinsic relationship between the maximum-likelihood quantum-state estimation and the representation of the signal is demonstrated on the seminal example of homodyne tomography. The quantum analogy of the transfer function determines the space where the reconstruction should be done without need for any ad hoc truncations of the Hilbert space. Keywords. Quantum tomography, maximum likelihood estimation, resolution of quantum tomography

Introduction The development of effective and robust methods for quantum state reconstruction is a task of crucial importance for quantum optics and information. Such methods are needed for quantum diagnostics: for the verification of quantum state preparation, for the analysis of quantum dynamics and decoherence, and for information retrieval. All these tasks are indispensable for future improvement of measurement procedures and characterization of quantum gates. Since the original proposal for quantum tomography and its experimental verification [1,2], this discipline has recorded significant progress and is considered as a routine experimental technique nowadays. Reconstruction has been successfully applied to probing the structure of entangled states of light and ions, operations (quantum gates) with entangled states of light and ions or internal angular momentum structure of correlated beams, just to mention a few examples [3]. All these applications exhibit common features. Any successful quantum tomography scheme relies on three key ingredients: on the availability of a particular tomographically complete measurement, on a suitable representation of quantum states, and on an adequate mathematical algorithm for inverting the recorded data. In addition, the reconstruction scheme must be robust with respect to noise. In real experiments the presence of noise is unavoidable due to losses and due to the fact that detectors are not ideal. 1 Corresponding Author: Z. Hradil, Department of Optics, Palack´ y University, 17. listopadu 50, 772 00 Olomouc, Czech Republic; E-mail: [email protected] .

182

D. Mogilevtsev et al. / Biased Reconstruction: Homodyne Tomography

The presence of losses poses a limit on the accuracy of a reconstruction, but sometimes losses can be turned into advantage and used for the reconstruction purposes [4]. The required robustness of a tomography scheme with respect to noise is often difficult to meet especially if it is biased, that is, if some aspects of the quantum systems in question are observed more efficiently than the others. Since our ability to design and control measurements is severely limited, this situation will typically arise when one wants to characterize a system with a large number or infinitely many degrees of freedom, for instance in the quantum tomography of light mode. Standard approach is to truncate the Hilbert space by a certain cut-off, reducing the number of parameters involved [5]. Such ad hoc truncation lacks physical foundation. It may have bad impact on the accuracy of reconstruction or conversely it may lead to more regular results. The latter case may easily happen when an experimentalist seeks for the result in the neighborhood of the true state. Such a tacitly accepted assumption may appear as crucial as it allows elimination of the infinite number of unwanted free parameters. This drawback may erode the notion of tomography as an objective scheme. To deal with this problem, the concept of biased tomography scheme has been proposed recently [6]. In this paper we will illustrate this approach on the seminal scheme of quantum tomography implemented by means of homodyne detection.

1. Tomographic measurement Let us review a generic formalism for the maximum-likelihood (ML) inversion of the measured data, which is capable to deal with generic scheme of tomographic reconstruction [6]. Let us assume detections of a signal enumerated by the generic index j. Their probabilities are predicted by quantum theory by means of positive-operator-valued measure (POVM) elements Aj , pj = Tr[Aj ρ],

0 ≤ Aj ≤ 1,

(1)

ρ being the quantum state. The observations A j are assumed to be tomographically complete in the Hilbert subspace we are interested in. No other specific assumptions about the operators Aj , their commutation relations or group properties will be made. In general, probabilities pj are not normalized to one as the operator sum  Aj = G ≥ 0 (2) j

may differ from the identity operator. Theoretical probabilities p j can be sampled experimentally by means of registered data N j . The aim is to find the quantum state ρ from data Nj . Let us emphasize that the overall normalization, given for example by the total number of elements in the ensemble, is missing in general. In that case all measurements should be normalized just mutually among  themselves, or equivalently, with respect to the total number of registered events j Nj . According to these generic assumptions the information about non-registered events is not available and therefore cannot be used for the reconstruction. Let us note in passing that this would be possible, if the number of elements in ensemble N was known. In such a case the statistics of missing events  described by POVM element 1 − G is experimentally sampled by the number N − j Nj . In the following we will not assume this kind of knowledge.

D. Mogilevtsev et al. / Biased Reconstruction: Homodyne Tomography

183

2. Maximum likelihood reconstruction The ML scenario hinges upon a likelihood functional associated with the statistics of the experiment. In the following, we will adopt the generic form of likelihood for unnormalized probabilities [7] .  pj log L = , (3) Nj log  j  pj  j which should be maximized with respect to ρ. Here the index j runs over all registered data. The extremal equation for the maximum-likely state can be derived in three steps: (i) The positivity of ρ is made explicit by decomposing it as ρ = σ † σ. (ii) Likelihood (3) is varied with respect to independent matrix σ using δ(log p j )/δσ = Aj σ † /pj ; (iii) Obtained variation is set equal to zero and multiplied from right side by σ with the result   j  pj  N j  Rρ = Gρ, R= Aj , (4) j  Nj  pj (ρ) j where the operator G is defined by Eq. (2) and operator R depends on the particular choice of L. Notice that this equation may be cast in the form of ExpectationMaximization (EM) algorithm [8] RG ρG = ρG ,

(5)

where RG = G−1/2 RG−1/2 and ρG = G1/2 ρG1/2 . This extremal equation may be solved by iterations in a fixed orthogonal basis. Keeping the positive semi-definiteness of ρG [by combining Eq. (4) with its Hermitian conjugate] the (n + 1)th iteration reads (n+1)

ρG

(n) (n)

(n)

= RG ρG RG ,

RG = G−1/2 R(ρ(n) )G−1/2 . (n)

(0)

Starting with some initial guess ρ G the iterations are repeated until the fixed point is reached. In terms of ρ G , the desired solution is then given by ρ = G−1/2 ρG G−1/2 .

(6)

Going back to likelihood in Eq. (3) we now see, that the operator G coming from the mutual normalization of probabilities, j pj = Tr[ρG], provides a complete (normalized) POVM, which is equivalent to the original biased observations A j :  −1/2 −1/2 G A G = 1 . This establishes the preferred basis for a reconstruction. Due j G j to the division by the operator G in Eq. (6) and in the sentence above the reconstruction can be done only in the subspace spanned by the non-zero eigenvalues of G. The spectrum of G plays therefore the role of tomographic transfer function analogously to the transfer function in optical imaging. It quantifies the resolution of the reconstruction in the Hilbert space. Large eigenvalue of G indicates that many observations overlapped in the corresponding Hilbert subspace and this part of the Hilbert space is thus more visible. The Hilbert subspace where the reconstruction was done is clearly not a subject of a free choice in the proper statistical analysis. This also gives a clue how to approximate the solution in the infinite dimensional case simply by taking the subspace corresponding to the dominant eigenvalues. The result of reconstruction can be easily checked in the

184

D. Mogilevtsev et al. / Biased Reconstruction: Homodyne Tomography

preferred basis afterwards. If the reconstructed state exhibits dominant contributions for the components with relatively small eigenvalues of G, the result cannot be trusted. The essence of the correct reconstruction inhere in the following recommended scenario: After collecting all data the optimal basis for reconstruction is identified as eigenvectors of G operator. The truncation is achieved by taking into account only those with dominant eigenvalues, where the ML extremal equation should be solved keeping the semi-positive definiteness of the density matrix. This establishes the quantum tomography as an objective tool for the analysis of infinite dimensional quantum systems. Indeed, previously reported results of tomographic schemes have always considered the space for reconstruction ad hoc: If one knows what the result should be it is not really difficult to get it.

3. Homodyne tomography The recommended approach will be illustrated on the seminal example of homodyne tomography, which triggered the interests in quantum state reconstruction [1,2]. An iterative algorithm similar to the general scheme described here has already been adopted for the reconstruction of the density matrix in finite Fock-state basis [5,9], though the scheme was considered to be unbiased G = 1. Such assumption holds approximately on the subspace in the neighborhood of the (expected) true state, however it is not valid in general. The quorum of measurements in homodyne tomography consists of projections into eigenstates of rotated quadrature operators. Assuming the efficiency ν, the corresponding POVM elements A(γ) read [10]  A(γ) = fmnk (ν, γ)|m + k n + k|. (7) m,n,k=0

The complex parameter γ specifies the point on the phase plane where the measurement has been done. The coefficients read ) n Cm , fmnk (ν, γ) = ν (m+n)/2 γ|n m|γ (1 − ν)k Cn+k m+k m! Cnm being the binomial coefficient C nm = n!(m−n)! and the projection of the quadrature operator eigenstates |γ on the Fock state |n is given as √  1/4   Hn ( 2|γ|) 2 √ n|γ = exp −|γ|2 + in arg(γ) . n π 2 n!

These POVM elements A(γ) completely describe the measurement. The corresponding probabilities for the signal state with the density matrix ρ reads p γ = Tr[A  γ ρ] and obviously, since not all the projections in phase space have been registered, γ pγ ≤ 1. The knowledge of measurement and experimental outcomes are the only ingredients needed for ML estimation. Particularly, there is no need to invert linear relation between quantum state and sampled probabilities as it is done for example, by means of inverse Radon transformation. Further details as well as comparison of homodyne tomography with other schemes will be detailed elsewhere [11]. Here we only demonstrate several key features of biased tomography approach.

D. Mogilevtsev et al. / Biased Reconstruction: Homodyne Tomography

185

Figure 1. Eigenvalues of the operator G for efficiencies ν = 1(hollow bars), ν = 0.6 (grey bars), ν = 0.4 (black bars).

The prominent role is played by the G operator, which quantitatively describes how much all the detections overlap. The eigenvalues of G indicate how much the given mode has been observed by quorum of tomographic observables. The reconstruction should be done in the subspace encompassing the dominant eigenvalues because just this part of Hilbert space has been visible. In the following we will demonstrate several realistic aspects affecting the resolution of homodyne tomography. For this purpose we have generated several data files in order to demonstrate various effects. Data used for analysis correspond to typical setups already adopted for quantum tomography by means of inverse Radon transformation. Since we are interested in mutual proportions between particular components, the absolute normalization ensuring G ≤ 1 will be released. Spectrum of G will be normalized in arbitrary units scaling with the number of detected events. The eigenvalues of G are plotted in Fig. 1 for efficiencies 1, 0.6 and 0.4. Homodyne tomography experiment was simulated for 6 phase cuts of π window for the signal corresponding to coherent state with the amplitude e iπ/4 . Altogether 1.2 10 5 data points spread in the phase space were accumulated into 64 bins for each phase cut. Let us point out that data binning is not necessary in ML estimation, which is capable to deal with rough data as well. Fig. 1 demonstrates the degradation of the resolution with decreasing efficiency. Non-zero eigenvalues delimitate the subspace for the reconstruction. Its dimension is relatively large (several tens) for efficiencies larger than 0.5, but it drops to about 5 in case of efficiency 0.4. This clearly demonstrates the effects of narrowing of field of view with decreasing efficiency. Of course, the reconstruction will be further

186

D. Mogilevtsev et al. / Biased Reconstruction: Homodyne Tomography (a)

(b)

200 1 ||*mn|

g

m

150

100

0.5 0

50 5

15 10

0

0

5

10

n+1

15

10 5

15

m+1

m (c)

(d)

50 40

1

g

m

|*mn|

30 20

0.5 0

10

5

15 10

0

0

5

10

15

n+1

10 15

5 m+1

m

Figure 2. Eigenvalues and eigenvectors of operator G for homodyne tomography.

spoiled by the fluctuations of recorded data, but this analysis is beyond the scope of this contribution. Fig. 2 illustrates the behavior of the operator G for ideal case of unit efficiency. The recorded data are represented by γ points in phase space. The panels a) and b) correspond to data points distributed along the 8 phase cuts in π window, each of them sampled equidistantly by 64 values on the interval (-3,3) in vacuum units (dense sampling). Panels c) and d) correspond to data set with 2 phase cuts in π window, each of them sampled by 8 values on the same interval (sparse sampling). Left panels a) and c) plots the eigenvalues of G, the corresponding right panels b) and d) plot the absolute values of corresponding eigenvectors, indices m and n label the eigenvectors and corresponding components, respectively. All calculations have been done in Fock basis truncated at Ntr = 15. As seen from Fig.2 partial tomography on limited Hilbert subspace is always possible. Sparse data set yields, of course, restricted field of view. Notice, however, that this kind of data cannot be handled within standard inverse Radon transformation. Large field of view, on the other hand, need not be always an advantage. It may happen that data available are not sufficient for full reconstruction in the visible of Hilbert space. An explicit result of ML reconstruction is presented in Fig.3. Data correspond to simulated homodyne tomography of the coherent state with the amplitude α = exp{iπ/4} for the case of dense sampling, see Fig. 2 a), b). Simulated noise corresponds to 102 experimental runs. The reconstruction was done using N it = 103 iterations of

187

D. Mogilevtsev et al. / Biased Reconstruction: Homodyne Tomography (a)

(b)

)

0.2 mn

0.2 0 1

0

Im(U

Re(U

mn

)

0.4

Ŧ0.2 2

1 3

4

5

n+1

6

7

2

6 7 4 5 3 1 2 m+1

3

4

5

n+1

6

7

(c) Ŧ3

x 10

3

2

2

Vmn

|'Umn|

6 7

(d)

Ŧ3

x 10

1 0 1

5 3 4 1 2 m+1

2

1 0 1

3

4

n+1

5

6

7

2

6 7 4 5 3 1 2 m+1

3

4

n+1

5

6

7

5 3 4 2 1 m+1

6 7

Figure 3. Results of homodyne tomography, explanation see the text.

the ML iterative procedure based on Eq. (5) and all calculations have been done in the Fock space truncated at N tr = 15. Upper panels of Fig. 3 plot real (a) and imaginary (b) parts of reconstructed density matrix. Panels (c) plots the absolute values of the differences between the reconstructed and the true density matrix elements. The confidence intervals on the reconstructed density matrix elements can be provided by calculating the variances −1/2

σ(ρmn ) = (F (ρmn )Nmes )

,

(8)

where Nmes is the total number of measurements, and the Fisher information F can be defined for the real part of the density matrix elements as follows [12]: F (Re[ρmn ]) =

 j

 j

pj 

pj

-

∂ p  j ∂Re(ρmn ) j  pj 

.2 (9)

and similarly for the imaginary part of ρ with Re replaced by Im . Panel (d) plots the variances of real (imaginary) parts of the reconstructed density matrix elements in the region m ≤ n (n > m) estimated via Eqs. (8) and (9). In this sense, the two upper panels show the results, i.e. the reconstructed density matrix), whereas the lower panels show the corresponding errors. Notice also, that the error Δ|ρ mn |, see the panel (c),

188

D. Mogilevtsev et al. / Biased Reconstruction: Homodyne Tomography

is just a result of theoretical analysis based on the exact knowledge of the true state), whereas the error σ mn , see the panel (d), is directly accessible from experimental data. The results seem to be convincing, since the experimental data reveal well the structure of quantum state. This is mainly due to the fact, that the reconstruction has been done on the subspace with sufficiently small dimension. Indeed, as seen in panel Fig. 2a), the 15th smallest eigenvalue of G taken into account was about only four times less than the prominent eigenvalue. In this sense the reconstruction should be done on larger Hilbert space in order to encompass other still visible components as well. However, this would increase the uncertainty of any estimation considerably. Systematic investigation of the errors involved in biased tomography will be given in the forthcoming paper.

