On Quantum Key Distribution Using Ququarts

ISSN 1063-7761, Journal of Experimental and Theoretical Physics, 2007, Vol. 104, No. 5, pp. 736–742. © Pleiades Publishing, Inc., 2007. Original Russian Text © S.P. Kulik, A.P. Shurupov, 2007, published in Zhurnal Éksperimental’noœ i Teoreticheskoœ Fiziki, 2007, Vol. 131, No. 5, pp. 842–850.

ATOMS, MOLECULES, OPTICS

On Quantum Key Distribution Using Ququarts

1

S. P. Kulik and A. P. Shurupov Moscow State University, Moscow, 119899 Russia *e-mail: [email protected] Received December 29, 2006

Abstract—A comparative analysis of quantum key distribution protocols using qubits and ququarts as information carriers is presented. Several schemes of incoherent attacks that can be used by an eavesdropper to obtain secret information are considered. The errors induced by the eavesdropper are analyzed for several key distribution protocols. PACS numbers: 03.67.Hkm, 42.25.Ja, 42.50.Dv DOI: 10.1134/S106377610705007X

1. GENERALIZED BB84 PROTOCOLS The idea of quantum key distribution (QKD) using states of dimension D > 2 was originally put forward in [4]. The QKD protocol proposed therein extended the well-known BB84 protocol to three-level systems [2]. According to [4], information is encoded into quantum states spanned by four mutually unbiased bases. Each basis is a set of three orthonormal vectors. By definition, the vectors in a family of mutually unbiased bases satisfy the following conditions: 1 |〈ei |ej 〉|2 = ---D

(1a)

if the vectors |ei 〉 and |ej 〉 belong to different bases (D is the dimension of the Hilbert space); |〈ei |ej 〉|2 = 0, i ≠ j, |〈ei |ej 〉|2 = 1

(1b)

if the vectors belong to the same basis. It was shown in [5] that a set of M = D + 1 mutually unbiased bases exists only if D = pk, where p and k are a prime and an integer, respectively. In particular, if D = 3 or 4, then the number of bases is M3 or M4. The cor1 responding basis states are called qutrits and ququarts, respectively. The total number of states spanned by the mutually unbiased bases is m = MD; i.e., 12 and 20 states are used in three- and four-level systems, respectively. None of the vectors spanned by mutually unbiased bases is geometrically distinguished: the projection of a particular vector onto one belonging to a different basis (i.e., nonorthogonal to the former vector) has the same value for any pair of vectors. This is a key property used in QKD protocols. Key distribution using high-dimensional quantum states essentially follows the scenarios of standard qubit protocols. A random string of characters taken from a D-ary alphabet (e.g., 0, 1, 2, and 3 if D = 4) is

1

encoded into a sequence of m nonorthogonal states from M randomly chosen (but known) bases. Further generalization leads to a protocol using an infinite-dimensional Hilbert space and an infinite set of bases [6]. For D = 4, it was found that 12 states spanned by three mutually unbiased bases are relatively easy to prepare [7, 8]. In this paper, we present a detailed analysis of the ququart-based generalized BB84 protocol using three of five possible mutually unbiased bases (M = 3). 2. ANALYSIS OF EAVESDROPPING STRATEGIES To detect eavesdropping attempts, Alice and Bob disclose and compare a fraction of their respective keys. The results of the comparison are used to estimate the error rate induced by channel noise and/or Eve’s intervention.1 In incoherent attacks, Eve measures each transmitted quantum state individually. When the attack is symmetric, the introduced disturbance is statistically similar to channel noise. In what follows, we denote three mutually unbiased bases in a four-dimensional Hilbert space by ψ, φ, and ϕ. 2 2.1. Intercept/resend In the simplest strategy (intercept–resend attack), 2 Eve intercepts the state sent by Alice to Bob, performs a direct measurement on it, and sends a new state depending on the measurement outcome to Bob. This possibility is not forbidden by the no-cloning theorem [3], because Eve knows exactly the state she prepares, but cannot exactly measure the intercepted state. Here1 Alice

736

and Bob are the conventional names of the sender and receiver, respectively; A and B denote their respective locations; and Eve is the conventional name of the eavesdropper.

