How to implement decoy-state quantum key distribution for a satellite uplink with 50 dB channel loss

1.3 MB·English

by  Evan Meyer-Scott

How to implement decoy-state quantum key distribution for a satellite uplink with
50 dB channel loss
Evan Meyer-Scott,∗ Zhizhong Yan, Allison MacDonald,†
Jean-Philippe Bourgoin, Hannes Hu¨bel,‡ and Thomas Jennewein§
Institute for Quantum Computing, University of Waterloo,
200 University Avenue W, Waterloo ON N2L 3G1, Canada
(Dated: January 5, 2012)
Quantumkeydistribution(QKD)takesadvantageoffundamentalpropertiesofquantumphysics
toallowtwodistantpartiestoshareasecretkey;however,QKDishamperedbyadistancelimitation
of a few hundred kilometers on earth. The most immediate solution for global coverage is to use
a satellite, which can receive separate QKD transmissions from two or more ground stations and
act as a trusted node to link these ground stations. In this article, we report a system capable of
performing QKD in the high loss regime expected in an uplink to a satellite using weak coherent
2 pulses and decoy states. Such a scenario profits from the simplicity of its receiver payload, but has
1 sofarconsideredtobeinfeasibleduetoveryhightransmissionlosses(40-50dB).Thehighlossis
0 overcome by implementing an innovative photon source and advanced timing analysis. Our system
2 handles up to 57 dB photon loss in the infinite key limit, confirming the viability of the satellite
uplinkscenario. Weemphasizethatwhilethissystemwasdesignedwithasatelliteuplinkinmind,
n
it could just as easily overcome high losses on any free space QKD link.
a
J

4
I. INTRODUCTION the uplink is beneficial due to looser telescope-pointing

requirements, less demanding opto-mechanics (no preci-
]
h Quantum key distribution (QKD) is the most success- sioncouplingorfibers),andlowerdataprocessingneeds.
p ful application to arise thus far from quantum informa- Additionally, all required components for the receiver
-
t tion theory [1, 2], but it carries the drawback of a dis- haveflowninspace,mostnotablysingle-photondetectors
n tance limitation [3–12]: even with future advances, no [18]. However, the channel loss in an uplink is estimated
a
u morethan400kmofdirecttransmissioninopticalfibers tobeabove40dB,beyondthecapabilityofcurrentQKD
q is expected. However, quantum repeaters and satellites systems, and generally deemed impossible. A free space
[ both have the potential to enable worldwide quantum QKD experiment over 144 km [9] has been performed in

communication. The former is very appealing with re- 2007, simulating the conditions for a satellite downlink,
2
v centpromisingresults[13],butisstillinthefundamental featuring a large 1 m receiver telescope and a modest
6 research stage. Satellite QKD, by contrast, is achievable 30 dB loss. Experiments have also been performed in
7 by today’s satellite and quantum technologies, which al- opticalfiberupto55dBchannelloss[19], employingsu-
9 ready have the required performance [14]. In the most perconducting single photon detectors whose cryogenic
0 feasible scenario, the satellite acts as a trusted node and temperatures are impractical for a small space-based re-
1. performs consecutive key distributions to two different ceiver. HereweshowthataQKDuplink inalossregime
1 ground stations allowing a symmetric key sharing be- beyond 40 dB is indeed feasible by implementing a pho-
1 tweenanytwolocations[15]. Bothadownlinkanduplink tonicsystemwhichincludesaninnovativephotonsource,
1 of photons from/to a satellite have been considered to advanced timing analysis, and commercial single photon
v: transmitquantumkeys,includingmuchworkondaylight detectors with the highest overall figure of merit [20].
i and nighttime free space links [16, 17]. The downlink is Our system can perform QKD based on weak coherent
X
expected to experience lower attenuation, since the up- pulses and decoy states up to 57 dB total loss (channel
ar link beam is much more affected by atmospheric turbu- + receiver loss) in the infinite key limit [21], and has the
lence [14]. Nonetheless, an uplink may be more practical potential to overcome finite size effects on a single satel-
since it keeps the complex and power-hungry source of lite passage [22]. Our approach could be implemented
photons on the ground, and permits the use of state-of- immediately in a satellite mission.
the-artsourcessuchasweakcoherentpulses,heraldedor In support of our experimental work, we have per-
entangled photons, single photon emitters, and possibly formed a rigorous analysis of channel performance for
quantummemories. Withrespecttosatellitetechnology, satellite uplinks and downlinks, including diffraction, at-
mospheric turbulence in the Hufnagel-Valley model [23],
pointingerror, atmosphericabsorption[24], multiphoton
statistics, telescopic losses, detector efficiencies, satellite
∗ [email protected]
orbit statistics, and background noise, to produce secure
† Department of Physics and Astronomy, McMaster University,
keyratestatisticsforavarietyofconditionsandsystems.