Conclusion Biased tomography scheme addresses some aspects of the quantum systems more efficiently than others. Its resolution can be characterized by means of quantum analogy of transfer function. Analogously to classical optics, performance may be further optimized and tuned in order to reach the desired resolution. We have illustrated some aspects of the recommended approach on the seminal example of homodyne tomography, which triggered the fast development of quantum tomography recently. Particularly, we have demonstrated that even imperfect observations can be used for extracting information about quantum objects.

Acknowledgements The authors acknowledge the support of the Czech Ministry of Education, projects MSM6198959213 and LC06007 , Grant No. 202/06/0307 of Czech Grant Agency, EU project COVAQIAL FP6- 511004 (J.R. and Z. H), and project BRFFI of Belarus and CNPq of Brazil (D.M).

References [1] K. Vogel and H. Risken, Phys. Rev. A 40, R2847 (1989). [2] M. Raymer, M. Beck, in ‘Quantum states estimation’, M. G. A. Paris and J. Rehacek Eds., Lect. Not. Phys. 649 (Springer, Heidelberg, 2004). [3] M. G. A. Paris and J. Rehacek (Eds), Quantum states estimation, Lect. Not. Phys. 649 (Springer, Berlin Heidelberg, 2004). [4] D. Mogilevtsev, Z. Hradil and J. Perina, Quantum. Semicl. Opt. 10, 345 (1998); D. Mogilevtsev, Opt. Comm. 156, 307 (1998); D. Mogilevtsev, Acta Physica Slovaca 49, 743 (1999). [5] A. I. Lvovsky, J. Opt. B: Quantum Semiclass. Opt. 6, S556 (2004). [6] Z. Hradil, D. Mogilevtsev, J. Rehacek, Phys. Rev. Lett. 96, 230401 (2006). [7] This form, suggested by E. Fermi, is sometimes called “extended maximum likelihood,” see R. Barlow, Statistics (Willey, New York, 1989) p. 90. It corresponds to Poissonian model with unknown mean numbers. [8] A. P. Dempster, N. M. Laird, D. B. Rubin, J. R. Statist. Soc. B 39, 1 (1977); Y. Vardi and D. Lee, J. R. Statist. Soc. B 55, 569 (1993).

D. Mogilevtsev et al. / Biased Reconstruction: Homodyne Tomography

189

[9] A. Ourjoumtsev, R. Tualle-Brouri, P. Grangier, Phys. Rev. Lett. 96, 213601 (2006); Science 312, 83 (2006); J.S. Neergaard-Nielsen, arXive:quant-ph/0602198; S.A. Babichev, B. Brezger, A.I. Lvovsky, Phys. Rev. Lett. 92, 047903 (2004); S.A. Babichev, J. Appel, A.I. Lvovsky, Phys. Rev. Lett. 92, 193601 (2004). [10] U. Leonhardt, Measuring the quantum state of light, (Cambridge University Press, Cambridge), 1997. [11] D. Mogilevtsev, J. Rehacek, Z. Hradil, Objective approach to biased tomography schemes, accepted for publication in Phys. Rev. A (2007). [12] H. Cramer, Mathematical Methods of Statistics (Princeton University Press, Princeton, NJ, 1946).

190

Quantum Communication and Security ˙ M. Zukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

Entanglement Conditions for Two- and Three-Mode States Mark HILLERY 1 Department of Physics, Hunter College of CUNY, 695 Park Avenue, New York, NY 10021 Abstract. There are several known conditions for detecting entanglement between two boson modes. These are inequalities that must be obeyed by all separable states, so that a state that violates one of them will be entangled. There are, however, entangled states that do not violate any of these inequalities, so that having additional conditions is useful. We provide a class of further inequalities whose violation shows the presence of entanglement. We initially consider observables that are quadratic in the mode creation and annihilation operators and find circumstances in which their uncertainties show that a state is entangled. Further examination allows us to formulate additional conditions for detecting entanglement. We conclude by showing how the methods used here can be extended to find entanglement in systems of more than two modes. Keywords. Entanglement, continuous variable systems

Introduction Entanglement has proven to be a valuable resource in quantum information processing, but determining whether or not a state is entangled is often far from simple. Particularly in the case in which the systems have continuous degrees of freedom, such as particle position or momentum or the quadrature components of field modes, the number of conditions for detecting entanglement is not large. Each of the known conditions detects only a subset of the set of entangled states. The conditions themselves are inequalities; if a state satisfies the inequality, then we know that it is entangled, but if it does not, then we can conclude nothing about the entanglement of the state. Let us quickly list the conditions that were known until recently. Consider a twomode system in which the annihilation operators for the modes are a and b. Perhaps the most well-known condition that guarantees that a two-mode state is entangled is given by [1,2] (Δ(xa + xb ))2 + (Δ(pa − pb ))2 < 2, (1) √ √ where xa = (a† + a)/ 2, pa = i(a† − a)/ 2 and similarly for x b and pb . A generalization of this criterion can detect all entangled two-mode Gaussian states [1,2]. A related criterion states that a state is entangled if [3] 1 [email protected]

M. Hillery / Entanglement Conditions for Two- and Three-Mode States

[Δ(xa + xb )]2 [Δ(pa − pb )]2 < 1.

191

(2)

This type of condition has been generalized for variables more complicated than x a + xb and pa − pb in [4]. Finally, Toth, Simon and Cirac derived an entanglement criterion for two-modes states that is given by [5] [(ΔN )2 + 1][(a† − b† )(a − b) − |a − b |2 + 1] <

1 1 N + , 4 8

(3)

where N = a† a + b† b. A state satisfying this condition is entangled. Note√that none of these conditions will detect the fact that the state (|0 a |1 b + |1 a |0 b )/ 2, i.e. the state that is a superposition of the states with one photon in one mode and no photons on the other, is entangled. This indicates that it would be useful to have more ways of determining whether a state is entangled. Last year three groups working independently considerably expanded the number of conditions that will detect entanglement. The first new condition, due to G. S. Agarwal and A. Biswas, is an uncertainty-relation type condition [6]. The second was due to M. S. Zubairy and myself [8]. We initially found conditions based on the sum of uncertainties of variables that are quadratic in the creation and annihilation operators, but were able to generalize these to conditions on correlation functions of arbitrarily high order. The last to appear was the paper E. Shchukin and W. Vogel, which contains very general methods for finding entanglement tests for continuous-variable systems [7]. Here we shall concentrate on the conditions appearing in [8,9]. We shall simply give the results; the proofs can be found in the original papers.

1. Conditions for Two-Mode States We begin by defining the operators L 1 = ab† + a† b and L2 = i(ab† − a† b) . Operators, proportional to these, along with one proportional to the operator L 3 = a† a + b† b, form a representation of the su(2) Lie algebra, i.e., J i = Li /2 (i = 1 − 3) satisfy the commutation relations [J k , Jm ] = ikmn Jn . Entanglement conditions expressed in terms of angular momentum operators have been derived by a number of authors [10]-[13]. We find that a two-mode state is entangled if (ΔL1 )2 + (ΔL2 )2 < 2(Na + Nb ).

(4)

We can immediately see that this new entanglement condition is useful, because it is √ satisfied by the state (|0 a |1 b + |1 a |0 b )/ 2. A short calculation shows that the above condition is equivalent to Na Nb < |ab† |2 .

(5)

The quantities in this inequality can be measured in a relatively straightforward way. The quantity on the right-hand side can be measured by photon-counting measurements. The quantity on the left-hand side can be measured with the aid of a phase shifter and a beam splitter. Suppose the b mode is first sent through a phase shifter that performs the action √ b → e−iφ b, and then √ both modes are sent into a beam splitter that sends a → (a + b)/ 2 and b → (b − a)/ 2. We then have that the output operators are

192

M. Hillery / Entanglement Conditions for Two- and Three-Mode States

1 aout = √ (a + e−iφ b) 2 1 bout = √ (−a + e−iφ b), 2

(6)

and the expectation of difference of the numbers in the two modes at the output is given by (aout )† aout − (bout )† bout = e−iφ a† b + eiφ ab† .

(7)

By choosing φ = 0 we can measure the real part of ab † and by choosing φ = −π/2 we can measure the imaginary part. These can then be combined to yield |ab † |2 . The entanglement condition in the previous paragraph is easily generalized, We find that a state is entangled if |am (b† )n |2 > (a† )m am (b† )n bn .

(8)

Let us now turn our attention to the variables K 1 = ab+a† b† and K2 = i(a† b† −ab). One half times these operators along with one half times the operator the operator K3 = a† a − b† b form a representation of the su(1,1) Lie algebra. As before, we would like to find inequalities involving these variables that tell us whether a two-mode state is entangled or not. The condition we find is rather different than the one we found for the case of su(2). The guiding idea is that the “eigenstates” (the reason for the quotation marks is that these states are, in general, not normalizable, and hence do not lie in the Hilbert space of two-mode states) of operators such as K 1 and K2 are highly entangled. States whose uncertainty in one of these variables is small will be close to one of these eigenstates, and will also be entangled. Therefore, for a state to be separable, its uncertainty in one of these variables must be greater than some lower bound. What we find is that in the case of K 1 and K2 , that lower bound is 1. In fact, letting K(φ) = eiφ a† b† + e−iφ ab,

(9)

we find that if for any φ a state satisfies (ΔK(φ)) < 1, then it must be entangled. This condition is equivalent to |ab | > [Na Nb ]1/2 ,

(10)

which, as before, is readily generalized. In particular, we find that a state is entangled if |am bn | > [(a† )m am (b† )n bn ]1/2 .

(11)

2. Conditions for Three Modes Let us now look at entanglement in three-mode states. Entanglement conditions for threemode Gaussian states were formulated by Giedke, et al. [14]. Conditions for determining whether a general three-mode state is completely separable were give in [8] and very recently conditions for multimode entanglement have been studied by Shchukin and Vogel [15].

M. Hillery / Entanglement Conditions for Two- and Three-Mode States

193

Consider three modes whose annihilation operators are a, b, and c. In this case, we shall actually give the derivation of the entanglement condition. For a state that is a tensor product of individual states for each of the modes, we have that |ab † c† | = |a b c | ≤ (Na Nb Nc )1/2 = Na Nb Nc 1/2 . For a state thatis completely separable in the three modes, thatis one that can be expressed as ρ = k pk ρak ⊗ ρbk ⊗ ρck , we find that |ab† c† | = k pk |a k b k c k |, which implies that  pk (Na Nb Nc k )1/2 |ab† c† | ≤ k

  ≤( pk )1/2 ( pk Na Nb Nc k )1/2 k

k

≤ Na Nb Nc

1/2

,

(12)

where the next to last step follows from the Schwarz inequality. If a state is completely separable, it must obey this inequality, and, therefore, if the inequality is violated, the state will be entangled. An example of a√state that does violate this inequality is given by |ψ = (|1 a |0 b |0 c + |0 a |1 b |1 c )/ 2, which is a kind of GHZ state. In particular, for this state Na Nb Nc = 0, and |ab† c† | = 1/2, which clearly violates the inequality |ab† c† | ≤ Na Nb Nc 1/2 . Therefore, we see that the types of inequalities developed here can be extended to study the multipartite entanglement of continuous-variable systems. In studying three-mode states, we are often interested in which subsystems are responsible for the entanglement. If the state is entangled, it may be the case that only two of the modes are entangled, while the third is not entangled with either of these two modes. For example, if the density matrix is of the form  ρabc = pj ρaj ⊗ ρbcj , (13) j

 where 0 ≤ pj ≤ 1 and j pj = 1, then mode a will not be entangled with either mode b or mode c, but modes b and c can be entangled leading to the overall entanglement of the state. If a three-mode density matrix cannot be expressed in the above form, or in either of the two forms  ρabc = pj ρbj ⊗ ρacj j

ρabc =



pj ρcj ⊗ ρabj ,

(14)

j

then we say that it is genuinely entangled. It has been shown how to produce genuinely entangled multimode states by van Loock and Braunstein [16]. We now want to give some simple conditions for determining whether a three-mode state is genuinely entangled, and to give an example of such a state that is not Gaussian and whose entanglement can be demonstrated by these conditions. Suppose that the three mode density matrix, ρ abc is of the form given in Eq. (13) or of the form of the first line in Eq. (14). Then it is the case that ρ ab = Trc (ρabc ) is separable, and the results of [8] imply that it must satisfy

194

M. Hillery / Entanglement Conditions for Two- and Three-Mode States

|ab† |2 ≤ Na Nb .

(15)

Therefore, if ρ abc satisfies the condtion |ab† |2 > Na Nb

(16)

it cannot be of either of these two forms. Similarly, if it satisfies the condition |bc† |2 > Nb Nc ,

(17)

it cannot be of the form given in the second line of Eq. (14). If it satisfies both of these conditions, it must be genuinely three-mode entangled. A simple example of a state that does satisfy these conditions is a three-mode, singlephoton W state 1 |Ψ = √ (|0, 0, 1 + |0, 1, 0 + |1, 0, 0 ). 3

(18)

This state is a superposition of states in which one mode has one photon and the other two modes are in the vacuum state. For this state we find that N a Nb = Nb Nc = 0, and ab† = bc† = 1/3. Therefore, both of the above conditions are satisfied, and the state is genuinely three-mode entangled. By replacing the one-photon state in the above example with a coherent state, we can find a family of states that is genuinely three-mode entangled. That is we consider the state |Ψ(α) = η(|0 a |0 b |α c + |0 a |α b |0 c +|α a |0 b |0 c ),

(19)

where |α is a coherent state and η=

1 . [3(1 + 2e−|α|2 )]1/2

(20)

For this state we again have that N a Nb = Nb Nc = 0, but now ab † = bc† = |ηα|2 exp(−|α|2 |). Therefore, we see that for all nonzero values of α the state |Ψ(α) exhibits genuine three-mode entanglement, though this entanglement is easiest to detect for |α| ∼ 1, because that is when the difference between the two sides of the inequalities, Eqs. (16) and (17), is greatest.