ON QUANTUM KEY DISTRIBUTION USING QUQUARTS

1

inafter, the bases used in Alice’s and Bob’s measurements are assumed identical; i.e., we consider the states retained after the key has been sifted. 1 Consider the following protocol using ququarts. Suppose that the Alice sends a state |ψα〉. If Eve performs a measurement in the basis ψ (randomly chosen with probability 1/3), then she prepares an exact copy of |ψα〉 and sends it to Bob. Since Eve’s information is correct, so is Bob’s measurement outcome. However, if Eve performs her measurement in φ or ϕ, then the outcome is any basis state with equal probability 1/4. Thus, Eve gains no information about the input state. When Bob performs a measurement in ψ on a state prepared by Eve in φ or ϕ, the correct outcome |ψα〉 is obtained only with probability 1/4. Thus, Bob’s measurement outcome is incorrect with probability 3/4. In the general case, Shannon’s entropy of a D-ary character is

The basis θ used in the generalized BB84 protocol satisfies the following conditions: 〈θ i|ψ i〉 = 〈θ i|φ i〉 = 〈θ i|ϕ i〉 = max, 〈θ i|ψ j〉 = 〈θ i|φ j〉 = 〈θ i|ϕ j〉 = min,

When only two bases are used in data transmission, the θ-basis elements are obtained simply as |θ i〉 = N ( |ψ i〉 + |φ i〉 ),

(4 D)

i.e., Eve’s error rate is 1/2. In this case, Bob’s error rate is 3/8. In the standard BB84 protocol [2], Bob’s error rate is 1/4 while Eve’s bit rate is I(2D) = 1/2. Eve can reduce the disturbance caused by her intervention by measuring only a fraction of the transmitted states. Then, her information reduces by the same factor. 2.2. Intermediate Basis Instead of guessing the bases used by Alice and Bob, Eve can perform her measurements in an intermediate basis [9]. Eavesdropping with an intermediate basis is the simplest strategy for gaining probabilistic information.

(4a)

1 〈θ i|ψ j〉 = 〈θ i|φ j〉 = ---------- . 2 3

(4b)

P ( θ α ) = 3/4,

P ( θ β ) = ( θ χ ) = ( θ δ ) = 1/12.

Hence, Eve’s information is I

(4 D)

3 1 3 1 = 2 + --- log 2--- + 3 ------ log 2------ ≈ 0.792; 4 12 4 12

i.e., her bit rate is 0.396. The corresponding disturbance is

i.e., her bit rate is 1/3. Bob’s error rate is the product of the respective probabilities of incorrect outcomes of Eve’s and Bob’s measurements: 2/3 × 3/4 = 1/2. This can be compared with the result obtained under the two-basis protocol using four-dimensional states, I 2 – basis = 1;

3 〈θ i|ψ i〉 = 〈θ i|φ i〉 = ---------- , 2 3

If Alice sends a state |ψα〉 and Eve’s measurements are performed in this basis, then the probabilities of correct outcomes are

(4 D)

I 3 – basis = 0.666;

(3)

where N satisfies normalization conditions. Thus, the element |θi 〉 lies in the hyperplane spanned by |ψi 〉 and |φi 〉. 1 When ququarts are used, we have

where HD(p1, …, pD) is the entropy defined as

in terms of the probabilities p1, …, pD of possible outcomes. 2 If Eve uses the intercept/resend strategy to extract data transmitted under this protocol, then the information leaked to Eve evaluated by using (1) is

(2)

i ≠ j.

I = log 2( D ) + H D ( p 1, …, p D ),

H D ( p 1, …, p D ) = p 1 log 2 p 1 + … + p D log 2 p D

737

(4 D)

E bob = 5/12. Analogous estimates under the qubit protocol are I

(2 D)

≈ 0.399,

E

(2 D)

≈ 1.4.