1280MainStreetW,HamiltonONL8S4M1,Canada
‡ DepartmentofPhysics,StockholmUniversity,10691Stockholm, Asaspecificexample, foranuplinktoasatellite600km
Sweden high, using a 25 cm diameter telescope on the ground
§ [email protected] and 30 cm on the satellite, our model shows about 80%
2
of total satellite passages over the ground station will be entanglement source run in reverse [26], and uses two
usable for QKD asymptotically (infinite key limit), with orthogonally-oriented PPKTP crystals, for polarization-
an average total loss of 52 dB, an order of magnitude insensitiveup-conversion. Thesourceemploysphasepre-
beyond the capability of current QKD systems. compensation using birefringent wedges in the 810 nm
beamtocompensatefortemporalwalkoffinthePPKTP
crystals. The pulsed 810 nm beam is set to 45◦ polariza-
II. TECHNOLOGY CONSIDERATIONS FOR tion (coherent superposition of horizontal and vertical),
SATELLITE TRANSMISSION while the 1550 nm pump light is modulated in polar-
ization (qubit state) and intensity (signal or decoy). In
The most obvious challenge in a satellite uplink is thisconfiguration,theoutputpulsesat532nmfollowthe
the sheer link distance: it can be 500 km to more than pulselengthofthe810nmlaserandthepolarizationand
30,000 km depending on the satellite orbit, making the amplitudeofthemodulated1550nmbeam. Themodula-
quantum channel extremely lossy. Additionally, noise tionisaccomplishedwithoff-the-shelftelecomwaveguide
due to detector dark counts and stray light, especially modulators,whichshowhighstabilityandswitchingcon-
moonlight and terrestrial light, will make satellite QKD trast, and switching speeds of a few GHz. The power of
more demanding. Finally, the short duration of each the two input beams is controlled such that the output
satellite passage, on the order of hundreds of seconds, pulses at 532 nm contain around one photon per pulse,
makes proving security of QKD difficult, given the small asdeterminedbytheoptimalaveragephotonnumberfor
numberofquantumsignalsreceived. Toaddressthechal- decoy-state QKD. The phase randomization is also ac-
lenges of a satellite uplink, both physical and technical complishedwiththetelecomlaser,whosecoherencetime
parameters must be tuned. The first variable that can (∼5 ns) is less than the period between adjacent pulses
be chosen to minimize loss is the wavelength of the pho- emitted from the mode-locked laser.
tons. Beam spread due to diffraction is one of the main The up-converted photons are collected into single
sourcesoflossandisproportionaltowavelength,soshort mode fiber, then Alice splits off some photons with a
wavelength photons are preferred. After considering the 99:1 fiber beamsplitter for source characterization. The
optical transmission of the atmosphere and single pho- light is allowed to exit at the fiber tip to the quantum
ton detector capabilities, a good choice is λ = 532 nm, channel, then passes through an adjustable lens to con-
which enables the use of thin silicon avalanche photodi- trol the beam size at Bob’s receiver and therefore the
odes [25]. This type of detector has the highest figure channel loss. Bob’s lens selects a small portion of the
of merit for single photon quantum information appli- beam to simulate a high loss channel to space. Bob
cations [20], based on efficiency, timing jitter and dark performs active basis choice with a half-wave plate [27],
count rate. In order to limit background noise, the sys- then the light passes through a polarizer (to determine
temmustemployshortpulsesandtemporallyprecisede- the bit value) and narrow-band filters before arriving at
tectionwhichallowtemporalfilteringofreceivedsignals. silicon single-photon detectors from Micro Photon De-
The optimization of this temporal filtering is described vices. The detectors have a peak efficiency of 48% at
below. Furthermore, a high system clock rate is impor- 550 nm, 10 dark counts per second and 30 ps timing res-
tant to generate enough signals to account for statistical olution, which allows temporal exclusion of much back-
fluctuations in estimation of an eavesdropper’s informa- ground noise. Given a minimum total loss of 40 dB and
tion (finite size effects). As a final consideration, the anachievable1GHzclockrate,themaximumcountrate
QKD system must have phase randomization such that seen by each detector is around 20,000 counts per sec-
subsequent pulses share no phase relation, which is as- ond, making losses due to dead time (70 ns) negligible.
sumedinsecurityproofstolimitinformationgiventoan The detector events are registered and digitized using a
eavesdropper. timetagging module with 156 ps resolution. All these
components are commercially available and many are al-
readyspacequalifiedorundergoingqualification,making
this system practical for satellite applications.
