. 5
( 9)


104 M. Suda

simply measuring the time-of-arrival of photons and is thus insensitive to optical
errors [16]. This concept will be established in the following COW protocol where
the Y basis is replaced by the Z basis, the X basis being used only occasionally to
check coherence [48].
Now Fig. 6.3 comes into play. Alice™s CW laser diode (1550 nm) together with
the intensity modulator either prepares pulses of coherent states of mean photon
number μ or completely blocks the beam (empty or “vacuum” pulses). The source
pulses leaving Alice™s laboratory with encoded information form a sequence of
coherent states. In particular, the protocol exploits the coherence between any pair of
subsequent pulses. The kth logical bits 0 and 1 are encoded in two-pulse sequences

which can be written in each case as a product of a coherent state | μ and an
empty state |0 leading to

√ √
√ √
|0k = | μ |0 , |1k = | 0 2k’1 | μ . (6.4)
2k’1 2k 2k

Note that in Eq. (6.4) the states |0k and |1k are not orthogonal because coherent
states are not orthogonal by nature. A time-of-arrival measurement, whenever con-
clusive, provides the optimal unambiguous determination of the bit value [28]. To
check coherence, a fraction f 1 of decoy sequences is produced which can be

written as a tensor product | μ 2k’1 | μ 2k . Now due to the very narrow-banded
CW laser including a large coherence length there is a well-de¬ned phase between
any two non-empty pulses within both, each decoy sequence but also across the bit
separation [a (1 ’ 0)’ bit sequence]. Since equally spaced pulses are produced,
the coherence of both, decoy and (1 ’ 0)- bit sequences, can be checked with a
single interferometer. Eve cannot count the number of photons in any ¬nite number
of pulses without introducing errors: photon number splitting (PNS) attacks can
be detected [28]. This is in contrast to the BB84 protocol where PNS attacks are
repelled by a decoy-state technique, which consists in varying μ [42, 83, 49].
The pulses propagate to Bob through a quantum channel characterized by a trans-
mission t and are split at a [t B : (1 ’ t B )]’ beam splitter with a transmission
1 (e.g. t B = 0.9 ). Only about 10% of the pulses are re¬‚ected
coef¬cient t B
into Bob™s interferometer (monitoring line) which is destined to check quantum
coherence. The pulses that are transmitted with about 90% (data line) are used to
establish the raw key by measuring the times of arrival. The counting rate at detector
D B is R = 1 ’ e’μtt B · ≈ μtt B · , where · is the quantum ef¬ciency of the photon
counter (between 5 and 15%) and μ ≈ 0.1’0.5 . Dark counts and limited ef¬ciency
of the detectors have to be taken into account.
The phase shift • in Bob™s interferometer is adjusted in such a way that within
the time slots (dashed lines in Fig. 6.3) only detector D M1 clicks for regular two-
pulse sequences (logical bits 0 or 1). When both pulses are non-empty [decoy
sequence or a (1 ’ 0)-bit sequence] detector D M2 can ¬re as well at a time where
only D M1 should have ¬red [78] resulting in a reduced visibility (both detectors
¬re). Here coherence can be quanti¬ed by Alice and Bob through the visibility
6 QKD Systems 105

p (D M1 ) ’ p (D M2 )
V= , (6.5)
p (D M1 ) + p (D M2 )

where p (D M j ) is the probability that detector D M j ¬res. These probabilities are
small, the average detection rate on the monitoring line being ∝ μt(1 ’ t B )· per
pulse. However, if the bit rate is high, enough counting rates can be achieved in a
reasonable time. The interferometer is only used to estimate the information of the
eavesdropper and cannot introduce errors on the key.
The system is tolerant to reduced visibility and robust against PNS attacks. The
system is insensitive to polarization ¬‚uctuations in ¬ber. One other advantage is that
standard telecom components can be used.
The protocol can be summarized as follows:

1. Alice sends a large number of sequences of “logical bit 0” and “logical bit 1,”
both with probability 1’ f , and “decoy sequences” with probability f 1.
2. Bob, after reception of the sequences, reveals for which bits he obtained detec-
tions on D B in the data line (raw key) and when the detector D M2 has ¬red in
the monitoring line.
3. Alice tells Bob which bits he has to remove from his raw key, since those bits
are due to the detections of decoy sequences (sifting).
4. Alice analyzes the detections in Bob™s detector D M2 . She estimates the break of
coherence through the visibilities V(1’0) (coherence across a bit separation) and
Vd (decoy sequences) and computes Eve™s information. It is considered as a part
of the protocol that Alice and Bob reject the key unless Vd = V(1’0) .
5. Alice and Bob run error correction and privacy ampli¬cation ending up with a
secret key.

Proving the security of the COW protocol remains a work in progress. The stan-
dard methods for proving the security of QKD protocols were, so far, developed
for protocols in which the quantum symbols are sent one by one (e.g., qubits in
the BB84, B92, six-state protocols [27]). The COW protocol, however, does not
use this symbol-per-symbol type of coding and the standard security proofs do not
apply in any straightforward way. To the contrary, the COW protocol is a so-called
distributed-phase-reference protocol (such as also the “differential-phase-shift”
protocol [43]) that relies on the overall phase, or more speci¬cally, the coherence
between successive non-empty pulses, to ensure the security of the protocol. For
this family of protocols, much is still to be done at the level of security proofs.
So far, the security of the COW protocol has been proven against some partic-
ular attacks, such as the beam-splitting attack (BSA) [28, 75, 10, 11] and some
intercept-resend (IR) attacks [28, 75]. Proofs for more speci¬c attacks, such as
zero-error attacks based on unambiguous state discrimination (USD) [10] and (in
the limit of high losses) against 1-pulse or 2-pulse attacks that generalize the BSA
by introducing errors [11], have also been shown (see Chap. 5).
106 M. Suda

6.2.4 Continuous Variables with Gaussian Modulation, QKD
with Coherent States (CV)

The designed and realized prototype that implements a continuous variable (CV)
QKD protocol is based on coherent states and reverse reconciliation [21, 2]. This
is a stable and automatic system working constantly during 57 h and yielding an
average secret key distribution rate of 8 kbits/s over 15 km standard optical ¬ber,
including all quantum and classical communication.
So-called CV protocols rely on both quadratures of a coherent state and have
been proposed in [67, 39, 14, 37, 34]. A complete implementation of the Gaussian-
modulated coherent-state reverse reconciliation (RR) CV-QKD protocol is described
in [50]. In the protocol, the quadratures operators of position x = √2 (a + + a) and
ˆ ˆ
momentum p = √2 (a + ’ a) of a train of coherent-state pulses are modulated in the
ˆ ˆ ˆ
complex plane with a Gaussian modulation of variance V A N0 at Alice™s side, where
N0 is the shot noise variance that appears in the Heisenberg relation ”x” p ≥ N0 .
The quantities a and a + are the bosonic annihilation resp. creation operators de¬ned
ˆ ˆ
for a coherent state |± using the Eigenvalue equation a|± = ±|± . The Eigen-
value ± = |±|e = (x + ± p) is a complex number. These coherent states are

sent from Alice to Bob through the quantum channel, along with a strong phase
reference (phase angle θ L O ) “ or strong local oscillator (LO) expressed classically
by the complex number ± L O = |± L O |e±θL O . Bob randomly measures the x or p ˆ ˆ
quadrature by making the signal interfere with the LO in a pulsed, shot noise-
limited homodyne detector. The phase shifting • rotates the quadratures x and p
ˆ ˆ
to x• = x cos • + p sin • and p• = ’x sin • + p cos •, and it can be shown eas-
ˆ ˆ ˆ ˆ ˆ
ily [25] that balanced homodyne detection (measuring the difference of the output
intensities I21 behind a 50/50 beam splitter) means measuring the rotated quadrature
component: I21 ∝ |± L O |x• . A balanced homodyne detection is an ampli¬er. The
ˆ ˆ
LO ampli¬es the signal by the mutual optical mixing of the two. Or, seen from
a different point of view, the homodyne detection is an interferometer that can be
measurably imbalanced by a weak signal mode, because the reference ¬eld (LO) is
very intense.
We now discuss the CV-QKD system [21]. As shown in Fig. 6.4. Alice produces
coherent light pulses of 1550 nm wavelength with a frequency of ω = 500 k H z; the
time between two pulses amounts therefore to ”t = 1/ω = 2 μs. The length of the
generated pulses is 100 ns. The pulses are separated into a weak signal (path above)
and a strong LO (path below) using an asymmetric 99/1 coupler. The LO contains
typically 107 photons per pulse. Both the signal and the LO have to be polarized
in the same direction. The signal pulses are then displaced in the complex plane,
with arbitrary amplitude |±| and phase θ, randomly chosen from a two-dimensional
Gaussian distribution centered at zero and with an adjustable variance V A N0 . Alice™s
intended modulation variance is adjusted with a second amplitude modulator. Time
and polarization multiplexing are used so that S and LO are transmitted to Bob in
the same optical ¬ber without interfering. A 2 — 40 m delay line (= time delay
”t = 80 n = 400 ns, where n = 3 is the index of refraction, and c is the speed of
c 2
6 QKD Systems 107

