WO2005060139A2

WO2005060139A2 - Secure quantum key distribution using entangled photons

Info

Publication number: WO2005060139A2
Application number: PCT/US2004/042145
Authority: WO
Inventors: Keith Kastella; Ralph S. Conti; Kenneth A. Augustyn
Original assignee: General Dynamics Advanced Information Systems, Inc.
Priority date: 2003-12-17
Filing date: 2004-12-17
Publication date: 2005-06-30
Also published as: US7831048B2; US20050135620A1; WO2005060139A3

Abstract

A system (Figure 1) and method of implementing quantum key distribution are provided that possess increased data rates and enhanced security. These increased data rates are provided through the use of biphotons (40). Through encoding bits of information on the intra-biphoton delay time and enabling separate polarization bases (45) for each of the photons comprising each biphoton (40), the system (Figure 1) and method increase data bandwidth available for quantum key distribution.

Description

SECURE QUANTUM KEY DISTRIBUTION USING ENTANGLED PHOTONS

Related Applications

[0001] The present application is related to U.S. Patent Application Serial No.

10/850,394, filed May 21, 2004, entitled "System and Method of Detecting Entangled Photons" to Kastella et al, and to U.S. Patent Application Serial No. 10/849,789, filed May 21, 2004, entitled "Quantum Steganography" to Conti et al, the disclosures of which are expressly incorporated by reference herein in their entireties. Field of the Invention

[0002] The present invention relates to the field of quantum key distribution and to methods and systems that utilize entangled photons. Background of the Invention

[0003] The objective of cryptographic key distribution is to enable two users who share no secret information initially, to agree on a key (e.g., a string of random bits), which enables them to form and transmit encrypted messages, while limiting a potential eavesdropper to information about a vanishingly small fraction of the key. The key may be used as a "one time pad," to encrypt a message. Alternately, or in addition, the key may be used in one or more cryptographic algorithms, such as DES, Triple-DES, IDEA, or AES/Rijndael. Additional applications include using the key in one or more electronic message signature, validation, or authentication schemes.

[0004] To facilitate description of various key distribution techniques, this specification employs the convention of using "Alice" to designate a key information sender, "Bob" to designate a key information receiver, and "Eve" to designate an eavesdropper. Under this convention, messages may be sent both from Alice to Bob and from Bob to Alice. Thus, Bob may transmit key information to Alice, in addition to Alice transmitting key information to Bob. [0005] Advancing research and experimental investigation of fundamental problems of quantum mechanics have led to a methodology for secure communications: quantum cryptography. At the heart of this technique lies the distribution of a cryptographic key whose security is guaranteed by the principles of quantum mechanics. With Quantum Key Distribution (QKD), two users, Alice and Bob, agree on a secret key using a communications channel capable of transmitting sequences of quantum states. Due to the Heisenberg uncertainty principle, it is not possible to accurately monitor these sequences without disturbing them in a way that can be readily detected by the legitimate users of the channel. After the transmission of a quantum sequence between Alice and Bob across this channel, Alice and Bob exchange messages through a second channel, called the public channel. Alice and Bob communicate across this public channel to assess the amount of disturbance in the transmission of the quantum sequence to determine the extent of noise and eavesdropping. If it is determined statistically that eavesdropping has not occurred, Alice and Bob select a body of information from the transmitted sequence in order to form a key that, with a high probability, is known only to the two of them and not to an eavesdropper, Eve. In QKD, the private quantum channel is combined with a public classical channel to create a conduit with high overall security. A variety of QKD protocols are known, such as BB84, B92, 4+2, Six State, Ekert scheme, and Goldenberg/Naidman class.

[0006] Two photons quantum-mechanic ally entangled together are referred to as an entangled-photon pair, or biphoton. Traditionally, the two photons comprising a biphoton are called "signal" and "idler" photons. The designation of which photon is referred to as "signal" and which is referred to as "idler" is arbitrary. The photons in an entangled photon pair have a connection between their respective properties. Measuring properties of. one photon of an entangled-photon pair determines properties of the other photon, even if the two photons are separated by a distance. As understood by those of ordinary skill in the art and by way of non- limiting example, the quantum mechanical state of an entangled-photon pair cannot be factored into a tensor product of two individual quantum states. Summary of the Invention

[0007] ^• Embodiments of the present invention provide novel systems and methods to implement quantum key distribution that possess increased data rates and enhanced security. These increased data rates are provided through the use of biphotons. Embodiments of the present invention increase the data bandwidth for quantum key distribution by encoding bits of information on one or more of: a delay time between the signal photon and idler photon comprising a biphoton, polarizations of the signal photon and idler photon comprising a biphoton, and polarization bases of the signal photon and idler photon comprising a biphoton. [0008] According to an embodiment of the invention, a system for quantum distribution of private information is provided. The system includes a sending unit that encodes at least one bit onto a time delay, the time delay being between a propagation of two photons comprising a biphoton. The system also includes a receiving unit that detects the at least one bit on a received biphoton transmitted from the sending unit.

