EP1348278A1

EP1348278A1 - Quantum cryptography transmission method and system

Info

Publication number: EP1348278A1
Application number: EP01994002A
Authority: EP
Inventors: Thierry Thales Intellectual Prop. DEBUISSCHERT
Original assignee: Thales SA
Current assignee: Thales SA
Priority date: 2000-11-10
Filing date: 2001-11-09
Publication date: 2003-10-01
Also published as: FR2816772A1; WO2002039663A1; FR2816772B1; US20040057526A1; US7639809B2; AU2002223047A1

Abstract

Quantum cryptography uses the basic principles of quantum mechanics for making secure transmission of an encryption key. It does not prevent eavesdropping on a transmission channel. However, if an eavesdropper intercepts the message, he inevitably introduces errors into it. Those errors are used by the transmitter and the authorised receiver to detect channel eavesdropping with certainty. In that case, the transmission is not validated and the eavesdropper has no information he can use. The invention aims at providing supplementary coding elements for detecting more systematically interception of transmission. It consists in encoding digital data on one of the parameters x of a particle stream to be transmitted such that the probability of transmission of two particles per period is negligible with the parameter x and its conjugate parameter in a minimal state ( DELTA x. DELTA y=1).

Description

QUANTUM CRYPTOGRAPHY TRANSMISSION METHOD AND SYSTEM

The invention relates to the field of cryptography.

Thanks to cryptography, a message can only be read by its recipient. A key is used to encrypt the message. Only the owner of the key is able to read the message on reception.

The encryption key must therefore be transmitted by the sender to the recipient of the encrypted message. This transmission is carried out such that only the recipient of the encrypted message receives this encryption key. Interception by a third party of the encryption key is detected by the sender or the recipient. Thus, the encryption key detected as intercepted is not used for encryption of the message.

An example of the principle of transmitting encryption keys is that of quantum cryptography. It consists of using physical properties to ensure the integrity of a received encryption key.

The encryption key is made up of a sequence of bits. For example, each bit is associated with a time offset of a pulse on a light flux. Then, the light flux coded in the time domain is attenuated.

The probability of detecting two photons associated with the same bit is, therefore, negligible.

The transmitter (Alice) can encode the encryption key in two non-orthogonal states. The pulses sent by Alice have a time width ΔT and an amplitude such that the probability of detecting a photon during the whole duration of the pulse is equal to one (state at one photon) or sufficiently low for the probability to detect two photons or negligible compared to the probability of detecting one (coherent state).

On reception, the detection states are chosen from a base of two states. These two detection states are orthogonal respectively to each of the states of the base used by the transmitter. During transmission, the choice of emission and detection states is made independently of each other.

If the states chosen by the transmitter and the receiver are orthogonal, the probability of detection is zero. The measurement result is certain, there is no ambiguity. If they are not orthogonal, there are two possible measurement results because the probability of detecting the photon is

0.5. If the photon is detected, it is certain that the state of the emitter is 45 ° from the state of the receiver. There is no ambiguity. Whatever the configuration, there is always a possibility of not detecting the photon. This non-detection of the photon makes it ambiguous to deduce the choice of offset of the transmitter from knowledge of the state of the receiver. It is this ambiguity about the lag that is used in quantum cryptography.

Photon detection is a one-time process that can occur at any time during the pulse. The spy (Eve) can, for example, measure all the impulses sent by Alice. It has a quantum efficiency detector equal to one. For each pulse emitted by Alice, it detects the corresponding photon. If it is capable of instantly retransmitting a pulse to a photon to the Bob receiver but with a time width ΔT 'shorter than that sent by Alice, it can also read the information without being unmasked as shown in Figure 1.

Indeed, Bob receives, then, shorter impulses, but he cannot notice it. The probability of detecting a photon is the same as in the case where the pulses were not intercepted. In addition, their time position is consistent with the coding imposed by Alice. Half of the impulses re-emitted by Eve lead to usable information (unambiguous) and the other half to ambiguous results. When Alice and Bob compare the key portions, they will not be able to detect an increase in the error rate which would indicate to them the presence of a spy.

So, if the pulses are of any length, a third party, the spy (Eve), can measure the information sent by the transmitter (Alice) and send an equivalent signal back to the receiver (Bob) without it can be detected. Eve then has a copy of the information without it being exposed. This type of espionage is difficult to carry out in practice, but its possibility of principle cannot be excluded.

The present invention proposes to guard against this type of espionage by using a minimal state. This minimum state is a state where the product of the uncertainty on the coding parameter and its conjugate parameter is equal to its minimum value.