Faraday Mirror
2 μs 40 m
Polarizer Amplitude Phase
Modulator Modulator
100 ns Local 50/50
Laser diode
1550 nm

Bob Channel

Homodyne LO
detector S
400 ns
40 m
F. Mirror

Pulse generation Modulation Quantum channel Homodyne detection

Fig. 6.4 Sketch of the optical layout of the CV-QKD prototype; LO: local oscillator, S: signal,
PBS: Polarizing beam splitter; see text for details

light in vacuum) is inserted using a PBS (because the signal is polarized) and includ-
ing a Faraday mirror (FM). The FM consists of a standard mirror and a 45—¦ rotator.
It therefore re¬‚ects the signal pulse by imposing a 90—¦ rotation on its polarization.
This system eliminates therefore all birefringence-induced polarization drifts. Using
a 50/50 beam splitter, Alice can detect and store the Gaussian-modulated coherent-
state signal S. Because of the orthogonal polarizations, the signal pulses (which
contain about 102 photons after attenuation) and the LO pulses are then coupled
in the transmission ¬ber using a PBS. The signal and LO pulses leave the PBS
therefore at the same output port and travel through the quantum channel with
orthogonal polarizations, being delayed by 400 ns.
In Bob™s system, the LO pulse is transmitted through a PBS and a phase modu-
lator imposes randomly a phase shift θ L O = 0 or θ L O = π . Using an analog delay
line as at Alice™s side the LO pulses are delayed by 400 ns and polarization rotated
by 90—¦ . Having now the same polarization, S and LO hit simultaneously the 50/50
beam splitter of a homodyne detection device where they interfere. The homodyne
detection system outputs an electric signal, whose intensity is proportional to the
rotated quadrature x• of the signal, where • = (θ ’ θ L O ) is the phase difference
ˆ ˆ
between S and LO. Bob measures randomly either xθ and xθ’π/2 to select one of
the two quadratures. Later, using a public authenticated channel, he informs Alice
about which quadrature he measured, so she may discard the irrelevant data. After
many similar exchanges, Alice and Bob share a set of correlated Gaussian variables,
which are called “key elements.”
On Bob™s side, homodyne detection is performed by choosing at random one
of the two relevant quadrature measurements. Consider then a simple detection
108 M. Suda

scheme, in which bit values are assigned by the sign of the detection signal, +
or ’, with respect to the half planes in the quantum optical phase space. As a result,
both sender and receiver have binary data at hand. Classical data processing is then
necessary for Alice and Bob to obtain a fully secret binary key.
Classical data processing means that Alice and Bob apply an error correction (or
reconciliation) algorithm to their data. In order for Alice to correct the errors that
appear in her data with respect to Bob™s data (reverse reconciliation), the two par-
ties perform a multilevel reconciliation process based on low-density parity check
(LDPC) codes which are described in detail in [50]. To extract the secret informa-
tion, Alice and Bob use privacy ampli¬cation algorithms based on hash functions
yielding at the end a shorter bit sequence unknown to Eve. In Chaps. 3 and 4 error
correction and privacy ampli¬cation are discussed in more detail.
Security proofs against individual Gaussian attacks including direct or reverse
reconciliation are treated in the literature [37, 36, 34, 35]. Using Shannon™s for-
mula, simple analytical expressions for a Gaussian channel are derived. Security
proofs against general collective attacks can be found in [60] and [24] with Shannon
information being replaced by the Holevo quantity. Unconditional security against
coherent attacks has also been proven [33, 69].
The secret key rate R is given as the difference between the amount of informa-
tion shared by Alice and Bob and the amount of information available to Eve. For
the system under consideration, the following results have been obtained [50, 21]:

V + χtot
I AB = ,
log2 (6.6)
1 + χtot

I AB , mutual information between Alice and Bob
V = (V A + 1), excess noise (V ≈ 18.5 shot noise units N0 )
V A , Gaussian modulation of variance at Alice™s side
χtot = (χline + χhom /T ), total noise added between Alice and Bob
χline = (1/T ’ 1 + ), channel noise referred to the channel input
T = 10’±l/10 , transmission coef¬cient of the channel
±, attenuation of the line (= 0.2 dB/km)
l, length of the line (e.g., 15 km ’ T = 0.5)
, excess noise at the channel™s input (= 0.005 shot noise units N0 )
χhom = (1 + vel )/· ’ 1, detector™s noise referred to Bob™s input
vel , noise added by the detection electronics (= 0.041 N0 units)
·, detector ef¬ciency (= 0.606).
Now two different attacks are taken into account yielding different key rates.
These are (a) individual attacks which entail the Shannon rate and (b) collective
attacks which give rise to the Holevo rate.

(a) Shannon rate (individual attacks): In the individual attack, Eve performs her mea-
surement after Bob reveals his quadrature measurement (sifting) but before the
error correction. Thus, her information is restricted to the Shannon information.
6 QKD Systems 109

In the reverse reconciliation protocol Eve™s information reads

T ( V + χtot )
IB E = ,
log2 (6.7)
+ χhom
2 T ( 1/V +χline )

and the Shannon raw key rate reads

R Sh = β I AB ’ I B E . (6.8)

β is a factor which takes into account the ef¬ciency of reconciliation algorithm
(β = 0.898 [50]).
(b) Holevo rate (collective attacks): Eve™s accessible information after error correc-
tion is now upper bounded by the Holevo quantity [68]. One obtains

R Hol = β I AB ’ χ B E . (6.9)

χ B E , the Holevo information bound, reads as follows:

»1 ’ 1 »2 ’ 1 »3 ’ 1 »4 ’ 1
χB E = G +G ’G ’G ,
2 2 2 2
G(x) = (x + 1) log2 (x + 1) ’ x log2 x,
√ √
»1,2 = (1/2)[A ± A2 ’ 4B] , »3,4 = (1/2)[C ± C 2 ’ 4D] ,
A = V √(1 ’ 2T ) + 2T + T 2 (V + χline )2√, B = T 2 (V χline + 1)2 ,

C = V B+TT(V +χline ) hom , D = B VT+ +χtot ) .
)+Aχ Bχhom
(V +χtot (V
Example: l = 25 km (T = 0.30) ’ R Sh = 15.2 kb/s and R Hol = 12.3 kb/s.

6.2.5 Entanglement-Based QKD (EB)

The use of quantum entanglement in combination with existing ¬ber telecommuni-
cation networks extends the possibility to implement long-distance QKD communi-
cation in the future [18].
The most important quotation related to the entanglement-based QKD system
(polarization encoding) described here is given in [40]. A schematic picture of some
technical details of the system is shown in Fig. 6.5.
The source emits polarization-entangled photons. The state can be written as

|¦ = √ ( | H810 H1550 + | V810 V1550 ) . (6.11)

Here H (V ) indicates horizontal (vertical) polarization of a photon. The signal-
mode photon (wavelength 1550 nm) and the idler-mode photon (wavelength 810 nm)
are generated in pairs by an asymmetric SPDC (spontaneous parametric down-
110 M. Suda