[0009] Various additional features of the above-described embodiment include the following. At the at least one bit may be cryptographic key information. The sending unit may impart a separate basis polarization to each photon comprising the biphoton. The sending unit may impart a separate polarization bit to each photon comprising the biphoton. The time delay may be introduced through lengthening a propagation distance of a photon comprising one of the biphotons. The receiving unit may further comprise a coincidence detector. [0010] According to another embodiment of the invention, a transmission unit for communicating private information is provided. The system includes a generator for creating a plurality of biphotons. The system also includes a time delay unit that introduces, for each biphoton, a relative time delay between the two photons comprising the biphoton. The system also includes a basis polarizing unit that selects a polarization basis for each biphoton. [0011] Various additional features of the above-described embodiment include the following. The relative time delay may represent cryptographic key information. The basis polarizing unit may randomly impart one of a linear polarization and a circular polarization. [0012] According to another embodiment of the invention, a biphoton configured to store information for transmission over a communications channel is provided. The biphoton comprises a first photon and a second photon, where the first photon being entangled with the second photon. The biphoton further includes at least one of a time delay between the first photon and the second photon, the time delay representing at least one bit of information, and a pair of polarizations, each of the pair of polarizations manifested on one of the first photon and the second photon, the pair of polarizations representing at least one bit of information. The biphoton is intended to be used for one of cryptographic key distribution, encryption, decryption, and authentication.

[0013] According to another embodiment of the invention, a method for communicating secret information is provided. The method includes generating a plurality of entangled photons. The method also includes creating a time delay in the propagation of two photons, where the time delay represents at least one bit of information. The method also includes transmitting the plurality of entangled photons. The method also includes detecting the time delay on received entangled photons. The method also includes forming cryptographic information from the at least one bit of information.

[0014] An additional feature of the above-described embodiment is that the method may include imparting a separate basis polarization to each photon comprising the entangled photons. [0015] According to another embodiment of the invention, a sequence of messages for communicating private information is provided. A message is transmitted over a communications channel, the message being comprised of a plurality of biphotons, each biphoton encoded with at least one polarization. A basis message is transmitted over a communications channel relating to a basis of each of a subset of the biphotons received by a receiver. A confirmation message is transmitted over a communications channel relating to a matching basis for a subset of the biphotons.

[0016] According to another embodiment of the invention, a system for quantum key distribution is provided. The system includes a sending unit that imparts a bit onto a biphoton through polarization and imparts a polarization basis on each the two photons forming the biphoton. The system also includes a receiving unit that detects the bit on a received biphoton transmitted from the sending unit, the receiving unit selecting a basis for each of the photons forming the received biphoton. Brief Description of the Drawings

[0017] The novel features that are considered characteristic of the invention are set forth with particularity in the appended claims. The invention itself, however, both as to its structure and operation together with the additional objects and advantages thereof are best understood through the following description of exemplary embodiments of the present invention when read in conjunction with the accompanying drawings.

[0018] Figure 1 is a block diagram of a first exemplary quantum key distribution embodiment.

[0019] Figure 1A is a schematic diagram illustrating a photon delay embodiment.

[0020] Figure IB is a schematic diagram illustrating a portion of the embodiment of

Fig. 1A.

[0021] Figure 2 is a flow chart that depicts a method for quantum key distribution.

[0022] Figure 3 is a schematic diagram illustrating a protocol for quantum key distribution.

[0023] Figure 4 is a schematic diagram illustrating a biphoton encoded with a bit and delay byte.

[0024] Figure 5 is a block diagram of a second exemplary quantum key distribution embodiment.

[0025] Figure 6 is a block diagram of a third exemplary quantum key distribution embodiment.

[0026] Figure 7 is a block diagram of a fourth exemplary quantum key distribution embodiment.