The subject of the invention is a method of coding digital data on one of the parameters x of a particle stream intended for transmission such as the probability of emission of two particles per period is negligible, characterized in that the parameter x and its conjugate parameter are in a minimal state (Δx.Δy = 1).

The invention provides a method for decoding coded digital data such that two conjugate parameters x and y of the coded particle flow are in a minimal state, knowing that the probability of detecting two particles per period is negligible, characterized in that it comprises minus:

A filtering step making it possible to separate the particles received verifying the relationship Δxi.Δyi> 1 but where Δxi ≠ Δx or Δyi ≠ Δy (Δx and Δy fixed) of the particles characterized Δx and Δy, and

• a decoding step proper of the particles verifying the minimal state relation.

The decoding process is implemented by a coded digital data decoder such that two conjugate parameters x and y of the coded particle stream are in a minimal state, knowing that the probability of detecting two particles per period is negligible, characterized in that it includes at least:

A filter making it possible to separate the particles received verifying the relationship Δxi.Δy-i> 1 but where Δxi ≠ Δx or Δyi ≠ Δy (Δx and Δy fixed) from the particles characterized Δx and Δy, and

• an elementary decoder receiving only the particles verifying the minimal state relation.

The characteristics and advantages of the invention will appear more clearly on reading the description, given by way of example, and of the figures relating thereto which represent:

- Figure 1, the representation of the pulses emitted by Alice and Eve according to the state of the art,

- Figure 2, a block diagram of the transmission system implementing the invention,

- Figure 3 (a), a first variant of the decoder according to the invention,

- Figure 3 (b), a second variant of the decoder according to the invention, - Figure 4, a transmission system having an "interferometer" structure according to the invention.

The parameters verifying the minimum state chosen by way of example in the figures and the description are the time width ΔT of the pulse carrying the information and its conjugate: the spectral width Δv of this pulse. The principles and system can be applied for any type of coding parameter x (temporal width, spectral width, polarization, position, pulse, beam size, beam divergence ...) and its parameter y such that they verify the relationship minimal state Δx.Δy = 1.

In FIG. 1, the pulses of temporal width ΔT are emitted by Alice. If Eve detects a photon, she can re-emit a pulse of shorter time width ΔT so that Bob cannot detect the interception. Indeed, the amplitudes of the pulses emitted by Alice and Eve are such that the probability of detecting a photon is the same for the two types of pulses. Depending on the moment of detection, the pulse sent by Eve carries information or not.

To guard against the type of espionage described above and shown in Figure 1, the pulses are also defined in the frequency space. The impulses emitted by Alice are characterized by a temporal width ΔT and a spectral width Δv whose product is always greater than a constant whose value is of the order of one: ΔT.Δv> 1. This relation is analogous to the relations d Heisenberg uncertainties which connect two conjugate parameters x and y: Δx. Δy> h. When this relation becomes an equality, we obtain a minimal state. The uncertainty on one of the conjugate variables is directly the opposite of the uncertainty on the other conjugate variable. These variables can, for example, be the position p _z and the pulse z. The analog in time-frequency space is called "Fourier Transform" pulse. It checks the relation ΔT.Δv = 1.

Figure 2 shows the block diagram of a transmission system implementing the invention. The encoder 1 therefore delivers a stream of pulses in a minimal state carrying the information to be transmitted on the value of the offset of the pulses with respect to the initial instant of the period. Such an encoder can include: • [ENCODER A] Or a source with 11 ⁺³ coded pulses (for example, a laser generating a discontinuous laser beam with more or less offset pulses according to the coded data and verifying the minimum state relation, • [B coder] a controllable retarder 13 receiving a stream of particle pulses verifying the minimum state relationship and coming from a pulse source 1 1 ⁺² ,

• [ENCODER C (case illustrated in Figure 2)] Or a 12 ⁺³ coded pulse cutter cutting pulses verifying the minimum state relationship with the appropriate time offset according to the data to be coded at the rate Tb in a beam continuous from a laser 11,

• [ENCODER D] Or a pulse cutter 12 cutting pulses verifying the minimum state relation at the rate Tb in a continuous beam from a source 11 then a controllable retarder 13 shifting the pulses more or less with respect to the initial instant of the period following the data to be coded.