Conclusion There is still much to be learned about entanglement in continuous variable systems. The recently derived conditions add to our knowledge of this subject, but are by no means the end of the story. For example, connections between some of these conditions have been explored by Nha and Kim [17]. A thorough study of all tests for continuous-variable entanglement that arise from linear combinations of second moments or variances of canonical coordinates was carried out by Hyllus and Eisert [18]. McHugh, Bužek, and Ziman found a class of non-Gaussian two-mode continuous-variable states for which the

M. Hillery / Entanglement Conditions for Two- and Three-Mode States

195

separability criterion for Gaussian states can be employed to determine whether they are separable or not [19]. These developments suggest that the entanglement of continuousvariable systems will be an active area of research for some time to come.

References [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19]

R. Simon, Phys. Rev. Lett. 84, 2726 (2000). L. -M Duan, G. Giedke, J. I. Cirac, and P. Zoller, Phys. Rev. Lett. 84, 2722 (2000). S. Mancini, V. Giovannetti, D. Vitali, and P. Tombesi, Phys. Rev. Lett. 88, 120401 (2002). V. Giovannetti, S. Mancini, D. Vitali, and P. Tombesi, Phys. Rev. A 67, 022320 (2003). G. Toth, C. Simon, and J. I. Cirac, Phys. Rev. A 68, 062310 (2003). G. S. Agarwal and A. Biswas, New J. of Phys. 7, 211 (2005). E. Shchukin and W. Vogel, Phys. Rev. Lett. 95, 230502 (2005). M. Hillery and M. S. Zubairy, Phys. Rev. Lett. 96, 050503 (2006). M. Hillery and M. S. Zubairy, Phys. Rev. A 74, 032333 (2006). A. Sørensen, et al., Nature 409, 63 (2001). A. Sørensen and K. Mølmer, Phys. Rev. Lett. 86, 4431 (2001). N. Korolkova, et al., Phys. Rev. A 65, 052306 (2002). C. Simon and D. Bouwmeester, Phys. Rev. Lett. 91, 053601 (2003). G. Giedke, B. Kraus, M. Lewenstein, and J. I. Cirac, Phys. Rev. A 64, 052303 (2001). E. Shchukin and W. Vogel, Phys. Rev. A 74, 030302(R) (2006). P. van Loock and S. L. Braunstein, Phys. Rev. Lett. 84, 3482 (2000). Hyunchul Nha and Jaewan Kim, Phys. Rev. A 74, 012317 (2006). P. Hyllus and J. Eisert, New J. Phys. 8, 51 (2006). D. McHugh, V. Bužek, and M. Ziman, Phys. Rev A 74, 050306(R) (2006).

196

Quantum Communication and Security ˙ M. Zukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

Entanglement Measures: State ordering vs. Local Operations a,b,c ˇ M´ario ZIMAN a,b,c,1 and Vladim´ır BUZEK a Research Center for Quantum Information, Slovak Academy of Sciences, D u´ bravsk´a cesta 9, 845 11 Bratislava, Slovakia b Faculty of Informatics, Masaryk University, Botanick a´ 68a, 602 00 Brno, Czech Republic c Quniverse, L´ısˇcˇ ie u´ dolie 116, 841 04 Bratislava, Slovakia

Abstract. A set of all states of a bi-partite quantum system can be divided into subsets each of which contains states with the same degree of entanglement. In this paper we address a question whether local operations (without classical communication) affect the entanglement-induced state ordering. We show that arbitrary unilocal channel (i.e., a channel that acts on one sub-system of a bi-partite system only) might change the ordering for an arbitrary nontrivial measure of entanglement. A slightly weaker result holds for the maximally entangled states. In particular, the maximally entangled states might not remain the most entangled ones at the output of a unilocal noise channel. Keywords. Quantum entanglement, local dynamics, entanglement measure, state ordering

1. Quantum entanglement Quantum phenomena (such as quantum dense coding [1], quantum teleportation [2], quantum secret sharing [3], etc.) associated with the existence of quantum entanglement represent one of the most important pillars of quantum information theory [4]. In spite of all the progress in understanding the nature of this phenomenon some features of the concept of quantum entanglement are still to be properly illuminated. In particular, due to the seminal work of Reinhard Werner [5] and others (see e.g. the review article [6]) we have a precise mathematical definition of what does it mean when we say that a bi-partite state is entangled. On the other hand a clear generally applicable operational meaning of the entanglement is still missing. In this paper we will analyze some dynamical aspects of quantum entanglement. Specifically we will study the relation between unilocal operations and static (kinematic) properties of quantum entanglement expressed in terms of the entanglement-induced state ordering. The concept of quantum entanglement is relatively easy to understand when we deal with pure states of bi-partite systems. This easiness originates in a close (mathemati1 Corresponding Author: M´ ario Ziman, Research Center for Quantum Information, Slovak Academy of Sciences, D´ubravsk´a cesta 9, 845 11 Bratislava, Slovakia

M. Ziman and V. Bužek / Entanglement Measures: State Ordering vs. Local Operations

197

cal) relationship between the concept of entanglement and the concept of statistical correlations. In fact, for pure quantum states these two concepts can be quantified by the same functions and the meaning of the statement “not entangled” is equivalent to the “not correlated”. However, conceptual differences between entanglement and statistical correlations become striking when we consider mixed states. An important feature of quantum entanglement reflecting its behavior under local operations and classical communication has been known for some time [4]. Namely, it is well established that two (classically) communicating distant parties cannot entangle their quantum systems without performing a global operation (corresponding to some effective interaction). In other words, arbitrary local operations cannot create the entanglement even if these actions are coordinated by an exchange of classical information. Moreover, local unitary transformations do not affect the quantum entanglement at all. These properties form a basis of our intuitive picture of quantum entanglement. Let us summarize these “natural” properties of entanglement: • The quantum entanglement is a property of a quantum state. • A quantum state is entangled, if it cannot be prepared from a factorized state (A ⊗ B ) by an action of local operations and classical communication, i.e. it  (j) cannot be expressed as a convex sum of factorized states ( AB = j pj A ⊗ (j)

B ). • LOCC (local operations plus classical communication) operations applied to an arbitrary (even entangled) quantum state can only destroy the entanglement. • Locally unitary equivalent quantum states are equally entangled. As we have already said, the concept of “not being entangled” is well defined. Nonentangled states are called separable. There is also a common agreement on the notion of maximally entangled quantum states that represent the other extreme. We say that a bi-partite quantum state is maximally entangled if it is pure and the two subsystems are in maximally mixed states, i.e.  AB = |Ψ Ψ| and TrB [|Ψ Ψ|] = TrA [|Ψ Ψ|] = d1 I with d = min {dimHA , dimHB }. There are two basic questions: i) whether a given state is entangled, or not?, and ii) whether we can compare the entanglement of different quantum states. Both questions can be addressed via the so-called entanglement measures. In this paper we will focus our attention on the concept of entanglement measures. We will study dynamics of entanglement under the action of local channels. Our paper is organized as follows: We start with a brief introduction to entanglement measures. Then we will analyze the stability of entanglement-induced state ordering and the properties of maximally entangled states with respect to local operations, in particular for the socalled unilocal channels. Finally, we will discuss some conceptual consequences of our analysis.

2. Entanglement measures The entanglement (see a recent review [7]) has been identified as the key ingredient in applications such as the quantum teleportation, the quantum secret sharing, etc. However, it is also known that the presence of entanglement itself does not guarantee the success of a protocol. For instance, an arbitrary entangled state cannot be used for the teleporta-

198

M. Ziman and V. Bužek / Entanglement Measures: State Ordering vs. Local Operations

tion. Even if a state can be exploited for this protocol the success/rate of the teleportation depends on the particular state. Hence, it seems there are states with different “quality” and “quantity” of entanglement. In order to quantify a degree of entanglement entanglement measures have been introduced. These measures are functionals defined on a state space designed to quantify the amount of entanglement in a given state. During the last ten years the topic of entanglement measures has attracted a lot of attention and many important results has been discovered. Principally there are two approaches to the entanglement measures: i) the operational approach, and ii) the axiomatic approach. The aim of the first approach is to adopt a procedure (protocol) that crucially depends on the presence of entanglement (for example the quantum teleportation), and to quantify its success of performance depending on the particular state. Such measure would give a direct operational meaning to quantum entanglement associated with a given state. Unfortunately no such (universal) procedure is known. In the abstract axiomatic approach we reformulate our intuitive understanding of entanglement into several axioms. There exist several different (not completely equivalent) choices for the system of axioms [8], however our aim is not to discuss all these choices. We say that the functional E : S(H) → [0, ∞] is an entanglement measure if the following properties hold: 1. Sharpness: E( AB ) = 0 if and only if  AB is a separable state. 2. Local unitary invariance: E(U A ⊗ UB AB UA† ⊗ UB† ) = E(AB ) for all unitary transformations U A , UB and all states AB . 3. Normalization: E(AB ) is maximal only for maximally entangled states, i.e. E(AB ) = maxAB E(AB ) if and only if Tr A AB = TrB AB ∼ I and Tr2AB = 1. 4. Nonincreasing under LOCC: A general LOCC operation transforms the original state AB into a mixture of states ω kAB = EkA ⊗ EkB [AB ] with probabilities p k . This condition guarantees that the entanglement is (on average) not created by AB LOCC operations, i.e. E( ) ≥ AB k pk E(ωk ).   AB AB 5. Convexity: E( k pk ωk ) ≤ k pk E(ωk ). 6. Additivity on pure states: E(Ψ AB ⊗ ΦA B  ) = E(ΨAB ) + E(ΦA B  ) for all pure states ΨAB , ΦA B  . The first four properties from the above list are in an agreement with our intuitive picture discussed in the previous section. In order to motivate the remaining two properties we have to take into account a situation in which a pair of systems is a part of a larger composite object. Without the loss of generality we can assume to have three parties (systems) A, B, C in a pure state Ω ABC . By performing measurement on the system C and reading an outcome j (associated with the state transformation IAB ⊗ FjC ) the original state  AB = TrC ΩABC is transformed into the state ωjAB = TrC ΩABC = TrC (IAB ⊗ FjC )[ΩABC ]. This happens with some probability p j . j Without the knowledge of the observed outcome j, the experimentalists possessing the systems A and B can use only the entanglement contained in the state  AB , because the measurement performed on C does not affect the average state  AB . However, if they acquire the information about the outcome j, they can exploit the entanglement shared in particular states ωjAB , hence they can on average exploit j pj E(ωjAB ) of the entanglement. The knowledge of j cannot decrease the entanglement contained originally in AB . Hence, although the measurement on the system C is a local action, the entan-

M. Ziman and V. Bužek / Entanglement Measures: State Ordering vs. Local Operations

199

glement between A and B can increase, i.e. the third party can assist to A and B to increase the entanglement they share providing that the information on j is communicated to A and B. In fact, the  measurements on the system C induces convex decompositions of the state AB = j pj ωjAB , thus we get the convexity condition for entanglement measures. For example, let us consider three parties A, B and C share a GHZ state |Ω ABC = √1 (|000 + |111 ). A bi-partite density operator  AB describes a classically maximally 2 correlated state, which is not entangled at all and cannot be used for the teleportation. On the other hand, if the third party C performs a measurement in the dual basis |± C = √12 |0 ± |1 then for both outcomes ±1 the parties A and B share a maximally AB = 12 (|00 ± |11 )(00| ± 11|). We see exentangled quantum state. In particular, ω ± plicitly that such an assistance by the third party can significantly increase the entanglement - this is the reason for the convexity condition. Taking the maximum of average entanglement over all decompositions we obtain the so-called entanglement of assistance  [9], Eassist (AB ) = max j pj E(ωjAB ). The requirement of the additivity is a rather natural property of the quantum entanglement, however we lack some clear operational reason for it and it is not trivially satisfied for the measures we use. For example, the additivity of entanglement of formation is one of the most important open problems in the quantum information theory. Therefore, it is demanded that this property holds only for tensor product of pure states. In a sense this should guarantee some scaling properties of quantum entanglement, i.e. more-dimensional systems can be more entangled.

3. Ordering vs. local operations Entanglement measures enable us not only to decide whether a given state is entangled, but they also allow us to conclude whether one state is more entangled than another. In fact, any entanglement measure can be used to induce an ordering on a set of quantum states. However, it has been pointed out in Ref. [10] and analyzed by many others [11] that entanglement-induced orderings for two different entanglement measures E1 , E2 can differ. Even for the most commonly used measures of entanglement [11] there exists a pair of states ω AB and AB such that E1 (AB ) > E1 (ωAB ), but E2 (AB ) < E2 (ωAB ). In Ref. [12] we addressed the question whether for a given entanglement measure the ordering is preserved under the action of local operations (without a classical communication). In a sense, we postulated an additional axiom that should be fulfilled by a “good” entanglement measure. There are several proposals for entanglement measures satisfying the basic properties 1-4 from the above list. For example, the entanglement of formation [13], the concurrence [14], tangle [15], the relative entropy of entanglement [16], the negativity [17], the squashed entanglement [18], etc. Certainly, the practical computability might be a non-trivial problem. In most cases the optimization and the minimization can be accomplished  only numerically. For a two-qubit  system the entanglement of formation Ef = inf j pj S˜vN (Ψj ), the tangle τ = inf j pj S˜L (Ψj ) and the concurrence √ C = τ are mutually closely related and they are straightforward to to compute. We used the notation S˜ for the corresponding entropy S of the reduced state ω = Tr B Ψ. The infima are taken over all convex decompositions of the given state  into pure states

200

M. Ziman and V. Bužek / Entanglement Measures: State Ordering vs. Local Operations

Cout

C2 Cout 2 Cout 1

C1

Cin Cin 2 1

Cin

Figure 1. The input/output diagram for the concurrence for two families of states: 1) Werner states 2 = qΨ+ +(1−q) 14 I with Ψ+ being a projector onto maximally entangled state |ψ+  = √1 (|00+|11), 2 and 2) pure states 1 = |ψψ| with |ψ = α|00 + β|11. We consider the depolarizing channel with p = 1/2. The states from the counterexample discussed in the paper are displayed and the change in the ordering is visible. The region under the line Cout = C in represents the allowed region that is achievable by local channels. The concurrence is measured in dimensionless units.