[0027] Figure 8 is a block diagram of a fifth exemplary quantum key distribution embodiment.

[0028] Figure 9 is a schematic diagram illustrating a protocol for quantum key distribution.

Detailed Description of the Invention

[0029] Generally, in QKD schemes, there is a tradeoff between rate of transmission of the key and its security, the latter being measured by the fraction of the key Eve can intercept. In some embodiments of the present invention, a biphoton sensitive material allows for a high-rate quantum key distribution. Maximizing the quantum key transmission rate is important because the encryption key may be used in a Vernam cipher (also known as a one-time pad). The

Vernam cipher is perfectly secure only when the length of the key and the length of the message are the same. However, unless the system is operated with equal key and message lengths, there is a trade between security and data rate. The entanglement properties of biphotons can potentially be exploited to enhance secure quantum key transmission rates in two ways: by encoding extra bits of information in the relative timing and polarization of the biphoton pair, and by increasing the rate at which biphotons can be securely sent.

[0030] Some embodiments of the present invention employ a biphoton sensitive material, which generally responds only to biphotons. In such embodiments, the receiver is insensitive to ambient light, even if it is the same frequency (color) as the biphotons or their constituent photons. This allows for free-space transmission of the biphotons without interference from other light sources.

[0031] Figure 1 illustrates an embodiment of a quantum key distribution system. The apparatus is composed of three primary components, a sender 20, a receiver 25, and a communications channel 30. Sender 20 is designed to produce, manipulate, and transmit biphotons. Receiver 25 detects and records the states of the biphotons transmitted by sender 20. [0032] Communications channel 30 is a medium that supports the transmission of biphotons. For instance, an optic fiber can support the transmission of biphotons and function as the medium of communications channel 30. Air and space are other media through which biphotons can propagate, thereby allowing for wireless transmissions of biphotons. Other media that support the transmission of biphotons can function in combination with sender 20 and receiver 25; the above examples are not exhaustive.

[0033] Sender 20 produces non-entangled, i.e., classical, light through the use of a laser

35. The light from this laser is directed to Parametric Down Converter (PDC) 40 in order to create biphotons. In this embodiment, sender 20 utilizes type II parametric down conversion in order to generate biphotons. PDC 40 includes, by way of non-limiting example, a beta-barium borate (BBO) crystal that converts single photons into biphotons through collinear type II parametric down-conversion. Type II parametric down conversion, also referred to as Spontaneous Parametric Down Conversion (SPDC), provides a reliable and robust system for producing biphotons. Together, laser 35 and PDC 40 produce the biphotons that sender 20 utilizes in order to effect QKD. Other techniques for generating biphotons may be used. For example, Type-I down conversion may be used.

[0034] Sender 20 manipulates the biphotons in order to impart information for transmission to receiver 25. This information for QKD is cryptographic information that may be used to form a cryptographic key. The biphotons are passed through a Polarizing Beam Splitter (PBS) 45, which separates each biphoton into its constituent signal and idler photons that propagate in different directions for separate manipulations. Note that this spatial separation of the photons does not break the quantum entanglement that exists between them. After each biphoton is passed through PBS 45, the photons remain entangled.

[0035] The idler photon is directed from PBS 45 to a mirror 50 where it is reflected into a photon delay 55. Photon delay 55 introduces a relative time delay between the propagation of the signal and idler photons by delaying the propagation of the idler photon to a polarization selector 60. There are a variety of ways to increase the time it takes for the idler photon to reach polarization selector 60 relative to the propagation of the signal photon. One method is through directing the idler photon through an electro-optic media having an index of refraction that varies with an applied voltage. Varying the voltage across the media varies the media's index of refraction, thereby altering the speed and time of the idler photon's propagation through the media and imparting a time delay byte. Another embodiment of photon delay 55 is depicted in Figures 1 A and IB described below.

[0036] The manipulation of a time delay between the idler and signal photons in each biphoton enables sender 20 to impart information onto the time delay of the biphoton. This information is a time delay byte, which is a piece of information that corresponds to the length of the time delay. This time delay byte may have multiple bits of information. Exemplary sizes for the time delay byte include 5-1O bits. However, a byte may be any number of bits. Through introducing selectable time delays- into the biphoton, it is possible to send multiple bits of information with the transmission of a single biphoton. To create an n-bit time delay byte, photon delay 55 is capable of selectably imparting one of 2" different time delays. With the electro-optic crystal whose index of refraction varies with applied voltage, it is possible to impart 2" different time delays by applying 2ⁿ different voltages across the electro-optic crystal. Alternately, with a linear array of Pockel cells and PBS devices, n pairs of Pockel cells and PBSs can impart 2" different time delays. To make the information contained on the time delay byte random for use in a cryptographic system, a random number generator randomly produces a number that corresponds to one of the 2" time delays in photon delay 55. Photon delay 55 thus imparts the time delay representing the random number onto the biphoton through varying the voltage across the electro-optic media, through altering the Pockel cell switches in the linear array, or by other techniques, depending on the specific embodiment.

