Distribution and certification of photonic entanglement for quantum communication

(1)

Thesis

Reference

Distribution and certification of photonic entanglement for quantum communication

VERBANIS, Ephanielle

Abstract

In this thesis, I study quantum resources for quantum communication and cryptography. The first part deals with bit commitment, a cryptographic primitive in which a party commits a secret bit to another party. After shortly presenting the security issues faced by quantum bit commitment, I demonstrate the first realization of a secure relativistic bit commitment sustained for 24 hours. The second part deals with the development of efficient methods to generate, distribute and characterize photonic entangled states. I address the problem of certifying entanglement in the presence of measurement imperfections, and demonstrate a practical implementation of a measurement-device-independent entanglement witness. I then address the challenge of long-distance distribution of entanglement. I demonstrate a heralded photon amplifier and entanglement swapping protocols adapted for the distribution of single photon entanglement, and further discuss the advantages and limitations of using single photon entanglement as a resource for quantum communication.

VERBANIS, Ephanielle. Distribution and certification of photonic entanglement for quantum communication. Thèse de doctorat : Univ. Genève, 2019, no. Sc. 5346

DOI : 10.13097/archive-ouverte/unige:119899 URN : urn:nbn:ch:unige-1198995

Available at:

http://archive-ouverte.unige.ch/unige:119899

Disclaimer: layout of this document may differ from the published version.

1 / 1

(2)

UNIVERSITÉ DE GENÈVE FACULTÉ DES SCIENCES Groupe de Physique Appliquée Professeur Hugo Zbinden

DISTRIBUTION AND CERTIFICATION OF PHOTONIC ENTANGLEMENT FOR QUANTUM COMMUNICATION

THÈSE

présentée à la Faculté des sciences de l’Université de Genève pour obtenir le grade de Docteur ès sciences, mention physique

par

Ephanielle VERBANIS

de Guadeloupe

Thèse N^o 5346

GENÈVE 2019

(3)

(4)

Abstract

Recent advances in manipulating quantum systems are driving forward a technological revolution. Many new applications based on quantum entanglement, such as quantum communication and quantum computing, are emerging and developing promisingly. In this thesis, I address several questions regarding entanglement resources and quantum communication.

The first part of my work deals with a field of research which is of increas- ing importance in this information age: cryptography. Following the success of quantum key distribution, which enables the transfer of information in provably secure ways, scientists attempted to realise similarly secure bit commitment protocols, cryptographic primitives in which a party commits a secret bit to a another party. Unfortunately, quantum bit commitment was proven impossible. Here, I present a classical bit commitment protocol whose security is based on timed classical exchanges and relativistic constraints, and demonstrate the first realization of a 24-hour relativistic bit commitment.

The rest of this thesis deals with the development of efficient methods to generate, distribute and characterize photonic entangled states for quantum communication. I first address the problem of certifying entanglement in the presence of measurement imperfections, which can lead to falsely identifying or over estimating entanglement. A recent solution to this was the development of measurement- device-independent entanglement witnesses (MDI-EW) which are robust against measurement errors and can detect all entangled states. Here, we propose and demonstrate a practical MDI-EW protocol, certifying entanglement for a family of polarization Werner states down to an entangled state fraction of 0.4.

I then address the challenge of long-distance distribution of entanglement, which is greatly limited by transmission losses in optical fibres. Single photon path entanglement is a promising resource to achieve this. Indeed, its single photon nature makes it simpler to generate and more robust to loss and detector inefficiency than two-photon entanglement. Its detection, on the other hand, is much more complex in distributed scenarios and requires additional resources. Here, we demonstrate a heralded photon amplifier and entanglement swapping protocols adapted for the distribution and detection of path entanglement. We further discuss the advantages and limitations of using path entanglement as a resource for long-distance quantum communication, notably for device independent quantum key distribution.

3

(5)

(6)

R´ esum´ e

Les récentes avancées en manipulation d’états quantiques entrainent une vraie révolution technologique. De nombreuses nouvelles applications basées sur l’intrication quantique, telles que la communication et l’informatique quantiques, se développent de manière prometteuse. Dans cette thèse, je traite de plusieurs questions portant sur les ressources d’intrication et la communication quantique.

La première partie de mon travail porte sur un domaine de recherche qui est d’une importance grandissante à l’ère de l’information: la cryptographie. S’inspirant de la distribution de clés quantiques qui permet de transférer de l’information de manière sécurisée, des scientifiques ont tenté de réaliser un protocole de mise en gage de bit dont la sécurité est aussi assurée par la physique quantique. Il s’est avéré qu’une mise en gage de bit quantique n’est pas possible dans un scénario asynchrone où les deux parties ne se font pas confiance. Ici, je présente un protocole de mise en gage de bit dont la sécurité repose sur des échanges synchronisés d’information classique et des contraintes relativistes. Je démontre ainsi la première réalisation d’une mise en gage de bit relativiste d’une durée de 24 heures.

La suite de cette thèse porte sur le développement de méthodes efficaces pour générer, distribuer et caractériser des états intriquées photoniques pour la communication quantique. Je traite, tout d’abord, du problème posé par les imperfections de mesure sur les méthodes de certification de l’intrication. Ces imperfections peu- vent, en effet, entrainer une estimation erronée de l’intrication. Une solution récente

`

a ce problème repose sur des témoins d’intrication dont le résultat ne dépend pas du dispositif de mesure. Ceux-ci sont donc insensibles aux erreurs de mesure et sont capable de détecter tous les états intriqués. Ici, je propose et démontre un protocole simplifié d’un tel témoin, certifiant l’intrication d’états de Werner jusqu’à une fraction d’intrication de 0.4.

Finalement, je traite de la problématique de la distribution de l’intrication, grandement limitée en distance par les pertes dans les fibres optiques. L’intrication en chemin formée par un photon unique délocalisé sur plusieurs modes spatiaux est une ressource prometteuse pour surmonter cette limitation. En effet, les états intriqués à un photon sont plus simple à générer et plus robustes face aux pertes et inefficacités des détecteurs que les états intriqués à deux photons. Leur détection, en revanche, est beaucoup plus complexe et demande des ressources additionnelles.

Ici, je démontre un protocole d’amplificateur de photon annoncé et de permutation d’intrication, adaptés à la distribution et la détection d’états intriqués en chemin.

5

(7)

J’examine en détail les avantages et limitations à utiliser ces états pour la communication quantique, et plus particulièrement pour la distribution de clés quantiques dont la sécurité ne dépend pas du dispositif expérimental utilisé.

