Get 20M+ Full-Text Papers For Less Than $1.50/day. Start a 14-Day Trial for You or Your Team.

Learn More →

Experimental two-way communication with one photon

Experimental two-way communication with one photon 1 1 2;5 Francesco Massa , Amir Moqanaki , Amin Baumeler , Flavio Del 1;2 3;4 2 1 Santo , Joshua A. Kettlewell , Borivoje Dakic , Philip Walther Vienna Center for Quantum Science and Technology (VCQ), Faculty of Physics, University of Vienna, Boltzmanngasse 5, Vienna A-1090, Austria Institute for Quantum Optics & Quantum Information (IQOQI), Austrian Academy of Sciences, Boltzmanngasse 3, Vienna A-1090, Austria Singapore University of Technology and Design, 8 Somapah Road, Singapore 487372 Centre for Quantum Technologies, National University of Singapore, 3 Science Drive, Singapore 117543 and Facolt Indipendente di Gandria, Lunga Scala, 6978 Gandria, Switzerland Superposition of two or more states is one of the fundamental concepts of quantum mechanics and provides the basis for several advantages offered by quantum information processing. In this work, we experimentally demonstrate that quantum superposition allows for two-way communication between two distant parties that can exchange only one particle once, an impossible task in classical physics. This is achieved by preparing a single photon in a coherent superposition of the two parties’ locations. Furthermore, we show that this concept allows the parties to perform secure and anonymous quantum communication employing one particle per transmitted bit. These important features can lead to the realization of new quantum communication schemes, which are simultaneously anonymous, secure and resource-efficient. INTRODUCTION that is robust against losses. Our results show that a feasible quantum resource, such as superposition, allows for communication features that are In recent decades, developments in the study of quantum classically impossible and can support the development of information science have gained insights that promise to rev- novel schemes. olutionise the future of information processing. Among them, quantum communication is one of the earliest known applica- tions demonstrating the clear advantage of quantum systems. The transmission of quantum states, in fact, allows for com- TWO-WAY SIGNALLING WITH A SINGLE PHOTON munication features that are not achievable with merely classi- cal resources, such as information-theoretically secure quan- In order to show two-way signalling, we consider a com- tum key distribution (QKD) [1–5] or quantum secure direct munication game in which a referee respectively assigns two communication (QSDC) [6–8]. random input bits, x and y, to two distant communication par- In terms of efficiency, it has been demonstrated, both the- ties, named Alice and Bob, who are then allowed to exchange oretically and experimentally, that quantum protocols reduce one particle. We call  the time it takes for the exchange to be the information transfer required to perform some specific dis- completed, that is the interval between the time at which the tributed computational tasks [9–15]. Some of these schemes particle leaves Alice’s or Bob’s location and the time at which provide an exponential advantage with respect to their classi- it is detected. We assume  shorter than the time required to a cal counterparts. At the same time, quantum systems allow physical object to travel more than once the distance between for a decrease in the amount of physical resources necessary Alice and Bob (see figure 1). When the exchange is com- for communication [16–21]. pleted, the referee asks Alice and Bob to reveal two output Along these lines, a recent theoretical result [22] has shown bits, a and b: they win the game if they both guess correctly that, by means of quantum superposition, it is possible to the value of the other player’s input (i.e. if a = y and b = x). perform two-way communication between two distant parties This game can be considered a variation of the well known that only exchange a single particle. Such an operation is im- “guess your neighbour’s input” (GYNI) game [26]. Under possible in classical physics, where two-way communication the constraint that the parties can only exchange one particle can be realised only if the parties exchange two particles, one within the time window  , only two possible causal relations per party, or if the same particle goes back and forth between between variables x, y, a and b, are possible: either x influ- them. Thus, for this specific task, quantum mechanics deter- ences a and b, whereas y influences b only (corresponding to a mines a reduction in number of particles to be used or, alter- one-way communication from Alice to Bob) or y influences a natively, in the time employed for the communication. and b, whereas x influences a only (one-way communication In this work, we experimentally demonstrate the two-way from Bob to Alice). Accordingly, the joint probability distri- signalling via superposition of single photons. Furthermore, bution p(abjxy) results in a classical mixture of the two one- we advance the scheme proposed in [22] for performing way signalling distributions. This imposes a maximal proba- QSDC. Our method achieves information-theoretically secure bility value of 1/2 of winning the game [27]. transfer of classical bits between two parties, given a shared Let us now consider the case of a single quantum parti- single-particle superposition state. With respect to other pro- cle prepared in a coherent superposition between Alice’s and posed QSDC schemes [6], our protocol has two advantages: Bob’s respective locations: 1) the direction of communication between the parties is hid- den, as for quantum anonymous communication [23–25], 2) security is not affected by multi-photon emission. We exploit y y j i = (ba + b )j0i; (1) in the latter property to realize an implementation of the protocol arXiv:1802.05102v3 [quant-ph] 19 Feb 2019 2 munication between Alice and Bob. This is achieved via im- plementation of the previously described two-way communi- cation scheme as a primitive. As communication via the pro- tocol is two-way, we convert this to a direct message system by allowing only one party to transmit a message at a time, and the other to transmit only random bits. Our protocol makes an implicit assumption that Alice and Bob share a quantum channel and many copies of the required superposition state,j i, which is known to be a powerful re- in course for secure communication [28]. Such states could be supplied on demand via a trusted server assuming the channel between the server and Alice, and the server and Bob, are se- cure to a possible eavesdropper. Alternatively, they could be in theory produced and stored by the two parties when they meet and then used at a later moment. Prior to the protocol, each state j i shared between the parties is labelled with in Figure 1 Diagrams of communication between two distant parties. index i. Classically, a single carrier travelling with finite speed, bounded by the For each round of communication, i, both Alice and Bob speed of light c, can transmit information either from Alice to Bob (blue x y perform local phase operationsj i = ((1) ba + arrow) or from Bob to Alice (red arrow) only, if the time  allowed for the encode communication is shorter than the time the carrier takes to travel more than y y i b (1) b )j0i to encode bits x and y , respectively. Both i i once the distance between Alice and Bob (space-time diagram on the left). send their part of the statej i via the quantum channel An information carrier in quantum superposition permits to overcome this encode limitation and carry out a two-way communication process (scheme on the and detect any returning photon. Detection of a photon reveals right). the parity bit r = x  y to each party. Assuming Alice i i i wishes to send an M -bit message fX ; : : : ; X g to Bob, the 1 M protocol can be described by the following sequence of steps: y y where ba and b are the particle creation operators at Alice’s and Bob’s location, respectively, andj0i is the vacuum state. 1. Decline communication. If no message is to be sent, Alice and Bob encode the bits x and y in the phase of the Alice and Bob select the bits x and y uniformly at i i particle, obtaining the state: random. x y y y 2. Declaration of the communication direction. Alice j i = p ((1) ba + (1) b )j0i: (2) encode initializes communication via setting x = 1 for d iter- 2 i ations of the protocol, where d is chosen as to be suffi- A 50/50 beam splitter is placed at the centre of the path be- ciently large as to be sufficiently improbable to occur by tween Alice and Bob. The action of the beam splitter can be chance. Detection of d repeated x = 1 results by Bob expressed by the following transformations: indicates that Alice intends to send a message. Should Bob simultaneously declare his intention to communi- y y y ba ! p (ba + b ); (3) cate, the protocol is aborted. 3. Transmission of the message. Alice sets x = X , for y y y i i b b b ! p (ba b ): (4) i going from 1 to M . Bob may or may not detect a photon, thus obtaining the parity value r = y  X , i i i Due to interference, after the device the final state of the pho- from which the bit X can be deduced. ton is: 4. Declaration of the end of the message. To end the ba j0i; if x = 0 and y = 0, message transmission, Alice sends x = 0 for d itera- b j0i; if x = 0 and y = 1, tions of the protocol. Alice and Bob return to step 1. j i = (5) fin b j0i; if x = 1 and y = 0, The description of the scheme makes no assumption on the ba j0i; if x = 1 and y = 1. power of an eavesdropper, allowing for information-theoretic security. Interception of a photon between the two parties will This means that, by checking whether they detect the particle leak exactly the parity between x and y , given by the position i i or not, Alice and Bob can infer the parity, r, of x and y. This of the photon after the interference at the central beam splitter. piece of information, combined to the knowledge of their in- This may be observed as the four possible states of j i encode put bits, allows them to ideally win the game with probability form two pairs that are identical under global phases, which 1, thus showing genuine two-way communication. cannot be observed via measurement. As such, only a single bit of information may be obtained by an eavesdropper. As each bit y is chosen uniformly at random, this bit contains no information about x , provided that y is unknown, and thus i i APPLICATION FOR ANONYMOUS COMMUNICATION leaks no information regarding Alice’s message bit X . Bob’s input thus acts as a random one-time pad. As communication We now present a secure two-party quantum communica- is two-way, pad bits y are also obtained by Alice, and as such tion protocol that provides anonymity of the direction of com- the scheme is anonymous in the direction of the message and 3 FM Flip Mirror TTM Time Tagging Module TTM pad. A detailed security analysis of the protocol is provided M Mirror BS Beam Splitter D Single Photon Detector LC Liquid Crystal Retarder in appendix E. C Fiber Coupler Such a system may be easily altered to become resistant to experimental losses within a realistic implementation. Losses caused by an erasure channel may result in no photon being Signal detected by Bob when required, causing a single bit error in M D BS A A the received message. Additional errors may be caused by Alice FM imperfections in the experimental set-up, such as dephasing A Photon Idler or non-optimal interference visibility. However, errors can be Source LC overcome, without compromising security, by adding redun- dancy to the protocol, as discussed in appendices D and E. Experimentally, this type of error correction requires no fast switching elements if channel losses are high, greatly simpli- D FM fying practical applications. BS In contrast to other quantum communication schemes, the LC security of the protocol is preserved even in the case of simul- B TTM taneous multi-photon emission from the source, as shown in appendix E (Theorem 1). This underlines the feasibility of our Bob protocol when using realistic single-photon sources. Although anonymous communication may be performed Figure 2 Experimental set-up. Single-photon pairs are produced through spontaneous parametric down-conversion (SPDC). For each pair, between two parties via use of shared classical data, our one photon is used to herald the presence of the other one, which is sent to a method demonstrates the power of a superposition state as a Mach-Zehnder interferometer. Alice and Bob occupy the area around the resource for communication. mirrors M and M , where, for each of them, a liquid-crystal phase shifter, A B for phase encoding, and a photon detector