[0037] The signal photon propagates directly from PBS 45 to polarization selector 60.

Polarization selector 60 includes, by way of non-limiting example, a half-wave plate that selectively rotates the polarization of the signal and idler photons by 90°. Polarization selector 60 is thus a controllable half-wave phase shifter capable of converting vertical polarization to horizontal polarization and vice versa. The idler photon reaches polarization selector 60 after traveling through photon delay 55. Polarization selector 60 sets a polarization configuration of the biphoton to one of two states in order to impart a bit onto the biphoton. Such a bit is encoded in the polarization of the individual signal and idler photons. This polarization bit may be either a "0" or a "1." To encode this information, polarization selector 60 selects either a vertical or horizontal polarization for the signal and idler photons. By way of non-limiting example, the combination of a signal photon with a horizontal polarization and an idler photon with a vertical polarization may represent a "1." The combination of a signal photon with a vertical polarization with an idler photon with a horizontal polarization may represent a "0." Other encodings are also possible. Encoding more than one bit is also possible.

[0038] From polarization selector 60, the biphoton propagates to a basis selector 65.

Basis selector 65 selects a basis randomly for the biphoton. Two exemplary bases are linear and circular polarization. Each of these bases has several different states. For example, a linear polarization basis may include horizontal and vertical states, and a circular polarization basis may include clockwise and counterclockwise states. Basis selector 65 includes, by way of non- limiting example, a quarter-wave plate that selectively shifts the polarization of the signal and idler photons by a quarter wave. Basis selector 65 is thus a controllable quarter-wave phase shifter, capable of converting linear polarization to circular polarization and vice versa. Basis selector 65 randomly selects whether to leave the linear polarization basis of the biphoton unaffected, or to convert it to a circular polarization basis. Thus, the states of one basis are either left alone or converted to the states of another basis. By way of non-limiting example, horizontal polarization may get converted to left circular polarization and vertical polarization may get converted to right circular polarization, or vice versa. A Pockel cell that introduces a quarter- wave shift when activated and no shift when inactivated may be used for this purpose. With circular polarization, a biphoton that has a horizontally polarized signal photon and a vertically polarized idler photon could have its polarization changed to, by way of non-limiting example, left circular polarization for the signal photon and right circular polarization for the idler photon. Alternatively, basis selector 65 may let the biphoton having vertical and horizontal polarizations pass through unaffected. Basis selector 65 thus selects the biphoton' s signal photon and idler photon basis, but essentially leaves the relative difference in polarization between the signal photon and idler photon unchanged. The information encoded in the states of one basis is therefore preserved when those states are converted into a different basis. Moreover, basis selector 65 leaves the polarization information of each biphoton bit unchanged. [0039] The choice of basis for each photon can be thought of as being a bit. Such a basis bit is encoded in the choice of linear or circular basis. For example, a biphoton with linearly polarized signal and idler photons, i.e., linear basis, can be thought of as encoding a "0," whereas a biphoton with circularly polarized signal and idler photons, i.e., circular basis, can be thought of as encoding a "1." This basis bit thus indicates which basis is used, but is independent of the particular states in that basis. The basis is used to test the security of the sequence of biphotons transmitted between sender 20 and receiver 25.

[0040] The idler and signal photons emerge from basis selector 65 and propagate towards mirrors 70 and 75. Mirrors 70 and 75 direct the propagation of the signal and idler photons into communications channel 30.