When information is transmitted by using ququarts 1 in three mutually unbiased bases, the elements of an intermediate basis (if any) can be determined by the following algorithm. The first element of the desired basis must have the form |θ α〉 = α |ψ α〉 +

∑

j = β, χ, δ

2

1 – a iΓ -------------- e j |ψ j〉. 3

(5)

The remaining vectors are calculated analogously. According to (1), the probabilities of Eve’s correct and incorrect guesses are a2 and (1 – a2)/3, respectively. However, there exists no basis of this kind that satisfies constraints (5) calculated by using (4). Therefore, an attack of this type is unfeasible under the protocol 1 using ququarts in three mutually unbiased bases. In [10], it was proved that there exists no basis of this kind in the case when all of possible five mutually unbiased bases are employed.

JOURNAL OF EXPERIMENTAL AND THEORETICAL PHYSICS

Vol. 104

No. 5

2007

KULIK, SHURUPOV

738 Alice-bob mutual information, IAE 1.0

+ D/3 |ψ 2〉 |E 32〉 + D – 1 |ψ 3〉 |E 33〉,

qubits (2b) ququarts (2b) (3b) intercept/resend (ir)

0.8

intermediate basis (ib) optimal algorithm (o)

0.6

o42

0.4 0.2 ir43

0

ib42 ib22

o2 2 o4 3 ir42 ir22

0.2 0.4 0.6 Alice-Eve mutual information, IAE

Fig. 1. Efficiency of eavesdropping strategies: Alice–Bob mutual information vs. private information known to Eve. A protocol is secure unless the former exceeds the latter.

2.3. Optimal Algorithm The following strategy proposed in [11, 12] maximizes Eve’s information and minimizes the disturbance caused by her intervention. After Eve has intercepted the carrier state sent by Alice to Bob, as in the standard strategy. She performs a unitary transformation on an auxiliary system (ancilla) interacting with the intercepted carrier to create entangled states, stores the ancilla state in a quantum memory, and forwards a modified carrier state to Bob. Suppose that Eve keeps all stored ancilla states until Bob has announced the bases used in his measurements. The amount of information gained by Eve after she has measured the stored states is determined by the effect of Eve’s intervention on the carrier states and the method used for measuring the ancilla states. A stronger effect implies more information known to Eve, but increases the introduced disturbance. The most general symmetric eavesdropping strategy 1 for ququarts is formulated as follows: U |ψ 0〉 |E〉 =

D – 1 |ψ 0〉 |E 00〉 + D/3 |ψ 1〉 |E 01〉

+ D/3 |ψ 2〉 |E 02〉 + D/3 |ψ 3〉 |E 03〉, U |ψ 1〉 |E〉 =

D/3 |ψ 0〉 |E 10〉 + D – 1 |ψ 1〉 |E 11〉

+ D – 1 |ψ 2〉 |E 12〉 + D – 1 |ψ 3〉 |E 13〉, U |ψ 2〉 |E〉 =

D/3 |ψ 0〉 |E 20〉 + D/3 |ψ 1〉 |E 21〉

+ D – 1 |ψ 2〉 |E 22〉 + D/3 |ψ 3〉 |E 23〉, U |ψ 3〉 |E〉 =

D/3 |ψ 0〉 |E 30〉 + D/3 |ψ 1〉 |E 31〉

(6)