are placed. After the second beam splitter, the photons can travel to Alice or Bob, according to the parity of the input bits. Removable mirrors are used to measure the time at which Alice EXPERIMENTAL RESULTS and Bob receive the photons from the source for the purposes explained in the main text. These mirrors steer light to fibers that can be connected to either Alice’s or Bob’s detector. For more details about the set-up, we refer Implementation of the communication game to appendix A. The set-up for the implementation of the communication Initial Reception Final Detection Delay (ns) game is shown in figure 2. A heralded single photon is sent Alice Alice 7.1 ± 0.4 to one of the input ports of a first beam splitter, which puts Alice Bob 8.2 ± 0.4 the photon in a superposition state between Alice’s and Bob’s Bob Alice 7.5 ± 0.3 locations. Then, Alice and Bob encode their bits in the phase Bob Bob 8.5 ± 0.4 of the photon and direct it to a second beam splitter, which Reference time: (10.1 ± 0.1) ns creates the final statej i. This scheme represents a Mach- fin Zehnder interferometer. Table I Time measurement results. The four possible delays between the initial reception and the final detection of the photon at Alice or Bob are In order to prove that each photon cannot be exchanged shown in the table. They are compared to the time the photon would take to more than once between the two parties, we measure the de- travel twice the minimum distance between the two parties, roughly equal to lay between two events: the reception of the photon before the the diagonal of the interferometer, at the speed of light in vacuum (reference encoding and the final detection after the second beam split- value). For each delay, the measurements are taken by unblocking only the corresponding path and recording the arrival-time statistical distributions for ter. Actually, there are four delays to be measured, according reception and final detection, respectively. The uncertainty on the delays are to whether the initial reception and the final detection of the obtained from the standard deviations of the associated arrival-time photon are considered at Alice or Bob. The delays are slightly distributions, dominated by the time jitter of our detectors. The uncertainty on the reference value is not statistical and is determined by the different due to the fact that the implemented interferometer measurement of the minimum distance between Alice and Bob. is rectangular. The results of these measurements are shown in table I. It can be seen that, in all the cases, the time  neces- sary for the photon exchange to be completed is shorter than the time the photon would take to travel twice the minimum the probability over the input sequence. Figure 3 shows the distance between Alice and Bob (reference time) by more than measured success probability for different values of the in- three standard deviations. This excludes the possibility that terferometric visibility in our Mach-Zehnder, averaged over the photon travels back and forth between Alice and Bob with the two output ports. The visibility at each port is defined as less than 1% risk. More details about the adopted measure- (N N )=(N + N ), where N and MAX MIN MAX MIN MAX ment method and the data analysis can be found in appendix N are the maximum and minimum number of detections MIN B. at that port. The success probability surpasses the classical We estimate the probability of winning the game by using limit as soon as the visibility is greater than zero. For our a random sequence of 100 input bit pairs, one every 0:5 s. maximally achieved visibility of 0:941  0:007, we observe In this time interval, we register an average number of pho- the maximal success probability of 0:961  0:006. At zero ton detections of about 15  10 . For each bit pair, there- visibility the success probability is 0:498  0:006, compara- fore, we compute the probability of success by counting how ble with the maximal achievable value in the classical case many photons go to the “right” output. We then average (0:5). At this point, the effect of the quantum superposition is 4 1.0 0.9 0.8 0.7 Theory Experiment 0.6 0.5 0.0 0.2 0.4 0.6 0.8 1.0 Average Visibility Figure 4 Example of secure communication. An example in which Alice sends a message in the form of a figure and Bob a random sequence Figure 3 Success probability vs interferometric visibility. The plot with the same length is presented. The three columns report, in the order, the shows the behaviour of the probability of winning the game with respect to figure sent by Alice, the figure received by Bob and the parity of the bits sent the quality of the single-photon interference produced by the state Alice and by Alice and Bob, the only piece of information an eavesdropper, Eve, can Bob share, which is quantified by the average interferometric visibility. The obtain from the superposition state. Two cases are shown: the basic protocol, visibility is varied by delaying one interferometric path with respect to the where each bit pair is sent once with an average probability of success of other: at zero visibility the two photon wave packets travelling in the two 88% and the error-corrected protocol, where each bit pair is sent five times, arms no longer overlap at the final beam splitter and the interference is with an average probability of success of 100%. completely cancelled. The equation of the red theoretical curve is y = 0:5(x + 1). The error on each probability is the standard error on the mean, obtained from the statistical variation over the sequence of input bits. For each point in the plot, a different random input sequence of bit pairs is (= 1), and r = 1 (= 0) otherwise. In appendix E we demon- generated. strate security of the protocol under such conditions. The reader should note that, as the experimental setup heralds the photon in the interferometer with a non-number-resolving de- totally nullified. tector, potential higher-order-emission terms from the source In order to claim implementation of a two-way communica- are statistically mixed. As discussed in appendix E, this does tion protocol with a single particle, we are required to demon- not affect security. Errors occur if in a given interval at least strate that Alice and Bob cannot share two or more photons at one photon goes to the “wrong” output or when no photon the same time. This can be shown by measuring the heralded is detected by both Alice and Bob at the end of the interval. second-order correlation function at zero delay of our photon- Such errors can be minimized by suitably choosing the av- (2) pair source, g (0) [29]. This is a number between 0 and erage number of detections per interval (see appendix D for 1, quantifying the amount of multi-photon emission from the more details). When the error probability per bit, p , is lower (2) source. A value of g (0) closer to 1 would imply that two than 50%, the majority-voting error-correction code can be or more photons are sent simultaneously to the interferometer. applied to further increase the success probability of the pro- For an ideal heralded single-photon source this number is 0. tocol. It consists in repeating the same message bit over N (2) We measure g (0) = 0:004  0:010, which is statistically communication intervals and selecting the outcome that oc- compatible to 0 and in line with the lowest values obtained in curs more often. We provide an example by implementing quantum optics experiment [30]. For more details about how simple schemes with N = 3 and N = 5. The average success this value was obtained we refer to appendix C. probability of the communication protocol without majority- vote procedure, measured by counting the successful trans- mission events for different random sets of 100 bit pairs, is Implementation of the anonymous communication protocol 0:88  0:01. By implementing the error-correction schemes with three and five repetitions per bit pair, we obtain success probabilities of 0:93 0:01 and 1:00= 0:01, respectively. We experimentally demonstrate an application of the We report an example where Alice sends a 10 pixels 10 pix- anonymous communication protocol with a probabilistic pho- els image in black and white, corresponding to 100 bits, and ton source and majority voting error-correction procedure. Bob sends a sequence of 100 random bits. Figure 4 shows the Although the distribution of the superposition states is per- outcome of the communication both for the basic protocol and formed here by a trusted third party, our method allows us to for the error-corrected one with five repetitions per bit pair. anonymously send an image between two parties in a manner secure to any eavesdropper acting only between them. The communication protocol employs the set-up described DISCUSSION in the previous section and depicted in figure 2. A communi- cation interval of 0:5 s is set for each pair of bits x and y , and i i the source emission rate is reduced so as to have an average of We have experimentally demonstrated that, by using quan- approximately three detection events per communication in- tum superposition, it is possible to perform two-way com- terval. Here we consider the sum of the detections Alice and munication between two parties that exchange only a sin- Bob record. If Alice (Bob) receives one or more photons dur- gle photon. The possibility that the photon travels back and ing a given communication interval, she (he) infers that r = 0 forth between them or that two or more photons are simul- Average Success Probability 5 taneously used is strictly ruled out by our implementation. one of them is sent to the Mach-Zehnder interferometer and Furthermore, we have designed and implemented a protocol the other is directly sent to a silicon avalanche photo-diode for anonymous messaging via utilising two-way communi- (APD) for heralding the presence of its twin in the interfer- cation as a primitive, and shown that the method achieves ometer. The use of polarizers for both photons of each pair information-theoretic security while being not compromised ensures that a defined polarization state is produced, in partic- by photon losses and multi-photon emission. The security ular jHijVi, where H stands for “horizontal” and V for “ver- of our protocol is based on the impossibility of measuring tical”). the global phase for single photons. We, therefore, show a novel utilization of basic quantum-mechanical phenomena for communication. Future developments hold the promise to ap- proach real-world applications based on the recent progress in The interferometric set-up bright deterministic single-photon sources [31], fast and low- loss optical switches [32] and high-efficiency single-photon detection [33]. Recently, QKD schemes based on phase en- The interferometer we built is depicted in figure 1 in the coding have raised great interest in the quantum cryptography main text. The distance between the mirror M and the beam community, because of providing a secure key rate that scales splitter BS is (106  1) cm, whereas the distance between with the square root of the communication channel transmis- M and BS is (119 1) cm. The minimum distance between B 2 sion [34, 35]. These protocols present some connections with the regions occupied by Alice and Bob is the distance between ours, as they also employ relative-phase detection through the sides of the liquid-crystal phase shifters, equal to (156 first-order interference. However, their purpose is different 1) cm. The geometry of the interferometer is chosen so as from direct communication and they make use of coherent to maximize the difference between the time photons take to states, meaning that security is not based on the properties travel from mirrors M and M to the detectors and the time A B of fixed-photon-number states. Nevertheless, both lines of they would take to travel twice the minimum distance between research show the importance of finding alternative commu- Alice and Bob, given the limits of space on our optical table. nication schemes that can be advantageous over the current The two flip mirrors FM and FM are placed at 10:0 cm A B ones. From this perspective, examining in depth the relation of distance from M and M , respectively. They are used to A B between the two works can be beneficial for future investiga- steer light to two fiber couplers, C and C , connected to two A B tions. 