[0041] In sum, sender 20 encodes a plurality of information in various forms into each biphoton in a stream of biphotons. Initially, laser 35 sends a stream of photons into PDC 40, which are converted into a stream of biphotons. Together, photon delay 55, polarization selector 60, and basis selector 65 are able to impart a time delay byte, polarization bit, and basis choice onto a biphoton. With photon delay 55 and polarization selector 60, and basis selector 65, this stream of biphotons is randomly manipulated to impart time delay bytes, polarization bits, and basis choices onto each biphoton. Consequently, the stream of biphotons is transformed into a sequence bearing quantum key information upon individual biphotons pairs carrying a delay byte and polarization bit. Through the introduction of this time delay byte, the infoπnation carrying capacity of the biphoton is increased over that of a photon that just holds a bit through polarization. Consequently, the introduction of the time delay byte increases the bandwidth of infoπnation carried by a stream of biphotons.

[0042] Sender 20 is synchronized with receiver 25, allowing for propagation time of the biphotons. Sender 20 and receiver 25 are preferably synchronized through the use of a global clock, such as one provided by the Global Positioning System (GPS). When sender 20 transmits the sequence of biphotons over communications channel 30 to receiver 25, the period of transmission is divided into time bins of equal length. Preferably, one biphoton is transmitted in a single time bin. As a result, sender 2O and receiver 25 can identify and track specific biphotons with the sequence of Lime bins. However, some time bins may not include any biphoton, and some time bins may include more than one biphoton. The choice of rate of biphoton production is a function of at least the desired bandwidth of information and relative security. Preferably, the probability that an individual time bin contains a biphoton is much less than one (by way of non-limiting example, such a probability may be 0.1).

[0043] Receiver 25 receives the sequence of biphotons transmitted over communications channel 30. Receiver 25 detects the polarization states of the received biphotons forming the transmitted sequence from sender 20. However, receiver 25 does not know which basis to measure the states with. Using one basis to measure states in a different basis will produce random results. When biphotons reach receiver 25, the incoming pairs encounter basis selector 80. Basis selector 80 randomly selects a polarization basis for detecting the biphoton. Basis selector 80 is used to guess at the basis polarization imparted onto each biphoton by sender 20. Because, in the present embodiment, there are two choices for the basis, linear or circular, basis selector 80 will incoirectly select the basis of the biphoton approximately one-half of the time. If basis selector 80 randomly guesses that the incoming pair has circular polarization, it will attempt to convert the biphoton to have linear polarization. If basis selector 80 randomly guesses that the basis of the incoming biphoton is linear, it will do nothing, thereby leaving the biphoton with the polarization imparted by basis selector 65, regardless of whether it is linear or circular polarization.

[0044] The two photons forming each biphoton are separated into idler and signal photons by polarizing beam splitter 45. In order to detect the relative time delay and read the relative time delay byte imparted onto each biphoton, a photon recombination system 85 is employed with receiver 25. Photon recombination system 85 employs a pair of polarizing beam splitters 90 and 95, as well as mirrors 100 and 105 in order to direct the stream of idler and signal photons along coincident paths towards a pair of detectors 110 and 115. Beam splitter 90 and mirrors 100 and 105 divide and direct the stream of signal photons into a pair of paths coincident with the paths of the idler photons that are split by beam splitter 95. As discussed in detail below, detectors 110 and 115 respectively detect biphotons with "1" and "0" polarization bits. [0045] Detectors 110 and 115 detect biphotons as an entangled, two-photon transition in a series of interaction regions. Each region is arranged so that arriving photons have different delays between the horizontally-polarized photons and the vertically-polarized photons. That is, each region is separated from the previous region by optics that delays one photon of each biphoton pair. These detectors are preferably optically thick to biphotons that arrive simultaneously within the entanglement time and are transparent to all other combinations. [0046] Detectors 110 and 115 are able to sense entangled biphotons through the use of a

Biphoton Sensitive Material ("BSM") 120 that is housed within an atomic vapor cell 125. BSM 120 is formed as a linear array of regions illustrated as "spots" within atomic vapor cell 125. A pair of mirrors 130 reflect the stream of biphotons through successive regions forming the linear array BSM 120 housed within atomic vapor cell 125.

[0047] BSM 120 absorbs biphotons under certain conditions. The absorption of biphotons causes BSM 120 to fluoresce. BSM 120 fluoresces only when the biphoton arrives inside of the entanglement time T_e. Each biphoton has an entanglement time T_e. BSM 120 is transparent to biphotons that arrive outside entanglement time T_e. Only those biphotons that arrive with a time delay shorter than the entanglement time T_e are absorbed by BSM 120, causing it to fluoresce. Biphoton absorption is also refeπed to as Entangled Two-Photon Absorption ("ETPA") as well as biphoton absoφtion. The molecules forming BSM 120 produce a fluorophoton in response to absorbing entangled photon pairs. This emitted fluorophoton strikes a Charge Coupled Device ("CCD"), photomultiplier tube ("PMT"), or other acceptable device (not shown) that detects the fluorophoton, thereby indicating that a biphoton was absorbed by BSM 120. The CCD is coupled to a computer that tracks and records the fluorophotons that impact the CCD.