III. SYSTEM CONFIGURATION
Our weak coherent pulse decoy-state system satisfies
all the above requirements through the sum-frequency IV. DECOY-STATE PROTOCOL
generation, or up-conversion method of photon produc-
tion in a χ(2) nonlinear crystal. The design and imple- Weak coherent pulse (WCP) sources based on (up-
mentation are illustrated in Fig. 1. To provide short conversion of) highly attenuated lasers are attractive for
pulses and fast modulation, light from a mode-locked QKD; however, because of the Poissonian statistics of
titanium sapphire laser at 810 nm is combined in two photon number in laser pulses, some pulses will have
type-I Periodically-Poled KTP crystals with light from a more than one photon and be subject to the photon
1550 nm continuous-wave laser to produce, due to en- number splitting attack [28]. In this attack, an adver-
ergy conservation, photons at 532 nm. The arrange- sary Eve splits off one photon from the pulse and stores
ment is equivalent to an asymmetric down-conversion it to measure only after the legitimate party Bob reveals
3
Single)mode)fiber) Dichroic)mirror)
Polariza2on% Polarizer) Timetagger)
maintaining)fiber)
Lens)
Fiber)polariza2on)
controller) Half%wave)plate) Key)
Coaxial)cable)
storage)
Glan%Taylor)polarizer)
PM) Phase)modulator) Bob)
Single)photon)
AM) Amplitude)modulator)
detector)
(receiver))
Fiber)to)free)space)
coupler) Bandpass)filter)
Fiber)polariza2on) Classical)
beamspli@er) Birefringent)wedges)
communica2on)
Fiber)99:1) ) Orthogonal)PPKTP)
Quantum)
beamspli@er) ) crystals)
channel)
Up%converted)
light)(532)nm))
Mode%locked) )
(810)nm)) )
Split)off)some)
Clock)
photons)for)source)
FPGA)
Key) characteriza2on)
storage) Alice)
PM)
Con2nuous)wave)
AM)
(1550)nm)) (transmi@er)) Timetagger)
PM)
FIG.1. SimplifiedschematicofQKDsystemforhighlosslink. Alice’sup-conversionphotonsourceproducesphotonsat532nm
which are sent through the controllable-loss channel to Bob’s receiver.
hismeasurementbasis. Evethenmeasuresinthecorrect istheerrorcorrectionefficiencyforpracticalerrorcorrec-
basis, and so gains full information about multi-photon tioncodes,H (x)=−xlog (x)−(1−x)log (1−x)isthe
2 2 2
pulses without leaving a trace. To combat this attack, binaryentropyfunction,andQ ande aretheestimated
1 1
thedecoy-stateprotocolwasintroduced[29,30],wherein gain and error rate for single photon pulses. The factor
Alice changes the average photon number of randomly Nµ is added since only detections of the signal state
interspersed pulses from the signal level µ to the decoy Nµ+Nν
µ contribute to the final key, and N is the number of
µ/ν
level ν. Since Eve cannot know whether a given pulse
signal/decoy detections. The key rate is then the gain of
is a signal or decoy pulse, the decoy pulses allow much
single-photon pulses, less the error correction on all sig-
better bounds on how much information Eve has gained
nalpulses,lesstheprivacyamplificationonsingle-photon
from multiphoton signals, and thus how much privacy
pulses. Note that this key rate should be multiplied by
amplification must be performed. The asymptotic key
the laser pulse rate to obtain secure key bits per second.
rate (adapted from Ref. [21]) per laser pulse obtainable
from a decoy pulse protocol is
We chose the two-decoy protocol from Ref. [21]. In
this protocol, Alice sends randomly a signal pulse with
R≥q Nµ {−Q f(E )H (E )+Q [1−H (e )]}, average photon number µ, a decoy pulse with average
N +N µ µ 2 µ 1 2 1 photon number ν < µ, or the vacuum. In our case, to
µ ν
(1) illustrate the utility of the two-decoy method, we took
where q = 1/2 is the basis reconciliation factor, Q the vacuum as being sent between adjacent laser pulses.
µ
is the signal gain, i.e. the ratio of Bob’s detections to Q and e were therefore calculated from Section D of
1 1
pulses sent by Alice for average photon number µ, E is Ref. [21], allowing a final secure key rate from equation
µ
thequantumbiterrorrateforsignalpulses,f(E )=1.22 (1).
µ
4
V. TIMING SYNCHRONIZATION
150
SincetheclockperiodsatAliceandBobwillinevitably
100
drift, a synchronization based on the sent and received
signalshadtobedevised. AsseeninFig. 2,thetimetag- 50
gingclockatBobmaydrifthundredsofnanosecondsrel- s)
n
aextiavmeptole,thifethlaeslearsecrlocclkoc(kppereiroiodd=is1s3honrst)enaetdAblyicoen.lAys1afsn, (ob 0
the clocks will be offset by 76 ns after one second, mak- − tB −50
ing signal identification impossible. Therefore, timing e
c−100
synchronizationbetweenAliceandBobisnecessary, and Ali
t
is accomplished here by timetagging a frequency-divided −150
version of the laser clock, following rough (∼ns) align-
ment with GPS signals. Additionally, a known pseudo- −200
randomsequencecouldbeinsertedtoallowabsolutetime
alignmentifrequired[10]. Bobthensendshistimetagsto −250
0 10 20 30 40 50 60
Alicewhouseshertimetaggedlaserclocksignaltostretch Time (s)
orcompressportionsofBob’sdetectiontimetagsdepend-
ingonthefluctuationsascausedbycavitylengthchanges
FIG. 2. Typically observed drift between Alice’s and Bob’s
inthelaserordriftsinthetimetagger’sclock. ThusAlice clocks. Alice’s clock is determined by the repetition rate of
canidentifywhichtagstokeepbasedontimingandrelay the mode-locked laser and Bob’s comes from his timetagger.