{Ψj }. The indexes vN , L stand for the von Neumann entropy (S vN = −Tr log ) and the linear entropy S L √= 2(1 − Tr2 ), respectively. It was√shown√in [14]√that for √ two qubits Ef = h( 12 [1 + 1 − τ ]), τ = C 2 and C = max{0, λ1 − λ2 − λ3 − λ4 }, where λj are decreasingly ordered eigenvalues of the matrix R = (σ y ⊗σy )∗ (σy ⊗σy ) and h(x) = −x log x − (1 − x) log(1 − x) is the binary entropy. In our previous work [12] we have shown that a stability of the entanglementinduced ordering is not compatible with the listed axioms. A simple counter-example one can present involves four qubits divided into two groups. Moreover, we have explicitly shown that the ordering is not preserved for all two-qubit measures providing one of the subsystems is affected by the depolarizing channel E p [ω] = p + (1 − p) 12 I. The violation of the ordering is depicted in the diagram on Fig. 1. Based on this explicit counterexample we can argue that there is no (nontrivial) entanglement measure E that is stable under the action of local operations of the form E ⊗ I, where E is a tracepreserving completely positive linear map on the system A only. Let us consider the so-called unilocal channel of the form E ⊗ I and some entanglement measure E. The action of such local channel can be expressed in the [E in , Eout ]diagram with respect to a given measure of the entanglement E. Whenever we find that for fixed values of E out there exist more input values E in , one can easily construct a suitable counter-example violating the condition of the ordering-preservation E(1 ) > E(2 ) ⇒ E(1 ) ≥ E(2 )

(1)

valid for all states 1 , 2 and j = E ⊗ I[j ] (j = 1, 2). More specifically. Let us define a “horizontal fiber” F h (Eout ) to be a set of all values of Ein such that there exists a state in with E(in ) = Ein and E(E ⊗ I[in ]) = Eout .   Whenever Fh (Eout ) ∩ Fh (Eout ) = ∅ for all pairs of possible values E out , Eout and   Fh (Eout ) = Fh (Eout ) ∩ Fh (Eout ) = Fh (Eout ), the counter-example can be designed.   Consider Eout > Eout . Because of the nonempty intersection of F h (Eout ), Fh (Eout ),

M. Ziman and V. Bužek / Entanglement Measures: State Ordering vs. Local Operations

201

there are states jin (j = 1, 2) with the same amount of the initial entanglement 1 2 1 2  Ein = Ein , but different values of the final entanglement E out = Eout > Eout = Eout . 1 2 Moreover, it is possible to choose  in and in to have different values of entanglement so that the ordering is not preserved, in particular, E( 1in ) < E(2in ). Each unilocal channel E determines a set SE in the [Ein , Eout ]-diagram. In particular, for S E forming some region (i.e. two-dimensional geometrical object) the ordering is not preserved, because   there are values Eout , Eout for which F h (Eout ) ∩ Fh (Eout ) = ∅. The formal description presented in the above paragraph as well as the particular analysis itself might be technically difficult. In fact, the illustration of the set S E requires to evaluate the entanglement for all possible states. However, intuitively the situation expressed in Fig. 1 is not that complicated. The observation that deserves special attention is that in order to avoid the counterexamples of the above form the entanglement measure and the transformation E must have very specific (and very peculiar) properties that are reflected in the [E in , Eout ]diagram. If the possible values of E out form a continuum (which is the case for all the measures we use), then the corresponding set S E must form a line. But this means, that either the equally entangled states are always mapped into the equally entangled states, or SE consists of horizontal and vertical lines. The corresponding maps would be indeed interesting. We started our discussion with the question whether there exists an entanglement measure such that for all channels E ⊗ I the induced ordering is preserved. However, the analysis led us to another questions. Specifically, for which channels a given entanglement measure is preserved? Our conjecture is that essentially arbitrary local channel affects the ordering. The only known exceptions are: 1) a unitary channels (E out = Ein ), 2) and the entanglement-breaking channels (E out = 0). Other “entanglement-orderpreserving” channels would be of interest per se. There is a strong evidence that such channels do not exist. Consequently, it seems that the measures stable under local operations should be discrete, i.e. the entanglement can achieve only certain countable set of values. An example of such measure is the trivial δ-measure that answers the question whether a given state is entangled, or not. Our statement holds modulo this type of ”discrete” entanglement measures.

4. Maximal entanglement vs. local operations It is important to know how the entanglement behaves under the action of quantum dynamics [19]. For example, it is interesting to know whether local sources of decoherence are relevant for a given quantum protocol based on entangled states. In the previous section we have analyzed how the local operations affect the entanglement-induced ordering. Positive answer to such question would give us a strong tool how to analyze the effect of local noise in general settings just by analyzing the behavior of the most entangled states. Unfortunately, we have found that the situation is puzzling, because it seems that essentially arbitrary unilocal channel does not preserve the ordering whatever measure we choose. In this section we will focus on a simpler question: How much can we learn from the analysis of the dynamics of maximally entangled states? In Ref. [12] we concluded that maximally entangled state remains most entangled also after the application of the local transformation E ⊗ I. Unfortunately, this

202

M. Ziman and V. Bužek / Entanglement Measures: State Ordering vs. Local Operations

statement is not correct and there is a loophole in the proof [21,22]. Here is a simple counter-example. Consider a system consisting of four qubits (the qubits A, A  on one side and B, B  on the other one) and a local map E AA = P0 ⊗ I + P1 ⊗ A, where Pj is defined as Pj [X] = Pj XPj (Pj = |j j|), and A[X] = 12 Tr(X)I. This transformation “checks” the state of A and either leaves A  unaffected, or it contracts its state into a maximally mixed state. We will analyze the action of such channel on two states: 1) 1 = ρABA B  = |0 0|A ⊗ |0 0|B ⊗ PA+ B  , or 2) maxi+ + + + mally entangled state  2 = P + = PABA  B  = PAB ⊗ PA B  , where PAB is a projector onto a maximally entangled state of qubits A, B, and similarly for P A+ B  . The first of these states is invariant under the action of E AA ⊗ IBB  , i.e. 1 = 1 , but 2 = EAA ⊗ IBB  [P + ] = 12 1 + 12 |1 1| ⊗ |1 1| ⊗ 14 I. The state 2 is, if entangled, for sure is strictly less entangled than  1 , i.e. ordering is not preserved for an arbitrary measure of entanglement. The convexity guarantees that E( 2 ) ≤ 12 E(1 ) < E(1 ). This result suggests that it is not straightforward to see how much the analysis of dynamics of maximally entangled states can tell us about the entanglement dynamics in general. On the other hand, in spite of the result related to the entanglement-induced ordering, in the present case the maximality is preserved for larger class of channels. Their characterization is an open problem and will be analyzed elsewhere [22]. An interesting feature that remains valid is that all maximally entangled states are (under unilocal channels) mapped into states with the same amount of entanglement [12]. This holds for any measure of entanglement.

5. Speculations and conclusions As a result of our analysis we discovered new features and properties of entanglement measures. We found that the ordering that implies statements such as “one state is more/less entangled than another” is not preserved under the action of local operations. Moreover, such ordering is affected by all unilocal operations except the unitary and the entanglement-breaking channels. Surprisingly enough, we also found that the maximally entangled states might be more fragile than “less” entangled states. This might sound counter-intuitive, but in some realistic cases, in which the systems are affected by a local noise, it could be better to start with less (noise-dependent) entangled state in order to increase the success of the protocol. Hence, the operational meaning of the property “being more/less entangled” is questionable. Operationally, “more entangled” should be synonymous to “having larger rate” of success. However, just a small modification of protocols (e.g. taking into account a local noise) might change this interpretation. Hence, does it make any sense to use the entanglement measures for the state ordering? If not, then what are these measures good for? Entanglement measures still provide us with very powerful tools enabling us to decide the basic question, whether a given state is entangled, or not. In fact, it is much simpler to compute the concurrence of two qubits than to prove the (non)existence of a separable decomposition. It might be that the idea of entanglement-induced state ordering cannot be based on some entanglement measure. To introduce such concept one should probably adopt different approach, in which the stability with respect to local operations is fulfilled “by the definition”. Even in this case we have more options depending on the class of operations we will consider. We can say that a state ω 1 is more,

M. Ziman and V. Bužek / Entanglement Measures: State Ordering vs. Local Operations

203

or equally entangled than a state ω 2 (ω1  ω2 ) if and only if there exists a completely positive tracepreserving linear operation E A ⊗ EB such that ω2 = EA ⊗ EB [ω1 ]. This is compatible with the fact, that entanglement can be only decreased by the action of local operations (LO). Alternatively, one can use the class of LOCC operations, or stochastic LOCC (SLOCC) operations. Two states are equally entangled if ω 1  ω2 and ω2  ω1 simultaneously. If two states are not equivalent, but ω 2  ω1 , then ω2  ω1 . All these types of entanglement-based orderings are, in principle, partial, i.e. not all states are comparable. For example, using the SLOCC-ordering all two-qubit entangled states are equally entangled, because they can be used for the teleportation. The LOCC-ordering is more strict and for the LO-ordering pure states with different Schmidt coefficients are not comparable. Intuitively, the most physical/operational is the LOCC-based state ordering. Recently, Kinoshita et al. in [23] analyzed compatibility of the LOCC-based ordering under the action of local operations. They presented an example of two states ω1  ω2 that are transformed by a unilocal operation E ⊗ I (the so-called selective entanglement-breaking channels) into ω 1 , ω2 such that ω2  ω1 . This explicit example supports our conclusion about the existence of entanglement-induced state orderings compatible with local operations, because it shows that for an arbitrary entanglement measure satisfying the the LOCC monotonicity condition the entanglement-induced ordering is not preserved. But, one can make even stronger conclusion that also the “operational” LOCC-based state ordering is not robust with respect to local operations. It seems that there is no way how to introduce a nontrivial entanglement-related state ordering compatible with local operations. The only option is to use the trivial δ-measure, or some simple modification of it. In the analysis of entanglement dynamics it is of interest to specify times at which the entanglement disappears. Although any particular dynamics depends on the initial state, these “entanglement-breaking” time instants t sep can be completely characterized by the analysis of the maximally entangled state. The channel is called entanglementbreaking E if and only if ω  = E⊗I[ω] is separable for all initial states ω. It is sufficient to verify this property for a maximally entangled state, i.e. whether E(E ⊗I[P + ]) = 0 [24]. The local dynamics is given by a one-parametric set of completely positive maps E t . We have analyzed [20] the general qubit master equation generating semigroup dynamics. The qubit semigroup evolution is characterized by two time scales: the decoherence time Tdecoherence and the decay time T decay . What are the limits on the entanglement decay? Which process is the fastest one? These questions are not answered in [20], but all the necessary tools are derived in that paper. It is known that in some cases t sep → ∞, but what is the shortest possible decay time t sep ? The result is that there is no limit and t sep can be arbitrarily small. For example, under the action of a local depolarization process Et [] = e−t/T  + (1 − e−t/T ) 12 I the maximally entangled states evolves into the state ωt = e−t/T P+ + (1 − e−t/T ) 14 I (Werner states). Hence, the entanglement vanishes for tsep = T ln 3. The parameter T can be adjusted so that the entanglement is destroyed in arbitrarily small time t sep . In general, the vanishing decoherence rate guarantees the shortest possible entanglement decay time, i.e. the process of entanglement decay can be ”infinitely” fast. Let us get back to the status of entanglement measures. The main message of this contribution is that the quantification of entanglement based on entanglement measures define a state ordering that is not preserved under the action of local operations. The interpretation of these measures should be reconsidered. It seems that large values of

204

M. Ziman and V. Bužek / Entanglement Measures: State Ordering vs. Local Operations

entanglement measures characterize the “distance” from the set of maximally entangled states, which is clearly defined. Similarly, small values should correspond to states that are very far (in the sense of entanglement) from the maximally entangled ones and very close to the separable region of the state space. The particular mathematical forms of these statements is not known, but the meaning of entanglement degree could be hidden there. The axiomatic entanglement measures can quantify different aspects of quantum entanglement, or they can serve as bounds for particular protocols. To understand the entanglement itself it is important to understand the numbers we use to quantify this phenomenon. Thinking about the relation between the state ordering, the entanglement measures, and the robustness with respect to local operations, opens new interesting conceptual questions deserving a deeper investigation.

Acknowledgements We would like to thank to Marco Piani for pointing out that there is a wrong statement in our earlier paper [12]. We thank him for interesting and encouraging discussions. This work was supported in part by the European Union projects QAP, CONQUEST, INTAS project number 04-77-7289, and by the Slovak Academy of Sciences via the project CEˇ GA201/01/0413. PI, and by the projects APVT-99-012304 and GA CR

References [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20] [21] [22] [23] [24]

C.H. Bennett and S.J. Wiesner, Phys. Rev. Lett. 69, 2881 (1992). C.H. Bennett, G. Brassard, C. Crepeau, R. Jozsa, A. Perez, and W.K. Wootters, Phys. Rev. Lett. 70, 1895 (1993). M. Hillery, V. Buˇzek, and A.Berthiaume, Phys. Rev. A 59, 1829 (1999). M.A. Nielsen and I.L. Chuang, Quantum Computation and Quantum Information, (Cambridge University Press, Cambridge, 2000). R.F. Werner, Phys. Rev. A 40, 4277 (1989). M.B. Plenio and S.S. Virmani, in Lectures on Quantum Information, eds. D.Bruss and G.Leuchs (Wiley, Weinhein. 2007), p. 161 (2007). M.B. Plenio and S.S. Virmani, Quant. Inf. Comp. 7, 1 (2007). M.J. Donald, M. Horodecki, and O. Rudolph, J. Math. Phys. 43, 4252 (2002). D.P. DiVincenzo, The entanglement of assistance in Lecture Notes in Computer Science 1509 (SpringerVerlag, Berlin, 1999), pp. 247-257. J. Eisert and M.B. Plenio, J. Mod. Opt. 46, 145 (1999). A. Miranowicz and A. Grudka, Phys. Rev. A 70, 032326 (2004). M. Ziman and V. Buˇzek, Phys. Rev. A 73, 012312 (2006). C.H. Bennett, D.P. DiVincenzo, J. Smolin, and W.K. Wootters, Phys. Rev. A 54, 3824 (1996). W.K. Wootters, Phys. Rev. Lett. 80, 2245 (1998). V. Coffmann, J. Kundu, and W.K. Wootters, Phys. Rev. A 61, 052306 (2000). V. Vedral, M.B. Plenio, M.A. Rippin, and P.L. Knight, Phys. Rev. Lett. 78, 2275 (1997). G. Vidal and R.F. Werner, Phys. Rev. A 65, 032314 (2002). M. Christandl and A. Winter, J. Math. Phys. 45, 829 (2004). K. Zyckowski, P. Horodecki, M. Horodecki, and R. Horodecki, Phys. Rev. A 65, 012101 (2002). M. Ziman and V. Buˇzek, Phys. Rev. A 72, 052325 (2005). M. Piani, private communication. M. Piani and M. Ziman, in preparation. Y. Kinoshita, R. Namiki, T. Yamamoto, M. Koashi, and N. Imoto, quant-ph/0611171. M. Horodecki, P.W. Shor, and M.B. Ruskai, Rev. Math. Phys 15, 629 (2003).