2-m-long multi-mode fibers. The coupling in the multi-mode fibers is about 96%. The distance between the flip mirrors and the couplers is also 10:0 cm, so that photons reach the fibers at the same time they would arrive at M and M if A B ACKNOWLEDGEMENTS FM and FM were not inserted. The uncertainty on all these A B distances is estimated to be 0:5 cm. The detectors D and D A B We would like to thank Marcus Huber, Tommaso Demarie are silicon APDs. We use them in a free-space configuration and Tiago Batalhao ˜ for useful discussions. P.W. acknowledges for the final detection of the photons but we connect them to support from the European Commission through QUCHIP the fibers from the couplers for the acquisition of the photon (No. 641039) and ErBeStA (No. 00942), and from the Aus- arrival-time distributions at the mirrors M and M . All the A B trian Science Fund (FWF) through CoQuS (W1210-4) and arrival times are measured by means of two different time-tag NaMuG (P30067-N36), the U.S. Air Force Office of Scientific logic units, one for each detector, and are always referred to Research (FA2386-17-1-4011), and Red Bull GmbH. A.B. ac- the detection of the heralding photon, used as a trigger. knowledges the Swiss National Science Foundation (SNSF) The interferometer is passively stabilized by thermal and under grant 175860, and the Erwin Schrodinger Center for vibrational isolation so that the phase between the two arms Quantum Science & Technology (ESQ). F.D.S. acknowledges is stable for about one minute. After this time, the phase can acknowledges financial support through a DOC Fellowship of be re-set by means of a piezo actuator mounted in a trombone the Austrian Academy of Sciences. J.A.K. acknowledges sup- delay line, which can be used to delay one arm with respect port from the Singapore National Research Foundation (NRF- to the other and therefore to change the interference visibility. NRFF2013-01). We re-set the piezo every 50 input bit pairs, corresponding to about 25 s. There are still some residual fluctuations of the phase around the stability point in this time interval, which, together with the standard poissonian fluctuations in the num- APPENDIX A: THE EXPERIMENTAL SET-UP ber of counts, determine the errors on the success probabilities reported in the main text. The single-photon source The polarization of the photons entering the interferometer is set to “horizontal” (H), that means parallel to the optical We use an SPDC-based single-photon source in a Sagnac table, before BS by means of two waveplates and a polar- configuration [36], with a 20-mm-long periodically-poled izer. The slow axes of the two liquid-crystal phase shifters are potassium tytanyl phosphate (PPKTP) crystal. The Sagnac aligned to the photon polarization. The refractive index along loop is realized using a dual-wavelength polarizing beam these axes depends on the voltage applied to the liquid crystal. splitter and two mirrors. The crystal converts a photon at 395 We characterize the phase-shift with respect to the voltage and nm into two photons at 790 nm and orthogonal polarizations. set a phase-shift of 0 to encode the bit 0” and of  to encode The produced photons are coupled into single-mode fibers: the bit 1”. 6 APPENDIX B: ANALYSIS OF THE PHOTON take to go from the mirror M or M to the detector is shorter A B ARRIVAL-TIME DISTRIBUTIONS than the time they would take to travel twice the minimum distance between Alice and Bob. In this procedure of compar- ison we neglect the error on t because the corresponding comp Let us call t the time photons take to travel from the AB relative error is more than 4 times lower than that on any t . mirror M to the detector D along the arms of the interfer- A B ometer. In the same way we call t , t , t the time AA BA BB photons take to go from M to D , from M to D and from A A B A APPENDIX C: MEASUREMENT OF THE SECOND-ORDER M to D , respectively. The procedure to measure t is B B AB CORRELATION FUNCTION AT ZERO DELAY the following: 1. we block all the possible paths for the photons except In order to measure the heralded second-order correlation for that one going from M to D . A B (2) function at zero delay, g (0), we steer the photons to the couplers C and C , by means of the flip mirrors FM and A B A 2. For each photon pair, we register the delay between the FM , and we connect the related fibers to the detectors D and detection of the heralding photon and the detection of B A D . We consider the two-fold coincidence rates between the its correlated photon at D , after it travels through the detection of the heralding photon and the detection of its cor- interferometer. In this way we acquire the arrival-time related photon at D or D , which we call respectively CC A B HA distribution for the final detection at D , referred to the and CC , and the three-fold coincidence rate, CC . We herald detection. HB HAB set the delays between the detections electronically in order to 3. We turn up the flip mirror FM and connect the multi- A maximize CC and CC and in these conditions we evalu- HA HB (2) mode fiber from the coupler C to the detector D . Af- ate g (0), according to the following formula([38]): A B ter correcting for the delay introduced by the fiber, we acquire the arrival-time distribution at M , as in point 2 C  CC H HAB 2. (2) g (0) = ; (6) (CC + CC ) HA HB 4. We fit the two obtained distributions with gaussian functions and, for each of them, we consider the mean where C is the single-count rate for the heralding photons. value and the standard deviation. (2) We average the rates over 3 minutes and obtain g (0) = 0:004  0:01, where the error is calculated from poissonian 5. We calculate t as the difference of the mean val- AB uncertainty on the count rates. This value is measured for 7 ues of the two distributions. Since the detections take mW of pump power in the source. place at the same detector and we use the same time- tag unit, the difference is not affected by further elec- tronic delays. The error on t is obtained by adding AB APPENDIX D: ERROR CORRECTION in quadrature the standard deviations of the two distri- butions. The error-correction procedure presented in the main text For the measurement of t , t and t , we fol- AA BA BB consists in repeating the encoding of each bit N times, with low analogous procedures. In order to correct the delays N odd, and performing majority voting, meaning that the re- introduced by the multi-mode fibers, their length is mea- N+1 sult occurring at least times is chosen. If the probability sured with a fiber-meter. We obtain (2:080  0:004) m and 2 of error per bit is p , the overall probability of error after N (2:088  0:004) m for the fibers connected to C and C , A B repetitions, p , is given by: respectively. The refractive index of the core, made of pure silica, is taken from [37]. The errors on the fiber lengths and on the refractive index are negligible with respect to the stan- k Nk p = p (1 p ) : (7) e b dard deviations of the arrival time distributions. Supplemen- N+1 k= tary Figure 1 shows the acquired arrival-time distributions, to- gether with the related gaussian fits. Our detectors are single-photon counting modules from Ex- In figure 5 we show the behaviour of p with respect to N celitas, model SPCM-AQRH. This model has a typical jitter for different values of p . It is clear that the higher is p , the b b slower p goes to 0. When p = 0:5, p is independent of N time (standard deviation) of 0:149 ns. Since each peak is ob- e b e and for p > 0:5 the majority-voting procedure only worsens tained by coincidence detection between two modules, if we consider only the effect of the jitter, we expect a standard de- the probability of success. viation of 0:210 ns. This value is compatible with those ob- We also consider the minimum amount of iterations N tained for fiber-coupled detection but significantly lower than necessary for p to be below a threshold value t. In figure 6, we plot the dependence of N on p for t = 0:01. This those obtained in case of free-space detection. We ascribe the t b trend is shown in figure 3. We can observe that N ! 1 mismatch to the imperfect alignment of the beam in the case of free-space detection. as p approaches 0:5 but it does not increase dramatically for As it can be seen from table 1 in the main text, the quantity p  0:3. jt t j= is always above 3, where t is the ref- In practice, imperfect detection efficiency and fiber trans- X ref X comp erence value and X can be AA, AB, BA or BB, respectively. mission losses can severely reduce p , thus compromising the This allows us to claim with less than 1% of risk that the two success rate of the protocol. In order to circumvent this prob- values are not compatible and then that the time the photons lem, it is possible to use multiple copies of the resource state 7 and 3, respectively. We have: 1 1 X X k nk p = p(n) (1 p ) p = (10) dAB s n=2 k=1 1 1 X X n n = 1 + p(0) p(n)p p(n)(1 p ) n=0 n=0 p = p(n)(1 p ) = (11) aw s n=1 = p(n)(1 p ) p(0); Figure 5 p vs N . The plot shows the overall error probability after N n=0 repetitions for different values of p . The slope of the curve reduces as p b b approaches 0:5. where p is the success probability per photon, that is the probability a photon is detected at the right output. By using the last two equations in expression 9 and expliciting p(n), we obtain, after some simple passages: mp m(1p ) s s p = (1 + e e ): (12) p(0) This expression tends to for m ! 0, when the term 2 2 becomes dominant, and for m ! 1, when the main contri- bution to p is given by p . In between these two regimes, b dAB p has a minimum at: 1 p m = log( ): (13) optm 2p 1 1 p s s Figure 6 N vs p . For this plot the threshold is set to 0.01. It can be noticed that N starts increasing significantly for p > 0:3. t b In some situations, one might wish to optimize the proba- bility both Alice and Bob bits are correctly transferred. An error on the bit-pair transmission occurs any time no photon is detected at all or at least one photon in the encoding interval j i and proceed as follows: for each communication inter- in comes out at the “wrong” port. If we call p the probability of val, if Alice (Bob) detects at least one photon, she (he) as- the latter case, the probability of error on the bit-pair transfer sumes that the parity bit is 0 (1). is: For our implementation, we use an SPDC-based heralded single-photon source. In each communication interval the p = p(0) + p (14) bpair w source emits n photons at different times, of which n are detected. We assume the photon-detection statistics are pois- By expliciting p(0) and p , we obtain: sonian. The probability that Alice and Bob together detect n photons is therefore: p = p(0) + p(n)(1 p ) = (15) bpair n=1 p(n) = e ; (8) m m(1p ) = 1 + e e : n! This expression tends to 1 for m ! 0 and m ! 1 and has a with m average number of detections. minimum for: There are three possible cases in which an error occurs in a given interval: 1) no photon is detected at all, 2) both Alice log(1 p ) and Bob detect photons, 3) all photons go to the wrong output. m = : (16) optp In case 1 Alice (Bob) always infers a value of “1”(“0”) for the parity bit. The two values are swapped in case 2. Since the We note that the distance between m and m tends to optm optp parity bit is random, this produces an error in the message bit 0 as p tends to 1. transmission 50% of the times. In case 3 the wrong message Since the value of p for our set-up is approximately 0:95, bit is transferred 100% of the times. This results in: we calculate that m and m are both around 3. We optm optp reduce the pump power of our source until we obtain globally p(0) p dAB about 3 detections per communication interval. p = + + p ; (9) b aw 2 2 We measure a success probability of the protocol, 1 p , of 0:88 0:01 over 10 sets of 100 random pairs of bits. The where p(0), p and p are the probabilities of cases 1, 2 error is calculated by considering the standard deviation of the dAB aw 8 probability over the sets and by dividing it by the square root that for every input x from Alice we have of the number of sets, thus obtaining an error on the average (; )  , where (;) is the trace distance and  is the value. The average number of detections, m and the proba- density operator a potential eavesdropper has access to. bility of success per photon, p , over the sets are respectively Note that a (1 )-secure protocol implies that the eaves- 3:34  0:06 and 0:935  0:008. By inserting these values in dropper can guess Alice’s bit x not better than with prob- our poissonian model, we calculate a theoretical success prob- ability 1=2 + . This follows, because   (; ) ability of 0:88 0:01, perfectly compatible with the measured P jP (x ) 1=2j=2 = (2P (x) 1)=2, where, given  , the value. We note that, considering p = 0:935, the maximal probability of guessing x is 1=2, and given , the probability theoretical success probability is 0:881, for m = 3:061. of guessing x is P (x)  1=2. In the same experimental conditions the probability 1 Throughout the analysis we will consider noisy and lossy p is measured to be 0:75 0:02, with an expected value bpair resource states, which motivates the statement of the follow- of 0:77 0:02. ing definition. We implement the majority-voting error-correction scheme with three and five repetitions per bit pair. In both cases we Definition 2 (Security parameter (noise) and loss). A resource average over four sets of 100 bit pairs, for a total of 1200 and state  has security parameter  if 2000 iterations, respectively. In the case of three repetitions, we obtain a success probability of 0:93 0:01. The expected min  (j ih j ;  )   : y k y nk n;j i2span(f(a^ ) (b ) j0ij 0kng): value in this case is 0:969 0:004, considering that we mea- h j i=1 sure m = 2:62 0:05 and p = 0:948 0:006. For the case (17) of five repetitions, the measured success probability results to be 1:00  0:01 while the expected value is 0:995  0:001, A resource state  with  loss is (1 ) + j0ih0j, with the measurement results m = 3:736  0:004 and p = wherej0ih0j is the vacuum state. 