(8)

Introduction

As our societies and technologies build on accessing and processing a large amount of information, finding secure ways to store and transfer information is becoming increasingly important. To date, most encryption schemes are not information- theoretically secure; they rely on problems which are computationally-hard to solve with present technology. One example is the widely used RSA public-key cryp- tosystem which rely on the factorization of a large number into its prime-numbers.

In 1994, Peter Shor demonstrated that the integer-factorization problem could be efficiently solved on a quantum computer [1]. Such computer uses qubits, quantum version of classical bits realized with two-state quantum systems, andentangled qubits [2]. Entanglement is a uniquely quantum resource which is responsible for many of the advantages quantum computers offer with respect to classical computers. However, useful quantum computation rely on the entanglement of a significant number of qubits. Such entangled states are highly sensitive to noise and decoher- ence, making the realisation of a useful quantum computer extremely challenging.

Nonetheless, there has been important experimental advances to scale up and operate highly coherent qubit platforms. We can expect quantum computers with 100 qubits¹ in the next few years [3], and possibly one day, enough qubits to efficiently solve the integer-factorization problem. Hence, the eventual realization of quantum computer poses a threat to the security of present classical cryptographic schemes.

Interestingly, quantum mechanics also provides a solution to safely transfer information. Quantum key distribution (QKD) [4,5,6] exploits the quantum mechanical principle that observation in general disturbs the quantum system being observed.

Thus, an eavesdropper cannot intercept a quantum exchange without introducing errors in the communication that would reveal his presence. Because the security of QKD relies on the laws of quantum physics, it can be proven to be secure even against an adversary with infinite computational power.

Most existing QKD protocols make the extra assumption that the two parties perfectly know how their correlations are established, i.e. that they trust their devices. Device-independent QKD schemes (DI-QKD) [7, 8] remove this assumption and allow to extract a key from some observed correlations, without having to care about practical details of the implementation. Such schemes rely on shared entan-

1 Google and IBM have recently reported devices with 72 and 50 qubits, respectively; both based on superconducting circuits.

9

(11)

gled states which violate a Bell inequality [9]. To ensure that the Bell inequality is violated without assumptions, all experimental loopholes must be closed, notably the detection loophole which sets a rather high detection efficiency threshold. Hence, to achieve DI-QKD, it is crucial to develop efficient ways to generate, distribute and detect entanglement.

While entanglement has been demonstrated in many different physical systems [10, 11, 12], its distribution definitely involves photons. Indeed, photons are the best carrier of information, especially at telecom wavelengths where the transmission losses of optical fibres are minimal. This thesis deals with the development of efficient resources and protocols for the generation, distribution and detection of photonic entangled states.

Generation In the last two decades, parametric processes have been widely used to generate entangled photons for quantum communication. Their advantages and limitations will be discussed throughout this thesis. Developing photon pair sources with higher performance is a very active area of research, which has shown interesting progress in the last few years. The ideal source would be deterministic, with high rates, high photon indistinguishability and purity.

Certification There are various methods to verify the presence of entanglement, with different degrees of confidence and assumptions. The highest confidence is reached with the violation of a Bell inequality, which guarantees the presence of entanglement without making any assumption on the state and on the internal work- ing of the measurement devices. The inconvenience is that it requires high detection efficiencies to close the detection loophole. This is experimentally challenging, and has only been achieved recently [13, 14, 15, 16], enabled mostly by impressive advances in the development of high-efficiency single photon detectors [17,18].

Such detection efficiency requirements can however be dropped when making some assumptions on the set-up. For example, measurement-device-independent entanglement witnesses do not make any assumptions on the measurements but require extra trusted qubits [19]. Standard entanglement witnesses, on the contrary, as- sume complete knowledge of the measurement devices and of the entangled state.

Consequently, they are not robust against measurement errors.

Distribution The distribution of photonic entangled states is mainly limited by the transmission losses of optical fibres, which is typically 0.2 dB/km at telecom wavelengths. In classical fibre-optic communication, the losses are compensated by repeaters or optical amplifiers. Such deterministic amplification is not possible in quantum communication due to the no-cloning theorem [20]. To overcome this limitation, several protocols based on quantum teleportation [21] have been proposed. One of them is a heralded photon amplifier [22], which allows to teleport an input state with a certain gain on the probability of having a photon at the output with respect to the vacuum. Another interesting protocol is entanglement swapping [23] which allows one to entangle two distant quantum systems that have never interacted directly with each other. It is a key step in quantum repeater schemes [24], whose principle consists in decomposing the full distance in shorter

(12)

CONTENTS 11 elementary links and consecutively swap entanglement between neighbouring links.

Repeater schemes rely on quantum memories to store elementary entanglement un- til entanglement has been established in the neighbouring link as well. Developing on-demand and efficient quantum memories is still an ongoing field of research.

Demonstration of these protocols have been achieved with various forms of entanglement such as polarization, time-bin or path entanglement. Each form has its own advantages and disadvantages which are worth studying and comparing.

Throughout this thesis, we will encounter two forms of entanglement: polarization and single photon path entanglement. The former has been extensively used in quantum communication applications due to the availability of high efficiency polarization-control elements. The later shows great promise for long-distance quantum communication as it is more robust to loss and detector inefficiency than two- photon entanglement. However, the means of measuring it in distributed scenarios have proven challenging.

There are many interesting questions to answer and technological challenges to solve to achieve quantum repeaters for DI-QKD and future quantum networks. In parallel, impressive demonstrations of standard QKD have been achieved, such as key distribution through 421 km of optical fibres [25] and using satellite to ground communication over 1200 km [26]. Commercial QKD systems are now also available.

Following the growing development of QKD, a natural question to ask is if other cryptographic tasks can be made secure using the laws of quantum physics. Can quantum mechanics guarantee the security in scenarios where two parties do not trust each other, and would like to make a bet or a commitment without the help a third referee party? We will see that for bit commitments protocols, exchanges of quantum states do not bring any advantages.

Outline of the thesis

In chapter 1, I first explain why secure quantum bit commitment is impossible. I then present a classical bit commitment protocol whose security is based on timed classical exchanges and relativistic constraints and demonstrate the first realization a 24-hour relativistic bit commitment.

In chapter 2, I present different approaches to certify entanglement which are robust to measurement errors. I then demonstrate a practical implementation of a measurement-device-independent entanglement witness applied to a family of polarization Werner states.