this information to Bob. This could be performed over Drifts in the clock are large compared to the nominal laser
the classical communication channel, and since only de- clock period of 13 ns, making timing synchronization a ne-
tection times and not bit or basis values are revealed, no cessity. Our synchronization scheme correctly aligns Bob’s
informationisleakedtoEve. Inthesatelliteapplication, detection events independent of which device is drifting.
we must also consider the fast movement of the satel-
lite towards or away from the base station. It becomes
necessary to know precisely the position of the satellite for receiver and detector efficiency, this peStrumdenitt Vsercshiona onf nMeAlTLAB
through orbit analysis and direct time-of-flight measure- losses up to 51 dB, higher than any WCP systems previ-
ments,whichprovideasmoothlyvaryingground-satellite ously built [6–8].
time-of-flight function [31]. In post processing, Alice can We additionally performed a quantum optical simula-
then align Bob’s timetags every second by applying the tionincludingphotonproduction,channeltransmittance
smooth time offset and searching for a coincidence peak and detection, to predict a secure key rate versus total
with her laser clock’s timetags. We estimate that with a loss as shown in Fig. 3b. The simulations show key
1 GHz clock rate and the worst case of 57 dB total loss, generation is possible up to 59 dB and agree with the
Bob would receive approximately 800 legitimate signals experimental results.
each second, more than sufficient for the time synchro- To highlight the viability of our system for a satel-
nization procedure. lite uplink, simulations of satellite orbits over one year
were performed to predict the total channel loss versus
passage time of the satellite. Using a realistic orbit at
VI. QUANTUM KEY DISTRIBUTION 600kmheight, 712satellitepassagesoverourhypotheti-
PERFORMANCE cal ground station near Ottawa, Canada were predicted,
about 80% of which have a portion with low enough loss
Our main results are summarized in Fig. 3. Using our for QKD (excluding cloudy nights). The total loss ver-
experimental setup, the detection rate and quantum bit sustimeoftheoverallbestsinglepassageandofthe80th
errorrate(QBER=E )ineachoftherectilinearanddi- percentilepassageareplottedinFig. 3a. Theaverageto-
µ
agonal bases for signals and decoys were measured and a tallossforusablepassagesforQKDis52dB,wellwithin
finalsecurekeyratefromequation(1)wascalculated. A the capability of our system.
pseudorandom sequence of 256 pulses was repeated and Finally, the total loss versus time for a satellite pas-
the resulting timetags formed into a histogram to give sageandsecurekeyrateversustotallosscancombineto
information on each individual pulse state, allowing full produce Fig. 3c, secure key rate versus time for a satel-
characterization of the system’s capability. The results lite passage. The rate is given in bits per laser pulse on
versus loss in Fig. 3b, based on many 1000 second data the left axis and bits per second on the right, based on
collection runs at a clock rate of 76 MHz, show secure our clock rate of 76 MHz. The curves in Fig. 3c can
key distribution is possible up to 57 dB experimentally. be integrated to find total bits of secure key generated
Thesecurekeygenerationrateatthismaximum57dBis over one passage. For the 80th percentile passage shown
2 bits/s, highlighting the viability of the quantum optics here, a total of 5.7×104 bits of secure key could be gen-
and detectors required for this high loss. Allowing 6 dB erated with our 76 MHz system. Additionally, as shown
5
SimulaLteods slo (sdsB ()dB)
0 10 20 30 40 50 60 70
0 Satellite#simula-on#parameters:#
Low#earth#orbit#(600#km#high)#
a)#Total#loss#versus#-me#due#to#
712#passages#per#year#
100 satellite#movement# Ground#sta-on:#OFawa,#Canada,#45oN#
25#cm#transmiLng#telescope#
30#cm#receiving#telescope#
532#nm#wavelength#
200 Bob#
e (s) Satellite#passage#
m performance#over#
Ti300 one#year:#
80th percentile
Best
400
Alice#
5100−01
Experiment
10−2 1100^66
Simulation
c)#Secure#key#rate#versus#-me#for#a#
se10−3 single#satellite#passage#
ul
key rate per laser p111000−−−654 Student Version of MATLAB 8B0etsht percentile 1111000000240 0e key rate (bits/s) ure key rate (bits/s)
ure curSec
ec10−7 Se
S
b)#Secure#key#rate#versus#total#loss##
10−8 11
10−90 10 20 30 40 50 60 70 0 100 200 300 400 500
Total loss (dB) TTiimmee ((ss))
FIG. 3. Secure key rate over high loss channel. a) Simulation of total loss versus visible passage time for a satellite uplink.
Here we show simulation data for the best overall passage in that year and, for comparison, the 142nd best passage, i.e. 80th
percentile of the 712 total passages for the year. The loss is minimum as the satellite is closest to the ground station (highest
elevation angle) and increases as the satellite approaches the horizon. b) Experimental results and simulation of secure key
rate versus loss. Our data agree well with the theoretical curve, which uses a quantum optical simulation to predict key rates.