where D denotes the disturbance introduced by Eve’s intervention, F = 1 – D is the fidelity of the state received by Bob after the eavesdropping attack, and |E〉 is the initial ancilla state. The entangled ancilla states |E00〉, |E01〉, … are normalized, and their dimension is not fixed. The symmetry and unitarity conditions simplify analysis of the strategy by reducing the number of parameters required to describe the most general eavesdropping attack. This strategy has been analyzed for protocols using ququarts in two [12] and all five [11] mutually unbiased 1 bases. We analyze this strategy for the protocol using three mutually unbiased bases. The amounts of Alice–Eve and Alice–Bob information are equal. Accordingly, the security of the protocol cannot be preserved if the dis(3) turbance exceeds the critical value D c = 0.2658. The analogous values obtained in the papers cited above are (2) (5) D c = 0.25 and D c = 0.2666. As expected, the critical disturbance Dc increases with the number of mutually unbiased bases. However, the increase is insignificant. On the other hand, an increase in the number of mutually unbiased bases reduces the key generation rate, which impedes the practical implementation of such protocols. The critical disturbance value determines an upper bound for error rate compatible with security of key distribution. Bob’s errors can be related to channel noise as well as Eve’s intervention. Therefore, a higher critical disturbance implies security of a noisier channel. Let us compare these results with those obtained when Eve uses a universal cloning machine [13]. An analytical study of the case of five bases was presented in [14]. Analogous predictions for qutrits were supported by numerical calculations performed for a universal cloning machine [11, 15]. The result obtained is fully consistent with the results for optimal eavesdropping. Figure 1 compares several strategies in terms of eavesdropping efficiency. The protocols considered here are secure if the Alice–Bob mutual information is greater than the mutual information known to Eve. This implies that the bit string shared by Alice and Bob after the key distillation and privacy amplification procedures have been completed is unconditionally secure. When Eve’s information exceeds the Alice–Bob mutual information, the security of the final key cannot be guaranteed. The line IAB = IEA represents the critical condition. The QKD protocol used by Alice and Bob is specified by the last digit in the notation of the curves. Eve chooses a strategy depending on her equipment (letters


Vol. 104

No. 5

2007


1

in the notation of the curves). Suppose that the protocol is the generalized BB4 using four-dimensional states spanned by two mutually unbiased bases (N42, N = o, ir, ib). For example, suppose that Eve extracts 40%. According to Fig. 1, the security of the final key cannot be guaranteed in this case if Eve uses the inter2 cept/resend strategy or an intermediate basis. However, a secret final key can be still be generated by the legitimate users when Eve can implement the optimal algorithm. As noted above, When Eve uses the optimal strategy in an individual attack, she extracts maximum information while the error rate is reduced to a minimum. Security is lost when Eve’s information equals that shared by Alice and Bob (i.e., the key generation rate vanishes).

Key generation rate, bits 1.0 0.8 0.6 0.4 0.2

0

10

20 14.64

2.4. Key Generation Rate The is key generation rate is the difference in mutual information between the Alice–Bob and Alice–Eve channels divided by the number M of the bases employed: 1 R AB = ----- ( I AB – I Eve ). M

I AB = log 2 N + ( 1 – E Bob ) log 2( 1 – E Bob )

is such that Ψ = Ψ1 ⊗ Ψ2 = a 1 b 1 |00〉 + a 1 b 2 |01〉 + a 2 b 1 |10〉 + a 2 b 2 |11〉.

3. DISCUSSION A Pair of Qubits or a Ququart? By definition, a separable state of two qubits Ψ 1 = a 1 |0〉 + b 1 |1〉,

Ψ 2 = a 2 |0〉 + b 2 |1〉

(8)

It is obvious that an arbitrary state of a four-level system can be represented as an entangled bipartite state of two qubits: Ψ = c 1 |00〉 + c 2 |01〉 + c 3 |10〉 + c 4 |11〉 ≠ Ψ 1 ⊗ Ψ 2 . (9) State (9) is separable if

E Bob -. + E Bob log 2-----------N–1 Figure 2 shows the key generation rate (the number of bits in the final key per transmitted bit) versus disturbance for several eavesdropping strategies. It is clear that the upper bound on the disturbance rate compatible with security increases with the carrier-state dimension, approaching unity in the limit of infinite dimension [6]. Therefore, security can be “physically” enhanced by using quantum systems of higher dimension. However, this approach is impeded by the complexity of manipulation on high-dimensional quantum states. The required preparation and measurement procedures are not sufficiently well developed. One exception is the use of two-photon polarization states generated by spontaneous parametric down-conversion (SPDC) [7].