Quantum Communication and Security ˙ M. Zukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

205

Diamond-based Quantum Information Technologies Sergei KILIN a,1 , Alexander NIZOVTSEV a , Alexander BUKACH a , Jean-François ROCH b , François TREUSSART b , Jörg WRACHTRUP c , Fedor JELEZKO c a B.I. Stepanov Institute of Physics, NASB, Nezavicimosti 68, Minsk, 220602, Belarus b Ecole Normale Supérieure de Cachan, 61, avenue du President Wilson, 94235 Cachan Cedex, France c University of Stuttgart, 3.Physikalisches Institut, 70550 Stuttgart, Germany Abstract. Quantum information technology (QIT) is extremely fast developing area strongly connected with achievements in modern physics. Different fields contribute to the QIT with unknown final leader of possible commercial implementations. Quantum computation and quantum cryptography involve new ideas and make quantum objects more familiar for scientists and engineers. In this paper we present a short review of recent achievements in QIT connected with diamondbased systems – one of the solid-state systems "participating" in the "quantum information race". Keywords. Solid state quantum information processing, QKD, single photon sources

1. Diamond-based versus other solid-state implementations of QITs The field of quantum informatics is rapidly growing towards its possible implementations. New achievements in the investigations of different candidates for prototypes of quantum information hardware (qubits, gates, scalable quantum processors, quantum memories and repeaters, etc.) are emerging in a short time scale, making leading edge of the investigations wider and more flexible. This fact leads to the necessity of the reviewing the field continuously. Development of quantum information requires the fabrication of basic components (quantum tool box), which can be reliably controlled. The most reliable systems are evidently coming from solid-state physics. Until recent time, solid-state quantum gates have been implemented with superconducting charge qubits [1] and biexciton qubits in a semiconductor quantum dot [2]. Two different systems have also been envisaged for using a single electron spin as a carrier for quantum processing. The first deals with paramagnetic centers, being either defects created in silica SiO 2 or impurities (e.g. phosphorous atoms) embedded in an ultra-pure silicon film of 28 Si isotope [3]. Single spin read-out was recently observed by magnetic force microscopy for the E’ center in irra1 Corresponding Author: Sergei Kilin, B.I.Stepanov Institute of Physics, NASB, Nezavicimosti 68,Minsk, 220602, Belarus

206

S. Kilin et al. / Diamond-Based Quantum Information Technologies

diated silica [4] and by electrical current measurement for a single paramagnetic trap at the Si/SiO2 interface of a field-effect transistor [5]. The second deals with the semiconductor AlAs/AlGaAs quantum dot systems. Electrical read-out of a single electron spin was also recently achieved in such a system [6], using spin-to-charge conversion and a quantum-point-contact to detect the single electron charge. Diamond-based systems are becoming more and more attractive for QITs [7]. Paramagnetic defects in diamond like the N-V colour center can be individually observed [8] and their spin state can be optically detected [9]. Even at the room temperature, they have coherence times sufficient for non-trivial coherent spin manipulation [16]. In [NV]− systems, an electron spin coherence time of about 50 μs at room temperature, has been measured in relatively impure diamond [11]. In this material, the coherence time is limited by local magnetic field fluctuations induced by flip-flops of electron or nuclear spins of nearby defects. Recent observations have demonstrated the level of 350 μs for the coherence time at room temperatures [7]. To extend such times further, the need for ultra-pure diamond samples was highlighted [12]. Nuclear spins in semiconductors [13] are also envisaged as carriers of quantum information thanks to their very long coherence time, lasting up to seconds. However, current technology for applicable schemes, relying on nuclear spin ensemble measurements and read-out of a single nuclear spin in semiconductor devices, are experimentally out of reach and will remain so for the foreseeable future. On the contrary, in the diamond crystal lattice, nuclear spins, like 13 C carbon, can be naturally coupled via hyperfine interaction (hfi) to the electron spin of a neighbouring paramagnetic defect like the [N-V] − colour center. This coupling leads to a hyperfine structure in the colour center energy levels [14] which has been proposed as the basis of a scalable quantum processor built with the help of two-qubit quantum gates, formed by the N-V colour center and a set of neighboring nuclear spins [15]. A recent experiment has shown that optical read-out of the electron spin state indeed gives access to the single nuclear spin state [16], the long coherence time usually associated to nuclear spin being preserved due to a low natural isotopic proportion (1.1%) of 13 C atoms. As a further step, coupling between the electron and nuclear spins has been used to implement a two-qubit quantum logical gate [7,16], directly adapted from bulk nuclear magnetic resonance quantum computing techniques [17], but applied in a scalable fashion. Accessibility of single spins for coherent manipulation even at room temperature, coherent control and read-out, demonstrated by the investigations of the N-V colour centers, together with the proposals to use these centers for room temperature single-photon emitters [18], quantum cryptography [19], quantum memory and quantum repeaters [20], puts the diamond-based systems on much more higher level in "quantum information race".

2. Material engineering of diamond at the nanoscale level First experiments which successfully demonstrated high potential of the diamond-based systems for QITs, have also shown that primary task for further advances of the systems is material improvement allowing control of the nitrogen and carbon isotopes contents as well as nanoengineering of diamond samples. Fortunately diamond material engineering has matured quite substantially during recent years.

S. Kilin et al. / Diamond-Based Quantum Information Technologies

207

1. Diamond has been recognized as the ultimate material for many advanced technological applications. Until now, it has not fulfilled this potential as it could not be synthesized with sufficient material quality. Continuous efforts to improve chemical vapour deposited (CVD) diamond has lead to a long-awaited breakthrough [12] in diamond synthesis technology required for advanced optics and electronics applications. In particular, it has become possible to control the nitrogen content in a single crystal diamond grown by CVD from tens of parts per million carbon atoms (ppm) down to below a ppb (parts per billion carbon atoms) [21] and the concentration of other impurities (e.g. boron or hydrogen) can be similarly controlled. It can provide the concentrations of the N-V centers in pure diamond less than 10 12 cm−3 , (i.e. less than one defect per cubic micrometer). Also nuclear isotope purity, especially with respect to 13 C, is an important figure of merit for pure diamond material production. Application of such ultra-pure single-crystal synthetic diamond to quantum information processing and communication will maximise phase memory time for electronic spin qubit which is limited by the value of 2T 1 = 2.5 ms at room temperature. 2. Ion implantation is an exceedingly useful and practical method for the modification of materials properties of semiconductors. Furthermore, it has been consistently shown that colour centers can be created in diamond with sub-micron spatial resolution via irradiation with focused electron or ion beams (FIB) [22]. Recently, high levels of control of the implantation process has been demonstrated [23] including the implantation of 15 N and the identification of [ 15 N-V] as distinct from [14 N-V], the implantation of N + 2 dimers to produce [N-V]/N dipole coupled centers only a few nanometers apart, the production of ensembles of [NV] centers with an inhomogeneous linewidth of only 15 GHz [24] and the identification of single [N-V] centers with coherence times of 350 μs [25]. Photon antibunching from [N-V] − centers created by ion implantation has been demonstrated with a g(2)(0) < 0.1 [26]. A subset of implanted [N-V] − centers were shown to be lifetime limited with essentially no spectral diffusion and importantly display a DC Stark shift of the order of 12 GHz/(V/μm). The importance of these results is that they demonstrate that atomic level control is now achievable using the implantation process. Ion implantation is also the method of choice for the introduction of impurities other than N. For example, SiV centers created by ion implantation were recently demonstrated [27] to display photon antibunching with a narrow emission bandwidth of 5 nm. To create scalable quantum computer on single spins, a method of producing ordered arrays of colour centers should be available. The simplest way to generate such arrays is via implantation through QuantFoil masks. Other techniques for nano-lithography in diamond can be also explored, such as e-beam lithography and spin coating of PMMA resist, offering ordered arrays of NV centers aligned to surface gates. 3. Important unavoidable program task for diamond-based QITs is creating photonic microstructures in diamond samples including micromirrors, microwaveguides, etc. The breakthrough in diamond material processing consists in threedimensional micromachining of free standing single-crystal diamond using an ion-beam lift-off technique [28]. This technique, which was initially developed as a method to remove thin layers from bulk diamond samples [29], allowed for the construction of an all-diamond optical waveguide structure. Additionally, pho-

208

S. Kilin et al. / Diamond-Based Quantum Information Technologies

tonic crystal slabs of diamond with an array of defect microcavities containing [N-V]- centers can be created [30]. 4. Colour centers embedded in diamond nanocrystals present a good "raw" material for QITs. Nanodiamonds can be produced by detonation of explosives with unique properties, such as uniform small particle size (3-5 nm) and non-facetted shape. Primary particles consist of single crystals but tend to aggregate into much larger polycrystalline agglomerates containing not only nanodiamond but also a small fraction of graphitic carbon. The nanodiamond contains about 2 wt.% of nitrogen in its crystal lattice, which makes this material a promising candidate for electronic applications. Purification and size selection of the nanodiamonds can be achieved afterwards, through centrifugation of the solution [31]. Since manipulation of nanocrystals is a lot more flexible than bulk crystals, it offers an alternative to the realization of diamond microstructures using FIB patterning and lift-off techniques [32]. For instance, improvement of photon collection efficiency can be obtained by using appropriate silica structures and spin-coating on their surface the polymer solution containing the size-selected nanocrystals. Note that chemical modification of the nanodiamonds is facilitated in solution, which functionalizes their surface. It also facilitates the synthesis of structured arrays of nanocrystals. 5. The [N-V] − center is not the only defect with potential use for quantum information processing applications in diamond. Moreover in some applications (e.g. single-photon emission) this center has far from ideal properties. However, CVD diamond growth and material post processing offers up a whole new spectrum of defects with potential to stock the diamond quantum tool box. Nickel [33] and Silicon [27] related defect centers in diamond have been demonstrated to act as single-photon sources. These represent only a small fraction of the many optically active centers that have been identified but never considered as potential single photon sources (SPSs). This is particularly true in the infra-red: since diamond has long been considered a wide band gap material for applications in the UV, little attention has been given to its potential as a source of single photons in the IR. More than 30 new colour centers have been identified in single crystal CVD diamond, which have not been previously reported in any other diamond. Promising candidates include the Vacancy-Hydrogen and NitrogenVacancy-Hydrogen defects [34] and Xe-related defects [35]. They display luminescent properties at 1358, 1382, 1456, and and 812 nm but their performance as SPSs has not yet been measured. Considerable effort should be focused on developing a detailed understanding of the optical and spin physics of these prospective defects.

3. Quantum characterization of single paramagnetic defect centers in connection with their applications in QITs Precise characterisation and understanding of quantum properties of single colour centers in diamond is still under progress. A great variety of the colour centers and the complex environment conditions together with the strict limitations posed on the candidates for QIT applications makes the characterisation an important and hard problem. The mostly

S. Kilin et al. / Diamond-Based Quantum Information Technologies

209

investigated potential candidate is the nitrogen vacancy [N-V] − defect center in diamond [7,8]. The fact that Nitrogen is a deep electron donor and diamond is a wide bandgap material precludes its use in traditional electronic applications, since thermal stimulation of carriers to the conduction band is negligible at room temperature. However, that property does lead to weak interactions with the surrounding lattice, and consequently to an "atom-like" structure [36] associated with very long coherence times for electron spin states of the colour center ground level. The NV defect in diamond comprises of a nitrogen atom at a lattices cite next to a carbon vacancy giving a center with C 3V symmetry. The negatively charged [N-V] − center [37] exhibits an allowed optical transition between an orbital singlet A 2 ground state and an orbital doublet E excited state which is observed as zero-phonon line (ZPL) [38] at 1.945 eV (λ = 637 nm). The transition has a moderate oscillator strength (0.12 for the total vibronic band, or 0.006 for the ZPL alone), which allows the optical detection of single NV defects. Both the ground and the excited states are spin triplets (S = 1). The spin levels structure of the 3 A2 ground state was well-characterized in the ensemble limit [39] and confirmed by optically-detected magnetic resonance (ODMR) experiments on single centers [8]. The state is split by 2.88 GHz at zero magnetic field into the lower m S = 0 level and the upper m S = ±1 levels. On the contrary, the fine structure of the excited 3 E state that manifested itself in hole-burning ensemble experiments [24,40] was not observed in single-center experiments [9] with one-laser (monochromatic) excitation. Instead, only one narrow line resulting from spin-conserving optical transitions between m S = 0 spin sublevels of 3 E and 3 A states was visible [9] in excitation spectra due to spin-selectivity of intersystem crossing (ISC) between spin sublevels of the 3 E state and the metastable singlet 1 A state of the center [41,42]. It is this photophysical property of the center underlies the opportunity to read-out its spin state optically [7] by monitoring the intensity of emitted fluorescence. Complete fine structure of the excited 3 E state was observed for single NV centers only very recently [43], using two-lasers (bichromatic) excitation which allows to visualize "dark" centers demonstrating non-spin-conserving optical transitions (lambdatransitions) even at zero magnetic and external electric fields. "Bright" centers (visible at monochromatic excitation and usually demonstrated spin-conservation excitationemission cycles) can also manifest non-spin-conserving lambda type EIT resonance at bichromatic excitation. The reason for the non-spin-conserving resonances is connected with the superposition of the excited sub-states with different spin projections into resulting energy states under the action of strain or external electric field in the vicinity of avoided crossings. Finally, three excited spin levels (each – doubly degenerated) split under the strains or external electric field [42,43,44] into two branches, the lower one has avoided crossings and therefore is attributed to the "dark centers", whereas there are no avoided crossings for the upper branch and it presents the "bright centers" [42,43]. As a result, photo-luminescence of N-V defect is associated with a ten-level structure: three levels for the 3 A2 ground state, six levels for the two branches of the 3 E excited state, and a metastable singlet intermediate 1 A state. Taking into account the energy difference between the upper and lower branches a seven-level structure is a good approximation for the modelling quantum dynamics in the specific center [41]. The coherence time of electron spin of N-V center in pure diamond is defined dominantly by it’s interactions with the surrounding nuclear spins formed primarily by the spin-1/2 13 C isotope. Recent spin-echo experiments [45] confirmed a basic idea of the single quantum object spectroscopy that each single object (electron spin of NV center)

210

S. Kilin et al. / Diamond-Based Quantum Information Technologies

experiences its own meso-environment (set of nuclear spins) leading to the individual dynamical response for selected center. As it was observed in [45] this environment is effectively separated into a set of individual proximal 13 C nuclear spins, which are coupled coherently to the electron spin, and the remainder of the 13 C nuclear spins, which cause the loss of coherence. Information about hfi interactions between NV and 13 C spins in different positions retrieved in these experiments can be clarified by ab initio (DFT) calculations [46]. Such calculations are also important for interpretation of electric field effects on single NV centers [43]. The well-characterised spin-qubit system of NV defects can be used for the QIT: the quantum processor implementation can be realized by the coherent spin manipulation. The first step for coherent spin manipulation is to prepare a pure state of the internal spin structure. For the [N-V] − center, spin state initialisation can be easily achieved by optical pumping with a polarised laser beam tuned above the absorption band. Decay from the 3 E level via optical emission dominates but conserves spin. On the other hand, decay via the metastable singlet level 1 A is slower since it does not conserve spin. Competition between those two processes at room temperatures leads to spin polarization of the 3 A ground level, making populated mainly the m s = ±0 substate [47]. Once polarised, the electronic spin can be manipulated using microwave resonant fields and spin echo techniques [48]. Such experiments have been performed on N-V center ensembles [49] and at the level of a single colour center [10]. Read-out of the spin state is achieved optically by observing the fluorescence photons’ emission that occurs only when the spin state is ms = 0 for both 3 A ground and 3 E excited energy levels.