0:960  0:004. All the measured values are compatible with the expected ones, thus confirming the validity of our theoret- The security parameter reflects how much an adversary ical model. might learn about the bit x. Note that this does not depend on the number of photons generated; hence, the protocol is resistant against multi-photon emissions. As will be shown APPENDIX E: SECURITY ANALYSIS OF THE in the proof, if the resource state lies in the span of having k ANONYMOUS COMMUNICATION PROTOCOL photons with Alice and n k with Bob (for some fixed n), then the protocol is perfectly secure. The definition for lossy The anonymous communication protocol is information- resource states is done in agreement with the theoretical letter theoretically secure under noise, losses, and repetitive trans- [22]. For the analysis, it is helpful to consider the pure version mission. Without loss of generality this analysis is done for of the protocol: All but the last operations are unitary. In the communication from Alice to Bob only. The other direction of last step, Bob measures his registers, which consist of a space communication is covered by symmetry. The analysis, overall containing any number of particles from 0 to n and his ran- performed for noisy protocol executions and potential multi- dom setting, with some appropriate observable. To generate photon emissions, covers three steps: First, we show secu- the random one-time pad, Bob uses thej+i = (j0i +j1i)= 2 rity in the case with losses, then we model the probabilistic state and encodes that setting with a unitary operation. The photon source as has been used in the experimental setup and randomness is generated by measuring that register. show security in that case, and finally we show security for Theorem 1. For given  and , the protocol is (1 (1))- the repetition code where multiple rounds are used in order secure. to reliably transmit a single bit. Once we achieve secure and reliable transmission of a single bit, multi-bit messages can ; ; Proof. Let  be the resource state, and  be the state an be transmitted securely and reliably by repeating the protocol. adversary has access to. We first use the triangle inequality of Integrity and authenticity can be achieved by the use of mes- the trace distance: sage authentication, which, however, needs some pre-shared randomness between the parties. ; 0; 0; ; ;    ;  +   ;  : (18) We prove security in the ideal-real model (also known as the simulator model). The ideal cryptographic primitive we There exists some  that makes the first expression on the right 0; want to implement is a secure transmission of a bit x from equal to 0: The reduced state  after tracing over Alice’s in- Alice to Bob. An adversary, in this ideal scenario, does not put and Bob’s randomness is independent of x. This is shown learn anything about x; she or he only learns that the primitive in the following calculation, where j i is the n-photon state has been used. The real scenario, then again, is the protocol that minimizes the security parameter  . Having j i as re- as explained above. If the adversary cannot distinguish a real source state, the initial state of the protocol is protocol execution from the ideal one, then the real protocol is called secure. In other words, if the adversary can simulate the nk y y data he or she sees in a real execution from the ideal primitive j i j+i jxi = a ^ b j0i j+i jxi ; (no access to the inputs), then the real protocol is secure. This k=0 (19) notion is covered by the following definition. Definition 1 (Approximate security). We call the proto- where the last register is Alice’s message register and the one col (1)-secure if there exists some density operator  such before Bob’s one-time-pad register. After the parties encode 9 their bits, the state is transformed to X nk kx y y Finally, we discuss the repetition code: N (odd) successive p (1) a ^ b j0i j0i jxi + 2 rounds are performed where Alice always transmits the same k=0 bit x and Bob uses the majority of the detected values as his (20) guess — a form of error correction. X nk kx+(nk) y y +p (1) a ^ b j0i j1i jxi : Theorem 3. If the protocol is (1 )-secure then the repe- k=0 tition code with N repetitions makes the protocol (1 N)- secure. By tracing over the message space and the randomness reg- 0; ister, we obtain  , which is Proof. The proof is analogous to the last. Due to the secu- 1 0 0 0 rity of the single-run protocol there exists some  , indepen- (k+k )x (k+k )x+2nkk (1) + (1) 0::: dent of x, such that  (; )  , where  is the state the k;k =0 eavesdropper has access to. Denote by  the i-th state the (21) eavesdropper has access to. Then nk nk y y ^ ^ ::: a ^ b j0ih0j b (a ^) = ;   N : (25) X nk nk i y y ^ ^ = 0 a ^ b j0ih0j b (a ^) : k i=1 k;k =0 k+k is even The second expression on the right, then again, can be bounded by using the fact that the trace distances does not increase under any completely-positive trace-preserving map and by using the strong-convexity property: 0; ; 0; ; ;     ;   (22) [1] C. H. Bennett and G. Brassard in Int. Conf. Computers, Systems and Signal Processing, Bangalore, 175-179 (1984). ;0 0;1 ;1 (1 ) j ih j ;  +   ;   (1 ) : [2] A. K. Ekert, Quantum cryptography based on bell theorem. Phys. Rev. Lett. 67, 661 (1991). 0;1 ;1 The term ( ;  ) is 0: Both density operators represent [3] C. H. Bennett, Quantum cryptography using any two the vacuum state. nonorthogonal states. Phys. Rev. Lett. 68, 3121 (1992). [4] R. Ursin et al., Entanglement-based quantum communication Note that if the resource state is a mixture of resource states over 144 km. Nat. Phys. 3, 481 (2007). with different photon numbers, then the protocol remains se- [5] S. Wang et al., Experimental demonstration of a quantum key cure, unless the purification registers are leaked to the eaves- distribution without signal disturbance monitoring. Nat. Pho- tonics 9, 832 (2015). dropper. [6] G.-L. Long, F.-G. Deng, C. Wang, X.-H. Li, K. Wen, W.- Now, let us discuss the security for the protocol as it is im- Y. Wang, Quantum secure direct communication and deter- plemented. The experimental setup uses a probabilistic pho- ministic secure quantum communication. Front. Phys., 2, 251- ton source that generates k particles, where that number is 272(2007). Poisson distributed with mean value m. [7] J.-Y. Hu, Y. Bo, M.-Y. Jing, L.-T. Xiao, S.-T. Jia, G.-Q. Qin, G.- L. Long, Experimental quantum secure direct communication Theorem 2. If the single-particle protocol is (1 )-secure with single photons. Light Sci. App. 5, e16144 (2016). then the use of a probabilistic photon source with mean [8] W. Zhang, D.-S. Ding, Y.-B. Sheng, L. Zhou, B.-S. Shi, G.- value m renders the protocol (1 m)-secure. C. Guo, Quantum secure direct communication with quantum memory. Phys. Rev. Lett. 118, 220501 (2017). Proof. Let  be the single-particle resource state that makes [9] P. Trojek, C. Schmid, M. Bourennane, C. Brukner, the single-particle protocol (1 )-secure, and let  be the M.Zukowksi, H. Weinfurter, Experimental quantum communi- simulated view of the eavesdropper. The resource state gener- cation complexity. Phys. Rev. A 72, 050305 (2005). ated by the probabilistic photon source is [10] H. Buhrman, R. Cleve, S. Massar, R. De Wolf, Nonlocality and communication complexity, Rev. Mod. Phys. 82, 665 (2010) 0 0 = p(k) : (23) [11] M. Smania, A. M Elhassan, A. Tavakoli, M. Bourennane, npj PPS Quantum Inf. 2, 16010 (2016) k=0 [12] S. Massar, Quantum fingerprinting with a single particle. Phys. A potential eavesdropper, in this case, has access to the re- Rev. A 71, 012310 (2005) P N 1 k 0 0 0 [13] J.M. Arrazola and N. Lutk ¨ enhaus, Quantum fingerprinting with duced state  = p(k)  , where  is the PPS k=0 i=0 i;k i;k coherent states and a constant mean number of photons, Phys. state of the i-th particle in the case k particles have been gener- Rev. A, 89, 062305 (2014) ated. Define by  the state p(k) . Due to strong- PPS k=0 [14] Xu, F. et al., Experimental quantum fingerprinting with weak convexity and subadditivity we have coherent pulses. Nat. Commun.6, 8735 (2015). ! [15] Guan, J.-Y. et al., Observation of quantum fingerprinting beat- 1 k 1 X O X ing the classical limit. Phys. Rev. Lett. 116, 240502 (2016). k 0 ( ;  )  p(k)  ;   p(k)k = m : PPS PPS i;k [16] C. H. Bennett and S. J. Wiesner, Communication via one- i=0 k=0 k=0 and two-particle operators on Einstein-Podolsky-Rosen states. (24) Phys. Rev. Lett. 69, 2881-2884 (1992) 10 [17] K. Mattle, H. Weinfurter, P. G. Kwiat, A. Zeilinger, Dense cod- simplest causal inequalities and their violation. New J. Phys. ing in experimental quantum communication. Phys. Rev. Lett. 18, 013008 (2015). 76, 4656-4659 (1996) [28] A. Nayak and J. Salzman, On communication over an [18] J. T. Barreiro, T.-C. Wei, P. G. Kwiat, Beating the channel ca- entanglement-assisted quantum channel, In Proc. 17th IEEE pacity limit for linear photonic superdense coding. Nat. Phys. Annual Conference on Computational Complexity, pp. 12- 4, 282-286 (2008) 12.(2002). [19] A. Ambainis, D. Leung, L. Mancinska, M. Ozols, Quan- [29] L. Mandel and E. Wolf, Optical Coherence and Quantum Op- tum random access codes with shared randomness. Preprint at tics(Cambridge Univ. Press, Cambridge, 1995). https://arxiv.org/abs/0810.2937(2009) [30] M. Eisaman, J. Fan, A. Migdall, S. Polyakov, Single photon sources and detectors. Rev. Sci. Instr., 82, 071101 (2011). [20] M. Pawłowski and M. Zukowski, Entanglement-assisted ran- [31] P. Senellart, G. Solomon, A. White, High-performance semi- dom access codes. Phys. Rev. A 81, 042326 (2010) conductor quantum-dot single-photon sources, Nat. Nanotech. [21] A. Tavakoli, A. Hameedi, B. Marques, M. Bourennane, Quan- 12,10261039 (2017) tum random access codes using single d-level systems, Phys. [32] F. Lenzini et al., Active demultiplexing of single photons from Rev. Lett. 114, 170502 (2015) a solidstate source, Laser Photonics Rev. 11, 3 (2017) [22] F. Del Santo and B. Dakic, ´ Two-way communication with a [33] E. A. Dauler et al., Review of superconducting nanowire single- single quantum particle. Phys. Rev. Lett. 120, 060503 (2018). photon detector system design options and demonstrated per- [23] M. Christandl and S. Wehner, in Int. Conf. Theory and Applica- formance. Opt. Eng. 53, 081907 (2014). tion of Cryptology and Information Security, Chennai, 217-235 [34] M. Lucamarini, Z.L. Yuan, J.F. Dynes, A. J. Shields, Overcom- (2005). ing the rate-distance limit of quantum key distribution without [24] G. Brassard, A. Broadbent, J. Fitzsimons, S. Gambs, A. Tapp, quantum repeaters, Nature (London) 557, 400403 (2018) Anonymous quantum communication. Int. Conf. Theory and [35] X. Ma, P. Zeng, H. Zhou, Phase-matching Quantum Key Dis- Application of Cryptology and Information Security, Kuching, tribution, Phys. Rev. X 8, 031043 (2018) 460-473 (2007). [36] T. Kim, M. Fiorentino, F. N. C. Wong, Phase-stable source of [25] S. Sun, E. Waks, Secure quantum routing. Preprint at polarization-entangled photons using a polarization Sagnac in- https://arxiv.org/abs/1607.03163 (2016). terferometer. Phys. Rev. A, 73, 012316 (2006). [26] M. L. Almeida, J.-D. Bancal, N. Brunner, A. Acin, N. Gisin, S. [37] I. H. Malitson, Interspecimen comparison of the refractive in- Pironio, Guess your neighbor’s input: a multipartite nonlocal dex of fused silica. J. Opt. Soc. Am. 55, 1205-1209 (1965) game with no quantum advantage. Phys. Rev. Lett. 104, 230404 [38] R.-J. Jin et al., Efficient detection of an ultra-bright single- (2010). ˇ photon source using superconducting nanowire single-photon [27] C. Branciard, M. Araujo, ´ A. Feix, F. Costa, C. Brukner, The detectors, Opt. Comm. 336, 47-54 (2015) http://www.deepdyve.com/assets/images/DeepDyve-Logo-lg.png Quantum Physics arXiv (Cornell University)

Experimental two-way communication with one photon

Download PDF
10 pages

Loading next page...