26.6 30 40 25 Error rate, %

Fig. 2. Key generation rate vs. error rate (bits per transmission). Points of intersection with abscissa axis correspond to upper bounds for disturbance.

(7)

Indeed, the relative number of discarded outcomes increases with the number of bases, while the private information is obviously proportional to (IAB – IEve), where IAB depends on the disturbance induced by channel noise and/or Eve’s intervention as follows:

739

c1 c4 = c2 c3 .

(10)

Indeed, the second photon in the pair is described by the reduced density matrix  2 2 c 1 + c 3 c 1 c 2* + c 3 c 4*  ρ 2 = Sp 1 ρ =  2 2  c 2 c *1 + c 4 c *3 c 2 + c 4

 ,  

(11)

where ρ ≡ |Ψ〉〈Ψ| and subscript 1 means that the first qubit is traced out. It follows from (11) that the eigen(2) values of ρ2 are λ 1, 2 = 0.1 only if condition (10) is satisfied. In this case, the component qubit states are pure; i.e., wavefunction (9) can be factored into single-photon ones. In practice, entangled states of two qubits are much more difficult to prepare and measure as compared to two uncorrelated qubits. A relatively simple method for preparing 12 ququart states spanned by three mutually unbiased was proposed in [7, 8]. Each prepared state is a separable pair of photon polarization states obtained generated by SPDC in crystals without inversion sym-


Vol. 104

No. 5

2007

KULIK, SHURUPOV

740

γ1

γ2 Fig. 3. Uncorrelated photon packets with mean photon number µ ~ 0.1.

γ1γ2 Fig. 4. Biphoton packets with mean biphoton number µ' ~ 0.1.

IF1

PBS

D1

IF2 D2

CC

Fig. 5. Setup for measuring the biphoton basis state |H1V2〉: PBS is a beamsplitter transmitting horizontal polarization and reflecting vertical polarization; CC is a coincidence circuit; IF1 and IF2 are interference filters with transmittance peaks at λ1 and λ2, respectively; D1 and D2 are photodetectors.

metry. The first basis consists of combinations of horizontally and vertically polarized photons: |ψ α〉 = |H 1, H 2〉,

|ψ β〉 = |H 1, V 2〉,

|ψ χ〉 = |V 1, H 2〉,

|ψ δ〉 = |V 1, V 2〉.

(12a)

Here, subscripts 1 and 2 refer to the component photons, which may have different frequencies. The remaining two bases, the diagonal one |ψ β〉 = |D 1, D 2〉,

|ψ β〉 = |D 1, A 2〉,

|ψ β〉 = | A 1, D 2〉,

|ψ β〉 = | A 1, A 2〉

(12b)

and the circular one |ψ γ 〉 = | R 1, R 2〉,

|ψ γ 〉 = | R 1, L 2〉,

|ψ γ 〉 = | L 1, R 2〉,

|ψ γ 〉 = | L 1, L 2〉

(12c)

are obtained by SU(2) transformations of photon states, which are easy to implement in polarization optics. The basis states in (12) are linear combinations of |H〉 and |V〉 for the first and second photons in a pair:

1 |+45°〉 ≡ |D〉 = ------- ( |H〉 + |V 〉 ), 2 1 |–45°〉 ≡ | A〉 = ------- ( |H〉 – |V 〉 ), 2

(13)

1 | R〉 = ------- ( |H〉 + i |V 〉 ), 2 1 | L〉 = ------- ( |H〉 – i |V 〉 ). 2

(14)