In chapter 3, I first present methods to efficiently generate and detect path entangled states. I then demonstrate the implementation of a heralded photon amplifier and an entanglement swapping protocol adapted for the distribution and detection of path entangled states, discussing the advantages and limitations of using path entanglement as a resource for long-distance quantum communication.

Finally, the last chapter summarizes the results of this work and discusses future research directions and open problems.

(13)

(14)

Chapter 1 Relativistic Bit Commitment around the Clock

Following the discovery of BB84 quantum key distribution, scientists attempted to realise other cryptographic tasks with unconditional security based on the laws of quantum physics. An important one is the primitive called bit commitment, which involves two parties who do not trust each other. In a bit commitment protocol, Alice commits a secret bit to a second party Bob, and reveals it to him at a later time of her choice. The protocol is secure if it is bothconcealing andbinding. Concealing means that Bob cannot access information about the committed bit before Alice reveals it. Binding means that Alice cannot reveal a different bit than the one she initially committed. Bit commitment finds uses in many applications for which it is not practical or not preferable to involve a trusted external referee, such as for digital signatures [27], secure electronic voting [28], honesty-preserving auctions [27]

and zero-knowledge proofs [29]. In this chapter, I first give a brief overview of the different attempts to achieve unconditionally secure bit commitment. I then describe the multi-round relativistic protocol [30] and its security, and present the first implementation of a 24-hour secure bit commitment.

1.1 Quantum bit commitment

Unconditionally secure bit commitment based on asynchronous exchanges of classical messages between two mistrustful parties is known to be impossible [31]. In 1984, C. H. Bennett and G. Brassard [4] suggested to exchange quantum states instead of classical messages, hoping to exploit the properties of quantum mechanics in a similar way to QKD. In their protocol, Alice commits to a bit by preparing a sequence of photons in either rectilinear or diagonal basis, which she then sends to Bob. Bob chooses randomly between one of the two bases to measure the polarization of the photons. To open the commitment, Alice reveals the basis she had chosen (i.e. the committed bit) and the polarization of each photon. Bob can compare these polarizations with his measurements in the correct basis. The protocol is secure against

13

(15)

a dishonest Alice who had prepared the states in a certain basis at the committing phase but who tries to reveal a different basis afterwards. To cheat, she would need to guess perfectly which polarizations Bob has previously measured in that other basis. However, the authors showed that this scheme is no longer secure against a dishonest Alice who can prepare pairs of maximally entangled states instead. If she keeps one photon of each pair in her laboratory and sends the second one to Bob, she can unveil either bit at the revealing stage by measuring her photon in the appropriate basis. The result of her measurements will always be correlated to the polarizations measured by Bob, as a consequence of the Einstein-Podolsky-Rosen EPR effect. She can then announce the polarization of each photon without error.

Bob cannot detect the difference and thus the protocol is not binding.

Other quantum schemes [32,33] which impose measurements and classical communication throughout the protocol, were proposed to counter the EPR attack. But a few years later, a generalisation of the EPR attack demonstrated that unconditionally secure quantum bit commitment was impossible [34,35,36]. Following the no-go theorem, most studies turned to the feasibility of quantum bit commitment under present technological assumptions, such as limited collective measurements of qubits [37] or imperfect quantum memories [38, 39,40].

1.2 Two-provers protocols and relativistic con- straints

In 1888, M. Ben-Oret. al.[41] proposed an alternative approach using only classical communication but in which each party is split in two agents. It was shown secure against classical attacks under the assumption that no communication was possible between the agents of the same party. This protocol was later simplified in [42] as follows.

Simplified-BGKW¹

– Prepare: the agents of Alice (A₁ and A₂) share a secret random-bit string a, while the agents of Bob (B₁ and B₂) share a secret random-bit string x.

– Commit: B₁ sends x to A₁. A₁ returns y = (d·x)⊕a to B₁, where d is the committed bit².

– Reveal: A₂ sends a toB₂ while A₁ reveals the committed bit d toB₁.

– Verify: B₁ andB₂ communicate and verify that the answer ofA₁ is consistent with the answer of A₂, i.e. that y is equal to (d·x)⊕a

1BGKW refers to the initials of the authors of [41]

2Here d∈ {0,1}, and (d·x) = 0 ifd= 0 and (d·x) =xifd= 1

(16)

1.3. Multi-round relativistic bit commitment 15 Here,⊕is the XOR operation. The protocol is clearly secure against a dishonest Bob, who receives what is to him a random string y. The amount of information on the committed bit learned from y depends on the randomness and the length of the string a, and can therefore be bounded to a very small value. Hence, the protocol isconcealing. On the other hand, the protocol is binding only if agent A₂ does not know the stringxbefore sending her answer toB₂. A. Kent [43] suggested relativistic constraints on the communication between the different agents to enforce the no-communication assumption. He later proposed a two-provers protocol using classical and quantum communication [44], which was shown secure against classical and quantum adversaries [45, 46] and experimentally demonstrated [47,48]. These protocols are however limited to a single round of exchanges. Hence, the maximum commitment time achievable is 21 ms if the agents are constrained to be on Earth.

1.3 Multi-round relativistic bit commitment

A multi-round scheme [30] based on the simplified-BGKW protocol and relativistic constraints was proposed to extend the commitment time. It relies on sustaining precisely timed classical exchanges between the two parties. Similarly to the simplified-BGKW protocol, each party is split in two agents, which are positioned at two different locations as shown in Figure. 1.1 (a). The multi-round protocol contains three phases: commit, sustain and reveal. Before starting the commit phase, the agents of Alice, and similarly the agents of Bob, share a set of random n-bit strings. The protocol goes as follows:

1. commit: B₁ sends a random n-bit string x₁ to A₁. A₁ returns to him the string y₁ =a₁ to commit the bit 0, and y₁ =x₁⊕a₁ to commit the bit 1, as in the simplified-BGKW protocol.

2. sustain:

– 2^nd round. B₂ sends x₂ to A₂. A₂ returns y₂ = (x₂·a₁)⊕a₂.³ – 3^rd round. B₁ sends x₃ to A₁. A₁ returnsy₃ = (x₃ ·a₂)⊕a₃

– k^th round. B_i sends x_k to A_i. A_i returns y_k = (x_k · a_k−1)⊕ a_k, for 2≤k ≤m.