In the example presented in FIG. 2, the coder 1 comprises a source of particles with pulse 11 ^{+ 2} (laser with mode latching, for example) and a retarder 13 such that the coded pulses verify the minimum state relation. The coded particle flow delivered by the encoder 1 is then attenuated by the attenuator 2 before being transmitted on the channel. This channel is said to be quantum because the probability that two particles are emitted on the channel per period is negligible or the probability that a single particle is emitted on the channel per period is equal to 1. The attenuator 2 proposed by FIG. 2 has a half-wave plate 21 followed by a polarizer 22 delivering a "key" beam on the quantum channel. The polarizer can also deliver a second, more intense beam. This annex "sync" beam can be used as a reference to synchronize the clocks of the transmitter and the receiver of the transmission system by quantum cryptography. The receiver comprises at least one decoder 3 receiving the "key" beam. This decoder 3 is possibly synchronized with the transmitter thanks to the "sync" auxiliary beam.

If the pulses emitted have a temporal width ΔT and a spectral width Δv which verify the minimum state relation Δv.ΔT = 1, a first variant of the decoder 3 proposed by FIG. 3 (a) can be used. The photons of the received "key" quantum signal are filtered by a filter of spectral width Δv. The photons of spectral width Δv are observed by the photon counter 31 'activated on the observation windows on which the value of the transmitted bit is certain (a window for the value bits "0" and a window for the value bits "1").

In FIG. 3 (b), the photons reflected by the filter Δv are also counted by a photon counter 31 ". The comparator 32 checks whether the number N _Δf of reflected photons is greater than much greater than the numbers N _Δv of photons observed in the observation windows. If this is the case, the decoder 3 decides that the information transmitted has been intercepted by a third person. Otherwise, depending on whether the photon counter 31 ′ detects a photon in one or the other. Another of the observation windows, the decoder 3 decides that a bit of value "0" or "1" has been emitted. Finally, if the photon counter 31 'does not detect a photon in one or the In other observation windows, the decoder 3 decides that there is non-reception, and cannot determine whether this non-reception is due to poor quality transmission or to interception by a third party.

Pulses close to the minimum state relation can be produced by, for example, 11 ⁺² mode latching lasers within an encoder 1. The time shifts are produced outside the laser by means of a retarder 13. The use of pulses produced by lasers with mode 11 ^{+2 latching} has important practical consequences.

Indeed, the pulse durations are typically between 10ps and 100fs. These values are much lower than the response times of existing photon counters (31 ') (typically 1 ns). The distinction between a shifted pulse and an unshifted pulse is therefore not possible. This function can be performed by an electrically controlled door (not shown) behind which the photon counter (31 ') is located. The possibility of making such a door very much depends on the response times obtained with the technology used, for example: 10 GHz with an electro-optical modulator.

The pulses verifying the minimum state relationship in time-frequency space make it possible to protect oneself from the type of espionage described in FIG. 1. Indeed, Eve intercepts the pulses sent by Alice and re-emits pulses of temporal width T 'and spectral width Δv' which must also verify the relationship ΔT 'Δv' = 1 so that the probability of detecting a photon remains the same. If the temporal width T is much smaller than T, then the spectral width Δv 'is necessarily larger than Δv. To detect the modification of the duration of the pulses emitted by Eve, it suffices to place a spectral filter of width Δv in front of Bob's photon counter as shown in Figure 3 (b). Most of the photons sent by Eve will then be reflected. By placing, for example, a second photon counter on the path of the reflected beam, the count rate on this counter will suddenly increase when Eve sends pulses shorter than those expected by Bob. The frequency filter can be achieved using, for example, an interference filter or a Fabry-Perot with adjustable spacing to choose the spectral bandwidth. If the pulses used are too small compared to the switching time of the door, an interferometer can be used between the transmitter and the receiver as shown in Figure 4. An 11 ⁺² pulse source delivers the flow of particles in the form of a train of pulses of temporal width ΔT and of periodicity Tb. The retarder 13 then comprises the separating element of the interferometer. The particle flow is thus separated into two parts sent to the two arms of the interferometer. In one of the arms, the retarder 13 can, for example, cause the pulse to pass or not through a delay line of duration ΔT / 2 (case t0 = 0, t1 = T / 2) depending on the data to be coded. Particle fluxes are attenuated on both arms by the attenuator 2 before being emitted as a "key" signal. The attenuator can, for example, use the auxiliary stream as a synchronization signal "sync" from the transmitter to the receiver. The decoder 3 then makes or not pass the pulse of the other arm of the interferometer in a delay line of identical duration (ΔT / 2 for example). If the self-timer 13 and the decoder 3 have chosen the same delay (0 or ΔT / 2), then the probability of detecting a photon is 100% in one of the output channels (channel a) and zero in the other track (track b). If the self-timer 13 and the decoder 3 have chosen different delays, then the probability of detecting a photon is 50% in each channel. The fact that the counter 31 'detects a particle in the path b, makes it possible to determine without fail what the delay chosen by the retarder 13. The counter of particle 31 ′ is placed downstream of a bandpass filter for particles of spectral width Δv or can, for example, be replaced by the device presented in FIG. 3 (b) if the pulses emitted are in a minimal state. The coding / decoding systems and methods using the minimum state relation for quantum cryptography have been described above in the particular case of temporal coding. The conjugate parameter is then the spectral width of the pulse carrying the information to be transmitted. It is thus possible to separate by simple filtering on the conjugate parameter the emitted particles not verifying the minimal state relation.