 
/lp/arxiv-cornell-university/experimental-two-way-communication-with-one-photon-hj6Ii8Aphs
ISSN
2511-9044
eISSN
ARCH-3342
DOI
10.1002/qute.201900050
Publisher site
See Article on Publisher Site

Abstract

1 1 2;5 Francesco Massa , Amir Moqanaki , Amin Baumeler , Flavio Del 1;2 3;4 2 1 Santo , Joshua A. Kettlewell , Borivoje Dakic , Philip Walther Vienna Center for Quantum Science and Technology (VCQ), Faculty of Physics, University of Vienna, Boltzmanngasse 5, Vienna A-1090, Austria Institute for Quantum Optics & Quantum Information (IQOQI), Austrian Academy of Sciences, Boltzmanngasse 3, Vienna A-1090, Austria Singapore University of Technology and Design, 8 Somapah Road, Singapore 487372 Centre for Quantum Technologies, National University of Singapore, 3 Science Drive, Singapore 117543 and Facolt Indipendente di Gandria, Lunga Scala, 6978 Gandria, Switzerland Superposition of two or more states is one of the fundamental concepts of quantum mechanics and provides the basis for several advantages offered by quantum information processing. In this work, we experimentally demonstrate that quantum superposition allows for two-way communication between two distant parties that can exchange only one particle once, an impossible task in classical physics. This is achieved by preparing a single photon in a coherent superposition of the two parties’ locations. Furthermore, we show that this concept allows the parties to perform secure and anonymous quantum communication employing one particle per transmitted bit. These important features can lead to the realization of new quantum communication schemes, which are simultaneously anonymous, secure and resource-efficient. INTRODUCTION that is robust against losses. Our results show that a feasible quantum resource, such as superposition, allows for communication features that are In recent decades, developments in the study of quantum classically impossible and can support the development of information science have gained insights that promise to rev- novel schemes. olutionise the future of information processing. Among them, quantum communication is one of the earliest known applica- tions demonstrating the clear advantage of quantum systems. The transmission of quantum states, in fact, allows for com- TWO-WAY SIGNALLING WITH A SINGLE PHOTON munication features that are not achievable with merely classi- cal resources, such as information-theoretically secure quan- In order to show two-way signalling, we consider a com- tum key distribution (QKD) [1–5] or quantum secure direct munication game in which a referee respectively assigns two communication (QSDC) [6–8]. random input bits, x and y, to two distant communication par- In terms of efficiency, it has been demonstrated, both the- ties, named Alice and Bob, who are then allowed to exchange oretically and experimentally, that quantum protocols reduce one particle. We call  the time it takes for the exchange to be the information transfer required to perform some specific dis- completed, that is the interval between the time at which the tributed computational tasks [9–15]. Some of these schemes particle leaves Alice’s or Bob’s location and the time at which provide an exponential advantage with respect to their classi- it is detected. We assume  shorter than the time required to a cal counterparts. At the same time, quantum systems allow physical object to travel more than once the distance between for a decrease in the amount of physical resources necessary Alice and Bob (see figure 1). When the exchange is com- for communication [16–21]. pleted, the referee asks Alice and Bob to reveal two output Along these lines, a recent theoretical result [22] has shown bits, a and b: they win the game if they both guess correctly that, by means of quantum superposition, it is possible to the value of the other player’s input (i.e. if a = y and b = x). perform two-way communication between two distant parties This game can be considered a variation of the well known that only exchange a single particle. Such an operation is im- “guess your neighbour’s input” (GYNI) game [26]. Under possible in classical physics, where two-way communication the constraint that the parties can only exchange one particle can be realised only if the parties exchange two particles, one within the time window  , only two possible causal relations per party, or if the same particle goes back and forth between between variables x, y, a and b, are possible: either x influ- them. Thus, for this specific task, quantum mechanics deter- ences a and b, whereas y influences b only (corresponding to a mines a reduction in number of particles to be used or, alter- one-way communication from Alice to Bob) or y influences a natively, in the time employed for the communication. and b, whereas x influences a only (one-way communication In this work, we experimentally demonstrate the two-way from Bob to Alice). Accordingly, the joint probability distri- signalling via superposition of single photons. Furthermore, bution p(abjxy) results in a classical mixture of the two one- we advance the scheme proposed in [22] for performing way signalling distributions. This imposes a maximal proba- QSDC. Our method achieves information-theoretically secure bility value of 1/2 of winning the game [27]. transfer of classical bits between two parties, given a shared Let us now consider the case of a single quantum parti- single-particle superposition state. With respect to other pro- cle prepared in a coherent superposition between Alice’s and posed QSDC schemes [6], our protocol has two advantages: Bob’s respective locations: 1) the direction of communication between the parties is hid- den, as for quantum anonymous communication [23–25], 2) security is not affected by multi-photon emission. We exploit y y j i = (ba + b )j0i; (1) in the latter property to realize an implementation of the protocol arXiv:1802.05102v3 [quant-ph] 19 Feb 2019 2 munication between Alice and Bob. This is achieved via im- plementation of the previously described two-way communi- cation scheme as a primitive. As communication via the pro- tocol is two-way, we convert this to a direct message system by allowing only one party to transmit a message at a time, and the other to transmit only random bits. Our protocol makes an implicit assumption that Alice and Bob share a quantum channel and many copies of the required superposition state,j i, which is known to be a powerful re- in course for secure communication [28]. Such states could be supplied on demand via a trusted server assuming the channel between the server and Alice, and the server and Bob, are se- cure to a possible eavesdropper. Alternatively, they could be in theory produced and stored by the two parties when they meet and then used at a later moment. Prior to the protocol, each state j i shared between the parties is labelled with in Figure 1 Diagrams of communication between two distant parties. index i. Classically, a single carrier travelling with finite speed, bounded by the For each round of communication, i, both Alice and Bob speed of light c, can transmit information either from Alice to Bob (blue x y perform local phase operationsj i = ((1) ba + arrow) or from Bob to Alice (red arrow) only, if the time  allowed for the encode communication is shorter than the time the carrier takes to travel more than y y i b (1) b )j0i to encode bits x and y , respectively. Both i i once the distance between Alice and Bob (space-time diagram on the left). send their part of the statej i via the quantum channel An information carrier in quantum superposition permits to overcome this encode limitation and carry out a two-way communication process (scheme on the and detect any returning photon. Detection of a photon reveals right). the parity bit r = x  y to each party. Assuming Alice i i i wishes to send an M -bit message fX ; : : : ; X g to Bob, the 1 M protocol can be described by the following sequence of steps: y y where ba and b are the particle creation operators at Alice’s and Bob’s location, respectively, andj0i is the vacuum state. 1. Decline communication. If no message is to be sent, Alice and Bob encode the bits x and y in the phase of the Alice and Bob select the bits x and y uniformly at i i particle, obtaining the state: random. x y y y 2. Declaration of the communication direction. Alice j i = p ((1) ba + (1) b )j0i: (2) encode initializes communication via setting x = 1 for d iter- 2 i ations of the protocol, where d is chosen as to be suffi- A 50/50 beam splitter is placed at the centre of the path be- ciently large as to be sufficiently improbable to occur by tween Alice and Bob. The action of the beam splitter can be chance. Detection of d repeated x = 1 results by Bob expressed by the following transformations: indicates that Alice intends to send a message. Should Bob simultaneously declare his intention to communi- y y y ba ! p (ba + b ); (3) cate, the protocol is aborted. 3. Transmission of the message. Alice sets x = X , for y y y i i b b b ! p (ba b ): (4) i going from 1 to M . Bob may or may not detect a photon, thus obtaining the parity value r = y  X , i i i Due to interference, after the device the final state of the pho- from which the bit X can be deduced. ton is: 4. Declaration of the end of the message. To end the ba j0i; if x = 0 and y = 0, message transmission, Alice sends x = 0 for d itera- b j0i; if x = 0 and y = 1, tions of the protocol. Alice and Bob return to step 1. j i = (5) fin b j0i; if x = 1 and y = 0, The description of the scheme makes no assumption on the ba j0i; if x = 1 and y = 1. power of an eavesdropper, allowing for information-theoretic security. Interception of a photon between the two parties will This means that, by checking whether they detect the particle leak exactly the parity between x and y , given by the position i i or not, Alice and Bob can infer the parity, r, of x and y. This of the photon after the interference at the central beam splitter. piece of information, combined to the knowledge of their in- This may be observed as the four possible states of j i encode put bits, allows them to ideally win the game with probability form two pairs that are identical under global phases, which 1, thus showing genuine two-way communication. cannot be observed via measurement. As such, only a single bit of information may be obtained by an eavesdropper. As each bit y is chosen uniformly at random, this bit contains no information about x , provided that y is unknown, and thus i i APPLICATION FOR ANONYMOUS COMMUNICATION leaks no information regarding Alice’s message bit X . Bob’s input thus acts as a random one-time pad. As communication We now present a secure two-party quantum communica- is two-way, pad bits y are also obtained by Alice, and as such tion protocol that provides anonymity of the direction of com- the scheme is anonymous in the direction of the message and 3 FM Flip Mirror TTM Time Tagging Module TTM pad. A detailed security analysis of the protocol is provided M Mirror BS Beam Splitter D Single Photon Detector LC Liquid Crystal Retarder in appendix E. C Fiber Coupler Such a system may be easily altered to become resistant to experimental losses within a realistic implementation. Losses caused by an erasure channel may result in no photon being Signal detected by Bob when required, causing a single bit error in M D BS A A the received message. Additional errors may be caused by Alice FM imperfections in the experimental set-up, such as dephasing A Photon Idler or non-optimal interference visibility. However, errors can be Source LC overcome, without compromising security, by adding redun- dancy to the protocol, as discussed in appendices D and E. Experimentally, this type of error correction requires no fast switching elements if channel losses are high, greatly simpli- D FM fying practical applications. BS In contrast to other quantum communication schemes, the LC security of the protocol is preserved even in the case of simul- B TTM taneous multi-photon emission from the source, as shown in appendix E (Theorem 1). This underlines the feasibility of our Bob protocol when using realistic single-photon sources. Although anonymous communication may be performed Figure 2 Experimental set-up. Single-photon pairs are produced through spontaneous parametric down-conversion (SPDC). For each pair, between two parties via use of shared classical data, our one photon is used to herald the presence of the other one, which is sent to a method demonstrates the power of a superposition state as a Mach-Zehnder interferometer. Alice and Bob occupy the area around the resource for communication. mirrors M and M , where, for each of them, a liquid-crystal phase shifter, A B for phase encoding, and