3. reveal: The followingAi sends the committed bit and the string y_m+1 =am

to the corresponding B_i.

For the verification, the agents of Bob communicate between each other to obtain the complete set of answers y_i. From these, they can calculate all the previous stringsa_i and verify that the bit received at the reveal phase is the one committed by the first answer y₁ at the commit phase.

3The operation ”·” is the multiplication in the Galois fieldF2ⁿ

(17)

Position t2 Q=t3

B1

A2 B1

A1

B2 Time

tL

L x1

y1

x2 y2 y3

x3

A2 B1 B2

A1 l1 l2 a)

b)

M

A1

00

M

Figure 1.1: (a) Positioning of the agents of Alice (A₁, A₂) and of Bob (B₁, B₂) for the multi-round relativistic protocol. AgentB_i imposes to receive the answer y_i of agentAi within a timeτi from the start of the round. This sets the limit distanceli

between the two agentsA_i and B_i. (b) Space-time diagram showing the relativistic constraints (solid red line) for the spatial configuration where agentA_i is positioned at the limit distance li.

The security against classical attacks is guaranteed if at any k^th round, agent Ai sends her answer yk before receiving any information about the string x_k−1 of the previous round. The no-communication assumption can be ensured by care- fully timing the exchanges between A_i and B_i and by constraining the minimum distance between the agents of Alice. More precisely, we must impose the following constraints:

• the answer of A_i should be received by B_i within a time τ_i from the start of this round, or the protocol is aborted.

• B_i should start the round t_L−(τ_i+τ_M) time after the start of the previous round,

(18)

1.4. 24-hour relativistic bit commitment 17 where t_L is the time taken by the light to travel the distance L between the two agents B_i, and τ_M is a time margin which is chosen to be much greater than the timing uncertainties of the experimental implementation. The first constraint sets the maximum distancel_i between agent B_i and A_i, effectively limiting the distance between the agents of Alice. Note that an agent located at the limit distance l_i must have access to light speed communication and instantaneous data processing to answer toB_i withinτ_i. An agent with realistic processing speed must be located closer to answer on time, while a dishonest agent located at a longer distance thanl_i will not be able to answer on time and the protocol will be aborted. Figure1.1 (b) shows the relativistic constraints for the case where the agents of Alice are placed at the limit distance l_i.

The security analysis of the multi-round protocol in [30] derived the following bound on the probabilitythat Alice successfully cheats and reveals a different bit than the one she initially committed to:

.2^−n/2^(m⁻¹⁾, (1.1)

where n is the length of the exchanged bit strings (x_i, a_i and y_i), and m + 1 is the number of rounds. We can see that to keep 1, the length n of the exchanged strings has to grow exponentially with the number of rounds. Thus, the commitment time is greatly limited by the performance of the data processing system. The implementation in [30] was limited to n = 512 and 6 rounds, yielding a commitment time of 2 ms for a distanceL of 131 km.

Interestingly, this security bound was significantly improved and shown to be linear in the number of rounds by two independent proofs [49,50]. The one in [49]

is given by:

≤m2^(−n+3)/2. (1.2)

This result allows much longer commitment time for reasonable strings length n.

A more recent bound has been derived [51] and showed a small reduction of the required resources. Following the security bound of eq. 1.2, we performed the first experimental realisation of a 24-hour long bit commitment. I will now present the implementation of this relativistic protocol.

1.4 24-hour relativistic bit commitment

1.4.1 Implementation

Each agent has a computer and a field-programmable gate array (FPGA) card installed to perform the computations of the multi-round protocol, as shown in Figure1.2. To ensure an accurate timing of the rounds, each FPGA is synchronised to the Coordinate Universal Time (UTC) via a Global Positioning System (GPS) clock. The clock consists of a GPS receiver outputting one electronic pulse per second (1-PPS), which then controls an oven-controlled crystal oscillator (OCXO).

(19)

GPS receiver

B₂ A₂

Antenna

1 PPS 10 MHz Optical links

(1 m)

A₁ B₁

GPS receiver Optical links

(1 m)

FPGA HDD ak

Clock SFP a_k PCIe 200 MBps

yk

x_k Optical links 2.5 Gbps

A_i B_i

FPGA Clock SFP Optical links

2.5 Gbps

HDD x k

x_k yk

Com. link a)

b) c)

L=7 km

Figure 1.2: (a) Experimental set-up showing the clocking system and the exchanges between the agents. (b) Detailed set-up of agentA_i. For each round, the stringa_k is loaded from the hard drive (HDD) to the FPGA at a rate of 200 MBps. The stringx_k, sent byB_i through the 1 m optical link, is read using a small form-factor pluggable (SFP) transceiver. Then, the string y_k is computed within the FPGA, using bothak andxk, and sent back through the optical fiber at a rate of 2.5 Gbps.

(c) Detailed set-up of agent B_i. The string x_k is loaded on the FPGA then sent to A_i via the optical link. The answer y_k is received and transferred to the HDD, where it is stored. To verify the commitment, agentB₂ transfers the stored data to B₁ via a communication link (Com. link).

The 10 MHz signal generated by the OCXO is multiplied inside the FPGA to 125 MHz, which then serves as a reference to clock the computational steps. Further details on the FPGA and the clocking system can be found in the paper [52].

The overall time uncertainty of the clocking system is less than 150 ns, which is sufficiently small to ensure that the relativistic constraints are satisfied.

The detailed set-ups of the agents are shown in Figure1.2(b)-(c). The agents of Bob are separated by a distance L=7 km. In this configuration and for a commitment time of 24 hours, the length of the strings must be at leastn = 128 to reach a security of 10⁻¹⁰; a similar value to the one used in [30]. With the various latencies of our system and the time needed to computey_k, we can perform a round in 1.8µs.

To account for possible fluctuations in the duration of the round, we impose that the answer of A_i is received by B_i within 3 µs from the start of the round. Note that fixing τ₁ = τ₂ = τ = 3 µs would correspond to a distance limit l_i of 450 m.

Additionally, we impose that each round starts 17µs after the start of the previous round. Given thatt_L= 23.3µs, we take a security margin is of τ_M = 3.3µs, which is much longer than the timing uncertainties of the protocol.

(20)

1.4. 24-hour relativistic bit commitment 19 The 24-hours bit commitment required 5×10⁹ rounds and a total of 162 GB of random bits. The achieved security was of = 7.8×10⁻¹⁰. The verification of the commitment was performed on a desktop computer, which required 72 hours of computation. This could have been shorten to about 90 minutes by using dedicated FPGAs. Note that one could also start the verification process during the sustaining phase.