Fig. 6.5 Schematic picture of the entanglement-based QKD system. The source emits polarization-
entangled photons of different wavelengths: 810 and 1550 nm. The 810 nm pair-photons are polar-
ization analyzed locally by Alice and detected by her silicon detectors (APDs, avalanche photo
diodes). The partner photons at 1550 nm are transmitted to Bob via telecom ¬bers on spool,
analyzed and detected by InGaAs-APDs. Classical communication is carried out via a TCP/IP
(transmission control protocol/internet protocol). FPGA: ¬eld programmable gate array; see text
for details

conversion) process [70, 63, 46] activated by two quasi-phase matched periodically,
poled KTiOPO4 ( ppK T P) crystals which have been tailored from a 532 nm pump
laser for type-I collinear generation of the photons (the pump laser and the crystals
are not shown in the picture).
The reason for choosing the 1550/810 set of wavelengths is twofold: Because of
the low absorption the signal is transmitted very well over optical ¬bers (1550 nm),
but has to be registered using InGaAs detectors which must be gated. Therefore,
the second pair photon (idler) is generated at a wavelength of 810 nm, which is
detectable more easily with Si-APDs. This photon is immediately measured at
Alice (at the source) with a passive BB84 detector module described in the next
section in more detail. Then the outcomes are correlated with the measurement
results at Bob™s 1550 nm-detection module in both bases. The implemented pro-
tocol is called BBM92 protocol and is a version of BB84 for entanglement-based
systems [7].
The description of the system shown in Fig. 6.5 goes as follows: The source at
Alice described above produces asymmetric entangled photons which are separated
by wavelength and coupled into single-mode ¬bers. The polarization analyzer for
810 nm photons is a free-space unit with a passive basis choice between measure-
ments in the H/V or +/’ basis. This basis choice is realized by a ¬rst 50/50 beam
splitter. The polarization measurements are performed with two polarizing beam
splitters (PBSs). The 810 nm photons are detected in a four-channel Si-APD array.
A delay module can set individual delay values for each Si-APD eliminating side
6 QKD Systems 111

channel attacks based on timing differences on Alice™s side. Each detection event is
recorded with a time stamp and an optical pulse (trigger) is generated at 1610 nm.
The trigger signal is wavelength multiplexed onto the quantum channel operating at
1550 nm.
The quantum channel is made up of a single-mode standard telecom ¬ber.
At Bob™s side the quantum signal is wavelength multiplexed to separate the quan-
tum signal at 1550 nm from the trigger at 1610 nm. Electronic polarization controller
is used to correct for polarization drifts in the quantum channel. Classical polariza-
tion state analysis is performed using polarimeters both on Alice™s and on Bob™s
side (not shown in Fig. 6.5). A ¬ber beam splitter acts as basis choice for the BB84
polarization analysis at Bob. Two ¬ber-based PBSs split the incoming light into two
orthogonal polarization components. Four InGaAs detectors measure the photon in
each of the four BB84 polarization states. Trigger signals are converted into gate
pulses on Bob™s FPGA board. Delay lines guarantee that the four InGaAs detectors
at Bob™s side open their gate at the same time.
Coincidences of detector clicks between Alice and Bob establish a secret key
after classical communication over TCP/IP.
Long-distance transmission of EB polarization-encoded qubits was successfully
demonstrated in free space up to 144 km [82]. In long-distance ¬ber-based EB
communication [57, 79] chromatic dispersion (CD) and birefringence (because of
polarization-mode dispersion, PMD) [15] seem to play an important role. A similar
EB QKD scheme described above was used to demonstrate the successful distri-
bution of secret keys over 1.45 km ¬ber glass in an urban environment where the
system was installed between the headquarters of a large bank and the Vienna city
hall in order to accomplish a bank transfer [65].
Security proofs for EB systems, in which the source is under Eve™s control, and
where higher losses can be tolerated if the source is in the middle between Alice
and Bob rather than if it is on Alice™s side, are presented in [53]. If deviations from
a perfect two-photon source are observed, EB security proofs take the presence of
multi-photon components into account when error rates are considered [45]. Tech-
nological imperfections of single photon detectors produce nonobservable increase
in the quantum bit error rate QBER (fake-state attacks [55, 54, 56] and time-shift
attacks [66, 86]).
The goal of the QKD system is to estimate a ¬nal secret bit rate R. In the EB
system discussed above the formula for the achievable secret key fraction reads [3]
[81, 4](SECOQC project [58])

ν A p D [ 1 ’ H (δ) ’ f (δ) H (δ) ] .
R= (6.12)

The particular quantities have the following meaning:
, this factor stems from the BB84 sifting procedure
ν A , Alice™s detection rate, ν A ≈ · A t A μ ≈ 106 s ’1
· A , quantum ef¬ciency of Alice™s detector (50%)
t A , transmittance in Alice™s side (40%)
112 M. Suda

μ, optimal pair generation (μ ≈ 5.106 s ’1 )
p D , measured probability of Bob™s detection ( p D ≈ 2 pd B + · B t B t)
pd B , probability of dark count per gate at Bob™s detector (= 3.10’5 )
· B , quantum ef¬ciency of Bob™s detector (10%)
t B , transmittance in Bob™s side (40%)
t, line transmittance with d being a distance (t = 10’±d/10 )
±, ¬ber attenuation (± = 0.25 dB/km)
H (δ) = ’δ log2 (δ) ’ (1 ’ δ) log2 (1 ’ δ), Shannon entropy
f (δ), depends on implemented error correction algorithm (= 1.1)
δ = QBER, measured quantum bit error rate (0.5% δ 3.5%)
δ is a function of t, p D , PMD, the two-photon visibility V and of multi-pair
contributions. Neglecting dark counts on Alice™s side the approximate formula for
the error rate reads [4]

1’V μ”T
1 d
δ≈ pd B + + +β ·B tB t . (6.13)
pD 2 2 d0

V, two-photon visibility (= 99%)
, multi-pair contribution to the error rate
”T, width of the gate pulse at Bob™s detector (= 2 ns)
β d0 , formula for PMD [27]

β = 0.001 and d0 = 25 km, two parameters, experimentally found
d, distance Alice“Bob in kilometer

For d = 0 km ’ δ ≈ 0.5 % ’ R ≈ 20 kHz . If we take the distance
between Alice and Bob to be d = 17 km one obtains a quantum bit error rate
δ ≈ 1.3% and a key rate R ≈ 6 kHz.

6.2.6 Free-Space QKD (FS)

Quantum cryptography is not necessarily restricted to the transmission of the quan-
tum state by means of ¬ber glass. Free-space QKD has become an accepted method
which has some advantages compared to the systems discussed so far. Interestingly
enough, the ¬rst laboratory demonstration of QKD by Bennett and Brassard in 1989
was a free-space experiment over 30 cm air using the polarization state of photons
for the generation of a quantum key. This system is described in detail in [5, 6]. In
the meanwhile one is able to execute QKD over large free-space distances [73, 72].
Here we report on a free-space QKD implementation which uses strongly attenuated
laser pulses over a distance of 500 m [84].
The system corresponds to the BB84 protocol [6] where qubits are encoded in the
polarization of faint laser pulses. This protocol can be described as follows: Alice
prepares single photons with randomly chosen polarization of four non-orthogonal
states (horizontal (H), vertical (V), +45—¦ or ’45—¦ ). She sends the photons to Bob,
6 QKD Systems 113

who analyzes the polarization in a randomly and independently chosen basis (either
H/V or ±45—¦ ). Subsequently, Alice and Bob compare publicly their basis choices
while discarding events where they had chosen different bases (sifting).
Quantum mechanics does not allow an eavesdropper (Eve) to measure the polar-
ization of a single photon without introducing errors between the communicating
parties. The quantum bit error rate (QBER) of the sifted key gives an upper bound
on the information Eve might have gained. This quantity is calculated during the
classical error correction procedure and at the same time is needed to make sure
that the information of a potential eavesdropper on the key is negligible (privacy
There have been some free-space experiments over relatively large distances
[73, 41, 47] showing the possibility to build global quantum key exchange systems
based on quantum communication satellites [64]. Below, a QKD free-space system
is described which can be applied to shorter distances in urban areas [84]. In Fig. 6.6
a sketch of the elements of such a system is drawn. Two units can be identi¬ed: the
left side belongs to the transmitter unit (Alice) and the right side belongs to the
receiver unit (Bob). The units are discussed subsequently.