Deviations from the theoretic curve are caused by imperfect alignment of the polarization inside the optical fibers. Treatment
Student Version of MATLAB
of error analysis is included in QKD security proofs, and is generally based on upper bounding the information given to an
eavesdropper compatible with measurement results. c) Expected secure key rate versus time for a satellite passage, based on
simulationsandexperimentalparameters. Thesecurekeyrateinbits/sontherightaxisassumesthe76MHzclockrateofour
source. The loss versus time and secure key rate versus loss curves combine to produce the output key rate over one satellite
passage.
in Fig. 4, our photon source is sufficiently stable for key able for QKD.
generation without active feedback for the duration of a
satellite passage.
Whenstatisticalfluctuations[22]andinformationthe- VII. REMOVAL OF BACKGROUND NOISE
oreticsecurityproofs[32]areconsidered,oursimulations
predict about 55 dB average loss is permissible over a To separate legitimate detections from background
singlesatellitepassagewithourhardwareandanachiev- noise, all detections were timetagged (see Appendix for
able 1 GHz clock rate. Recent work on the finite-key discussion of timing system), subdivided into 10 ms long
problem for qubits [33] should allow channel losses to sections and then binned with a bin width equal to a
beextendedfurther(onceopticalmodesareconsidered), fraction of the laser clock cycle. Then the detections
making a higher number of yearly satellite passages us- from the QKD source should be tightly peaked around
6
the technical requirements to be satisfied with full in-
7600 5 formation theoretic security. As noted above, a space-
4.5 based quantum receiver is less demanding than a quan-
7500 tum source, as all required components for the receiver
4
have flown in space [35], so a near-term satellite mission
s/s)7400 3.5 using our approach as a prototype is possible.
bit 3
e ( %)
ure key rat7300 22.5QBER ( spartoTechleleistsesintmiglliasonsuidotnsctoaimnncdmliunudgneiccdahteaitloelenrnmbgiaennsidnfwgorisdautffihfucalinle-dnsctdacelelsaigQssnKiicnaDgl
Sec7200 1.5 a reference frame system to compensate for the slow ro-
tation of the satellite [36, 37], which will be our next
1
7100 steps of research. Additionally, how best to deal with a
0.5 strongly fluctuating channel while maintaining security
7000 0 is an open question [14, 38, 39]. As a first step, we simu-
00 220000 440000 660000 880000 11000000
Time(s) latedsecurekeyrateversusloss,comparingastaticchan-
nel to a fluctuating channel with log-normal probability
density function [40]. We found no difference in secure
FIG. 4. Stability of secure key rate (solid line) and QBER
(dashedline). Dataweretakenat30dBtotallossover1000s, key rate even for strongly turbulent atmosphere, so long
andthemeansecurekeyrateandQBERare7560±24bits/s as the average channel loss was the same. Additionally,
and 1.85±0.03 % respectively. The small drifts are likely putting tighter bounds on the finite-key problem for re-
due to temperature fluctuations which alter the polarization alistic implementations is a great challenge for theorists,
transformation in the connecting optical fibers. to enable the use of lossier channels than ever [33, 41].
Student Version of MATLAB Our system must be updated to include a truly random
pulse sequence on Alice’s side, and a receiver on Bob’s
the laser pulse times with a width determined by the jit- side capable of measuring in both rectilinear and diag-
ter [34], and the background noise distributed randomly. onal bases simultaneously with passive basis choice. To
The true signals were separated from dark counts and bring our system to the desired 1 GHz clock rate is not
stray light by choosing an optimal window width around difficult, as the modulators can handle a few GHz and
the peaks, which narrows with increasing loss as more the upconversion process is clock rate independent. We
background counts must be excluded to maintain an ac- would simply require a mode-locked laser with shorter
ceptable QBER (Fig. 5). Only timetags within the win- cavity length and updated electronics.
dow contribute to the final key calculations, and those
outside are discarded. The number of erroneous back-
Finally, with a quantum receiver in space and a suit-
ground counts per second that are included in the raw
able photon source, a number of additional quantum
key is given by
physics experiments over ground-space distance become
viable, including teleportation and entanglement swap-
ping [42], fundamental tests of quantum mechanics [43],
C =W ×r×C , (2)
errors bkgd and tests of new physical theories [44]. In addition, an
entangled photon source which emits one photon around
where W is the timing window, r is the laser repeti-
the desired 532 nm is envisaged for the future [45, 46].
tion rate, and C is the total number of background
bkgd This photon would be directed to the satellite while the
counts per second. The final key rate given by equation
other photon of the entangled pair would be in the tele-
1 depends on both QBER and raw key rate, leading to
com band around 1550 nm, suitable for long-distance
the optimal timing windows as noted in Fig. 5c. The
transmission in optical fibers. A central ground sta-
optimal timing window decreases from 2 ns at low loss,
tion containing the source could be connected locally by
to 40 ps at 57 dB, making full use of the good timing
fibers to end-users, and globally via satellite to another
affordedbyoursystem,anddisplayingthelineardropin
such ground station. Furthermore, it is possible that the
QBER due to C as W narrows.
errors uplink transmission can be enhanced by implementing
wave-front corrections of the transmitted optical beam,
through adaptive optics [47]. This technology is used
VIII. DISCUSSION AND CONCLUSION in astronomic observation, and could be realized at the
ground station even once the mission is deployed. In
We have demonstrated the design and viability of a summary, the future for QKD using satellites is bright,
QKDsystemcapableofoperationunderultra-highchan- theuplinkisdemonstrablyfeasible,andinthenearterm
nel losses of up to 57 dB. Our system therefore satis- we expect to see multiple satellite missions for quantum
fies the challenging requirements for uplink of quantum information, both for fundamental science and applica-
keys to a satellite, and future improvements will allow tions.