1.4.2 Discussion

Can this protocol be implemented in any spatial configuration and for any commitment time? In this section, I discuss the limitations of our implementation and security issues.

L [km]

2 4 6 8 10

Data Transfer Rate [Bps]

10³ 10⁴ 10⁵ 10⁶ 10⁷ 10⁸ 10⁹ 10¹⁰

Figure 1.3: Data transfer rate from the hard drive to the FPGA on a logarithmic scale as a function of the distanceLbetween the two agents of Bob. The horizontal red line represents the 200 MBps limit, and the vertical red line shows L_min. The black square corresponds to our experiment.

Regarding spatial configurations, limitations come at short distances between the agents. First of all, we are limited by the computing speed of the FPGA and the various latencies in our system. The minimum time needed to perform a round, which in our case is 1.8 µs, sets the time constraint τ. As the distance L is shortened, the time between the start of each round must also decrease to satisfy the second point of the relativistic constraints. Hence, the shortest distance allowed is ultimately limited byτ_iand τ_M as: L_min =c×3(τ+τ_M)/2. With our parameters, L_min is about 2.8 km. Secondly, the data transfer rate from the hard drive to the

(21)

FPGA is limited to 200 MBps with our system⁴. Figure1.3shows the data transfer rate on a logarithmic scale as a function of the distanceL. The shaded region shows where the bit-commitment is no longer possible with our experimental set-up and chosen security parameters. We observe that for distances shorter than 2 km the data transfer rate rises above our limit of 200 MBps. However, this happens below our minimum secure distanceL_min, and so does not present our first limitation.

Table1.1gives a comparison of the required resources and the security parameter between two different spatial configurations and commitment times. The number of rounds needed for a given commitment time decreases with the distance. Hence, the required resources drop significantly at longer distances.

The security of the protocol relies on an accurate timing between each round.

Our synchronisation system uses a GPS signal, which could actually be falsified by a dishonest Alice. To avoid attacks on the timing of the rounds, Bob could rely on local clocks only. To do so, the local clocks must be initially synchronised and their time uncertainty must be low enough to achieve the given commitment time.

In our case, the time margin τ_M, taken to account for the timing uncertainties, was of 3.3µs. Thus, the uncertainty of the clocks must be less than ∼10⁻¹¹ for a commitment time of 24 hours and less than∼10⁻¹³ for a commitment time of one year. Forτ_M = 1 ms (case 2 of table1.1), this requirement drops to∼10⁻⁸ for a 24- hour commitment. Uncertainties of this order can be achieved with commercially available clocks [53]. However, special care must be taken for short distance and long commitment time.

L [km] T r [ Bps] Data [GB] T_v

1 7.0 24 h 7.8×10⁻¹⁰ 5×10⁵ 162 1 h 26 min 1 y 2.8×10⁻⁷ 5×10⁵ 59362 530 h

2 10000 24 h 1×10⁻¹² 649 0.2 7 s

1 y 3.9×10⁻¹⁰ 649 81 44 min

Table 1.1: Table showing the security parameter, the average data transfer rate r from the hard drive to the FPGA, the amount of data and the estimated verification timeT_v achievable with a dedicated FPGA for two different cases of spatial configurations and commitment times (24 h and 1 year). Case 1: τ = 3 µs, l = 450 m and τ_M = 3.3 µs; Case 2: τ = 20 ms, l= 3000 km and τ_M = 1 ms . The length of the communicated string is set to 128 bits in both cases.

1.5 Conclusion and Outlook

We demonstrated a 24-hour relativistic bit commitment with standard computing power in a realistic and potentially useful scenario. Our implementation could in

4The transfer of data from HDD to FPGA was done with a PCIe Gen1 x1 link

(22)

1.5. Conclusion and Outlook 21 practice be extended to a large range of spatial configurations and longer commitment times. Limitations arise in scenarios with short distances between the two agents of Bob, which are the most demanding in terms of resources, e.g. large amount of data, fast data computing and very low timing uncertainty. Scenarios with largerL, such as case 2 of table1.1, require far fewer resources and allow more flexibility in the choice of the time constraintτ and time margin τ_M. Indeed, the case 2 could correspond to a scenario with one agent of Bob in the center of the US and the other one in the center of China. With τ and τ_M extended respectively to 20 ms and 1 ms, the agents of Alice could be located within a large region of these two countries. Following this example, we can imagine networks formed by several interconnected nodes allowing commitments from parties all over the world.

On the down side, the commitment of a single bit requires a large amount of random data, e.g 162 GB in our case. This could present a practical issue for applications which require many committed bits. Astring commitment which uses the same resources as itsbit version, would be compelling. The extension to string commitment was investigated in [50,54], but required different binding assumptions.

The security of the protocol relies on the perfect synchronization of the exchanges between the agents of different parties. In our experiment, the communication between agent Bi and Ai was made over a 1 m dedicated optical fibre. But in more realistic scenarios, these exchanges will be made through classical communication network, which are prone to failures such as delays in the packet delivery.

If one agentAi fails, once, to reply within the time constraintτ, the whole protocol is aborted. To overcome this issue, K. Chakraborty et al. [55] proposed a mod- ified version of the multi-round relativistic protocol, with three agents per party.

Their protocol was proven robust to losses and delays of classical communication networks.

Finally, both bit and string multi-round protocols were proven secure against classical attacks. Security against quantum attacks was proven in the single round case, but is still an open question for the multi-round case [30, 49, 50].

(23)

(24)

Chapter 2 Measurement-Device-Independent Entanglement Witness

Quantum entanglement plays a key role in many of the most interesting applications of quantum communication and quantum information [2]. Developing ways to characterize the generation and distribution of entanglement is therefore crucial. How to be sure that entanglement was indeed generated? How to detect entanglement and quantify it? These questions can be challenging to answer and various methods were proposed to tackle this problem. The choice of the method will depend on the system to be characterised and on the desired properties for the entanglement verification scheme, e.g. ease of implementation, efficiency, robustness against noise, etc.. An important property, which has often been overlooked in past experiments, is the sensitivity to measurement errors and its effect on the conclusion drawn about the entanglement. In this chapter, I present methods to certify entanglement which are robust to measurement errors and I demonstrate the practical implementation of a measurement-device-independent entanglement witness (MDI-EW) to certify the entanglement of all entangled states.