Fig. 6.6 Simpli¬ed diagram of the free-space Alice and Bob setup: D: cube, housing the laser-
diodes, F: ¬ber mode¬lter, Q: quarter- and half-wave plates for polarization compensation of the
¬ber, BS: beam splitter, CD: detector for calibration of mean photon numbers, S: shutter to prevent
daylight coming in when calibrating the mean photon numbers. The front lens of the Alice tele-
scope is protected from sunlight by a 25 cm long black coated tube. Therefore the receiver collects
less stray light. Bobs unit see text

The transmitter unit consists of four laser diodes together with a conical mirror
and a spatial ¬lter. The diodes produce in random sequence (according to the choices
of basis and bit values) weak coherent pulses of polarized light (polarization: H, V,
+45—¦ , ’45—¦ ) of mean photon number μ of 0.1 approximately. The advantage of this
method is that no active polarization manipulation is needed. The four laser diodes
emitting 850 nm wavelength are seen on the left side in Fig. 6.6. They are arranged
around a conical mirror where the four beams are re¬‚ected and combined into one
direction. The beams have to pass a spatial ¬lter in order to let pass only a single
spatial mode and are then injected into a single-mode ¬ber. A monitoring APD is
114 M. Suda

mounted behind a BS. The second output of the BS leads to a telescope which emits
the photons into free space.
To ensure that as many photons from Alice as possible are detected by Bob, two
telescopes are employed, one at each end. Detailed data can be achieved elsewhere
[73]. In [84], a distance of about 500 m between two buildings in downtown Munich
has been chosen.
The receiver unit (Bobs module, right side of Fig. 6.6) is directly attached to the
end of the receiver telescope. A non-polarizing BS, a set of two PBSs, and a HWP
are used to perform the polarization analysis of the incoming photons. The 50/50
BS selects the basis (H/V or ±45—¦ ) randomly and the subsequent PBS including the
HWP determines whether a conclusive polarization measurement can be obtained.
The module acts completely passive. The single photons are detected by four silicon
APDs. Attached to the outputs of Bob™s module is the time stamp unit that records
the time-of-arrival of each detection event (timing resolution better than 1 ns).
Once the synchronization task is ¬nished, Alice and Bob can start the key sifting
process. If Alice has sent the photon in the same basis as measured by Bob, they
will use the assigned bit value for the sifted key. Ideally, both sifted keys would be
perfectly correlated. But experimental imperfection and/or an eavesdropper cause
errors. The CASCADE algorithm is used for error correction [38]. Public commu-
nication is necessary during this procedure. Each publicly transmitted bit increases
the eavesdropper™s knowledge of the key. Hence, these announced bits have to be
taken into account during the privacy ampli¬cation process [52]. In Chaps. 3 and 4
CASCADE and privacy ampli¬cation are treated more precisely.
A sifted key of about 50 kbit/s (QBER=3.2%) and a secure key of about 17 kbit/s
could be achieved during night operation. However, weather conditions affect the
attenuation of the free-space link. It has been observed that only fog, heavy rain,
or snowfall limits the transmission severely as well as strong turbulence above sun-
heated roofs close to the optical path.
Recently, a paper has been published presenting an entanglement-based QKD
system overcoming the limitation of the night operation. Here spectral, spatial, and
temporal ¬ltering techniques are used in order to achieve a secure key continuously
over several days under varying light and weather conditions [62].

6.2.7 Low-Cost QKD (LC)

A free-space quantum-cryptographic system that can operate in daylight conditions
is described in the following [17]. The system acts at a wavelength of 632.8 nm.
It works over a short range of a few meters and is designed to eventually work in
short-range consumer applications. The free-space QKD system for short distances
should be a low-cost application that is aimed at protecting consumer transactions.
The design philosophy is based on a future hand-held electronic credit card using
free-space optics. A method is proposed to protect these transactions using the
shared secret stored in a personal hand-held transmitter. Thereby Alice™s module
6 QKD Systems 115

is integrated within a small device such as a mobile telephone, or PDA (personal
digital assistant), and Bob™s module consists of a ¬xed device such as a bank ATM
(a-synchrone transfer mode).
Quantum cryptography provides a means for two parties to securely generate
shared messages. The information is encoded in non-orthogonal quantum states
which an eavesdropper cannot measure without disturbing. The most commonly
used method is devised on the BB84 protocol [6]. It is based on polarization encod-
ing presented in the preceding section. This method is also applied in the low-cost
QKD system described here. After the sifting procedure Alice and Bob should the-
oretically be correlated unless eavesdropping has taken place on the quantum chan-
nel. The eavesdropper must measure in a random polarization basis uncorrelated to
that of Alice and will therefore inject errors. This should be actively monitored by
measuring the error rate and discarding data where the error rate exceeds a certain
threshold (typically ∼ 12%).
In an experimental setup errors like optical imperfections, background counts,
and detector noise limit the signi¬cance of the results. Therefore, the processes of
error correction [13] and privacy ampli¬cation [8] are performed resulting in a secret
key shared only by Alice and Bob.
Long-distance free-space QKD experiments have been developed over 23 km
[47] and 10 km [41] just as well as studies in order to develop QKD systems between
ground and low earth orbit satellites [31].
Alice™s module uses a driver circuit which produces sub-5 ns pulses. The driver
pulses are combined with the output from a digital input/output card (NuDAQ) and
passed to four AlInGaP LEDs, see Fig. 6.7. The NuDAQ card is regulated by an
external clock and passes a random bit string, generated by a quantum number gen-
erator (QRNG, idQuantique), to the Alice module, recording which LED ¬res. The
driver pulses are produced at a repetition rate of 5 MHz. The four LEDs are attached
to a holder with dichroic sheet polarizers which are orientated in each of the four
polarization states, 0—¦ , 90—¦ , 45—¦ and ’45—¦ , placed over each output. Not till then
the light is polarized. To combine the four beam paths, a diffraction grating is used.
Because of the special design the holder serves to direct the polarized light toward

NuDAQ Alice Bob TIA

Public channel

Network connection

Fig. 6.7 Schematic diagram of a short-distance free-space QKD system. NuDAQ: digital
input/output data acquisition card, CLK: external clock, TIA: time interval analyzer card, TCP/IP:
transmission control protocol/internet protocol; see text for details
116 M. Suda

the grating. A pinhole is placed after the grating together with a 50 mm focal lens
to collimate the beam. A 632.8 ± 3 nm ¬lter is included to limit the bandwidth.
Currently the free-space quantum transmission between Alice and Bob consists
of a ¬xed connection of roughly 5 cm distance. In addition, Alice and Bob commu-
nicate classically via the internet which is a real public channel.
Bob™s module consists of a setup similar to Alice™s module but in reversed order.
First the beam coming from Alice is ¬ltered and focused to a similar grating, where
the beam is diffracted to four detectors with dichroic sheet polarizers (orientated in
the four polarization directions) over each detector. Four passively quenched silicon
avalanche photodiodes are used for detection. A simple circuit takes the output from
the detectors and converts it to a readable positive pulse. Time-of-arrival information
is recorded by a time interval analyzer card (TIA).
The bit error rate is B E R = Nwrong /Ntotal where Nwrong is the number of erro-
neous bits and Ntotal is the number of bits received in total. The module has to be
able to operate in daylight conditions, so the background error rate [31] is the most
limiting factor of the entire system.
The signal count S for this system is

RνT ·
S= (6.14)
including the following quantities:
R, pulse repetition rate (5 MHz)
ν, expected photon number (∼ 0.3 [52])
T , lumped transmission including geometric losses (∼ 1, because of the short-range
·, ef¬ciency of the detection system (∼ 0.045)

The protocol effectively splits the signal into four on the detectors, leading to a
factor 4 reduction in signal bit rate after sifting the key. The background rate is given

Pb = B t , (6.15)

where B is the background count rate per detector ( B ¤ 36,000 counts/s) and t
is the time synchronization gate (5 ns). The background error rate for this system is

E = 0.027 + . (6.16)

The current version of Bob™s module can operate in shaded areas but not in full
direct sunlight.
Most QKD systems use the CASCADE algorithm [38] for error correction,
which we discussed in Sect. 3.2. Another method has been adapted here. The
6 QKD Systems 117

so-called low-density Parity Check (LDPC) algorithm [23] is implemented for the
system in the case under consideration. The advantage of this code is that the
protocol has very little interactive communication compared to CASCADE. The
error corrected keys are then passed through the privacy ampli¬cation process. This
effectively reduces the length of the key. To estimate the key length, the L¨ tkenhaus
bound is used [51]. Currently the system is able to establish more than 4000 secret
bits per second between transmitter and receiver in low-light conditions.
In the next generation device it is expected to be able to operate at 10,000 secret
bits per second up to full daylight conditions. Eventually, Alice™s module must be
able to be brought to Bob™s module and fully automatically aligned. This can be
done using a ¬xed alignment cradle or docking station.