By criterion (10), these basis states can be factored into corresponding products of single-photon states; i.e., they are not entangled. Consider two single-photon states prepared independently in the same spatial mode. Figures 3 and 4 illustrate the distributions of uncorrelated and entangled photons, respectively, in pulse train. It can be shown that this key distribution scheme is a combination of two independent BB84 protocols. As compared to the standard BB84, it can be used to increase the key generation rate, but has no advantage in terms of security. Polarization states in a Hilbert state with D = 4 can be measured by pair coincidence counting with two photodetectors [7]. In this scheme, a pair of uncorrelated photons is equivalent to a biphoton within the coincidence time window Tc. Since a single photon cannot be reliably prepared within a narrow time interval by current experimental techniques, a two-photon state can be generated only by SPDC. However, a photon pair generated in this manner cannot be used to implement a four-state QKD protocol. A QKD scheme using biphotons as carrier states is characterized by a higher key generation rate and an enhanced protection against eavesdropping attacks. 3.2. Pair Coincidence Scheme When the carrier states are biphoton polarization states (ququarts), gated avalanche photodiodes can be 1 used as single-photon counters: the bias voltage is held below the breakdown threshold and increased only for a short gate window τ when an input photon is expected to arrive. Basically, a photodetector can be characterized by two parameters: quantum efficiency η and probability p of dark count over a time τ. Figure 5 schematizes a standard setup for measuring the biphoton state |H1V2〉. Horizontally and vertically polarized light transmitted and reflected, respectively, by a polarizing beamsplitter is directed to detectors operating in single-photon counting mode. Biphoton light is selected by interference filters with transmittance peaks at different wavelengths, the detector outputs are compared by a coincidence circuit (an AND gate), and a count signal is produced only when both detectors fire within the same gate window.


Vol. 104

No. 5

2007


1

Since biphoton arrival times follow the Poisson distribution

741

(S/N) 2 /(S/N)1 100

n

µ –µ P ( n, µ ) = ----- e , n!

80

the mean photon number µ per gate τ should be reduced to minimize the probability that two biphotons arrive within the same window (see Figs. 3 and 4). In practical quantum cryptography, weak laser pulses with µ = 0.1 are used to prepare single-photon states [16]. In summary, we give several estimates. 1. The probability of dark counts in both photodiodes within the same gate is

60 40 20 0

Ps = µη2. For low-noise detectors with p on the order of 10–4– a correction PNN proportional to p squared can be neglected. 2. The probability of coincidence of a photon count with probability η in one detector and a dark count with probability p (conditioned on the probability 1 – η that no photon arrives) in the other is

Fig. 6. Two-photon to one-photon SNR ratio for µ ~ 0.1.

10–5,

2

P NN = ( 1 – µ ) p . This outcome is not a strictly dark count, because one of the photons making up a biphoton is still detected. However, we interpret it as a dark count. For the two-photon detection scheme considered here, the signal-to-noise ratio (SNR) is estimated as

intermediate basis is used in Eve’s attack. Then, she can guess three out of four quarts correctly. For example, if Alice’s sends the string αδβαχδδβγαβδ…, then Eve may have the string αδcαχbδβγαaδ…. Here, three out of 12 quarts are incorrect. However, comparing the corresponding bit-string representations

P SN = µη ( 1 – η ) p ( 1 – p ) ≈ µη ( 1 – η ) p.

Alice 00 11 01 00 10 11 11 01 10 00 01 10 Eve 00 11 10 00 10 01 11 01 10 00 00 10

For a single-photon scheme, the SNR is PS η S  --- ≈ -------= --------------------- .  N 2 P SN (1 – η) p Thus, the two-photon SNR exceeds the single-photon one by a factor of µη S  --- ≈ --------------------- .  N 1 ( 1 – µ ) p Figure 6 shows the dependence of this factor on η calculated for the typical mean photon number µ = 0.1. For InGaAs photodiodes (λ = µm, η = 0.1), the difference in SNR amounts to an order of magnitude. 3.3. Mapping onto a Two-Dimensional Key As pointed out in [17], Alice and Bob can use binary 3 codewords to represent the characters in a D-ary alphabet. For example, if D = 4, then α = 00,

β = 01,

χ = 10,

δ = 11.