2.1 Resource-efficient MDI-EW

There are three standard approaches to characterize entanglement: Quantum State tomography (QST) [56, 57], entanglement witnesses [58], and Bell inequalities [9, 59]. I, now, briefly describe each approach and how they are affected by measurement imperfections.

Quantum state tomography techniques enable us to fully characterise the state of the quantum system. In QST, multiple copies of the unknown state are measured in a set of tomographically complete bases. The density matrix of the state is then reconstructed from the acquired data. The degree of entanglement can be computed directly from the density matrix. The drawback of QST is that experimental errors often lead to the reconstruction of a non-physical density matrix [60].

Several correcting techniques have been developed to obtain a physical state which 23

(25)

matches the observed data as close as possible [56,61,62], but they can lead to an overestimation of the degree of entanglement [63].

Entanglement witnesses are the most frequently used tools for the certification of entanglement. The distinction between entangled states and separable ones is usually made as follows. For any entangled stateρ, there exists a Hermitian opera- torW, called an entanglement witness, such that tr[W ρ]<0, and tr[W σ]≥0 for all separable states σ. To be able to determine experimentally the value tr[W ρ], the operator W is decomposed as a linear combination of product Hermitian operators, which are then estimated independently from local measurements on the subsystems ofρ. Here too, measurement errors can lead to an estimation of tr[W ρ] which is inexact, and possibly to the wrong conclusion about the presence of entanglement [64, 65]. Moreover, entanglement witnesses are not quantitative.

Bell inequalities can only be violated when the measurements are performed on non-local states [66]. Hence, a violation of a Bell inequality faithfully certifies the presence of entanglement, regardless of the actual measurements performed and of possible errors on them. On the downside, this method cannot detect all entangled states. Indeed, all non-local states are entangled, however, certain entangled states generate correlations which do not violate Bell inequalities [66,67]. For example, a Werner state of the form:

ρ=λΨ⁺ Ψ⁺+ (1−λ)I4, (2.1) where |Ψ⁺i is a maximally entangled state and I4 is white noise, is entangled for visibilities λ higher than 1/3. However, the correlations it generates only violate CHSH inequality [68] for λ≥1/√

2.

In 2012, F. Buscemi [69] proposed a solution to overcome the issue of measurement errors sensitivity, while detecting all entangled states. He introduced Bell-like tests where the classical inputs, which specify the measurements to be performed, are replaced by trusted quantum inputs. Interestingly, he showed that in such tests, called semi-quantum non-local games, all entangled states can be distinguished from separable ones. This result immediately led to the derivation of measurement-device-independent entanglement witnesses (MDI-EW) [19], which were shown tolerant to losses and robust against measurement errors. While these MDI-EWs relax the requirement on the measurement accuracy, they demand the extra generation of trusted quantum inputs, thereby, adding experimental challenges.

Following semi-quantum non-local scenarios, a natural way to implement an MDI-EW for detection of bipartite photonic entanglement is shown in Figure2.1(top).

The quantum inputs are heralded single photons prepared by trusted Linear Op- tic Circuits (LOC). Alice, and similarly Bob, mixes the quantum input state with her part of the shared entangled state ρ_AB on a 50:50 beam-splitter to perform a Bell state measurement (BSM). The quantum input photons and the photons of the entangled state must be indistinguishable in all degrees of freedom, apart from the polarization, at each BSM. Thus, this implementation is very demanding

(26)

2.2. Construction of the MDI-EW 25

a b

Figure 2.1: Concept of Measurement Device Independent Entanglement Witness.

Top: An entangled state is probed with locally prepared quantum inputs prepared by trusted Linear Optic Circuits (LOC) and the (2 possible) results of the Bell state measurements (BSM) are used to compute the witness. Bottom: The simplified scheme uses trusted quantum states encoded on an extra degree of freedom of the initial entangled state using LOCs and the (4 possible) BSM outcomes are used to compute the witness.

experimentally, as it requires the generation of six photons with high purity. Nev- ertheless, two experiments successfully witnessed bipartite entangled states in this way [70,71].

Using an idea inspired by Detector-Device-Independent QKD [72,73], we developed an approach in which Alice and Bob encode the input qubit state by LOCs directly on an extra degree of freedom of the entangled photons, as shown in Fig- ure2.1(bottom). Hence, this implementation removes the need for additional single photons, i.e it is resource-efficient. We must, however, make the assumption that the entangled state lives in the qubit subspace. Moreover, this implementation gives access to the four outcomes of the BSM. Before describing further our implementation and results, I will first introduce the MDI-EW derived for our experiment, and the source of entangled photons to be witnessed.

2.2 Construction of the MDI-EW

For each measurement of our experiment, Alice (Bob) prepares an input qubit state τ_x (τ_y), chosen at random from a set{τ₁...τ_m}. The inputs aretrusted if they can be prepared as requested without leaking information about the state description [19].

The measurements of Alice and Bob can be described by the POVMs {A_a} and {B_b}, respectively. If they share an entangled state ρ_AB, the joint probabilities observed are given by:

P(ab|τ_x, τ_y) = tr [(A_a⊗B_b)(τ_x⊗ρ_AB⊗τ_y)]. (2.2) When the shared state is separable, ρ_AB =P

kρ^A_k ⊗ρ^B_k, with ρ^A_k, ρ^B_k > 0, the joint probabilities become:

(27)

P_SEP(ab|τ_x, τ_y) = X

k

tr

A_a τ_x⊗ρ^A_k tr

B_b ρ^B_k ⊗τ_y

. (2.3)

A suitable MDI-EW can be constructed for any entangled state. However, the violation of a particular MDI-EW only occurs when the shared state is close to the one for which the MDI-EW was constructed, and when the measurements performed are close to the prescribed Bell state measurements. To remove the necessity for prior-knowledge about the entangled state, D. Rosset developed a new way to construct a MDI-EW directly from the observed joint probabilities. The main steps of his method are summarized below. More details can be found in [74,75].

A MDI-EW is usually defined as:

W =X

abxy

β_abxy·P(ab|τ_x, τ_y), (2.4)

• W <0 for a specific entangled state ρAB and specific measurements{Aa}and {B_b}.

• W ≥0 for any separable state, regardless of the measurements made.