6.3 Summary
Quantum key distribution has triggered intense and proli¬c research work during the
past 10 years and now progresses to maturity. During the EC/IST project SECOQC
the seven most important QKD systems have been developed or re¬ned, and this
work compiled to some extent the physical and technical principles developed so far.
These systems are (1) the plug and play system, (2) the Phase-Coding QKD, (3) the
time-coding QKD, (4) the continuous variables system, (5) the entanglement-based
system, (6) the free-space system, and (7) the low-cost QKD.
(1) The Plug and Play auto-compensating system designed by idQuantique SA
employs a strong laser pulse (» = 1550 nm) emitted by Bob™s laser diode. The
pulse is separated at a ¬rst 50/50 BS. The two pulses travel down to the two input
ports of a PBS, after having traveled, respectively, through a short and a long arm
which includes a phase modulator and a delay line. The linear polarization is turned
by 90—¦ in the short arm, so that the two pulses exit the PBS by the same port.
The separated pulses travel down to Alice, are re¬‚ected on a FM, attenuated, and
come back orthogonally polarized. In turn, both pulses now take the other path at
Bob™s interferometer and arrive simultaneously at the ¬rst BS where they interfere.
They are detected by InGaAs APD™s. Since the two pulses follow the same path
in the interferometer (short“long or long“short), the system is auto-compensated.
The BB84 and the SARG protocols are implemented using phase coding. Alice
applies one of the four phase shifts on the second pulse of each pair and Bob™s
phase modulator completes the protocol. In order to avoid noise enhancement by
elastic Rayleigh scattering, the laser pulses are emitted in trains and are stored in
a long delay line at Alice™s side before being sent back to Bob. The Plug and Play
auto-compensating design offers the advantage of being highly stable and passively
(2) The one-way weak pulse system (phase-coding) designed by Toshiba Research
Europe Ltd. is a ¬ber-optic, decoy-state system with phase encoding. It employs
a decoy protocol using weak and vacuum pulses. It uses two asymmetric Mach-
Zehnder interferometers for encoding and decoding. Both the signal and the decoy
118 M. Suda

pulses are generated by a 1550 nm pulsed laser diode. The pulses are modu-
lated with an intensity modulator to generate the necessary ratio of signal pulse
strength to decoy pulse intensity and are then strongly attenuated to the desired level
before leaving Alice™s side. An active stabilization technique is used for continuous
(3) The coherent one-way system (time-coding) designed by GAP-Universit´ de e
Gen` ve, idQuantique SA and ARC realizes the novel distributed-phase-reference
COW protocol. Here Alice™s CW laser diode (1550 nm) and an intensity modulator
prepares pulses of weak coherent states or completely blocks the beam. A time-
of-arrival measurement and an interferometer at Bob™s side provide both optimal
unambiguous determination of bit values and check of coherence for signal and
decoy sequences using a phase shifter. The visibility of the various pulse sequences
behind the interferometer provides information about an attack of an eavesdropper.
(4) The continuous variables system developed by CNRS-Institute d™Optique-
Univ. Paris-Sud, THALES Research and Universit´ Libre de Bruxelles implements
a coherent-state reverse-reconciliated QKD protocol. The protocol encodes the key
information on both quadratures of the electromagnetic ¬eld. Alice uses a pulsed
laser diode and an asymmetric BS to generate signal and local oscillator pulses.
The signal pulses are appropriately modulated in amplitude and phase. The signal
is then time- and polarization-multiplexed with the delayed local oscillator before
propagating through the quantum channel. After de-multiplexing, Bob uses a time-
resolved homodyne detection system in order to measure the quadrature selected
by his phase modulator. Alice and Bob share therefore correlated continuous data.
Ef¬cient low-density parity check error correction and privacy ampli¬cation provide
for generating a binary secret key.
(5) The entanglement-based QKD system was developed by an Austrian“Swedish
consortium (University of Vienna, ARC and Royal Institute of Technology of Kista).
The system uses the unique quantum mechanical property of entanglement for trans-
ferring the correlated measurements into a secret key. The asymmetric source at
Alice produces two photons of different wavelengths (810 nm and 1,550 nm) by
spontaneous parametric down-conversion in a ppKTP crystal set. The 810 nm pho-
ton is measured by Alice in a passive system (one 50/50 BS and two PBSs, four Si
detectors), thus implementing the BBM92 protocol for entangled states. The other
1,550 nm photon travels down the quantum channel with low-transmission losses
and is registered by Bob using a similar passive system except for the four InGaAs
detectors. The quantum correlations between the photons create a secret key.
(6) The free-space QKD system was developed by the group of H. Weinfurter
from the university of Munich. It employs the BB84 protocol using polarization-
encoded attenuated laser pulses with photons of 850 nm wavelength. Decoy states
are used to ensure key security even with faint pulses. The system is applicable to
day and night operation using excessive ¬ltering in order to suppress background
light. The transmitter (Alice) applies four laser diodes producing random sequences
of weak coherent pulses of different polarization. The photons travel down a free-
space distance between two telescopes (at Alice™s and Bob™s side) and are registered
6 QKD Systems 119

by the receiver (Bob). The receiver mainly consists of the spatial ¬lter and the polar-
ization analyzing module with single-photon detectors.
(7) The low-cost QKD system was developed by John Rarity™s team of the uni-
versity of Bristol. The system can be applied for secure banking including con-
sumer protection. The system can operate in daylight conditions and uses the BB84
protocol. The transmitter (Alice) consists of a hand-held computer interfaced to a
FPGA. Pulses from the FPGA drive four polarized LEDs which are combined in
a diffractive optical element. The receiver (Bob) is run from a laptop computer.
His optical system uses a standard BS-based analyzer with four photon detec-
tors. The main error source is background light. Error correction is accomplished
by the low-density parity check code followed by privacy ampli¬cation to ensure

1. All´ aume (Editing author), R., Bouda, J., Branciard, C., Debuisschert, T., Dianati, M., Gisin,
N., Godfrey, M., Grangier, P., L¨ nger, T., Leverrier, A., L¨ tkenhaus, N., Painchault, P., Peev,
a u
M., Poppe, A., Pornin, T., Rarity, J., Renner, R., Ribordy, G., Riguidel, M., Salvail, L., Shields,
A., Weinfurter, H., Zeilinger, A.: Quantum key distribution and cryptography. SECOQC White
Paper (2007) 97
2. Assche, G., Cardinal, J., Cerf, N.: IEEE Trans. Inf. Theory 50, 394 (2004) 106
3. Beaudry, N., Moroder, T., L¨ tkenhaus, N.: arXiv:0804.3082 (2008) 111
4. Beaudry, N., Moroder, T., L¨ tkenhaus, N.: in preparation (2008) 111, 112
5. Bennett, C., Bessette, F., Brassard, G., Salvail, L., Smolin, J.: J. Cryptol. 5, 3 (1992) 98, 100, 112
6. Bennett, C., Brassard, G.: Conf. on Computers, Systems and Signal Processing, Bangalore,
India (IEEE, New York) p. 175 (1984) 98, 100, 103, 112, 115
7. Bennett, C., Brassard, G., Mermin, N.: Phys. Rev. Lett. 68, 557 (1992) 110
8. Bennett, C., Brassard, G., Robert, J.M.: SIAM J. Comp. 17(2), 210 (1988) 115
9. Branciard, C., Gisin, N., Kraus, B., Scarani, V.: Phys. Rev. A 72, 032,301 (2005) 100
10. Branciard, C., Gisin, N., L¨ tkenhaus, N., Scarani, V.: Quant. Inf. Comput. 7, 639 (2007) 105
11. Branciard, C., Gisin, N., Scarani, V.: New. J. Phys. 10, 013,031 (2008) 105
12. Brassard, G., L¨ tkenhaus, N., Mor, T., Sanders, B.: Phys. Rev. Lett. 85, 1330 (2000) 100, 101
13. Buttler, W., Lamoreaux, S., Torgerson, J., Nickel, G., Donahue, C., Peterson, C.: Phys. Rev. A
67(5), 052,303 (2003) 115
14. Cerf, N., L´ vy, M., Assche, G.: Phys. Rev. A 63, 052,311 (2001) 106
15. Damask, J.: Polarization Optics in Telecommunications. Springer, New York (2005) 111
16. Debuisschert, T., Boucher, W.: Phys. Rev. A 70, 1042,306 (2004) 104
17. Duligall, J., Godfrey, M., Harrison, K., Munro, W., Rarity, J.: New J. Phys. 8, 249 (2006) 114, 116
18. Dusek, M., L¨ tkenhaus, N., Hendrych, M.: Progress in Optics 49, 381 (2006) 97, 109
19. Dynes, J., Yuan, Z., Sharpe, A., Shields, A.: Opt. Express 15/13, 8465 (2007) 100
20. F´ lix, S., Gisin, N., Stefanov, A., Zbinden, H.: J. Mod. Opt. 48, 2009 (2001) 100
21. Fossier, S., Diamanti, E., Debuisschert, T., Villing, A., Tualle-Brouri, R., Grangier, P.:
arXiv:0812.3292 (2008) 106, 108
22. Fuchs, C., Gisin, N., Grif¬ths, R., Niu, C., Peres, A.: Phys. Rev. A 56, 1163 (1997) 100
23. Gallager, R.: IRE Trans. Inf. Th. IT-8, 21 (1962) 117
24. Garc´a-Patr´ n, R., Cerf, N.: Phys. Rev. Lett. 97, 190,503 (2006) 108
± o
25. Gerry, C., Knight, P.: Introductory quantum optics. 1st edn. Cambridge University Press,
Cambridge (2005) 102, 106
120 M. Suda