Key rate per laser pulse
0 1 2 3 4 5 6
00 x
1
0
−
7
7
R00
ec.5.5
x 10−5 e
1.4 iv 0.08
,"#-.#/0#+&+,%#%&''#e
1.2 r tim 0.07
e Secure key rate
puls 1 ingRa11w key rate 0.06
Student Version of MATLABStud Key rate per laser Key rate per laser pulse0000....234560246800x 110"−#72-#/0R00#+e..55&ce+,iv%e#%r& ti'm'i#n window (ns)Receiver timing window (ns)11QgB 1.521.5200.511.500.511.5wESRQ i00RneaBdcwEou Rkrwee y0.01k( en11ra1y..s55t )erKSattuee0.02dyeper laser pulsen tr 2Vae0.03111rtsei00022 o0000000000000 n−−−p............ 000000000000654o2345678e12345f0.043 MrQBERQBERA lTaLRaw key rateRaw key rateAsB0.05e4rSecure key rateSecure key rate Secure key rate per laser pulsepu0.06111111l000000s−−−−−−e987654500.07 6 0.08x 10−7250#/.50R#!e"c#e$iv%%e#%r& ti'm'nOi#n(1ogp& twth)i*inmi+nd'oa,#wl t(nims)1in.5g wind3--2-2o.45-..######w//////000000######2
en 1 e
t Version o 000 R00..e55ceiver timin11g 22wi0ndow (0.0n11s..55) 0.0e key rat 0.0122000−.0710.0 0.0 0.0 0.0 0.0
f M 1 2ur 3 4 5 6 7 8
ATLA FIG.5. Rawkeyrate(allsignaldetectionevents)Sec, s1ec0u−r8ekeyrate, andquantumbiterrorrate(QBERS)tudvenet rVserusiosn tofi mMATiLnAgB window
B
from experimental data. a) At 40 dB total loss, b) At 54 dB total loss. Note that raw key rate and QBER both increase with
timingwindow, asmoredarkandbackgroundcountsareadmitted. Securekeyrateshowsamaximumat1.2nsforthe40dB
case and 0.4 ns for the 54 dB case, as the benefit of increasing the raw key rate is offset by the detriment of increasing the
QBER. c) Secure key rate versus timing window fo1r0v−a9r ious loss points. The observed optimal timing window is marked on
0 0.5 1 1.5 2
each curve with an X, and the dashed line is a guide to the eye for the optimal window width trend.
Receiver timing window (ns)
Appendix: Receiver timing sySsttudeemnt Version of MATLAB slow changes in optical path length. By contrast, using
the timetagging approach, Bob can send back to Alice
only the timetags generated by his receiver, which will
be small in number due to the high channel loss. Al-
In practical QKD systems, the use of timing informa- ice can then align them to her source rate and tell Bob
tion is necessary to exclude illegitimate detections [19]. whichtokeep. Asanexample,withaclockrateof1GHz
Oursystememploysfree-runningdetectorsandtimetags Alice would have to send 109 gate pulses per second in-
every detection event, in contrast to gated detection dependent of the loss for gated operation, while if using
schemes which only open detectors during the specified timetags, Bob would have to transmit only about 5000
arrival time of a pulse. Both are subject to detector timetags per second back to AliceStfuodren5t 0VedrsBiont ooft MaAlTlLoAsBs.
control attacks [48–50] with most effort being focused
on gated avalanche photodiodes for telecom applications
[51]. For satellite applications, the timetagging method ACKNOWLEDGMENTS
is preferable as it requires much less data transmission.
A recent precise timing experiment [52] required every The authors thank NSERC (CGS, QuantumWorks,
gate pulse to be sent classically in parallel to the quan- Discovery, USRA), Ontario Graduate Scholarships, CI-
tum channel from Alice to Bob, a vast overhead which is FAR, Canadian Space Agency, Ontario Ministry of Re-
impractical for space applications, due to both fast and search and Innovation, and CFI for funding.
[1] C.H.BennettandG.Brassard,InternationalConference [2] N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Rev.
on Computers, Systems & Signal Processing (1984). Mod. Phys. 74, 145 (2002).
8
[3] C.H.Bennett,F.Bessette,G.Brassard,L.Salvail, and [23] R. R. Beland, “The infrared & electro-optical systems
J. Smolin, Journal of Cryptology 5, 3 (1992). handbook. Atmospheric propagation of radiation,” (In-
[4] J. D. Franson and H. Ilves, Appl. Opt. 33, 2949 (1994). frared Information Analysis Center, Environmental Re-
[5] Y. Zhao, B. Qi, X. Ma, H.-K. Lo, and L. Qian, Phys. searchInstituteofMichigan,AnnArbor,MichiganUSA,
Rev. Lett. 96, 070502 (2006). and SPIE Optical Engineering Press Bellingham, Wash-
[6] D.Stucki,N.Walenta,F.Vannel,R.T.Thew,N.Gisin, ington USA, 1993) Chap. 2.