[0048] Although BSM 120 absorbs entangled photon pairs thereby producing fluorescence, BSM 120 does not generally absorb other types of photons. BSM 120 generally does not absorb and fluoresce in response to absoiption except for biphotons whose constituent signal and idler photons aπive within the entanglement time of each-other. Other types of photons and biphotons generally do not cause BSM 120 to fluoresce, and therefore do not register on the CCD. Thus, BSM 120 is effectively transparent to such other types of photons and biphotons. These other types of photons can include random photons, which may consist of individual or multiple photons that may or may not be entangled with other photons. Random photons can also include multiple photons that are not entangled with any other photons. Individual photons are generally not absorbed by BSM 120; BSM 120 is effectively transparent to individual photons. Thus, even if random photons or biphotons with a long inter-photon delay reach detectors 110 and 115, they will not register. Embodiments of the present invention that employ a BSM are therefore virtually immune from interference from other light sources. Such embodiments may be used to transmit and receive biphotons encoding information in high ambient light conditions, even if the ambient light contains photons the same frequency as the signal photons, idler photons, and initial laser photons. These embodiments are particularly useful for transmission through air or space. Additionally, the ability to detect biphotons and only biphotons increases security.

[0049] Detectors 110 and 115 provide a system whereby the random polarization bits and time delay bytes contained on the biphotons transmitted from sender 20 are detected and read. The computer connected to the CCDs of detectors 110 and 115 records the fluorescence patterns and thereby recovers information from the sequence of biphotons. This information is recorded in a manner such that each biphoton has an associated numeric identity corresponding to its time bin, a delay byte, and a polarization bit. The numeric identity of a biphoton corresponds to the placement of a particular biphoton within the biphoton sequence. For instance, the 25^ϋ biphoton emitted from sender 20 will arrive in a particular time bin, say the /z-fh time bin, and thereby have the number n as its associated numeric identity. Note that for this example of the 25^th biphoton emitted, n might be larger than 25 (where, on average, less than one biphoton is emitted in each time bin) or smaller than 25 (where, on average, more than one biphoton is emitted in each time bin). Preferably, however, less than one biphoton is emitted in each time bin on average. By way of non-limiting example, a biphoton may be emitted in a given time bin with a selectable probability of, e.g., 0.1.

[0050] For BSM 120 to detect biphotons with different delay bytes, a pair of birefringent phase delay filters 122 are used to delay the propagation of the signal photon relative to the idler photon. BSM 120 detects quantum entangled biphotons when the pairs aπive at a BSM region 120 within the entanglement time T_e. As a biphoton enters either detector 110 or 115, the pair is reflected against mirrors 130 a plurality of times through the linear array of regions of BSM 120 in vapor cell 125. Each time the biphoton passes between minors 130 and BSM 120, it passes through one of the two birefringent phase delay filters 122. With each pass through birefingent phase delay filter 122, the signal photon is increasingly delayed with respect to the idler photon. Once the signal photon is sufficiently delayed such that the time delay between the signal and idler photon is less than the entanglement time T_e, the biphoton will be detected by the following region in the linear array of regions of BSM 120 and cause it to fluoresce. Consequently, the particular region that fluoresces in the linear array of regions of BSM 120 identifies the time delay byte that was imparted to the biphoton by sender 20.