a photon detector are placed. After the second beam splitter, the photons can travel to Alice or Bob, according to the parity of the input bits. Removable mirrors are used to measure the time at which Alice EXPERIMENTAL RESULTS and Bob receive the photons from the source for the purposes explained in the main text. These mirrors steer light to fibers that can be connected to either Alice’s or Bob’s detector. For more details about the set-up, we refer Implementation of the communication game to appendix A. The set-up for the implementation of the communication Initial Reception Final Detection Delay (ns) game is shown in figure 2. A heralded single photon is sent Alice Alice 7.1 ± 0.4 to one of the input ports of a first beam splitter, which puts Alice Bob 8.2 ± 0.4 the photon in a superposition state between Alice’s and Bob’s Bob Alice 7.5 ± 0.3 locations. Then, Alice and Bob encode their bits in the phase Bob Bob 8.5 ± 0.4 of the photon and direct it to a second beam splitter, which Reference time: (10.1 ± 0.1) ns creates the final statej i. This scheme represents a Mach- fin Zehnder interferometer. Table I Time measurement results. The four possible delays between the initial reception and the final detection of the photon at Alice or Bob are In order to prove that each photon cannot be exchanged shown in the table. They are compared to the time the photon would take to more than once between the two parties, we measure the de- travel twice the minimum distance between the two parties, roughly equal to lay between two events: the reception of the photon before the the diagonal of the interferometer, at the speed of light in vacuum (reference encoding and the final detection after the second beam split- value). For each delay, the measurements are taken by unblocking only the corresponding path and recording the arrival-time statistical distributions for ter. Actually, there are four delays to be measured, according reception and final detection, respectively. The uncertainty on the delays are to whether the initial reception and the final detection of the obtained from the standard deviations of the associated arrival-time photon are considered at Alice or Bob. The delays are slightly distributions, dominated by the time jitter of our detectors. The uncertainty on the reference value is not statistical and is determined by the different due to the fact that the implemented interferometer measurement of the minimum distance between Alice and Bob. is rectangular. The results of these measurements are shown in table I. It can be seen that, in all the cases, the time  neces- sary for the photon exchange to be completed is shorter than the time the photon would take to travel twice the minimum the probability over the input sequence. Figure 3 shows the distance between Alice and Bob (reference time) by more than measured success probability for different values of the in- three standard deviations. This excludes the possibility that terferometric visibility in our Mach-Zehnder, averaged over the photon travels back and forth between Alice and Bob with the two output ports. The visibility at each port is defined as less than 1% risk. More details about the adopted measure- (N N )=(N + N ), where N and MAX MIN MAX MIN MAX ment method and the data analysis can be found in appendix N are the maximum and minimum number of detections MIN B. at that port. The success probability surpasses the classical We estimate the probability of winning the game by using limit as soon as the visibility is greater than zero. For our a random sequence of 100 input bit pairs, one every 0:5 s. maximally achieved visibility of 0:941  0:007, we observe In this time interval, we register an average number of pho- the maximal success probability of 0:961  0:006. At zero ton detections of about 15  10 . For each bit pair, there- visibility the success probability is 0:498  0:006, compara- fore, we compute the probability of success by counting how ble with the maximal achievable value in the classical case many photons go to the “right” output. We then average (0:5). At this point, the effect of the quantum superposition is 4 1.0 0.9 0.8 0.7 Theory Experiment 0.6 0.5 0.0 0.2 0.4 0.6 0.8 1.0 Average Visibility Figure 4 Example of secure communication. An example in which Alice sends a message in the form of a figure and Bob a random sequence Figure 3 Success probability vs interferometric visibility. The plot with the same length is presented. The three columns report, in the order, the shows the behaviour of the probability of winning the game with respect to figure sent by Alice, the figure received by Bob and the parity of the bits sent the quality of the single-photon interference produced by the state Alice and by Alice and Bob, the only piece of information an eavesdropper, Eve, can Bob share, which is quantified by the average interferometric visibility. The obtain from the superposition state. Two cases are shown: the basic protocol, visibility is varied by delaying one interferometric path with respect to the where each bit pair is sent once with an average probability of success of other: at zero visibility the two photon wave packets travelling in the two 88% and the error-corrected protocol, where each bit pair is sent five times, arms no longer overlap at the final beam splitter and the interference is with an average probability of success of 100%. completely cancelled. The equation of the red theoretical curve is y = 0:5(x + 1). The error on each probability is the standard error on the mean, obtained from the statistical variation over the sequence of input bits. For each point in the plot, a different random input sequence of bit pairs is (= 1), and r = 1 (= 0) otherwise. In appendix E we demon- generated. strate security of the protocol under such conditions. The reader should note that, as the experimental setup heralds the photon in the interferometer with a non-number-resolving de- totally nullified. tector, potential higher-order-emission terms from the source In order to claim implementation of a two-way communica- are statistically mixed. As discussed in appendix E, this does tion protocol with a single particle, we are required to demon- not affect security. Errors occur if in a given interval at least strate that Alice and Bob cannot share two or more photons at one photon goes to the “wrong” output or when no photon the same time. This can be shown by measuring the heralded is detected by both Alice and Bob at the end of the interval. second-order correlation function at zero delay of our photon- Such errors can be minimized by suitably choosing the av- (2) pair source, g (0) [29]. This is a number between 0 and erage number of detections per interval (see appendix D for 1, quantifying the amount of multi-photon emission from the more details). When the error probability per bit, p , is lower (2) source. A value of g (0) closer to 1 would imply that two than 50%, the majority-voting error-correction code can be or more photons are sent simultaneously to the interferometer. applied to further increase the success probability of the pro- For an ideal heralded single-photon source this number is 0. tocol. It consists in repeating the same message bit over N (2) We measure g (0) = 0:004  0:010, which is statistically communication intervals and selecting the outcome that oc- compatible to 0 and in line with the lowest values obtained in curs more often. We provide an example by implementing quantum optics experiment [30]. For more details about how simple schemes with N = 3 and N = 5. The average success this value was obtained we refer to appendix C. probability of the communication protocol without majority- vote procedure, measured by counting the successful trans- mission events for different random sets of 100 bit pairs, is Implementation of the anonymous communication protocol 0:88  0:01. By implementing the error-correction schemes with three and five repetitions per bit pair, we obtain success probabilities of 0:93 0:01 and 1:00= 0:01, respectively. We experimentally demonstrate an application of the We report an example where Alice sends a 10 pixels 10 pix- anonymous communication protocol with a probabilistic pho- els image in black and white, corresponding to 100 bits, and ton source and majority voting error-correction procedure. Bob sends a sequence of 100 random bits. Figure 4 shows the Although the distribution of the superposition states is per- outcome of the communication both for the basic protocol and formed here by a trusted third party, our method allows us to for the error-corrected one with five repetitions per bit pair. anonymously send an image between two parties in a manner secure to any eavesdropper acting only between them. The communication protocol employs the set-up described DISCUSSION in the previous section and depicted in figure 2. A communi- cation interval of 0:5 s is set for each pair of bits x and y , and i i the source emission rate is reduced so as to have an average of We have experimentally demonstrated that, by using quan- approximately three detection events per communication in- tum superposition, it is possible to perform two-way com- terval. Here we consider the sum of the detections Alice and munication between two parties that exchange only a sin- Bob record. If Alice (Bob) receives one or more photons dur- gle photon. The possibility that the photon travels back and ing a given communication interval, she (he) infers that r = 0 forth between them or that two or more photons are simul- Average Success Probability 5 taneously used is strictly ruled out by our implementation. one of them is sent to the Mach-Zehnder interferometer and Furthermore, we have designed and implemented a protocol the other is directly sent to a silicon avalanche photo-diode for anonymous messaging via utilising two-way communi- (APD) for heralding the presence of its twin in the interfer- cation as a primitive, and shown that the method achieves ometer. The use of polarizers for both photons of each pair information-theoretic security while being not compromised ensures that a defined polarization state is produced, in partic- by photon losses and multi-photon emission. The security ular jHijVi, where H stands for “horizontal” and V for “ver- of our protocol is based on the impossibility of measuring tical”). the global phase for single photons. We, therefore, show a novel utilization of basic quantum-mechanical phenomena for communication. Future developments hold the promise to ap- proach real-world applications based on the recent progress in The interferometric set-up bright deterministic single-photon sources [31], fast and low- loss optical switches [32] and high-efficiency single-photon detection [33]. Recently, QKD schemes based on phase en- The interferometer we built is depicted in figure 1 in the coding have raised great interest in the quantum cryptography main text. The distance between the mirror M and the beam community, because of providing a secure key rate that scales splitter BS is (106  1) cm, whereas the distance between with the square root of the communication channel transmis- M and BS is (119 1) cm. The minimum distance between B 2 sion [34, 35]. These protocols present some connections with the regions occupied by Alice and Bob is the distance between ours, as they also employ relative-phase detection through the sides of the liquid-crystal phase shifters, equal to (156 first-order interference. However, their purpose is different 1) cm. The geometry of the interferometer is chosen so as from direct communication and they make use of coherent to maximize the difference between the time photons take to states, meaning that security is not based on the properties travel from mirrors M and M to the detectors and the time A B of fixed-photon-number states. Nevertheless, both lines of they would take to travel twice the minimum distance between research show the importance of finding alternative commu- Alice and Bob, given the limits of space on our optical table. nication schemes that can be advantageous over the current The two flip mirrors FM and FM are placed at 10:0 cm A B ones. From this perspective, examining in depth the relation of distance from M and M , respectively. They are used to A B between the two works can be beneficial for future investiga- steer light to two fiber couplers, C and C , connected to two A B tions. 