It is therefore characterised by a set of real coefficients β_abxy and of input qubit states {τ_x,y}. Interestingly, D. Rosset developed a semi-definite program (SDP) to extract the coefficientsβabxy directly from the experimental observations. This SDP is actually the dual of a primal SDP constrained by the observed joint probabilities P(ab|τ_x, τ_y) and the given set of input qubit states{τ_x,y}, as explained further below.

The experiment can then be performed in two steps. A first set of experimental data is used to extract the coefficient β_abxy and construct a MDI-EW of the form of eq.2.4. This MDI-EW can then easily be applied to the other sets of data.

The primal SDP, mentioned above, allows to reach a first conclusion about the presence of entanglement, and is sketched as follows:

Primal SDP

(1) W⁰ =− min

Πab,σ^±_ab

X

ab

tr[σ_ab⁻] s.t.

(2) Π_ab, σ_ab^± >0 (3) σ_ab⁺ −σ⁻_ab−(Πab)^>^A = 0

(4) tr[Πab(τx⊗τy)] =P(ab|τx, τy) (2.5) The optimization problem of this SDP is to minimize P

abtr[σ⁻_ab] given the constraints (2), (3) and (4), with Π_ab andσ_ab^± as free variables. The constraint imposed by the observed joint probabilities is given in point (4). The experimental set-up, including the state ρ_AB and the measurements {A_a} and {B_b}, is described here

(28)

2.3. Entangled photon pairs source 27 by the joint POVM {Π_ab} acting on input state τ_x⊗τ_y. If the shared state ρ_AB is separable, then the POVM elements are also separable:

Π^SEP_ab =X

k

Π^A_a,k⊗Π^B_b,k, (2.6)

decomposed over Π^A_a,k,Π^B_b,k >0. The partial transpose of (2.6) is non-negative:

Π^SEP_ab ^>A

=X

k

(ΠÂ_a,k)^>⊗Π^B_b,k >0. (2.7) Hence, if we decompose (Π_ab)^>Â in parts with positive and negative eigenvalues (point (3) of the SDP) [76], we clearly see that, for separable states, the minimum in point (1) is achieved when σ_ab⁺ = (Πab)^>Â, and σ_ab⁻ = 0; thus W⁰ = 0. On the other hand, when ρ_AB is entangled, the joint POVM {Π_ab} is non-separable. For qubits, non-separable operators always have negative partial transposes [58]. This means that a value W⁰ < 0 in point (1) certifies the presence of entanglement in ρ_AB.

The dual problem of the SDP in eq. 2.5 is not very intuitive to understand, so I will not describe it here. Interested readers can find its description in the supplementary material of [74] and in [75]. However, one important point is that the solution of the dual provides a bound on the solution of the primal (2.5). Hence, the dual solution found for particular P(ab|τx, τy) and {τx,y} contains coefficients β_abxy which can be used as an MDI-EW for other experiments, provided the set of quantum inputs stays the same.

2.3 Entangled photon pairs source

Various approaches to generate entangled photons have been explored in the last few decades [17], such as deterministic sources based on solid-state emitters [77], and probabilistic sources based on spontaneous parametric down conversion (SPDC) [78]

and four-wave mixing [79] in media with non-linear optical susceptibility χ⁽²⁾ and χ⁽³⁾, respectively. To date, SPDC sources have been the most widely used sources for quantum communication. They are relatively easy to operate at near-room- temperature, tunable in wavelength and bandwidth and reaching high generation rates. The entangled photon sources developed in this thesis are all based on SPDC processes. In this section, I give a general description of second-order non-linear processes and present the source of polarization entangled photon pairs tested with the MDIEW.

2.3.1 Spontaneous parametric down conversion

In the presence of an electric field, the charges of a dielectric medium suffer small displacements from their equilibrium position, resulting in the polarization of the

(29)

medium. This polarization exhibits a non-linear dependence on the driving electric field. Under the assumption that the non-linear terms are small compared to the linear term, the polarization can be expanded as a power series of the electric field E(r,t):

P(r, t) =₀χ⁽¹⁾E(r, t) +₀χ⁽²⁾E(r, t)²+₀χ⁽³⁾E(r, t)³+... (2.8) where ₀ is the permittivity of vacuum, χ⁽¹⁾ is the linear optical susceptibility, χ⁽²⁾ and χ⁽³⁾ are the second order and third order optical susceptibilities, etc. It should be pointed that a non-zero χ⁽²⁾ is only found in media without inversion symmetry [80]. When an optical electric field:

E(z, t) =X

n

(E(k_n, ω_n)e^i(kⁿ^z−ωⁿ^t)+c.c) (2.9) passes a dielectric medium, the second order non-linear polarization is given by:

P⁽²⁾(z, t) = ₀χ⁽²⁾X

n,m

(E(k_n, ω_n)e^i(kⁿ^z−ωⁿ^t)+c.c)(E(k_m, ω_m)e^i(k^m^z−ω^m^t)+c.c) (2.10) The oscillation of the polarization will have the following frequency components:

ω = 2ω_n, ω = 2ω_m (second-harmonic generation), ω = ω_n+ω_m (sum frequency generation) or ω =ω_n−ω_m (difference frequency generation). Hence, light will be emitted from the oscillation of the electrons at all these frequencies. These second order non-linear optical interactions also give rise to probabilistic SPDC processes, in which a pump photon at frequency ω_p is converted in two photons called signal and idler, following energy conservation:

ωp =ωs+ωi (2.11)

The light fields generated at each point within the crystal will propagate and in- terfere with the fields generated at further points. To observe constructive inter- ferences for the SPDC process, the followingphase matching condition imposed by momentum conservation must be satisfied:

k_p =k_s+k_i, (2.12)

where k_i = n_i(ω_i)ω_i/c and n_i(ω_i) is the refractive index of the medium. Phase matching can be achieved either in natural crystals, exploiting for example the birefringence of the material, or in engineered crystals. One method is based on quasi phase matching, in which a poling period Λ is inscribed in the crystal to periodically invert the sign ofχ⁽²⁾. The quasi phase matching condition is:

k_p =k_s+k_i+ 2π

Λ , (2.13)

With this method the following three types of phase matching can be engineered:

• Type 0, the signal, idler and pump photons have the same polarization.

(30)

2.3. Entangled photon pairs source 29

• Type I, the signal and idler photons have the same polarization, orthogonal to the one of the pump photons

• Type II, the signal and idler photons have orthogonal polarization, one orthogonal and one parallel to the pump photons.