H. Zbinden, S. Gray, C. R. Towery, and S. Ten, New [24] G.P.Anderson,A.Berk,P.K.Acharya,M.W.Matthew,
Journal of Physics 11, 075003 (2009). L.S.Bernstein,J.JamesH.Chetwynd,H.Dothe,S.M.
[7] Y. Liu, T.-Y. Chen, J. Wang, W.-Q. Cai, X. Wan, L.-K. Adler-Golden,A.J.Ratkowski,G.W.Felde,J.A.Gard-
Chen, J.-H. Wang, S.-B. Liu, H. Liang, L. Yang, C.-Z. ner,M.L.Hoke,S.C.Richtsmeier,B.Pukall,J.B.Mello,
Peng,K.Chen,Z.-B.Chen, andJ.-W.Pan,Opt.Express and L. S. Jeong, Proc. SPIE 3866, 2, (1999) pp. 2–10.
18, 8587 (2010). [25] I. Rech, G. Luo, M. Ghioni, H. Yang, X. S. Xie, and
[8] H. Takesue, S. W. Nam, Q. Zhang, R. H. Hadfield, S. Cova, IEEE Journal of Selected Topics in Quantum
T. Honjo, K. Tamaki, and Y. Yamamoto, Nature Pho- Electronics 10, 788 (2004).
tonics 1, 343 (2007). [26] H. Hu¨bel, M. R. Vanner, T. Lederer, B. Blauensteiner,
[9] R. Ursin, F. Tiefenbacher, T. Schmitt-Manderbach, T. Loru¨nser, A. Poppe, and A. Zeilinger, Opt. Express
H. Weier, T. Scheidl, M. Lindenthal, B. Blauensteiner, 15, 7853 (2007).
T. Jennewein, J. Perdigues, P. Trojek, B. Omer, [27] The optimal solution for this short wavelength is to use
M.Furst,M.Meyenburg,J.Rarity,Z.Sodnik,C.Barbi- passivebasischoice,whereintheincomingphotonpasses
eri, H. Weinfurter, and A. Zeilinger, Nature Physics 3, through a 50:50 beamsplitter and is measured in either
481 (2007). the rectilinear or diagonal basis depending on the path
[10] T. Schmitt-Manderbach, H. Weier, M. Fu¨rst, R. Ursin, randomly taken out of the beamsplitter. Because only
F. Tiefenbacher, T. Scheidl, J. Perdigues, Z. Sodnik, two detectors were available for this experiment, we im-
C. Kurtsiefer, J. G. Rarity, A. Zeilinger, and H. We- plemented a slow, active basis choice: a motorized ro-
infurter, Phys. Rev. Lett. 98, 010504 (2007). tation stage containing a half-wave plate was rotated to
[11] T. Jennewein, C. Simon, G. Weihs, H. Weinfurter, and 0◦ or 22.5◦ to choose to measure in the rectilinear and
A. Zeilinger, Phys. Rev. Lett. 84, 4729 (2000). diagonal bases respectively.
[12] W. Tittel, J. Brendel, H. Zbinden, and N. Gisin, Phys. [28] N. Lutkenhaus and M. Jahma, New Journal of Physics
Rev. Lett. 84, 4737 (2000). 4, 44 (2002).
[13] Simon, C., Afzelius, M., Appel, J., Boyer de la Giroday, [29] W.-Y. Hwang, Phys. Rev. Lett. 91, 057901 (2003).
A., Dewhurst, S. J., Gisin, N., Hu, C. Y., Jelezko, F., [30] H.-K. Lo, X. Ma, and K. Chen, Phys. Rev. Lett. 94,
Kro¨ll, S., Mu¨ller, J. H., Nunn, J., Polzik, E. S., Rarity, 230504 (2005).
J. G., De Riedmatten, H., Rosenfeld, W., Shields, A. [31] P.Villoresi,T.Jennewein,F.Tamburini,M.Aspelmeyer,
J., Sko¨ld, N., Stevenson, R. M., Thew, R., Walmsley, I. C.Bonato,R.Ursin,C.Pernechele,V.Luceri,G.Bianco,
A., Weber, M. C., Weinfurter, H., Wrachtrup, J., and A.Zeilinger, andC.Barbieri,NewJournalofPhysics10,
Young, R. J., Eur. Phys. J. D 58, 1 (2010). 033038 (12pp) (2008).