26. Ghernaouti-H´ lie (Editing author), S., Tashi, I., L¨ nger, T., Monyk, C.: Quantum cryptogra-
e a
phy: An innovation in the domain of secure information transmission. SECOQC Business
White Paper (2008) 97
27. Gisin, N., Ribordy, G., Tittel, W., Zbinden, H.: Rev. Mod. Phys. 74, 145 (2002) 97, 98, 100, 103, 105, 112
28. Gisin, N., Ribordy, G., Zbinden, H., Stucki, D., Brunner, N., Scarani, V.: arXiv:0411022
(2004) 103, 104, 105
29. Gobby, C., Yuan, Z., Shields, A.: Appl. Phys. Lett. 84, 3762 (2004) 100
30. Gobby, C., Yuan, Z., Shields, A.: Electron. Lett. 40, 1603 (2004) 103
31. Gorman, P., Rarity, J., Tapster, P., Knight, P.: New J. Phys. 4, 82 (2002) 115, 116
32. Gottesman, D., Lo, H.K., L¨ tkenhaus, N., Preskill, J.: Quant. Inf. Comp. 5, 325 (2004) 100, 101, 103
33. Gottesmann, D., Preskill, J.: Phys. Rev. A 63, 022,309 (2001) 108
34. Grosshans, F., Assche, G., Wenger, J., Brouri, R., Cerf, N., Grangier, P.: Nature 421, 238
(2003) 106, 108
35. Grosshans, F., Cerf, N.: Phys. Rev. Lett. 92, 047,905 (2004) 108
36. Grosshans, F., Cerf, N., Wenger, J., Tualle-Brouri, R., Grangier, P.: Quant. Inf. Comp. 3, 535
(2003) 108
37. Grosshans, F., Grangier, P.: Phys. Rev. Lett. 88, 057,902 (2002) 106, 108
38. Helleseth, T: (ed.). Advances in cryptology - proceedings of eurocrypt ™93. Lecture Notes in
Computer Science, Springer, Berlin 765, 410 (1994) 114, 116
39. Hillery, M.: Phys. Rev. A 61, 022,309 (2000) 106
40. H¨ bel, H., Vanner, M., Lederer, T., Blauensteiner, B., Lor¨ nser, T., Poppe, A., Zeilinger, A.:
u u
Opt. Express 15/12, 7853 (2007) 109
41. Hughes, R., Nordholt, J., Derkacs, D., Peterson, C.: New J. Phys. 4(43), 1 (2002) 113, 115
42. Hwang, W.Y.: Phys. Rev. Lett. 91, 057,901 (2003) 101, 103, 104
43. Inoue, K., Walks, E., Yamamoto, Y.: Phys. Rev. Lett. 89, 037,902 (2002) 105
44. Intallura, P., Ward, M., Karimov, O., Yuan, Z., See, P., Shields, A.: arXiv:0710.0565 (2007) 103
45. Koashi, M., Preskill, J.: Phys. Rev. Lett. 90, 057,902 (2003) 111
46. Konig, F., Mason, E., Wong, F., Albota, M.: Phys. Rev. A 71, 033,805 (2005) 110
47. Kurtsiefer, C., Zarda, P., Halder, M., Weinfurter, H., Gorman, P., Tapster, P., Rarity, J.: Nature
419, 450 (2002) 113, 115
48. Lo, H.K., Chau, H., Ardehali, M.: J. Cryptology 18, 133 (2005) 104
49. Lo, H.K., Ma, X., Chen, K.: Phys. Rev. Lett. 94, 230,504 (2005) 100, 101, 104
50. Lodewyck, J., Bloch, M., Garc´a-Patr´ n, R., Fossier, S., Karpov, E., Diamanti, E., Debuiss-
± o
chert, T., Cerf, N., Tualle-Brouri, R., McLaughlin, S., Grangier, P.: Phys. Rev. A 76, 042,305
(2007) 106, 108, 109
51. L¨ tkenhaus, N.: Phys. Rev. A 59, 3301 (1999) 117
52. L¨ tkenhaus, N.: Phys. Rev. A 61, 052,304 (2000) 114, 116
53. Ma, X., Fung, C.H., Lo, H.K.: Phys. Rev. A 76, 012,307 (2007) 111
54. Makarov, V., Anisimov, A., Skaar, J.: Phys. Rev. A 74, 022,313 (2005) 103, 111
55. Makarov, V., Hjelme, D.: J. Mod. Opt. 52, 691 (2005) 103, 111
56. Makarov, V., Skaar, J.: Quant. Inf. Comput. 8, 622 (2008) 103, 111
57. Marcikic, I., de Riedmatten, H., Tittel, W., Zbinden, H., Legr´ , M., Gisin, N.: Phys. Rev. Lett.
93, 180,502 (2004) 111
58. Monyk (Coordinator), C.: Development of a global network for secure communication based
on quantum cryptography. EC/IST Integrated Project SECOQC Contract No. 506813 (2004-
2008) 97, 111
59. Muller, A., Herzog, T., Huttner, B., Tittel, W., Zbinden, H., Gisin, N.: Appl. Phys. Lett. 70,
793 (1997) 98, 102
60. Navasqu´ s, M., Grosshans, F., Ac´n, A.: Phys. Rev. Lett. 97, 190,502 (2006) 108
e ±
61. Niederberger, A., Scarani, V., Gisin, N.: Phys. Rev. A 71, 042,316 (2005) 100
62. Peloso, M., Gerhardt, I., Ho, C., Lamas-Linares, A., Kurtsiefer, C.: arXiv:0812.1880 (2008) 114
63. Pelton, M., Marsden, P., Ljunggren, D., Tenger, M., Karlsson, A., Fragemann, A., Canalias,
C., Laurell, F.: Opt. Express 12, 3573 (2004) 110
6 QKD Systems 121

64. Pfennigbauer, M., Aspelmeyer, M., Leeb, W., Baister, G., Dreischer, T., Jennewein, T., Neck-
amm, G., Perdigues, J., Weinfurter, H., Zeilinger, A.: J. Opt. Netw. 4, 549 (2005) 113
65. Poppe, A., Fedrizzi, A., Ursin, R., B¨ hm, H., Lor¨ nser, T., Maurhardt, O., Peev, M., Suda, M.,
o u
Kurtsiefer, C., Weinfurter, H., Jennewein, T., Zeilinger, A.: Opt. Express 12/16, 3865 (2004) 111
66. Qi, B., Fung, C.H., Lo, H.K., Ma, X.: Quant. Inf. Comput. 7, 73 (2007) 103, 111
67. Ralph, T.: Phys. Rev. A 61, 010,303(R) (1999) 106
68. Renner, R.: Ph.D. thesis ETH Zurich (2005) 109
69. Renner, R., Cirac, J.: arXiv:0809.2234 (2008) 108
70. Ribordy, G., Brendel, J., Gautier, J., Gisin, N., Zbinden, H.: Phys. Rev. A 63, 012,309 (2000) 110
71. Scarani, V., Bechmann-Pasquinucci, H., Cerf, N., Dusek, M., L¨ tkenhaus, N., Peev, M.:
arXiv:0802.4155 (2008) 97
72. Schmitt-Manderbach, T.: Diss., LMU M¨ nchen (2007) 112
73. Schmitt-Manderbach, T., Weier, H., F¨ rst, M., Ursin, R., Tiefenbacher, F., Scheidl, T.,
Perdigues, J., Sodnik, Z., Kurtsiefer, C., Rarity, J., Zeilinger, A., Weinfurter, H.: Phys. Rev.
Lett. 98, 010,504 (2007) 112, 113, 114
74. Stucki, D., Barreiro, C., Fasel, S., Gautier, J.D., Gay, O., Gisin, N., Thew, R., Thoma, Y.,
Trinkler, P., Vannel, F., H., Z.: arXiv:0809.5264 (2008) 103
75. Stucki, D., Brunner, N., Gisin, N., Scarani, V., Zbinden, H.: Appl. Phys. Lett. 87, 194,108
(2005) 103, 105
76. Stucki, D., Gisin, N., Guinnard, O., Ribordy, G., Zbinden, H.: New. J. Phys. 4, 41.1 (2002) 98, 100
77. Stucki, D., Ribordy, G., Stefanov, A., Zbinden, H., Rarity, J.: J. Mod. Opt. 48, 1967 (2001) 100
78. Suda, M., Herbst, T., Poppe, A.: Eur. Phys. J. D 42, 139 (2007) 102, 104
79. Takesue, H.: Opt. Express 14, 3453 (2006) 111
80. Tancevski, L., Slutsky, B., Rao, R., Fainman, S.: Proc. SPIE 3228, 322 (1997) 100
81. Tsurumaru, T., Tamaki, K.: arXiv:0803.4226 (2008) 111
82. Ursin, R., Tiefenbacher, F., Schmitt-Manderbach, T., Weier, H., Scheidl, T., Lindenthal, M.,
Blauensteiner, B., Jennewein, T., Perdigues, J., Trojek, P., Omer, B., F¨ rst, M., Meyenburg,
M., Rarity, J., Sodnik, Z., Barbieri, C., Weinfurter, H., Zeilinger, A.: nature physics doi,
10.1038/nphys629 (2007) 111
83. Wang, X.B.: Phys. Rev. Lett. 94, 230,503 (2005) 100, 101, 104
84. Weier, H., Schmitt-Manderbach, T., Regner, N., Kurtsiefer, C., Weinfurter, H.: Fortschr. Phys.
54/8-10, 840 (2006) 112, 113, 114
85. Yuan, Z., Sharpe, A., Shields, A.: Appl. Phys. Lett. 90, 011,118 (2007) 101
86. Zhao, Y., Fung, C.H., Qi, B., Chen, C., Lo, H.K.: arXiv:0704.3253 (2007) 103, 111
Chapter 7
Statistical Analysis of QKD Networks
in Real-Life Environment