The use of the parameters of temporal width, spectral width is only one example of realization. In general, it is possible to use all types of parameters x (temporal width, spectral width, polarization, position, pulse, beam size, beam divergence, etc.) to carry the information to be transmitted. The invention then lies in the fact that this parameter x and its conjugate parameter y (respectively: spectral width, temporal width, conjugate polarization parameter, pulse, position, beam divergence, beam size ...) verifies the relation d 'minimum state Δx.Δy = 1 on transmission. On reception, it is then easy to separate the particles verifying the minimum state relation by filtering according to the conjugate parameter y. Filtering makes it possible to separate the particles received verifying the relationship Δxi.Δy-i> 1 but where Δxi ≠ Δx or Δy-i ≠ Δy (Δx and Δy fixed by the coder and known a priori from the decoder) from the particles characterized Δx and Δy .

Claims

1. Method for coding digital data on one of the parameters x of a particle stream intended for transmission such that the probability of emission of two particles per period is negligible, characterized in that the parameter x and its parameter conjugate are in a minimal state (Δx.Δy = 1).

2. Coding method according to the preceding claim, characterized in that:

• either it involves the transformation of the sequence of K bits of digital data into a train of K pulses of particle flux of duration ΔT (ΔT = Δx), of spectral width Δv (Δv = Δy) verifying the minimal state relation ΔT.Δv = 1, with a predetermined periodicity Tb knowing that each of the K pulses is offset or not in time such that the k ^lipmθ pulse is offset by a duration t0, respectively t1, with respect to the initial instant of the period following the value "0", respectively "1", of the k ' ^th bit with k integer such that 0 <k <K and the shifts tO and t1 are such that 0 <t0, t1 <Tb - ΔT and 0 <lt1 -t0l <DT;

• either the parameter x corresponds to the size of the particle beam and its conjugate parameter y to its divergence, or vice versa; • either the parameter x corresponds to the polarization.

3. Coder of digital data on one of the parameters x of a particle stream intended for a particle emitter such that the probability of emission of two particles per period is negligible, characterized in that the parameter x and its parameter conjugate are in a minimal state (Δx.Δy = 1).

4. Encoder according to the preceding claim, characterized in that:

• either it comprises at least one source capable of generating "Fourier Transform" pulses of duration T, of spectral width Δv and which verify the minimum state relation ΔT.Δv = 1 (T = Δx, Δv = Δy) in the time-frequency base and / or in that it makes it possible to transform the sequence of the K bits of digital data into a train of K pulses of duration T, of spectral width Δv, of predetermined periodicity Tb knowing that each of the K pulses is offset or not temporally such that the k ' ^th pulse is shifted by duration tO, respectively t1, with respect to the initial instant of the period following the value "0", respectively "1", of k ' ^Θmθ bit with k integer such that 0 <k <K and the shifts tO and t1 are such that 0 <t0, t1 <Tb - ΔT and 0 <lt1-t0l <ΔT; • either the parameter x corresponds to the size of the particle flux and its conjugate parameter y to its divergence, or vice versa;

• either the parameter x corresponds to the polarization.

5. A digital data transmitter comprising at least one digital data encoder according to claim 3 or 4 downstream of an attenuator making it possible to reduce the number of particles emitted per period such as the probability that two particles are emitted per period Tb is negligible.

6. Method for decoding coded digital data such that two conjugate parameters x and y of the coded particle flow are in a minimal state, knowing that the probability of detecting two particles per period is negligible, characterized in that it comprises at least:

• a filtering step making it possible to separate the particles received verifying the relationship Δx-i.Δyi ≥ 1 but where Δxi ≠ Δx or Δyi ≠ Δy (Δx and Δy fixed) of the particles characterized Δx and Δy, and • a decoding step properly called particles checking the minimal state relation.