A complete theoretical description of SPDC can be found in [80, 81,82, 83]

2.3.2 Polarization entangled photon pairs source

Figure 2.2: Polarization entangled photon pair source. The pump laser (Toptica DL100) is filtered in wavelength using a prism (P). Its polarization is adjusted with a half-wave plate (HWP) before the PPLN crystal. The lenses L₁ and L₂ have a focal length of f=22 mm and f=150 mm, respectively. A filter (F) removes the pump. A HWP is adjusted to align the polarization with the fast and slow axis of the polarisation maintaining fiber (PMF).

There are various methods to generate polarization entangled photons via SPDC [84,12]. The approach we use here is particularly simple to implement and is based on Type-II phase matching. The experimental set-up of the source is shown in Figure2.3. A type-II periodically poled Lithium Niobate (PPLN) crystal of 2 cm is pumped with a 50 mW continuous laser at 782 nm, generating degenerate photons at 1564 nm, horizontally and vertically polarized .

The quality of the entanglement in polarization will degrade if the two polarization states can be inferred from other degrees of freedom; i.e. from the time of emission, the spatial mode and the wavelength. The time of emission must be taken into account because Lithium Niobate is a birefringent material. Thus, the signal and the idler photons generated with orthogonal polarization will not propagate at the same speed within the crystal. The polarization of the signal and idler photons could be deduced by measuring their arrival time. To solve this issue, the photons were directly coupled into a polarization maintaining fibre (PMF). The length (1.44 m) and the orientation of the slow and fast axis were adjusted to compensate the temporal walk-off induced inside the PPLN crystal [85, 86].

(31)

In addition to the temporal walk-off, the birefringence of the crystal can induce a difference in spatial shape between the two polarization modes. This issue is readily solved when coupling the twin photons into the same single mode fibre. On the down side, it is impossible to couple efficiently both signal and idler photons into the same single mode fibre. For this source, we obtained a coupling efficiency around 25%. The description of how we measured this coupling efficiency can be found in appendix5.0.1. With careful optimization of the alignment, of the focusing parameter and the collection beam waists, this value could have been increased to 50%, as achieved in [86].

A simple way to avoid the correlation between one wavelength and one particular polarization is first to produce photons degenerated in wavelength. The temperature of the crystal was set to∼70^oC, adjusting the phase-matching to generate both the signal and idler photons around 1564 nm. The photons can then be deterministically separated using a 100 GHz Dense Wavelength Division Multiplexing (DWDM) filter, sightly detuned from the central wavelength of the photons. The transmitted part (ITU channel 16) is sent towards Bob, while the reflected part is sent towards Alice, producing the following state:

ψ⁺

= 1

√2[|HiA|ViB+e^iφ|ViA|HiB] (2.14) It should be pointed that in CW regime, the conservation of energy imposes perfect correlations in the wavelengths of the twin photons. Thus, the separation method mentioned above does not require any additional filtering stage, as needed in pulsed regime [86]. The relative phase φ can be set to zero using a Soleil-Babinet (SB) compensator placed on Alice’s side.

2.4 Implementation of the resource-efficient MDI- EW

A schematic of the experimental set-up for the resource-efficient MDI-EW is shown in Figure 2.3. The input qubits τx and τy were encoded directly onto the optical path degree of freedom of the photons via a 50:50 beam-splitter (BS) on each side, seeTrusted LOC on the figure. If we assign the states |0i and|1i to the lower and upper paths, respectively, the encoded qubit states are of the form:

|0i+e^iθ^j|1i /√

2, (2.15)

where θ_j is the relative phase between the upper and lower paths, which can be adjusted with a piezoelectric transducer (PZT) mounted on a mirror. The states

|0iand|1ican simply be encoded by blocking the appropriate path using automated shutters.

A complete BSM was performed by first rotating the polarization in the lower path from|Hi to |Vi and vice versa using a HWP, then by recombining the lower

(32)

2.4. Implementation of the resource-efficient MDI-EW 31

Figure 2.3: Experimental setup. L: lens; PMF: polarisation maintaining fiber;

SB: Soleil-Babinet; BS: beam-splitter; S: shutter; QWP: quarter-wave plate; PZT:

piezoelectric transducer.

and upper paths on a second 50:50 BS, and finally by projecting in the {|Hi,|Vi}

basis using polarizing beam-splitters (PBS) on both output paths. Each output of the PBS corresponds to one of the following Bell states (see Figure 2.3):

Ψ^±

= 1

√2(|Hi |1i ± |Vi |0i), Φ^±

= 1

√2(|Hi |0i ± |Vi |1i).

(2.16)

To correctly encode the input qubits and observe a good interference, the interferometers should be perfectly balanced. Balancing the optical path lengths of the lower and upper arms of a standard bulk Mach–Zehnder interferometer, while keeping a high coupling into the output fibres, is a complicated task. Thus, we implemented instead a configuration similar to a Michelson interferometer, as shown in Figure 2.4 (a). The input beam enters a 50:50 BS slightly off-center. The two modes 0 and 1 are both reflected back to the same BS, via two retro-reflectors, where they overlap. The length difference and relative phase between the two arms can be adjusted at the retro-reflector of arm 1 using a manual translation stage topped with a PZT stage. The two output modes, labelledcanddare collected into optical fibres, followed by fibre-based PBS. It should be pointed that a tilted quarter-wave plate (QWP) is added in the arm 0 of each interferometers to compensate for the birefringence introduced by the optical elements. Finally, the photons are detected

Distribution and certification of photonic entanglement for quantum communication

Thesis

Reference

Distribution and certification of photonic entanglement for quantum communication

DISTRIBUTION AND CERTIFICATION OF PHOTONIC ENTANGLEMENT FOR QUANTUM COMMUNICATION

THÈSE

Ephanielle VERBANIS

Abstract

R´ esum´ e

Contents

Introduction

Chapter 1

Relativistic Bit Commitment around the Clock

1.1 Quantum bit commitment

1.2 Two-provers protocols and relativistic con- straints

1.3 Multi-round relativistic bit commitment

1.4 24-hour relativistic bit commitment

1.4.1 Implementation

1.4.2 Discussion

1.5 Conclusion and Outlook

Chapter 2

Measurement-Device-Independent Entanglement Witness

2.1 Resource-efficient MDI-EW

2.2 Construction of the MDI-EW

2.3 Entangled photon pairs source

2.3.1 Spontaneous parametric down conversion

2.3.2 Polarization entangled photon pairs source

2.4 Implementation of the resource-efficient MDI- EW