[0051] Refening, for example, to detector 115, a biphoton will pass from photon recombination system 85 to a first region in the linear array of regions of BSM 120 without encountering either of birefringent phase delay filters 122. If this first region in the linear array fluoresces, then the time delay byte imparted to the biphoton is one that is represented by zero time delay. As the biphoton is reflected against minor 130 as it propagates from the first region in the linear array forming BSM 120 to the second region, it passes through birefringent phase delay filter 122 twice, thereby slowing down one photon of the pair thus reducing the relative time delay between the signal and idler photons by one unit of time delay. If the second region in the linear array of BSM 120 fluoresces when the biphoton reaches it, then the biphoton initially canied a delay byte represented by one unit of time delay. This process of reflection by minors 130 and reduction of the time delay by one unit of time by birefringent phase delays 122 continues until the signal and idler photons have a relative time delay less than the entanglement time T_e. The location of fluorescence within array of BSM 120 regions therefore indicates the time delay byte. Detector 110 operates in essentially the same manner as detector 115. For a time delay byte composed of n bits of information, detectors 110 and 115 each have 2" regions in the linear anay of BSM 120 to detect the 2ⁿ possible time delays imparted by photon delay 55. [0052] Together, sender 20, communications channel 30, and receiver 25 respectively function to transmit, cany, and detect a sequence composed of a series of biphotons that each individually carry a delay byte and a polarization bit. Through exploiting the time delay between the signal and idler photons, sender 20 increases the bandwidth of the sequence transmitted between sender 20 and receiver 25. A sequence composed entirely of biphotons that are each only carrying a polarization bit carries one bit of information per photon pair. With the introduction of the time delay and addition of the delay byte to each photon pair, each individual biphoton carries 1+n bits of information, where n is the number of bits in the time delay byte. Hence, with the introduction of the delay byte, the bandwidth of the sequence produced from sender 20 is increased. With the introduction of a basis selector and addition of a basis bit, each individual photon carries 2+n bits: n bits in the time delay byte, one polarization bit, and one basis bit. Note that the size of the byte forming the time delay byte may vary from zero to n bits of information, where n may be as large as ten or more.

[0053] Refeπing again to detectors 110 and 115, photon recombination system 85 utilizes beam splitters 90 and 95 to separate the incoming biphotons through the use of polarization. The use of polarization enables photon system 85 to separate the incoming biphotons based upon whether they cany a "1" or a "0" polarization bit. Polarization selector 60 in sender 20 polarizes the idler and signal photons to encode a polarization bit of information. This polarization bit from polarization selector 60 is what polarizing beam splitters 90 and 95 act upon when separating the streams of incoming idler and signal photons. Consequently, the streams of idler and signal photons received by receiver 25 are separated into streams of biphotons caπying a "0" polarization bit and those carrying a "1" polarization bit. The biphotons carrying the "1" polarization bit are directed towards detector 110. The biphotons caπying a "0" polarization bit are directed toward detector 115. As a result, detector 110 detects and measures the delay bytes of all of the "1" polarization bit biphotons, and detector 115 detects and measures the delay bytes of all of the "0" polarization bit biphotons.

[0054] Basis selector 80 randomly guesses at the basis of the incoming biphotons. Since there are two possible bases in the given example, circular and linear, basis selector 80 will randomly guess the correct basis fifty percent of the time. For the biphotons that basis selector 80 correctly guessed the basis, photon recombination system 85 sorts them based on their linear polarization of caπying either a "1" or "0" polarization bit and directs them to the appropriate detector 110 or 115. Although basis selector 80 will guess the basis correctly approximately fifty percent of the time, basis selector 80 also guesses the wrong basis fifty percent of the time. [0055] For the biphotons that basis selector 80 incorrectly guessed, these biphotons also propagate toward photon system 85. There are two possible directions that the constituent signal photons and idler photons of biphotons whose basis was incoπectly guessed (i.e., those with circular polarization) may travel from photon system 85: Such photons may travel either to detector 110 or 115. These circularly polarized photons will randomly appear either at detector 110 with a probability of Yι (50%) or at detector 115 with a probability of Vi (50%). Therefore, even though basis selector 80 incorrectly guesses the basis of fifty percent of the incoming biphotons, half of the signal and or photons from such incorrectly guessed biphotons will nevertheless travel to the correct detector 1 10 or 1 15. Half of the signal or idler photons from incorrectly guessed biphotons will travel to the wrong detector 110 or 115. In sum, a quarter of biphotons whose basis was guessed incoπectly will be coπectly detected at their respective detector 110 or 115.

[0056] Figure 1A depicts in detail a photon delay 55 embodiment. This embodiment varies the length of the path of propagation for the idler photon relative to the signal photon through the use of multiple systems 1 100 of Pockel cells and PBSs. Each system is capable of selectively imparting a delay by selectively redirecting a photon to an additional length of propagation path. The systems 1102-1 1 18, generally 1100, are placed one after the other in a linear aπay. With the array of systems 1100, it is possible to controllably vary the distance that the idler photon propagates relative to the signal photon, thereby imparting a time delay byte. In particular, a time delay unit Δt is chosen. The first system 1102 is configured to include an additional delay of Δt when activated. The second system 1104 is configured to include an additional delay of 2Δr when activated. More generally, the i-th system 1 100 in the array is configured to include an additional delay of 2 Δt when activated. Each system 1100 may be independently activated. Thus, in a photon delay embodiment with m such systems 1100, any delay that is an integer multiple of Δt. from zero to 2'"Δt may be obtained. Other systems can introduce time delays such as a configuration of minors or aπay of fiber optic media. [0057] Figure IB depicts in detail an exemplary system 1100 of Pockel cells and PBSs.