4. Scalable quantum gates in diamond and characteristic requirements for multiple qubits systems Well-established single electron and nuclear spin measurement of N-V colour centers is a key step in solid-state quantum information processing, as it allows for the assessment of the implemented quantum operations such as the generation of spin-entanglement. A two-qubit conditional quantum gate with fidelity of nearly 90% was demonstrated using a single isolated N-V colour center coupled to a 13 C nucleus [16]. Recently spinentanglement was generated for two electron spins belonging to closely spaced pairs of substitutional nitrogen defects NV/N [25]. These realisations of two-qubits entangled states are an important next step towards realistic quantum processors on a long spin chain or 2-D arrays. There are different proposals (architectures) to reach the goal; each of them has different requirements for physical samples. (a) To allow controlling magnetic dipolar and (or) optical coupling between defects in arrays via controlled positioning and external fields, it is necessary to achieve 5 nm defect separation with 2 nm accuracy, which corresponds to 0.5 MHz magnetic dipole-dipole coupling. (b) To reach local addressing of individual spins in arrays, a moderate field gradient of 0.02 G/nm is required for 5 nm defect spacing for single qubits frequency resolution at phase memory time of 350 μs. Alternatively, local addressing and manipulation of spin states can be achieved using two-photon stimulated-Raman transitions. (c) The relatively large Rabi frequencies for single spins should be used to achieve the quantum error correction fidelity threshold. (d) To reach single-shot spin readout at room temperature a low Q resonator structure is required for the necessary improvement of the readout fidelity. Yet,

S. Kilin et al. / Diamond-Based Quantum Information Technologies

211

state-of-the-art readout technique requires at least 10 readout cycles for spin measurements.

5. Diamond-based single-photon sources, QKD, quantum memory and repeaters Due to an increasing number of applications, from quantum optics, quantum cryptography and the realization of quantum optical gates, significant efforts have been expended recently in the development of new and reliable single-photon sources [50]. Triggered single photons, emitted by [N-V] − colour centers in a turn-key situation, have recently been used to improve the security of an open-air quantum key distribution (QKD) system compared to equivalent faint laser pulses [51]. Working conditions were however limited to open-air night operation since [NV]- center broadband emission prevents filtering of daylight stray photons. Moreover, the coherence time of the emitted photons is limited only to a few picoseconds, even at cryogenic temperatures. Since this value is much smaller than the radiative lifetime of the dipole emitter, all interference effects associated to the overlap of two independent single photon wavepackets are wiped out, what naturally limits the applications of [NV]- center in linear optics quantum information processing [52], which requires source generated indistinguishable single-photon states. To date, (near) time-bandwidth-limited single-photon emission was only achieved in a few systems, like quantum dots, single atoms and zero-phonon-line emission from single molecules at cryogenic temperatures. Two-photon interferences were observed and entanglement between photons was generated. Recently, a Nickel-related defect in diamond (NE8) was identified to be a source of single photons in the infrared, emitting at ∼ 800 nm with a room temperature linewidth of 1.5 nm (FWHM) and short photon emission lifetime [33]. The emission concentrated mainly within a ZPL what is a result of extremely small value of the electron-phonon interactions in this defect-free center. In the context of a single-photon source for fiber optic communications, this colour center displays properties which are in many respects superior to the [N-V] − colour center. The attenuation of standard silica glass optical fiber at the [N-V]− wavelength 637 nm to 740 nm is 7 dB/km, whereas for the NE8 wavelength at 800 nm it is 2.8 dB/km. Furthermore, the NE8 linewidth is much smaller at room temperature, compared to the very broad spectral emission of approximately 100 nm from the [N-V] − center. Emission from the NE8 center therefore experiences approximately 3 orders of magnitude less dispersion broadening in standard optical fiber than [N-V]− emission. This is an especially important parameter when considering communications over long distance. Furthermore, it has been shown that these defects can be fabricated by chemical vapour deposition [53] and that the host diamond crystal can be grown directly on the surface of the core of an optical fiber for photon waveguiding [54]. Such properties pave the way to daylight open-air single-photon QKD as well as fiberbased schemes. From other promising candidates for SPS the above-mentioned Hydrogen Vacancy, Hydrogen-Nitrogen-Vacancy and Xe-related defects in diamond [34,35] will probably serve at IR region. Colour centers in diamond were also suggested to use for implementation of the quantum repeater protocol [20]. Specific sequences of laser, radiofrequency and microwave pulses that implement all repeater stages within the NV+ 13 C center: entanglement mapping, swapping and purification are discussed in [55]. Numerical simula-

212

S. Kilin et al. / Diamond-Based Quantum Information Technologies

tion reported there shows high efficiency of such a repeater at low Rabi frequencies of the pulses. The recent finding of the non-spin-conserving transitions for NV centers in strained samples of diamonds [43] gives a new support for a very demanded idea to make all-optical control of single spins and to transfer quantum state of photons on long-lived nuclear spin states [56] realizing quantum memory.

Acknowledgements This work is supported by EU (Specific Targeted Research Project EQUIND, Engineered Quantum Information in Nanostructured Diamond – funded by the FP6 IST directorate as contract Number 034368) and partially by INTAS under grant # 04-77-7289.

References [1] T. Yamamoto, Yu. A. Pashkin, O. Astafiev, Y. Nakamura, and J. S. Tsai, Nature 425, 941 (2003). [2] X. Li, Y. Wu, D. Steel, D. Gammon, T. H. Stievater, D. S. Katzer, D. Park, C. Piermarocchi, and L. J. Sham, Science 301, 809 (2003). [3] B. E. Kane, Nature 393, 133 (1998). [4] D. Rugar, R. Budakian, H. J. Mamin, and B. W. Chui, Nature 430, 329 (2004). [5] M. Xiao, I. Martin, E. Yablonovitch, and H. W. Wang, Nature 430, 435 (2004); see also for a general review E. Yablonovitch, H. W. Jiang, H. Kosaka, H. D. Robinson, D. S. Rao, and T. Szkopek, Proceedings of the IEEE 91, 761 (2003). [6] J. M. Elzerman, R. Hanson, L. H. Willems Van Beveren, B. Witkamp, L. M. K. Vandersypen, and L. P. Kouwenhoven, Nature 430, 431 (2004). [7] J. Wrachtrup, F. Jelezko, J. Phys.: Cond. Matter 18, S807-S824 (2006); A. D. Greentree, P. Olivero, M. Draganski, E. Trajkov, J. R. Rabeau, P. Reichart, B. C. Gibson, S. Rubanov, S. T. Huntington, D. N. Jamieson, S. Praver, J. Phys.: Cond. Matter, 18, S825-S842 (2006). [8] A. Gruber, A. Drabenstedt, C. Tietz, L. Fleury, J. Wrachtrup, and C. Von Borczyskowski, Science 276, 2012 (1997). [9] F. Jelezko, I. Popa, A. Gruber, C. Tietz, J. Wrachtrup, A. Nizovtsev, and S. Kilin, Appl. Phys. Lett. 81, 2160 (2002). [10] F. Jelezko, T. Gaebel, I. Popa, A. Gruber, and J. Wrachtrup, Phys. Rev. Lett. 92, 076401 (2004). [11] T. A. Kennedy, J. S. Colton, J. E. Butler, R. C. Linares, and P. J. Doering, Appl. Phys. Lett. 83, 4190 (2003). [12] J. Isberg, J. Hammersberg, E. Johansson, T. Wikstrom, D. J. Twitchen, A. J. Whitehead, S. E. Coe, and G. A. Scarsbrook, Science 297, 1670 (2002); G. A. J. Amaratunga, Science 297, 1657 (2002). [13] D. Gammon, Al. L. Efros, T. A. Kennedy, M. Rosen, D. S. Katzer, D. Park, S. W. Brown, V. L. Korenev, and I. A. Merkulov, Phys. Rev. Lett. 86, 5176 (2002); T. D. Ladd, J. R. Goldman, F. Yamaguchi, Y. Yamamoto, E. Abe, and K. M. Itoh, Phys. Rev. Lett. 89, 017901 (2002). [14] V. A. Nadolinny, A. P. Yelisseyev, J. M. Baker, M. E. Newton, D. J. Twitchen, S. C. Lawson, O. P. Yuryeva, and B. N. Feigelson, J. Phys. Condens. Matter 11, 7357 (1999). [15] J. Wrachtrup, S. Y. Kilin, and A. P. Nizovtsev, Opt. Spectrosc. 91, 429 (2001). [16] F. Jelezko, T. Gaebel, I. Popa, M. Domham, A. Gruber, and J. Wrachtrup, Phys. Rev. Lett. 93, 130501 (2004). [17] M. Mehring, J. Mende, and W. Scherer, Phys. Rev. Lett. 90, 153001 (2003). [18] R. Brouri, A. Beveratos, J.-P. Poizat, and P. Grangier, Opt. Lett. 25, 1294 (2000); C. Kurtsiefer, S. Mayer, P. Zarda, and H. Weinfurter, Phys. Rev. Lett. 85, 290 (2000); A. Beveratos, S. Kühn, R. Brouri, T. Gacoin, J.-P. Poizat, and P. Grangier, Eur. Phys. J. D 18, 191 (2002). [19] A. Beveratos, R. Brouri, T. Gacoin, A. Villing, J.-P. Poizat, and P. Grangier, Phys. Rev. Lett. 89, 187901 (2002); R. Alleaume, F. Treussart, G. Messin, Y. Dumeige, J.-F. Roch, A. Beveratos, R. Brouri-Tualle, J.-P. Poizat, and P. Grangier, New Journal of Physics 6, 92 (2004).

S. Kilin et al. / Diamond-Based Quantum Information Technologies

213

[20] L. Childress, J. M. Taylor, A. S. Sørensen, M. D. Lukin, Phys. Rev. Lett. 96, 070504 (2006); P. van Loock et al. Phys.Rev.Lett. 96, 240501 (2006). [21] A. Wotherspoon, J. W. Steeds, P. Coleman, D. Wolverson, J. Davies, S. Lawson, and J. Butler, Diamond and Related Materials 11, 692 (2002); P. M. Martineau, S. C. Lawson, A. J. Taylor, S. J. Quinn, D. J. F. Evans, and M. J. Crowder, Gems&Gemology 40, 2 (2004). [22] J. Martin, R. Wannemacher, J. Teichert, L. Bischoff, and B. Kohler, Appl. Phys. Lett. 75, 3096 (1999). [23] J. R. Rabeau, P. Reichart, G. Tamanyan, D. N. Jamieson, S. Prawer, F. Jelezko, T. Gaebel, I. Popa, M. Domhan, and J. Wrachtrup, Appl. Phys. Lett. 88, 023113 (2006). [24] C. Santori, D. Fattal, S. N. Spillane, M. Fiorentino, R. G. Beausoleil, A. D. Greentree, P. Olivero, M. Draganski, J. R. Rabeau, P. Reichart, B. C. Gibson, S. Rubanov, D. N. Jamieson, S. Praver, Optics Express 14, 7986 (2006). [25] T. Gaebel, M. Domhan, I. Popa, C. Wittmann, P. Neumann, F. Jelezko, J. R. Rabeau, N. Stavrias, A. D. Greentree, S. Prawer, J. Meijer, J. Twamley, P. R. Hemmer, and J. Wrachtrup, Nature Phys. 2, 408 (2006). [26] J. Meijer, B. Burchard, M. Dohman, C. Wittmann, T. Gaebel, I. Popa, F. Jelezko, J. Wrachtrup, Appl. Phys. Lett. 87, 261909 (2005). [27] C. Wang, C. Kurtsiefer, H. Weinfurter, and B. Burchard, J. Phys. B: At. Mol. Opt. Phys. 39, 37 (2006). [28] P. Olivero, S. Rubanov, P. Reichart, B. Gibson, S. Huntington, J. Rabeau, A. D. Greentree, J. Salzman, D. Moore, D. N. Jamieson, and S. Prawer, Advanced Materials 17, 2427 (2005). [29] N. R. Parikh, J. D. Hunn, E. McGucken, M. L. Swanson, C. W. White, R. A. Rudder, D. P. Malta, J. B. Posthill, and R. J. Markunas, Appl. Phys. Lett. 61, 3124 (1992). [30] A. D. Greentree, J. Salzman, S. Prawer, L. C. Hollenberg, Phys. Rev. A 73, 013818 (2006); S. TomljevicHanic, M. J. Steel, C. M. de Sterke, J. Salzman, Optics Express 14, 3556 (2006). [31] A. Kruger, M. Ozawa, F. Kataoka, T. Fujino, Y. Suzuki, A. E. Aleksenskii, A. Ya. Vul’, and E. Osawa, Carbon 43, 1722 (2005). [32] On the other side it is also known that nanocrystalline diamond of extremely high quality can be created by the implantation of carbon in silica. [33] T. Gaebel, I. Popa, A. Gruber, M. Domhan, and J. Wrachtrup, New J. Physics 6 (2004), 98; E Wu, V. Jacques, H. Zeng, P. Grangier, F. Treussart, and J.-F. Roch, Opt. Express 14, 1296 (2006). [34] C. Glover, M. E. Newton, P. M. Martineau, S. Quinn, and D. J. Twitchen, Phys. Rev. Lett. 92, 135502 (2004); C. Glover, M. E. Newton, P. Martineau, D. J. Twitchen, and J. M. Baker, Phys. Rev. Lett. 90, 185507 (2003); J. P. Goss, P. R. Briddon, R. Jones, S. Sque, J. Phys.: Cond. Matter 15, S203 (2005). [35] A. M. Zaitsev, A. A. Bergman, A. A. Gorokhovsky, and Mengbing Huang, Phys. Stat. Sol. (a) 203, 638 (2006). [36] S. Ya. Kilin, A. P. Nizovtsev, T. M. Maevskaya, A. Drabenstedt, and J. Wrachtrup, Journal of Luminescence 86, 201 (2000). [37] The NV defects appear in two forms, neutral and negatively charged. [38] The ability to observe the ZPL lines even at room temperature is a result of small electron-phonon coupling, which is the manifestation of large Debye temperature due to the rigidity of the diamond lattice and the small carbon mass. [39] X. F. He, N. B. Manson, and P. T. HFisk, Phys. Rev. B 47, 8816 (1993). [40] D. Redman, S. Brown, and S. C. Rand, JOSA B 9, 768 (1992); N. R. S. Reddy, N. B. Manson, and E. R. Krauz, J. Lumin. 38, 46 (1987); N. B. Manson and C. Wei, J. Lumin. 58, 158 (1994). [41] A. P. Nizovtsev, S. Ya. Kilin, F. Jelezko, I. Popa, A. Gruber, C. Tietz, and J. Wrachtrup, Opt. Spectrosc. 94, 895 (2003); A. P. Nizovtsev, S. Ya. Kilin, F. Jelezko, I. Popa, A. Gruber, and J. Wrachtrup, Physica B 340-342, 106 (2003); Opt. Spectrosc. 99, 233 (2005). [42] N. B. Manson, J. P. Harrison, and M. J. Sellars, Phys. Rev. B 74, 104303 (2006). [43] Ph. Tamarat, N. B. Manson, R. L. McMurtie, A. Nitsovtsev, C. Santori, P. Neumann, T. Gaebel, F. Jelezko, P. Hemmer, and J. Wrachtrup, E-Print Cond-Mat/0610357 (2006); Ph. Tamarat, T. Gaebel, J. R. Rabeau, M. Khan, A. D. Greentree, H. Wilson, L. C. L. Hollenberg, S. Prawer, P. Hemmer, F. Jelezko, and J. Wrachtrup, Phys. Rev. Lett. 97, 083002 (2006). [44] It is known from defects in the C3v symmetry group, that an externally applied field with components orthogonal to the three-fold symmetry axis of the defects, which is defined to be along z, lifts the degeneracy of the excited state 3 E level. A. Kaplyanski, V. Kolyshkin, and V. N. Medvedev, Soviet Physics Solid State, (USSR) 12, 1193 (1970). [45] L. Childress, M. V. Gurudev Dutt, J. M. Taylor, A. S. Zibrov, F. Jelezko, J. Wrachtrup, P. R. Hemmer,