10 20 30 40 50 60 70 80 90 100 Photodetector quantum efficiency η, %

(15)

However, the example given below demonstrates that they should change to this representation with care to maximize their advantage. Suppose that two mutually unbiased bases are used by Alice and Bob, and an

we see that Eve’s error rate reduces to 1/6 (only four out of 24 bits are incorrect). The explanation is that the errors in Eve’s bit string are blockwise independent, whereas her errors in the original quart string are oneto-one independent. Thus, a D-ary string must not be mapped onto a binary one before error correction and privacy amplification procedures have been completed. Moreover, Alice and Bob must not disclose mapping (15), because otherwise Eve can optimize her strategy, for example, by assigning different weights to input states. The security of QKD protocols using qubits and qudits (quan- 4 tum systems with D > 2) was discussed in [18]. Finally, we emphasize that the use of high-dimensional quantum states is a “physical” approach to resolving the issues arising in quantum cryptography. Our analysis shows that protocols using such carrier states are better protected against eavesdropping attacks and/or corruption by noise. Lower key generation rate associated with higher space dimension (due to a larger fraction of discarded outcomes) can be compensated for by using fewer mutually unbiased bases. The current availability of well-developed methods for preparing, converting, and measuring two-photon


Vol. 104

No. 5

2007

KULIK, SHURUPOV

742

polarization states suggests that this class of states is a promising candidate for use in future quantum cryptosystems. ACKNOWLEDGMENTS We thank H. Zbinden, H. Weinfurter, S.N. Molotkov, and D. Horoshko for helpful discussions of the results of this study. This work was supported by the Russian Foundation (project nos. 06-02-16769 and 07-02-01041-a) and under the State Program for Support of Leading Science Schools (grant no. NSh-4586.2006.2).

6. D. V. Sych, B. A. Grishanin, and V. N. Zadkov, Laser Phys. 14, 1314 (2004). 7. S. P. Kulik, G. A. Maslennikov, and E. V. Moreva, Zh. Éksp. Teor. Fiz. 129, 814 (2006) [JETP 102, 712 (2006)]. 8. Yu. I. Bogdanov, E. V. Moreva, G. A. Maslennikov, et al., Phys. Rev. A 73, 063810 (2006). 9. C. Bennett, F. Bessette, G. Brassard, et al., J. Cryptology 5, 3 (1992). 10. R. Asplund, G. Bjork, and M. Bourenanne, J. Opt. B: Quantum Semiclassic. Opt. 3, 163 (2001). 11. D. Bruss and C. Macchiavello, Phys. Rev. Lett. 88, 127901 (2002). 12. F. Caruso, H. Bechmann-Pasquinucci, and C. Macchiavello, Phys. Rev. A 72, 032340 (2005). 13. V. Buz ek and M. Hillery, Phys. Rev. Lett. 81, 5003 (1998). 14. N. J. Cerf, M. Bourennane, A. Karlsson, and N. Gisin, Phys. Rev. Lett. 88, 127902 (2002). 15. T. Durt, N. J. Cerf, N. Gisin, and M. Zukowski, Phys. Rev. A 67, 012311 (2003). 16. N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Rev. Mod. Phys. 74, 145 (2002). 17. H. Bechmann-Pasquinucci and W. Tittel, Phys. Rev. A 61, 062308 (2000). 18. D. V. Khoroshko and S. Ya. Kilin, Opt. Spektrosk. 94, 750 (2003) [Opt. Spectrosc. 94, 691 (2003)]. ^

REFERENCES 1. S. Wiesner, SIGACT News 15, 78 (1983). 2. C. H. Bennett and G. Brassard, in Proceedings of the IEEE International Conference on Computers, Systems, and Signal Processing, Bangalore, India (IEEE, New York, 1984), p. 175. 3. W. K. Wootters and W. H. Zurek, Nature 299, 802 (1982). 4. H. Bechmann-Pasquinucci and A. Peres, Phys. Rev. Lett. 85, 3313 (2000). 5. W. K. Wooters and B. D. Fields, Ann. Phys. (N.Y.) 191, 363 (1989).

Translated by A. Betev

SPELL: 1. Ququarts, 2. resend, 3. codewords, 4. qudits


Vol. 104

No. 5

2007