K. Lessiak and J. Pilz

As discussed before, Quantum Key Distribution (QKD) has already been realized in
various experiments. Due to this there is an interest to prove whether or not external
in¬‚uences like temperature, humidity, sunshine duration, and global radiation have
an effect on the quality of QKD systems. In consequence there is also an interest
to predict the qubit error rate (QBER) and the key rate (KR). In the course of the
SECOQC project [10], measurements of different devices in the prototype network
in Vienna have been conducted. Within these measurements the correlation between
QBER, KR, and these environmental in¬‚uences is analyzed. Therefore, statistical
methods such as generalized linear models and generalized linear mixed models are
used. Applying these two models predictions become possible. For the implemen-
tations we used the statistical software R c (R version 2.7.1).
In Sect. 7.1 the statistical methods used for the analysis are introduced. There
the basic principles of generalized linear models (GLMs) are established. An intro-
duction to generalized linear mixed models (GLMM) is also given. Furthermore,
the results of the ¬eld experiment in Vienna are shown and processed in Sect. 7.2.
Hereafter, in Sect. 7.3 the analyses and processing of the data take place.

7.1 Statistical Methods

Linear models play a decisive role in the economic, social, and engineering sciences,
especially in the investigation of causal relationships. They establish a ¬rm basis of
statistical methodologies. Because of the different requirements in these sciences, a
variety of models have been studied and made available. Very important extensions

K. Lessiak (B)
Safety & Security Department, Quantum Technologies, AIT Austrian Institute of Technology
GmbH, Lakeside B01A, 9020 Klagenfurt, Austria, katharina.lessiak@ait.ac.at;
J. Pilz
Institute of Statistics, Klagenfurt University, Universit¨ tsstraße 65-67, A-9020 Klagenfurt, Austria,

Lessiak, K., Pilz, J.: Statistical Analysis of QKD Networks in Real-life Environment. Lect. Notes
Phys. 797, 123“149 (2010)
c Springer-Verlag Berlin Heidelberg 2010
DOI 10.1007/978-3-642-04831-9 7
124 K. Lessiak and J. Pilz

of linear models are, for example, generalized linear models, mixed effect models,
and nonparametric regression models.
The starting point for these extensions is the linear regression model:

y = β0 + β1 x1 + · · · + β p x p + µ, (7.1)

with response variable y and predictors x1 , ..., x p . In this regression model µ is the
error, which is assumed to be normally distributed.
In principle, there are three extensions of the linear model. The ¬rst extension
of the above-mentioned regression model generalizes the x part. Basically, the pre-
dictors x in a linear model are combined in a linear way to model the effect on the
response. But sometimes it is inadequate to capture the structure of the data in a
linear way, because more ¬‚exibility is necessary. Additive models, trees, and neural
networks are methods that allow a more ¬‚exible regression modeling of the response
that combine the predictors in a nonparametric manner.
There also exist data which have a grouped, nested, or hierarchical structure and
that lead to the second extension of the above-mentioned regression model, namely
the generalization of the µ part. Because repeated measures, longitudinal, and man-
ifold data consist of several observations taken on the same individual or group and
the fact that this induces a correlation structure in the error µ, mixed effect models
are needed.
In the following, the third extension is explained in detail, which generalizes the
y part of the linear model.

7.1.1 Generalized Linear Models (GLMs)

GLMs have been introduced by Nelder and Wedderburn (1972) [7] and a detailed
representation is given by McCullagh and Nelder (1989) [6]. GLMs are necessary
to represent categorical, binary, and other response types because in standard linear
models it is not possible to handle non-normal responses such as counts or propor-
tions. Logit-, probit-, and Poisson models are important special cases of GLMs.
To de¬ne a GLM it is necessary to specify two components. At ¬rst, it is essential
that the distribution of the response variable is a member of the exponential family.
Furthermore, the link function shows how the mean of the response and a linear
combination of the predictors are related.

De¬nition 7.1 (cf. [4]) In a GLM the distribution of Y is from the exponential family
of distributions which take the general form

yθ ’ b(θ )
+ c(y, φ) .
f (y | θ, φ) = exp (7.2)

The θ is called the canonical parameter and represents the location while φ is
called the dispersion parameter and represents the scale.
7 Statistical Analysis of QKD Networks in Real-life Environment 125

The exponential family distributions have mean and variance (cf. [4]):

E(Y ) = μ = b (θ ), (7.3)

var (Y ) = b (θ ) a(φ). (7.4)

The mean is a function of θ only, while the variance is a product of functions of
the location and the scale. b (θ ) is called the variance function and describes how
the variance relates to the mean.

Let · denote the linear predictor:

· = β0 + β1 x1 + · · · + β p x p , (7.5)

then the link function g describes how the mean response E(Y ) = μ is linked to the
covariates through the linear predictor:

· = g(μ). (7.6)

Thus, a speci¬c generalized linear model is characterized by choosing the dis-
tributional type of the exponential family, the choice of the link function, and the
de¬nition of the predictors.
An example from the exponential family is the normal or Gaussian which is in
the following de¬ned by specifying the functions a, b, and c of Eq. 7.2 (cf. [4]):

(y ’ μ)2
exp ’
f (y | θ, φ) = √
2π σ 2σ 2
yμ ’ μ2 /2 1 y 2
= exp ’ + log(2π σ 2 ) ,
σ 2σ
2 2


θ = μ, φ = σ 2 , a(φ) = φ, b(θ ) = θ 2 /2, and c(y, φ) = ’(y 2 /φ + log(2π φ))/2.

The parameter φ is free in contrary to other exponential family members as, for
example, for the Poisson and binomial distributions. The reason is that the normal
distribution is a two-parameter family. It is also important to state that in the normal
case b (θ ) = 1 and hence the variance is independent of the mean. The identity link
in the normal distribution is de¬ned as · = μ.
Usually, the parameters β of a GLM can be estimated using maximum likelihood
[6]. Furthermore, having estimated a GLM for a data set the goodness of ¬t has to
be tested. In GLMs a measure for the goodness of ¬t is the deviance which measures
how closely the observed values are approximated by the model-based ¬tted values
of the response. To compare the deviance of two models a likelihood ratio test can be
used. There a statistic is used, which has a χ 2 -distribution with degrees of freedom
equal to the difference in the number of parameters estimated under each model.
126 K. Lessiak and J. Pilz

7.1.2 Generalized Linear Mixed Models (GLMMs)
The generalized linear mixed model (GLMM) is an extension of the GLM, espe-
cially to the context of clustered measurements. In a GLMM the idea of the GLM
is combined with the idea to include random effects. So, in a GLMM the linear
predictor · = x T β of the GLM is extended by adding random effects, which
are responsible to account for the correlation structure of clustered observations.
According to Faraway (2006) [4] the model takes the following form.