[14] C. Bonato, A. Tomaello, V. D. Deppo, G. Naletto, and [32] V.ScaraniandR.Renner,Phys.Rev.Lett.100,200501
P. Villoresi, New Journal of Physics 11, 045017 (25pp) (2008).
(2009). [33] M.Tomamichel,C.C.W.Lim,N.Gisin, andR.Renner,
[15] R. Alleaume, J. Bouda, C. Branciard, T. Debuiss- Preprintat: <http://arxiv.org/abs/1103.4130> (2011).
chert, M. Dianati, N. Gisin, M. Godfrey, P. Grangier, [34] The final jitter of Alice’s mode-locked laser timetags is
T. Langer, A. Leverrier, N. Lutkenhaus, P. Painchault, about300ps.Giventhe156psresolutionofthetimetag-
M. Peev, A. Poppe, T. Pornin, J. Rarity, R. Renner, ger, and jitter of Alice’s electronics of 200 ps, this leaves
G. Ribordy, M. Riguidel, L. Salvail, A. Shields, H. We- 160 ps for jitter of the laser. Therefore, improvement is
infurter, and A. Zeilinger, “SECOQC white paper on possiblemosteasilyinthelaserstabilityandtimetagres-
quantum key distribution and cryptography,” (2007). olution,makingthistimingmethodevenmoreappealing.
[16] R.J.Hughes,W.T.Buttler,P.G.Kwiat,S.K.Lamore- [35] I.ProchazkaandF.Yang,JournalofModernOptics56,
aux,G.L.Morgan,J.E.Nordholt, andC.G.Peterson, 253 (2009).
Journal of Modern Optics 47, 549 (2000). [36] J. Chen, G. Wu, L. Xu, X. Gu, E. Wu, and H. Zeng,
[17] R. J. Hughes, J. E. Nordholt, D. Derkacs, and C. G. New Journal of Physics 11, 065004 (13pp) (2009).
Peterson, New Journal of Physics 4, 43 (2002). [37] A. Laing, V. Scarani, J. G. Rarity, and J. L. O’Brien,
[18] M. A. Krainak, G. Yang, W. Lu, and X. Sun, in Detec- Phys. Rev. A 82, 012304 (2010).
tors and Imaging Devices: Infrared, Focal Plane, Single [38] J. H. Shapiro, Phys. Rev. A 84, 032340 (2011).
Photon,Vol.7780,editedbyE.L.Dereniak,J.P.Hartke, [39] D.Y.Vasylyev,A.A.Semenov, andW.Vogel,Preprint
P. D. LeVan, R. E. Longshore, A. K. Sood, M. Razeghi, at: <http://arxiv.org/abs/1103.1440> (2011).
and R. Sudharsanan (SPIE, 2010). [40] P. W. Milonni, J. H. Carter, C. G. Peterson, and R. J.
[19] R. J. Collins, R. H. Hadfield, V. Fernandez, S. W. Nam, Hughes,JournalofOpticsB:QuantumandSemiclassical
and G. S. Buller, Electron. Lett. 43, 180 (2007). Optics 6, S742 (2004).
[20] R. H. Hadfield, Nature Photonics 3, 696 (2009). [41] S. Bratzik, M. Mertz, H. Kampermann, and D. Bruß,
[21] X.Ma,B.Qi,Y.Zhao, andH.-K.Lo,Phys.Rev.A72, Phys. Rev. A 83, 022330 (2011).
012326 (2005). [42] M. Aspelmeyer, T. Jennewein, M. Pfennigbauer, W. R.
[22] S.-H.Sun,L.-M.Liang, andC.-Z.Li,Phys.Lett.A373, Leeb, andA.Zeilinger, IEEEJournalofSelectedTopics
2533 (2009). in Quantum Electronics 9, 1541 (2003).
9
[43] N. Gisin, V. Scarani, W. Tittel, and H. Zbinden, An- [48] V. Makarov, New Journal of Physics 11, 065003 (2009).
nalen der Physik 9, 831 (2000). [49] C. Wiechers, L. Lydersen, C. Wittmann, D. Elser,
[44] T.C.Ralph,G.J.Milburn, andT.Downes,Phys.Rev. J. Skaar, C. Marquardt, V. Makarov, and G. Leuchs,
A 79, 022121 (2009). New Journal of Physics 13, 013043 (2011).
[45] S.M.Spillane,M.Fiorentino, andR.G.Beausoleil,Opt. [50] H.Weier,H.Krauss,M.Rau,M.Fu¨rst,S.Nauerth, and
Express 15, 8770 (2007). H.Weinfurter,NewJournalofPhysics13,073024(2011).
[46] C. So¨ller, B. Brecht, P. J. Mosley, L. Y. Zang, [51] L. Lydersen, C. Wiechers, C. Wittmann, D. Elser,
A. Podlipensky, N. Y. Joly, P. S. J. Russell, and C. Sil- J. Skaar, and V. Makarov, Nature Photonics 4, 686
berhorn, Phys. Rev. A 81, 031801 (2010). (2010).
[47] T. Berkefeld, D. Soltau, R. Czichy, E. Fischer, B. Wan- [52] A. Restelli, J. C. Bienfang, C. W. Clark, I. Rech, I. La-
dernoth, and Z. Sodnik, in Adaptive Optics Systems II, banca, M. Ghioni, and S. Cova, IEEE Journal of Se-
Vol.7736,editedbyB.L.Ellerbroek,M.Hart,N.Hubin, lected Topics in Quantum Electronics 16, 1084 (2010)
and P. L. Wizinowich (SPIE, 2010) p. 77364C. .