214

S. Kilin et al. / Diamond-Based Quantum Information Technologies

and M. D. Lukin, Science 314, 281 (2006). [46] M. Đuszczek, R. Laskowski, P. Horodecki, Physica B 348, 292 (2004); V. A. Pushkarchuk, S. Ya. Kilin, A. P. Nizovtsev, A. L. Pushkarchuk, V. E. Borisenko, C. von Borczyskowski, and A. B. Filonov, Optics and Spectroscopy 99, 245 (2005); V. A. Pushkarchuk, S. Ya. Kilin, A. P. Nizovtsev, A. L. Pushkarchuk, V. E. Borisenko, and A. B. Filonov, J. Appl. Spectr. 74, 86 (2007). [47] At low, helium, temperatures selective excitation makes more populated the ms = ±1 substates. [48] Alternatively, new perspective method of coherent manipulation can be implemented by the bichromatic optical excitation of strained samples of diamonds with an additional external control parameter – electric field (see [43]). [49] T. A. Kennedy, F. T. Charnock, J. S. Colton, J. E. Butler, R. C. Linares, and P. J. Doering, Phys. Stat. Sol. B 233, 416 (2002). [50] See e.g. New Journal of Physics 6 special issue "Focus on Single Photons on Demand" (2004). [51] R. Alleaume, F. Treussart, G. Messin, Y. Dumeige, J.-F. Roch, A. Beveratos, R. Brouri-Tualle, J.P. Poizat, and P. Grangier, New Journal Of Physics 6, 92 (2004). [52] E. Knill, R. Laflamme, and G. J. Milburn, Nature 409, 46 (2001). [53] J. R. Rabeau, Y. L. Chin, S. Prawer, F. Jelezko, T. Gaebel, and J. Wrachtrup, Appl. Phys. Lett. 86, 131926 (2005). [54] J. R. Rabeau, T. S. Huntington, A. D. Greentree, and S. Prawer, Appl. Phys. Lett. 86, 134104 (2005). [55] A. A. Bukach and S. Ya. Kilin, Opt. Spectrosc. (2007), to be published. [56] Single nuclear spin coherence time at the level of 20 ms has been observed recently for13 C+NV system. M. V. Gurudev Dutt, L. Childress, L. Jiang, E. Togan, J. Maze, F. Jelezko, P. R. Hemmer, and M. D. Lukin, (2007), to be published.

Quantum Communication and Security ˙ M. Zukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

215

Towards Quantum-based Election Scheme a,b,c,1 ˇ Vladim´ır BUZEK, Mark HILLERY, d and M´ario ZIMAN a,b,c Research Center for Quantum Information, Slovak Academy of Sciences, D u´ bravsk´a cesta 9, 845 11 Bratislava, Slovakia b Faculty of Informatics, Masaryk University, Botanick a´ 68a, 602 00 Brno, Czech Republic c Quniverse, L´ısˇcˇ ie u´ dolie 116, 841 04 Bratislava, Slovakia d Department of Physics, Hunter College of CUNY, 695 Park Avenue, New York, NY 10021, USA

a

Abstract. We propose a quantum-based voting protocol. In this protocol votes of individual voters are encoded into highly entangled states that are used to implement the protocol. We show that privacy of the voting can be achieved using quantum resources. Keywords. Quantum privacy, quantum voting, quantum protocol, quantum cryptography, quantum entanglement

1. Privacy and quantum Cryptography is an art of keeping, distributing and reading secret information [1,2]. Since the seminal work of Bennett and Brassard [3] it has been convincingly demonstrated that quantum resources can be used for an efficient distribution of secret keys. The so-called quantum cryptography [4] has been transforming from an experimental stage to a technologically feasible commercial product. In spite of all successes of the quantum cryptography only recently, the first attempts to analyze the potential of quantum resources for achieving the privacy and anonymity in communication protocols have been made. Anonymous broadcast channel is a protocol in which the identity of the sender (or receiver) is hidden, i.e. only the person sending the message will know who sent it. Probably the simplest classical solution to this task has been proposed by David Chaum [5] who has analyzed the so-called dining cryptographers problem. Three cryptographers are having a dinner. When it comes time to pay the bill, the waiter appears and tells them that their dinner has already been paid for. The cryptographers would like to know if one of them paid for the dinner, or whether an outside party (usually assumed to be the NSA) paid the bill. In addition, if one of the cryptographers did pay for the dinner, the identity of this person should not be revealed. How can this be accomplished? The procedure is both simple and clever. Each cryptographer flips a coin, and places it to his right, so that it is between him and the cryptographer sitting next to him (the cryptographers are sitting at a circular table). We shall assume 1 Corresponding Author: Vladim´ır Buˇ zek, Research Center for Quantum Information, Slovak Academy of Sciences,D´ubravsk´a cesta 9, 845 11 Bratislava, Slovakia

216

V. Bužek et al. / Towards Quantum-Based Election Scheme

that each cryptographer can see only the two coins adjacent to him. We shall assign a value of 0 to tails and 1 to heads. Now, each cryptographer adds, modulo 2, the values of the two coins he can see. If he did not pay for the dinner, then he announces the value of the sum. If he did pay for the dinner, he adds 1 to the sum, and announces that value. The three cryptographers then add (again modulo 2) the three announced values. If the result is 0, then the NSA paid for the dinner, and if the result is 1, one of them did. This protocol can be easily extended to an arbitrary number of users, and a slightly modified version can be used for voting. Let us assume there are N voters. Each pair of voters, (j, k) shares a random integer (key) c jk , with j, k ≤ N , and satisfying c jk = either v k = 0 (“no”) or v k = 1 (“yes”). He −ckj . Each voter chooses   broadcasts  the message sk = vk + j=k cjk . Because of cjk = −ckj it is the case that k sk = k vk . Finally, each of the users can compute the sum and find out the total number of the “yes” votes. Let us note that all operations are modulo N . Privacy in this scheme is assured, but the protocol is not secure and cheating is easy. One cannot guarantee that voters will not “vote” an arbitrary number times v k ≤ N , i.e. the result can be easily manipulated. However, there exists a modification that solves this problem and provides security based on the RSA protocol (for more details see Refs. [5,6]). Quantum information can be also used to construct an anonymous broadcast channel [7], but it does not provide us with an additional security compared to classical protocols, since these are already secure. The complexity of quantum-based protocols seems to be slightly simpler, but a deeper analysis is required. In addition to the quantum protocol for anonymous broadcast of classical information, there exists [8] a protocol for anonymous broadcast of quantum information. The transmission of quantum information is based on anonymous teleportation of the state so that the identity of the sender remains hidden. The protocol proposed in [8] allows generate anonymously an EPR pair between two partners (sender and receiver) out of originally shared GHZ state. In what follows we will analyze a quantum-based election scheme. The first quantum voting protocols have been discussed by Vaccaro et al. [9] and independently by Hillery et al. [10]. In the next section we will present a voting scheme that has been originally proposed in [10] and slightly modified version that has been analyzed in [11].

2. Anonymous voting Anonymous voting is an essential tool of democratic decision making. The protocol works as follows: Let us assume N participants, each of them is voting “yes” or “no” to answer a specific question. In addition to the voters there is also an authority (or authorities) counting the votes (in general, the authority is managing the whole process of voting - see below). From the formal point of view the act of voting transforms N input bits into the final result compressed into 3 options: collective “yes”, collective “no”, or an inconclusive result. Hence, intuitively, one might think that in order to ensure the anonymity of individual votes many bits of information have to be deleted. It turns out that this is not the case. However, based on such intuition one can understand that quantum approach can be indeed useful here. Indeed, the elementary unit of quantum information - the qubit, is a system into which we can encode infinitely many bits of information, but according to the Holevo bound only a single bit can be decoded from a single qubit. This is exactly the desired feature, which is classically impossible to realize.

V. Bužek et al. / Towards Quantum-Based Election Scheme

217

The rigorous anonymous voting scheme must satisfy at least the following requirements [2]: 1. 2. 3. 4.

privacy - only the individual voter should know how he voted; security - each voter can vote only once and cannot change someone else’s vote; verifiability - each voter can make sure that his vote has been counted; eligibility - only eligible voters can vote.

In what follows we will focus mainly on the first requirement, but we shall suggest a method guaranteeing the second requirement as well. In classical cryptography a considerable effort [6] has been devoted to designing voting systems. Nevertheless, in our paper we shall only consider quantum-based approaches. The first quantum voting scheme was proposed by J. Vaccaro, J. Spring, and A. Chefles in [9]. It makes use of multiparty states whose total particle number is definite, but the total number of particles possessed by an individual voter is not fixed. The votes are encoded in a phase. We shall discuss here the schemes proposed in [10], one of which also encodes votes in a phase, but in this case each voter has a fixed number of particles. Two types of voting scheme will be presented, a travelling-ballot scheme, and a distributed-ballot scheme. In addition, we shall divide the discussion into two parts. In the first part of the paper the voters will be assumed to be honest. In the second part, we will consider that voters might try to cheat in a very specific way, i.e. they try to register more than one vote.

3. Honest voters Let us first consider the travelling-ballot scheme. In order to simplify our discussion we will consider only three parties, two voters, Alan and Bob, and the authority who is managing the whole voting procedure. The authority 2 begins the voting procedure by preparing a two-qutrit state 1  |Ψ = √ |j a |j b . 3 j=0 2

(1)

In this travelling-ballot scheme the authority holds the first qutrit and sends the second one to Alan who performs one of the two voting operations on the qutrit. If he wants to register “yes” vote, he performs the operation E + , where E+ |j = |j + 1 (the addition is modulo 3), and if he wants to vote “no” he does nothing. He then passes the qutrit on to Bob, who makes the same choice. Bob then sends the qutrit back to the authority. The authority’s final two-qutrit state is 1  |Ψm = √ |j a |j + m b , 3 j=0 2

(2)

where m = 0, 1, 2 is the number of “yes” votes. We note that Ψ m |Ψm = δm,m , so that if the authority measures the final state in the basis {|Ψ m |m = 0, 1, 2}, she will be able to determine the number of “yes” votes. 2 In

order to maintain the gender balance we assume the voters to be males but the authority is the female.