De¬nition 7.2 In a GLMM the response is a random variable Y taking values
y1 , ..., yn and with a distribution coming from the exponential family as before,

yi θi ’ b(θi )
f (yi | θi , φ) = exp + c(y, φ) . (7.8)

Moreover, with the canonical link θi = μi , the ¬xed effects β and the random
effects γ are related to θi through

θi = xiT β + z iT γ , (7.9)

where xi and z i are the corresponding rows from the design matrices X and Z for the
¬xed and random effects. The random effects are assumed to follow a probability
density h(γ |V ) with given (hyper-) parameters V.

A more speci¬c de¬nition for longitudinal and cluster data is given in Fahrmeir,
Kneib, and Lang (2007) [3].
Furthermore, according to Faraway (2006) [4] for estimation the likelihood takes
the form
f (yi |β, φ, γ )h(γ |V )dγ .
L(β, φ, V /y) = (7.10)

Due to the integral in the likelihood it becomes in general very dif¬cult to com-
pute this term explicitly. So, there are a lot of approaches to approximate the likeli-
hood using theoretical or numerical methods. Following Verbeke and Molenberghs
[13, 14] there are three main approximations to explain
• approximating the integrand
• approximating the data
• approximating the integral
The Laplace method is used for the approximation of the function to be inte-
grated, a speci¬c approach is given in Tierney and Kadane (1986) [12]. A penalized
quasi-likelihood approach (PQL) can be used for “approximating the data” and is
detailed in Wol¬nger and O™Connel (1993) [15]. For the case that these methods fail
(adaptive), Gaussian quadrature methods can be used, details are given in Pinheiro
7 Statistical Analysis of QKD Networks in Real-life Environment 127

and Bates (1995) [8], (2000) [9]. Demidenko [2] gives an introduction to approxi-
mations of maximum likelihood by statistical simulation methods, especially Monte
Carlo methods. Moreover, a Bayesian approach is possible, which is considered in
Sinha (2004) [11] and a further interesting approach is the generalized estimating
equations (GEE) considered by Zeger, Liang and Albert (1988) [17].

7.2 Results of the Experiments
As already described in Sect. 9.1, in the course of the SECOQC project in Vienna a
prototype of a QKD network was implemented. There were seven QKD-link devices
(described in Chap. 6) which connected ¬ve subsidiaries of SIEMENS Austria.
The measurements started on October 1, 2008 and were concluded on November
8, 2008. During this time the devices were tested and upgrades were executed. The
data used in this chapter are based only on the measurements from the different
devices from October 8, 2008 to October 10, 2008 of the quantum network because
a lot of data gaps arise out of upgrades on the devices. During the measurements in
the ¬ber ring network in Vienna data about the quality of QKD systems, especially
the qubit error rate (QBER) and the key rate (KR), are obtained. The data on air
temperature, humidity, sunshine duration, and global radiation are obtained from the
Central Institute for Meteorology and Geodynamics (ZAMG), which is the national
weather service agency in Austria. The calculations have been implemented in R
and are based on [4] and [16].

7.2.1 Data Set for the Device “Entangled”

First of all the entangled-based device is discussed which is called “Entangled.”
Alice was positioned in the SIEMENS Austria location in Erdberg (ERD) and Bob
was located in Siemensstrasse (SIE). The route ERD“SIE was used. The data set
consists of qubit error rate (QBER), key rate (KR), temperature, humidity, sunshine
duration, and global radiation. In Table 7.1 a short extract of the data set is presented.

Table 7.1 Extract of the data set of the device “Entangled”
QBER KR Temperature Humidity Sunshine duration Global radiation
329 2734 148 88 0 0
345 2650 145 89 0 0
329 2728 143 90 0 0
336 3151 141 91 0 0
379 2489 140 91 0 0
354 3056 141 91 0 0

An initial graphical and numerical look at the data is essential for any data
analysis. To get a compact numerical overview of the data the six statistics mini-
mum, 1st quantile, median, mean, 3rd quantile, and maximum for each numerical
128 K. Lessiak and J. Pilz

Table 7.2 Numerical overview of the results from the device “Entangled”
QBER KR Temperature
Min. : 291.0 Min. : 1707 Min. : 117.0
1st Qu.: 345.0 1st Qu.: 2304 1st Qu.: 134.0
Median : 364.0 Median : 2559 Median : 148.0
Mean: 374.3 Mean: 2519 Mean: 149.5
3rd Qu.: 393.0 3rd Qu.: 2700 3rd Qu.: 163.0
Max. : 513.0 Max. : 3595 Max. : 184.0
Humidity Sunshine duration Global radiation
Min. : 71.00 Min. : 0.0 Min. : 0.0
1st Qu.: 80.00 1st Qu.: 0.0 1st Qu.: 0.0
Median: 83.00 Median : 0.0 Median : 0.0
Mean : 84.07 Mean : 101.2 Mean : 92.98
3rd Qu.: 91.00 3rd Qu.: 0.0 3rd Qu.: 140.00
Max. : 93.00 Max. : 600.0 Max. : 539.00

variable are requested which are suf¬cient to get a rough idea of the distributions. In
Table 7.2 these six statistics of the data set from the device “Entangled” are shown.
In Fig. 7.1 the scatterplot of the data set is shown. A high correlation between
the variables is indicated by an elongated ellipse in the plot and it can be distin-
guished between a positive correlation and a negative correlation which depends on
the orientation. It can be seen that QBER and KR are highly correlated. To get a
numerical overview about the pairwise correlations the correlation matrix is useful.
The correlation matrix of the device “Entangled” can be seen in Table 7.3.
The scatterplot matrix and the correlation matrix show that external in¬‚uences
like temperature, humidity, sunshine duration, and global radiation do not have an
in¬‚uence on the quality of QKD systems, i.e., on the entangled-based device. In
contrast to the results of the measurements of April 23, 2008 shown in [5] an in¬‚u-
ence of these external in¬‚uences on the quality of QKD systems can be observed.
This difference is due to the fact that the devices were upgraded.
The next step to get a good overview and a good understanding of the data is
to have a look on graphical summaries. An essential means to get an idea of the
distribution of each numerical variable are histograms. A further well-known means
is a density estimate. Boxplots are very useful to ¬nd out the outliers in the data set.
In Fig. 7.2 the histogram, the density function, and the boxplot of QBER and KR are
given. The boxplot of QBER shows a lot of outliers. Before testing the distributions
it is important to eliminate these outliers. The reason is that these outliers can falsify
the result.
To get further information about the distributions different tests are possible,
for example, the Kolmogorov“Smirnov test. A good alternative is the Cramer“
von Mises two sample test [1] because it is more powerful than the Kolmogorov“
Smirnov test. The Cramer“von Mises two sample test declares that QBER can be
assumed to be gamma distributed because the p-value is 0.36. The fact that the
p-value is greater than 0.05 is an indication that this hypothesis cannot be rejected.
7 Statistical Analysis of QKD Networks in Real-life Environment 129

2000 3000 75 85 0 200 400







sunshine duration


global radiation

300 400 500 120 150 180 0 200 500

Fig. 7.1 Scatterplot matrix for the data set of the entangled-based device

Table 7.3 Correlation matrix for the device “Entangled”
QBER KR Temperature
QBER 1.0000000 “0.7000019 0.0276082
KR “0.7000019 1.0000000 “0.0179497
Temperature 0.0276082 “0.0179497 1.0000000
Humidity “0.0824010 0.0895992 “0.9473179
Sunshine duration 0.0968474 “0.2794770 0.5800525
Global radiation 0.0075992 “0.2888295 0.5531215
Humidity Sunshine duration Global radiation
QBER “0.0824010 0.0968474 0.0075992
KR 0.0895992 “0.2794770 “0.2888295
Temperature “0.9473179 0.5800525 0.5531215
Humidity 1.0000000 “0.6192554 “0.5692125
Sunshine duration “0.6192554 1.0000000 0.8631108
Global radiation “0.5692125 0.8631108 1.0000000
130 K. Lessiak and J. Pilz

Histogram of QBER Density function of QBER Boxplot of QBER










300 350 400 450 500 250 350 450 550
Data$QBER N = 293 Bandwidth = 10.35

Histogram of key rate Density function of key rate Boxplot of key rate




. 5
( 9)