2-m-long multi-mode fibers. The coupling in the multi-mode fibers is about 96%. The distance between the flip mirrors and the couplers is also 10:0 cm, so that photons reach the fibers at the same time they would arrive at M and M if A B ACKNOWLEDGEMENTS FM and FM were not inserted. The uncertainty on all these A B distances is estimated to be 0:5 cm. The detectors D and D A B We would like to thank Marcus Huber, Tommaso Demarie are silicon APDs. We use them in a free-space configuration and Tiago Batalhao ˜ for useful discussions. P.W. acknowledges for the final detection of the photons but we connect them to support from the European Commission through QUCHIP the fibers from the couplers for the acquisition of the photon (No. 641039) and ErBeStA (No. 00942), and from the Aus- arrival-time distributions at the mirrors M and M . All the A B trian Science Fund (FWF) through CoQuS (W1210-4) and arrival times are measured by means of two different time-tag NaMuG (P30067-N36), the U.S. Air Force Office of Scientific logic units, one for each detector, and are always referred to Research (FA2386-17-1-4011), and Red Bull GmbH. A.B. ac- the detection of the heralding photon, used as a trigger. knowledges the Swiss National Science Foundation (SNSF) The interferometer is passively stabilized by thermal and under grant 175860, and the Erwin Schrodinger Center for vibrational isolation so that the phase between the two arms Quantum Science & Technology (ESQ). F.D.S. acknowledges is stable for about one minute. After this time, the phase can acknowledges financial support through a DOC Fellowship of be re-set by means of a piezo actuator mounted in a trombone the Austrian Academy of Sciences. J.A.K. acknowledges sup- delay line, which can be used to delay one arm with respect port from the Singapore National Research Foundation (NRF- to the other and therefore to change the interference visibility. NRFF2013-01). We re-set the piezo every 50 input bit pairs, corresponding to about 25 s. There are still some residual fluctuations of the phase around the stability point in this time interval, which, together with the standard poissonian fluctuations in the num- APPENDIX A: THE EXPERIMENTAL SET-UP ber of counts, determine the errors on the success probabilities reported in the main text. The single-photon source The polarization of the photons entering the interferometer is set to “horizontal” (H), that means parallel to the optical We use an SPDC-based single-photon source in a Sagnac table, before BS by means of two waveplates and a polar- configuration [36], with a 20-mm-long periodically-poled izer. The slow axes of the two liquid-crystal phase shifters are potassium tytanyl phosphate (PPKTP) crystal. The Sagnac aligned to the photon polarization. The refractive index along loop is realized using a dual-wavelength polarizing beam these axes depends on the voltage applied to the liquid crystal. splitter and two mirrors. The crystal converts a photon at 395 We characterize the phase-shift with respect to the voltage and nm into two photons at 790 nm and orthogonal polarizations. set a phase-shift of 0 to encode the bit 0” and of  to encode The produced photons are coupled into single-mode fibers: the bit 1”. 6 APPENDIX B: ANALYSIS OF THE PHOTON take to go from the mirror M or M to the detector is shorter A B ARRIVAL-TIME DISTRIBUTIONS than the time they would take to travel twice the minimum distance between Alice and Bob. In this procedure of compar- ison we neglect the error on t because the corresponding comp Let us call t the time photons take to travel from the AB relative error is more than 4 times lower than that on any t . mirror M to the detector D along the arms of the interfer- A B ometer. In the same way we call t , t , t the time AA BA BB photons take to go from M to D , from M to D and from A A B A APPENDIX C: MEASUREMENT OF THE SECOND-ORDER M to D , respectively. The procedure to measure t is B B AB CORRELATION FUNCTION AT ZERO DELAY the following: 1. we block all the possible paths for the photons except In order to measure the heralded second-order correlation for that one going from M to D . A B (2) function at zero delay, g (0), we steer the photons to the couplers C and C , by means of the flip mirrors FM and A B A 2. For each photon pair, we register the delay between the FM , and we connect the related fibers to the detectors D and detection of the heralding photon and the detection of B A D . We consider the two-fold coincidence rates between the its correlated photon at D , after it travels through the detection of the heralding photon and the detection of its cor- interferometer. In this way we acquire the arrival-time related photon at D or D , which we call respectively CC A B HA distribution for the final detection at D , referred to the and CC , and the three-fold coincidence rate, CC . We herald detection. HB HAB set the delays between the detections electronically in order to 3. We turn up the flip mirror FM and connect the multi- A maximize CC and CC and in these conditions we evalu- HA HB (2) mode fiber from the coupler C to the detector D . Af- ate g (0), according to the following formula([38]): A B ter correcting for the delay introduced by the fiber, we acquire the arrival-time distribution at M , as in point 2 C  CC H HAB 2. (2) g (0) = ; (6) (CC + CC ) HA HB 4. We fit the two obtained distributions with gaussian functions and, for each of them, we consider the mean where C is the single-count rate for the heralding photons. value and the standard deviation. (2) We average the rates over 3 minutes and obtain g (0) = 0:004  0:01, where the error is calculated from poissonian 5. We calculate t as the difference of the mean val- AB uncertainty on the count rates. This value is measured for 7 ues of the two distributions. Since the detections take mW of pump power in the source. place at the same detector and we use the same time- tag unit, the difference is not affected by further elec- tronic delays. The error on t is obtained by adding AB APPENDIX D: ERROR CORRECTION in quadrature the standard deviations of the two distri- butions. The error-correction procedure presented in the main text For the measurement of t , t and t , we fol- AA BA BB consists in repeating the encoding of each bit N times, with low analogous procedures. In order to correct the delays N odd, and performing majority voting, meaning that the re- introduced by the multi-mode fibers, their length is mea- N+1 sult occurring at least times is chosen. If the probability sured with a fiber-meter. We obtain (2:080  0:004) m and 2 of error per bit is p , the overall probability of error after N (2:088  0:004) m for the fibers connected to C and C , A B repetitions, p , is given by: respectively. The refractive index of the core, made of pure silica, is taken from [37]. The errors on the fiber lengths and on the refractive index are negligible with respect to the stan- k Nk p = p (1 p ) : (7) e b dard deviations of the arrival time distributions. Supplemen- N+1 k= tary Figure 1 shows the acquired arrival-time distributions, to- gether with the related gaussian fits. Our detectors are single-photon counting modules from Ex- In figure 5 we show the behaviour of p with respect to N celitas, model SPCM-AQRH. This model has a typical jitter for different values of p . It is clear that the higher is p , the b b slower p goes to 0. When p = 0:5, p is independent of N time (standard deviation) of 0:149 ns. Since each peak is ob- e b e and for p > 0:5 the majority-voting procedure only worsens tained by coincidence detection between two modules, if we consider only the effect of the jitter, we expect a standard de- the probability of success. viation of 0:210 ns. This value is compatible with those ob- We also consider the minimum amount of iterations N tained for fiber-coupled detection but significantly lower than necessary for p to be below a threshold value t. In figure 6, we plot the dependence of N on p for t = 0:01. This those obtained in case of free-space detection. We ascribe the t b trend is shown in figure 3. We can observe that N ! 1 mismatch to the imperfect alignment of the beam in the case of free-space detection. as p approaches 0:5 but it does not increase dramatically for As it can be seen from table 1 in the main text, the quantity p  0:3. jt t j= is always above 3, where t is the ref- In practice, imperfect detection efficiency and fiber trans- X ref X comp erence value and X can be AA, AB, BA or BB, respectively. mission losses can severely reduce p , thus compromising the This allows us to claim with less than 1% of risk that the two success rate of the protocol. In order to circumvent this prob- values are not compatible and then that the time the photons lem, it is possible to use multiple copies of the resource state 7 and 3, respectively. We have: 1 1 X X k nk p = p(n) (1 p ) p = (10) dAB s n=2 k=1 1 1 X X n n = 1 + p(0) p(n)p p(n)(1 p ) n=0 n=0 p = p(n)(1 p ) = (11) aw s n=1 = p(n)(1 p ) p(0); Figure 5 p vs N . The plot shows the overall error probability after N n=0 repetitions for different values of p . The slope of the curve reduces as p b b approaches 0:5. where p is the success probability per photon, that is the probability a photon is detected at the right output. By using the last two equations in expression 9 and expliciting p(n), we obtain, after some simple passages: mp m(1p ) s s p = (1 + e e ): (12) p(0) This expression tends to for m ! 0, when the term 2 2 becomes dominant, and for m ! 1, when the main contri- bution to p is given by p . In between these two regimes, b dAB p has a minimum at: 1 p m = log( ): (13) optm 2p 1 1 p s s Figure 6 N vs p . For this plot the threshold is set to 0.01. It can be noticed that N starts increasing significantly for p > 0:3. t b In some situations, one might wish to optimize the proba- bility both Alice and Bob bits are correctly transferred. An error on the bit-pair transmission occurs any time no photon is detected at all or at least one photon in the encoding interval j i and proceed as follows: for each communication inter- in comes out at the “wrong” port. If we call p the probability of val, if Alice (Bob) detects at least one photon, she (he) as- the latter case, the probability of error on the bit-pair transfer sumes that the parity bit is 0 (1). is: For our implementation, we use an SPDC-based heralded single-photon source. In each communication interval the p = p(0) + p (14) bpair w source emits n photons at different times, of which n are detected. We assume the photon-detection statistics are pois- By expliciting p(0) and p , we obtain: sonian. The probability that Alice and Bob together detect n photons is therefore: p = p(0) + p(n)(1 p ) = (15) bpair n=1 p(n) = e ; (8) m m(1p ) = 1 + e e : n! This expression tends to 1 for m ! 0 and m ! 1 and has a with m average number of detections. minimum for: There are three possible cases in which an error occurs in a given interval: 1) no photon is detected at all, 2) both Alice log(1 p ) and Bob detect photons, 3) all photons go to the wrong output. m = : (16) optp In case 1 Alice (Bob) always infers a value of “1”(“0”) for the parity bit. The two values are swapped in case 2. Since the We note that the distance between m and m tends to optm optp parity bit is random, this produces an error in the message bit 0 as p tends to 1. transmission 50% of the times. In case 3 the wrong message Since the value of p for our set-up is approximately 0:95, bit is transferred 100% of the times. This results in: we calculate that m and m are both around 3. We optm optp reduce the pump power of our source until we obtain globally p(0) p dAB about 3 detections per communication interval. p = + + p ; (9) b aw 2 2 We measure a success probability of the protocol, 1 p , of 0:88 0:01 over 10 sets of 100 random pairs of bits. The where p(0), p and p are the probabilities of cases 1, 2 error is calculated by considering the standard deviation of the dAB aw 8 probability over the sets and by dividing it by the square root that for every input x from Alice we have of the number of sets, thus obtaining an error on the average (; )  , where (;) is the trace distance and  is the value. The average number of detections, m and the proba- density operator a potential eavesdropper has access to. bility of success per photon, p , over the sets are respectively Note that a (1 )-secure protocol implies that the eaves- 3:34  0:06 and 0:935  0:008. By inserting these values in dropper can guess Alice’s bit x not better than with prob- our poissonian model, we calculate a theoretical success prob- ability 1=2 + . This follows, because   (; ) ability of 0:88 0:01, perfectly compatible with the measured P jP (x ) 1=2j=2 = (2P (x) 1)=2, where, given  , the value. We note that, considering p = 0:935, the maximal probability of guessing x is 1=2, and given , the probability theoretical success probability is 0:881, for m = 3:061. of guessing x is P (x)  1=2. In the same experimental conditions the probability 1 Throughout the analysis we will consider noisy and lossy p is measured to be 0:75 0:02, with an expected value bpair resource states, which motivates the statement of the follow- of 0:77 0:02. ing definition. We implement the majority-voting error-correction scheme with three and five repetitions per bit pair. In both cases we Definition 2 (Security parameter (noise) and loss). A resource average over four sets of 100 bit pairs, for a total of 1200 and state  has security parameter  if 2000 iterations, respectively. In the case of three repetitions, we obtain a success probability of 0:93 0:01. The expected min  (j ih j ;  )   : y k y nk n;j i2span(f(a^ ) (b ) j0ij 0kng): value in this case is 0:969 0:004, considering that we mea- h j i=1 sure m = 2:62 0:05 and p = 0:948 0:006. For the case (17) of five repetitions, the measured success probability results to be 1:00  0:01 while the expected value is 0:995  0:001, A resource state  with  loss is (1 ) + j0ih0j, with the measurement results m = 3:736  0:004 and p = wherej0ih0j is the vacuum state. 