7. Decoding method according to the preceding claim, characterized in that:

• either the two parameters Δx and Δy are the time width ΔT of the pulse offset or not depending on the value of the bits to be coded and its spectral width Δv, knowing Δt = ΔT-lt1-t0l, the decoding then comprises:

- the filtering step which makes it possible to separate the particles of spectral width Δv from the other particles, and - the decoding step proper which comprises:

> observation of the particle flux received over one or two time windows for each of the periods of duration

Tb of reception of a bit,

• if tO <t1, the first observation time window begins at time tO (inclusive) and ends at time t1 (excluded), the second observation window begins, if applicable, at time t1 + Δt (excluded) and ends at time t1 + T (included) or vice versa,

• if t1 <tO, the first observation time window begins at time t1 (inclusive) and ends at time tO

(excluded), the second observation window begins, if applicable, at time tO + Δt (excluded) and ends at time tO + T (included) or vice versa,> particle detection in the or the temporal observation windows delivering:

• a bit with value "0": ^π if tO <t1, when a particle is detected in the window starting at tO of period k, ° if t1 <tO, when a particle is detected in the window starting at tO + Δt of period k,

• a bit with value "1":

° if t1 <tO, when a particle is detected in the window starting at t1 of period k, ^π if tO <t1, when a particle is detected in the window starting at t1 + Δt of period k,

• a signal indicating an ambiguity in the value of the bit if no particle was detected in the first and, if necessary, in the second observation window,

- And / or counting the number N _Δv of particles received with spectral width equal to Δv, counting the number N _Δ f of particles received with different spectral width Δf (Δf ≠ Δv) and a comparison of these two numbers N _Δv and N _Δ f such that if N _Δv "

N _Δf , the interception of the particles by a third party is signaled;

• either the two parameters Δx and Δy are the size of the flux and its divergence, the filtering step then makes it possible to separate the particles whose divergence does not check the expected value from the particles whose divergence checks this value;

• either the two parameters Δx and Δy are the polarization of the light flux and its conjugate parameter Δy, the filtering step then makes it possible to separate the photons whose conjugate parameter Δy does not check the expected value from the photons whose conjugate parameter Δy checks it.

8. Decoder of coded digital data such that two conjugate parameters x and y of the coded particle flow are in a minimal state knowing that probability of detecting two particles per period is negligible, characterized in that it comprises at least: • a filter making it possible to separate the particles received verifying the relation Δxi.Δyi> 1 but where Δxi ≠ Δx or Δyi ≠ Δy (Δx and Δy fixed) from the particles characterized Δx and Δy, and • an elementary decoder receiving only the particles verifying the relation of minimal condition.

9. Decoder according to the preceding claim, characterized in that:

• either the two parameters Δx and Δy are the time width ΔT of the pulse offset or not depending on the value of the bits to be coded and its spectral width Δv, knowing Δt = ΔT-lt1 -t0l, the decoder then comprises:

- the filter which is passing for the particles of the pulses of spectral width Δv,

- at least a first particle counter:> which is activated on one or two time observation windows of the period of duration Tb of reception of a bit:

• if tO <t1, the first observation time window begins at time tO (included) and ends at time t1 (excluded), the second observation window starts at time t1 + Δt (excluded ) and ends at time t1 + T

(included),

• first observation time window begins at time t1 (included) and ends at time tO (excluded), the second observation window starts at time tO + Δt (excluded) and ends at l 'instant tO + T (included),

> which makes it possible to detect the presence or not of particles in the time observation window (s) and to deliver at least: "a bit of value" 0 ": ^π if tO <t1, when a particle is detected in the window starting at tO of period k, ^a if t1 <tO, when a particle is detected in the window starting at tO + Δt of period k, • un bit with value "1":

^D if t1 <tO, when a particle is detected in the window starting at t1 of period k, ^α if tO <t1, when a particle is detected in window starting at t1 + Δt of period k, - un signal indicating an ambiguity on the value of the bit if no particle was detected in the first and, if necessary, in the second observation window. - And / or the first particle counter (31 ′) delivering the number N _Δv of particles it detects and the decoder also comprises at least:

> a second counter (31 ") delivering the number N _Δf of particles received by the decoder (3) and of spectral widths Δf different from Δf ≠ Δv, and

> a comparator (32) of these two numbers N _Δv and N _Δf such that if N _Δv "N _Δf , it delivers a predetermined signal indicating either the ambiguity on the value of the bit, or the interception of the particles by a third party;

• either the two parameters Δx and Δy are the polarization of the light flux and its conjugate parameter Δy, the filtering step then makes it possible to separate the photons whose conjugate parameter Δy does not verify the expected value of the photons whose conjugate parameter Δy la checked.

10. Use of the transmitter of claim 5 for transmitting an encryption key by quantum cryptography to a receiver synchronous with the transmitter using the annex beam transmitted by the transmitter and comprising a decoder (3) according to one of claims 8 or 9.