218

V. Bužek et al. / Towards Quantum-Based Election Scheme

Let us note a number of properties of this scheme: If one party votes “yes” while the other votes “no” ( if both vote “yes” or both vote “no” it is obvious to everyone how each voter voted), there is no information in the state |Ψ 1 about who voted “yes” and who voted “no”. In addition, during the entire process of registering of votes when the second qutrit is travelling (before it is returned back to the authority), the reduced density matrices of Alan, Bob, and the authority are ρ = (1/3)I, where I is the identity matrix. That means that during the process of registering of votes, neither the voters nor the authority can determine how the voting is progressing. In particular, Bob cannot determine by examining the particle he receives from Alan how he voted. Therefore, the scheme maintains the privacy of the voting process. The scheme can be easily extended to more than two voters. If there are N voters qudits of dimension D > N are to be used. The initial state of the voting system prepared by the authority is an entangled state of two qudits D−1 1  |Ψ = √ |j a |j b . D j=0

(3)

As before, the authority keeps the first qudit and sends the second one to the voters. Each voter either applies the shift operator E + for a “yes” vote, or does nothing for a “no” vote, and then sends the qudit on to the next voter. After the last voter registers his vote the travelling qudit is sent back to the authority. She then determines the outcome of the voting. Here again, during the process of registration of votes the reduced density matrix of the travelling qudit reads ρ b = I/D, i.e. by itself, it carries no information about the votes cast. This is stronger security than that provided by a naive classical scheme. In that scheme, a ballot goes from one voter to another, and each voter enters into it its vote, 0 for “no” and 1 for “yes”, plus a random number. At the end the ballot is sent back to the authority, and every voter sends his random number to the authority, who then subtracts the sum of these random numbers from the total number registered in the ballot. At the end the total number of “yes” votes can be determined. If the random number remains secret, then the scheme ensures the privacy, but if the random number of one of the voters, Bob, for example, becomes known, then the voter who voted just before Bob and the one who voted just after him can determine Bob’s vote. The quantum scheme does not require the use of additional secret information, which can become compromised. One simple attack on the quantum protocol can be used to determine the vote of a single voter or a group of successive voters. An eavesdropper, Eve (who could possibly be the authority) wants to know how Bob voted. She intercepts the ballot qudit just before it is due to be received by Bob and sends it on to the voter after Bob. To Bob she sends her own qudit, which is in the state |0 . After Bob votes, she intercepts the qudit and measures it; if it is in the state |0 , Bob voted “no”, if it is in the state |1 , Bob voted “yes”. This type of attack can be prevented if successive voters share an entangled two qudit states of the form given in Eq. (3). The voters can then teleport the ballot state to each other rather than to physically send the ballot particle. This procedure would prevent interception of the ballot particle. A travelling ballot can also be used for, what was called in Ref. [9], an anonymous survey. This can be used to compute, for instance, an average salary of a group of people without learning the salary of any individual involved in the survey. One uses a travelling ballot, and each participant of the survey applies a specific operation number of times that

V. Bužek et al. / Towards Quantum-Based Election Scheme

219

is proportional to their salary, e.g. one vote means 10, 000 Euro, two means 20, 000 Euro, etc. The authority counts the number of “votes” and divides the result by the number of participants in order to find the average. In this process the information about individual salaries is available neither to the authority nor to the participants of the survey. For the case of a distributed ballot, we shall suppose that there are N voters and the authority, who counts the votes. The authority prepares the N -qudit ballot state D−1 1  ⊗N |Ψ = √ |j , D j=0

(4)

where the states {|j |j = 0, . . . D} compose an orthonormal basis of the D-dimensional space of an individual qudit, while D ≥ N . A single qudit is now distributed to each of the voters. In order to register the “no” vote a voter while in order to does nothing, 2πik/D register the “yes”, the voter applies the operator U = D−1 |k k|, to his qudit. k=0 e Note that at all times during the voting procedure the reduced density matrix of the qudit of a single voter is ρ = (1/D)I, so that he can infer nothing about the votes of other voters. After registering their votes the voters sent their qudits back to the authority. If we assume that m voters voted “yes” then the state of the quantum system that authority has reads D−1 1  2πijm/D ⊗N |Ψm = √ e |j . D j=0

(5)

The states |Ψm are orthogonal for different values of m and hence can be perfectly distinguished by the authority. Consequently, the authority can determine the number of “yes” votes. Note that the states |Ψ m contain no information about individual votes, they encode only the total number of “yes” votes. Again, the privacy of individual voters is protected. An interesting variant on this procedure was reported by Dolev, et al. [11]. In their scheme, the ballot state is the same as in the previous protocol, but the operators for registering the votes are different as are the measurements that are performed. In addition, in this protocol the authority is not required, each voter can count the number of “yes” votes. A voter registers a “no” vote by applying the operator F such that D−1 1  2πijk/D F |j = √ e |k , D k=0

(6)

and to record a “yes” vote he applies the operator E + F , where E+ |j = |j + 1 . If we define bn = 0 when the nth voter voted “no” and b n = 1 when the nth voter voted “yes”, then the state after the voting is 1 |Ψ = √ DN −1



|l1 + b1 . . . |lN + bN ,

(7)

l1 +...lN =0 modD

where the addition inside the kets is mod D. Each voter now measures his qudit in the computational basis. The result of the measurement is one of the terms in the sum in the above equation. Nevertheless, from the fundamental principles of quantum mechanics it follows that the result of the measurement is totally random. Therefore, each vote has

220

V. Bužek et al. / Towards Quantum-Based Election Scheme

a random number added to it. Nevertheless these random numbers fulfill the constraint that they add to zero mod D. Each voter announces the result of his measurement. There is no danger in doing so, because this number tells the other voters nothing about the outcome of the vote, i.e. whether it was “yes” or “no”. Finally, each voter adds all of the announced results mod D, and the result is equal to the total number of “yes” votes.

4. Dishonest voters One problem with the voting schemes presented so far is that there is no mechanism that would prevent voters from voting more than once. If they want to vote “yes” more than once they simply apply the operator corresponding to a “yes” vote more than once, if they want to increase the number of “no” votes they apply the inverse of the “yes” operator. One possible way of dealing with this problem was proposed in Ref. [10]. The ballot state is the same as in the distributed-ballot scheme discussed above. In addition, the authority distributes to each voter two voting qudits. The voting qudit corresponding to a “yes” vote is in the state |ψ(θ y ) while the qudit corresponding to a “no” vote is in the state |ψ(θn ) , where D−1 1  ijθ e |j , |ψ(θ) = √ D j=0

(8)

and the angles θ y and θn are given by θ y = (2πly /D) + δ and θn = (2πln /D) + δ. The integers ly and ln and the number 0 ≤ δ < 2π/D are known only to the authority. The voter chooses the voting particle corresponding to his vote, and using a process much like the teleportation, he is able to transfer the state of the voting qudit onto his ballot qudit. Because the authority knows l y , ln , and δ she can determine the number of “yes” votes. If a voter tries to “cheat” and tries to determine the values of θ y and θn , he can only measure them to an accuracy of the order 2π/D. If he uses these measured values to vote, he will introduce errors. These errors will show up if the voting is repeated several times. If no cheating occurred, then the result will be the same each time. If cheating did occur, then the results will fluctuate. Therefore, the authority would be able to tell if someone is cheating. Let us now examine this procedure in more detail. First, we assume that (l y −ln )N < D, where, as before, N is the number of voters. This condition is necessary in order that different voting results be distinguishable. As previously mentioned, the integers ly and ln and the angle δ are not known to the voters. Depending on his choice the voter combines either |ψ(θ y ) , or |ψ(θn ) , with the original ballot particle, i.e. creates a system composed from the ballot andthe voting qudits. Then he performs a two-qudit D−1 measurement of the observable R = r=0 rPr , where the operators Pr =

D−1 

|j + r b j + r| ⊗ |j v j|,

(9)

j=0

and the subscript b denotes the ballot qudit while the subscript v denotes voting qudit. the D−1 Registering the outcome r the voter applies the operation V r = Ib ⊗ j−0 |j + r v j|

V. Bužek et al. / Towards Quantum-Based Election Scheme

221

to the voting qudit. If the voter voted “yes”, the state of the ballot and the voting qudits reads % & r−1 D−1  1  |k |ψ(θy ) |k ⊗(N −1) = ei(D+k−r)θy |k ⊗(N +1) Vr Pr √ D k=0 k=0 +

D−1 

ei(k−r)θy |k ⊗(N +1) .

(10)

k=r

It is necessary to remove the factor exp(iDθ y ) = eidδ in the first term. After a voter has voted, he tells the authority the value of r he obtained. NWhen the ballot state is returned back to the authority, she applies an operator W = k=1 Wrk to one of the particles in the ballot state. The integer r k is the value of r obtained by the k th voter, where

−idδ |k 0 ≤ k ≤ r − 1 e (11) Wr |k = |k r ≤ k ≤ d − 1 That removes the phase factors. Each voter sends both (the ballot and the voting) qudits back to the authority. The remaining unused qudit must be kept, or destroyed in order to secure the privacy of the registered vote. The authority is then in possession of a state consisting of 2N qudits. If my = m the voters voted “yes”, m n = N − m voters voted “no”, the authority, after the application of the operator W , has the state |Ωm

D−1 1  ij(my θy +mn θn ) ⊗2N √ = e |j , D j=0

(12)

where an irrelevant global phase factor has been dropped. The phase factor appearing in the sum can be expressed as e ij(my θy +mn θn ) = eijmΔ eijN θn , where Δ = θy − θn = 2π(ly − ln )/D. The factor e ijN θn can be removed by the authority by applying a unitary transformation that transforms j to e ijN θn |j . This finally leaves the authority with the state D−1 1  2πijq/D ⊗2N |Ωq = √ e |j , D j=0

(13)

where q = m(ly − ln ). These states are orthogonal for different values of q (where q is an integer between 0 and D − 1). We see that from the state |Ω q the authority can determine the value of p corresponding to this state. This allows the authority to determine m, because she knows both l y and ln . Note that q should always be a multiple of ly − ln if the voters are using their proper ballot states. If after measuring the ballot state, the authority finds a value of q that is not a multiple of l y − ln , then she knows that someone has cheated. A voter who wants to vote more than once is faced with the problem of determining what θ y or θn is, and this cannot be done from just a single state. The no-cloning theorem makes it impossible for a voter to simply copy the voting states. What the voter is faced with is a problem of phase estimation, and the best he can do is to determine the phase to within an accuracy of order 1/D. If he makes an error, the value of Δ will not, in general be a multiple of 2π/D, and this will cause the authority

222

V. Bužek et al. / Towards Quantum-Based Election Scheme

to obtain different results for m if the voting procedure is repeated several times. More detailed analysis will be given elsewhere [12] If the authority is malicious as well as curious, one of the new security problems that arises is that of the state identification, i.e. verifying whether the initial ballot state is the valid one, and whether the voting states provided by the authority are also correct. The authority could cheat either by sending a ballot state that is a product state, so that each voter’s particle is “decoupled” from all of the others, or by sending voting states that are different for each voter. In principle, if the authority is required to supply a large number of both types of states to the voters, they can verify the correctness of the states by performing the state tomography. A less dramatic test is for the voters to take subsets of ballot particles or subsets of voting particles corresponding to the same choice (all “yes” or all “no”) and to measure them. For example, a set of “yes” voting states can be measured in order to determine whether the state is completely symmetric or not. If it is not, then the authority is trying to cheat by sending different voting states to different voters. Another possibility, at least in regard to the ballot state, is for the voters to prepare that state by themselves. However, this second option is somewhat restrictive, because it requires that participants (voters) have to meet at the same place (or they need quantum resources for a remote-state preparation). This problem could perhaps be addressed by having two authorities, one who prepares the states and one who counts the votes. Here one would have to assume that these authorities are not both dishonest and cooperating with each other.

5. Conclusion We have presented a quantum-based voting scheme ensuring the anonymity of the voters. This scheme generalizes the solution for the classical dining-cryptographers problem. Nevertheless, there is one difference: The dining-cryptographers system realizes one-to-many broadcast channel, whereas the suggested quantum protocol implements a type of many-to-one broadcast channel. In particular, only a collective information corresponding to the final result is transmitted to a known receiver (the authority). Verifiability can be guaranteed if each of the participants will play the role of the authority, i.e. each of them will count his vote by himself. At the end of the protocol all voters compare whether they got the same result, or not. This can be done either publicly, or using some anonymous agreement protocol [12] that tells whether all voting results that are obtained by individual counts of voters, are the same, or not. However, this modification opens new security problems that have to be dealt with. Although there exist classical proposals for voting (for example based on dining-cryptographers protocol), the security is an open problem in both classical and quantum settings. We have shown that quantum resources can be used for anonymous voting with quantum-ensured privacy. This quantum protocols also partially satisfy the remaining requirements as discussed in [2]. Clearly much work remains to be done on the subject to give the final answer, whether quantum resources are indeed useful for a secure anonymous election. The ideas in the presented protocol can be used in other communication and/or cryptographic tasks in which the privacy issues are of importance.

V. Bužek et al. / Towards Quantum-Based Election Scheme

223

Acknowledgments We thank Gorka Azkune and John Vaccaro for helpful comments. This work was supported in part by the European Union projects INTAS-04-77-7289, QAP and CONQUEST, by the Slovak Academy of Sciences via the project CE-PI, by the projects ˇ GA201/01/0413. APVT-99-012304 and GA CR

References [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12]

S. Singh, The Code Book, (Anchor Books, New York, 2000) B. Schneier, Applied Cryptography, (Wiley, New York, 1996). C.H. Bennett and G. Brassard, Proceedings of IEEE International Conference on Computers Systems and Signal Processing, Bangalore India, 175 (1984). N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Rev. Mod. Phys. 74, 145 (2002). D. Chaum, Journal of Cryptology 1, 65 (1988). J.N.E. Bos, PhD thesis, Eindhoven University of Technology, ISBN 9061964059 (1992) M. Christandl and S. Wehner, quant-ph/0409201. ˇ J. Bouda and J. Sprojcar, quant-ph/0512122. J.A. Vaccaro, J. Spring, and A. Chefles, quant-ph/0504161 (2005). M. Hillery, M. Ziman, V. Buˇzek, and M. Bielikov´a, Phys. Lett. A 349, 75 (2006) and quant-ph/0505041. S. Dolev, I. Pitowski, and B. Tamir, quant-ph/0602087. M. Bonanome, V. Buˇzek, M. Hillery, and M. Ziman, in preparation

This page intentionally left blank

225

Quantum Communication and Security M. Żukowski et al. (Eds.) IOS Press, 2007 © 2007 IOS Press. All rights reserved.

Author Index Achilles, D. Acín, A. Amans, D. Atkinson, P. Banaszek, K. Beveratos, A. Bourennane, M. Brainis, E. Brukner, Č. Bukach, A. Bužek, V. Cabello, A. Canagasabey, A. Cerf, N. Christandl, M. Cooper, K. Corbari, C. Deparis, O. Emplit, P. Fotiadi, A. Gill, R.D. Gisin, N. Gorbachev, V.N. Haelterman, M. Hillery, M. Horoshko, D. Hradil, Z. Hudson, A. Ibsen, M. Jelezko, F. Kazakov, A.Ya. Kazansky, P.G. Kiesel, N. Kilin, S. Kofler, J. König, R. Kowalik, J. Kulik, S.P. Kupriyanov, D.V. Kurtsiefer, C. Kuś, M. Lamoureux, L.-P. Landry, O.

37 50 3 146 133 139 22 3 22, 63 205 196, 215 75 3 3 83 146 3 3 3 3 99 50, 139 163 3 190, 215 11 181 146 3 205 163 3 113 v, 11, 205 63 83 v 123 155 22 69 3 139

Laskowski, W. Massar, S. Mégret, P. Mishina, O.S. Mitchison, G. Mogilevtsev, D. Molotkov, S.N. Nguyen, A.-T. Nizovtsev, A. Paterson, K.G. Phan Huy, K. Piper, F. Pironio, S. Pomozov, D.I. Řeháček, J. Renner, R. Ritchie, D.A. Roch, J.-F. Rogacheva, E. Scarani, V. Schack, R. Schmid, C. Shields, A.J. Shurupov, A.P. Solano, E. Stevenson, R.M. Stucki, D. Thew, R. Tóth, G. Treussart, F. Trifonov, A. Trojek, P. Trubilko, A.I. Usenko, C.V. van Houwelingen, J. Wasilewski, W. Weinfurter, H. Wrachtrup, J. Young, R.J. Zbinden, H. Ziman, M. Żukowski, M.

113 3, 50 3 155 83 181 31 3 205 175 3 175 50 31 181 83 146 205 37 50, 139 175 22, 113 146 123 113 146 139 139 113 205 37 22 163 89 139 133 22, 113 205 146 139 196, 215 v, ix, 22, 113

This page intentionally left blank