0:960  0:004. All the measured values are compatible with the expected ones, thus confirming the validity of our theoret- The security parameter reflects how much an adversary ical model. might learn about the bit x. Note that this does not depend on the number of photons generated; hence, the protocol is resistant against multi-photon emissions. As will be shown APPENDIX E: SECURITY ANALYSIS OF THE in the proof, if the resource state lies in the span of having k ANONYMOUS COMMUNICATION PROTOCOL photons with Alice and n k with Bob (for some fixed n), then the protocol is perfectly secure. The definition for lossy The anonymous communication protocol is information- resource states is done in agreement with the theoretical letter theoretically secure under noise, losses, and repetitive trans- [22]. For the analysis, it is helpful to consider the pure version mission. Without loss of generality this analysis is done for of the protocol: All but the last operations are unitary. In the communication from Alice to Bob only. The other direction of last step, Bob measures his registers, which consist of a space communication is covered by symmetry. The analysis, overall containing any number of particles from 0 to n and his ran- performed for noisy protocol executions and potential multi- dom setting, with some appropriate observable. To generate photon emissions, covers three steps: First, we show secu- the random one-time pad, Bob uses thej+i = (j0i +j1i)= 2 rity in the case with losses, then we model the probabilistic state and encodes that setting with a unitary operation. The photon source as has been used in the experimental setup and randomness is generated by measuring that register. show security in that case, and finally we show security for Theorem 1. For given  and , the protocol is (1 (1))- the repetition code where multiple rounds are used in order secure. to reliably transmit a single bit. Once we achieve secure and reliable transmission of a single bit, multi-bit messages can ; ; Proof. Let  be the resource state, and  be the state an be transmitted securely and reliably by repeating the protocol. adversary has access to. We first use the triangle inequality of Integrity and authenticity can be achieved by the use of mes- the trace distance: sage authentication, which, however, needs some pre-shared randomness between the parties. ; 0; 0; ; ;    ;  +   ;  : (18) We prove security in the ideal-real model (also known as the simulator model). The ideal cryptographic primitive we There exists some  that makes the first expression on the right 0; want to implement is a secure transmission of a bit x from equal to 0: The reduced state  after tracing over Alice’s in- Alice to Bob. An adversary, in this ideal scenario, does not put and Bob’s randomness is independent of x. This is shown learn anything about x; she or he only learns that the primitive in the following calculation, where j i is the n-photon state has been used. The real scenario, then again, is the protocol that minimizes the security parameter  . Having j i as re- as explained above. If the adversary cannot distinguish a real source state, the initial state of the protocol is protocol execution from the ideal one, then the real protocol is called secure. In other words, if the adversary can simulate the nk y y data he or she sees in a real execution from the ideal primitive j i j+i jxi = a ^ b j0i j+i jxi ; (no access to the inputs), then the real protocol is secure. This k=0 (19) notion is covered by the following definition. Definition 1 (Approximate security). We call the proto- where the last register is Alice’s message register and the one col (1)-secure if there exists some density operator  such before Bob’s one-time-pad register. After the parties encode 9 their bits, the state is transformed to X nk kx y y Finally, we discuss the repetition code: N (odd) successive p (1) a ^ b j0i j0i jxi + 2 rounds are performed where Alice always transmits the same k=0 bit x and Bob uses the majority of the detected values as his (20) guess — a form of error correction. X nk kx+(nk) y y +p (1) a ^ b j0i j1i jxi : Theorem 3. If the protocol is (1 )-secure then the repe- k=0 tition code with N repetitions makes the protocol (1 N)- secure. By tracing over the message space and the randomness reg- 0; ister, we obtain  , which is Proof. The proof is analogous to the last. Due to the secu- 1 0 0 0 rity of the single-run protocol there exists some  , indepen- (k+k )x (k+k )x+2nkk (1) + (1) 0::: dent of x, such that  (; )  , where  is the state the k;k =0 eavesdropper has access to. Denote by  the i-th state the (21) eavesdropper has access to. Then nk nk y y ^ ^ ::: a ^ b j0ih0j b (a ^) = ;   N : (25) X nk nk i y y ^ ^ = 0 a ^ b j0ih0j b (a ^) : k i=1 k;k =0 k+k is even The second expression on the right, then again, can be bounded by using the fact that the trace distances does not increase under any completely-positive trace-preserving map and by using the strong-convexity property: 0; ; 0; ; ;     ;   (22) [1] C. H. Bennett and G. Brassard in Int. Conf. Computers, Systems and Signal Processing, Bangalore, 175-179 (1984). ;0 0;1 ;1 (1 ) j ih j ;  +   ;   (1 ) : [2] A. K. Ekert, Quantum cryptography based on bell theorem. Phys. Rev. Lett. 67, 661 (1991). 0;1 ;1 The term ( ;  ) is 0: Both density operators represent [3] C. H. Bennett, Quantum cryptography using any two the vacuum state. nonorthogonal states. Phys. Rev. Lett. 68, 3121 (1992). [4] R. Ursin et al., Entanglement-based quantum communication Note that if the resource state is a mixture of resource states over 144 km. Nat. Phys. 3, 481 (2007). with different photon numbers, then the protocol remains se- [5] S. Wang et al., Experimental demonstration of a quantum key cure, unless the purification registers are leaked to the eaves- distribution without signal disturbance monitoring. Nat. Pho- tonics 9, 832 (2015). dropper. [6] G.-L. Long, F.-G. Deng, C. Wang, X.-H. Li, K. Wen, W.- Now, let us discuss the security for the protocol as it is im- Y. Wang, Quantum secure direct communication and deter- plemented. The experimental setup uses a probabilistic pho- ministic secure quantum communication. Front. Phys., 2, 251- ton source that generates k particles, where that number is 272(2007). Poisson distributed with mean value m. [7] J.-Y. Hu, Y. Bo, M.-Y. Jing, L.-T. Xiao, S.-T. Jia, G.-Q. Qin, G.- L. Long, Experimental quantum secure direct communication Theorem 2. If the single-particle protocol is (1 )-secure with single photons. Light Sci. App. 5, e16144 (2016). then the use of a probabilistic photon source with mean [8] W. Zhang, D.-S. Ding, Y.-B. Sheng, L. Zhou, B.-S. Shi, G.- value m renders the protocol (1 m)-secure. C. Guo, Quantum secure direct communication with quantum memory. Phys. Rev. Lett. 118, 220501 (2017). Proof. Let  be the single-particle resource state that makes [9] P. Trojek, C. Schmid, M. Bourennane, C. Brukner, the single-particle protocol (1 )-secure, and let  be the M.Zukowksi, H. Weinfurter, Experimental quantum communi- simulated view of the eavesdropper. The resource state gener- cation complexity. Phys. Rev. A 72, 050305 (2005). ated by the probabilistic photon source is [10] H. Buhrman, R. Cleve, S. Massar, R. De Wolf, Nonlocality and communication complexity, Rev. Mod. Phys. 82, 665 (2010) 0 0 = p(k) : (23) [11] M. Smania, A. M Elhassan, A. Tavakoli, M. Bourennane, npj PPS Quantum Inf. 2, 16010 (2016) k=0 [12] S. Massar, Quantum fingerprinting with a single particle. Phys. A potential eavesdropper, in this case, has access to the re- Rev. A 71, 012310 (2005) P N 1 k 0 0 0 [13] J.M. Arrazola and N. Lutk ¨ enhaus, Quantum fingerprinting with duced state  = p(k)  , where  is the PPS k=0 i=0 i;k i;k coherent states and a constant mean number of photons, Phys. state of the i-th particle in the case k particles have been gener- Rev. A, 89, 062305 (2014) ated. Define by  the state p(k) . Due to strong- PPS k=0 [14] Xu, F. et al., Experimental quantum fingerprinting with weak convexity and subadditivity we have coherent pulses. Nat. Commun.6, 8735 (2015). ! [15] Guan, J.-Y. et al., Observation of quantum fingerprinting beat- 1 k 1 X O X ing the classical limit. Phys. Rev. Lett. 116, 240502 (2016). k 0 ( ;  )  p(k)  ;   p(k)k = m : PPS PPS i;k [16] C. H. Bennett and S. J. Wiesner, Communication via one- i=0 k=0 k=0 and two-particle operators on Einstein-Podolsky-Rosen states. (24) Phys. Rev. Lett. 69, 2881-2884 (1992) 10 [17] K. Mattle, H. Weinfurter, P. G. Kwiat, A. Zeilinger, Dense cod- simplest causal inequalities and their violation. New J. Phys. ing in experimental quantum communication. Phys. Rev. Lett. 18, 013008 (2015). 76, 4656-4659 (1996) [28] A. Nayak and J. Salzman, On communication over an [18] J. T. Barreiro, T.-C. Wei, P. G. Kwiat, Beating the channel ca- entanglement-assisted quantum channel, In Proc. 17th IEEE pacity limit for linear photonic superdense coding. Nat. Phys. Annual Conference on Computational Complexity, pp. 12- 4, 282-286 (2008) 12.(2002). [19] A. Ambainis, D. Leung, L. Mancinska, M. Ozols, Quan- [29] L. Mandel and E. Wolf, Optical Coherence and Quantum Op- tum random access codes with shared randomness. Preprint at tics(Cambridge Univ. Press, Cambridge, 1995). https://arxiv.org/abs/0810.2937(2009) [30] M. Eisaman, J. Fan, A. Migdall, S. Polyakov, Single photon sources and detectors. Rev. Sci. Instr., 82, 071101 (2011). [20] M. Pawłowski and M. Zukowski, Entanglement-assisted ran- [31] P. Senellart, G. Solomon, A. White, High-performance semi- dom access codes. Phys. Rev. A 81, 042326 (2010) conductor quantum-dot single-photon sources, Nat. Nanotech. [21] A. Tavakoli, A. Hameedi, B. Marques, M. Bourennane, Quan- 12,10261039 (2017) tum random access codes using single d-level systems, Phys. [32] F. Lenzini et al., Active demultiplexing of single photons from Rev. Lett. 114, 170502 (2015) a solidstate source, Laser Photonics Rev. 11, 3 (2017) [22] F. Del Santo and B. Dakic, ´ Two-way communication with a [33] E. A. Dauler et al., Review of superconducting nanowire single- single quantum particle. Phys. Rev. Lett. 120, 060503 (2018). photon detector system design options and demonstrated per- [23] M. Christandl and S. Wehner, in Int. Conf. Theory and Applica- formance. Opt. Eng. 53, 081907 (2014). tion of Cryptology and Information Security, Chennai, 217-235 [34] M. Lucamarini, Z.L. Yuan, J.F. Dynes, A. J. Shields, Overcom- (2005). ing the rate-distance limit of quantum key distribution without [24] G. Brassard, A. Broadbent, J. Fitzsimons, S. Gambs, A. Tapp, quantum repeaters, Nature (London) 557, 400403 (2018) Anonymous quantum communication. Int. Conf. Theory and [35] X. Ma, P. Zeng, H. Zhou, Phase-matching Quantum Key Dis- Application of Cryptology and Information Security, Kuching, tribution, Phys. Rev. X 8, 031043 (2018) 460-473 (2007). [36] T. Kim, M. Fiorentino, F. N. C. Wong, Phase-stable source of [25] S. Sun, E. Waks, Secure quantum routing. Preprint at polarization-entangled photons using a polarization Sagnac in- https://arxiv.org/abs/1607.03163 (2016). terferometer. Phys. Rev. A, 73, 012316 (2006). [26] M. L. Almeida, J.-D. Bancal, N. Brunner, A. Acin, N. Gisin, S. [37] I. H. Malitson, Interspecimen comparison of the refractive in- Pironio, Guess your neighbor’s input: a multipartite nonlocal dex of fused silica. J. Opt. Soc. Am. 55, 1205-1209 (1965) game with no quantum advantage. Phys. Rev. Lett. 104, 230404 [38] R.-J. Jin et al., Efficient detection of an ultra-bright single- (2010). ˇ photon source using superconducting nanowire single-photon [27] C. Branciard, M. Araujo, ´ A. Feix, F. Costa, C. Brukner, The detectors, Opt. Comm. 336, 47-54 (2015)

Journal

Quantum Physics – arXiv (Cornell University)

Published: Feb 14, 2018

There are no references for this article.