Pockel cells are electro-optic crystals that are used as a switch. Each Pockel cell can switch the polarization of an incoming polarized photon so that the succeeding PBS will either direct the photon through an additional length of path 1202 or let it pass on to the next Pockel cell and PBS system 1 100 in the linear array via path 1204. Both paths 1202, 1204 that an incoming photon may take are depicted at 1200. The following assumes for puiposes of illustration that system 1100 is the π-th in a serial delay (e.g., 55). At 1210, the system 1100 sets the π-th bit to "0" by allowing an incoming photon to pass through without diverting it to an additional path length. A horizontally-polarized photon passes directly through the first Pockel cell 1206 unchanged, straight through the first 1208 and second 1212 polarizing beam splitters, and through the second Pockel cell 1214, unchanged, at 1210. At 1220, the system 1100 sets the n-t bit to "1" by diverting an incoming photon to an extended path length, thereby effecting a 2' Δt delay. A horizontally-polarized photon is converted to a vertically-polarized photon by the first Pockel cell 1206, directed by the first polarizing beam splitter 1208 to the first 1216 and then second minor 1218, and on to a second polarizing beam splitter 1212, which directs the photon to a second Pockel cell 1214. The second Pockel cell 1214 converts the vertically-polarized photon back to horizontal polarization, and passes the photon out of system 1100. [0058] Figure 2 is a flow chart 300 that depicts a method for the creation, transmission, and reception of a sequence of biphotons that supports quantum key distribution. The process begins at step 301 and proceeds to step 310 where a sequence of biphotons are generated using, by way of non-limiting example, laser 35 and PDC 40. In step 320, the signal and idler photons are separated utilizing, by way of non-limiting example, PBS 45. Step 340 checks whether it is likely that enough bits have been received. The decision at 340 is based on at least the desired amount of data to be sent and the rate of biphoton transmission. If step 340 yields a "NO," then control is passed to step 350, where a delay byte is introduced to the biphoton with photon delay 55. If it is likely that enough bits have been received, then the process is passed to end step 420. Alternately, or in addition, the receiver may communicate whether enough bits have been received, using a quantum or classical channel. [0059] In step 360, a random polarization bit is imposed on to the biphoton, using, by way of non-limiting example, polarization selector 60. In step 370, a basis is randomly selected and imposed on the biphoton. Next, the biphoton is transmitted across communications channel 30 in step 380. A basis polarization is randomly guessed for reception of the transmitted biphotons in step 390, by, by way of non-limiting example, receiver 25. hi step 400, the polarization bit and delay byte are read by, by way of non-limiting example, detectors 110 and • 115, and this information is recorded at step 410. Based upon decision step 340, this process discontinues in step 420 when a sequence of N biphotons has been transmitted. [0060] Figure 3 illustrates a protocol, such as- for use in the exemplary system of Fig. 1, for quantum key distribution in which polarization bits are correlated, allowing for a highly secure transmission rate and in which a delay byte is transmitted. By convention and for ease of discussion, sender 20 is referred to as Alice and receiver 25 is referred to as Bob. The objective of this protocol is to enable Alice and Bob, who initially share no common secret information, to share a secret key in such a manner that an eavesdropper Eve would be detected. [0061] Referring to the exemplary embodiment of Figure 3, in step 1, Alice generates and transmits a sequence of biphotons utilizing sender 20. This sequence is a stream of N biphotons, each of which has a selected basis and is encoded with a polarization bit and delay byte. For the n-t biphoton in the sequence, the polarization bit is denoted p_n and delay byte is denoted d_n. Polarization bit p_n caπies one bit of information and delay byte d_n caπies one or more bits of information. Alice transmits this sequence over a communications channel (e.g., 30) to Bob. The communications channel (e.g., 30) supports the transmission of biphotons. [0062] In step 2, Bob the receiver detects the sequence sent by Alice. Utilizing a receiver

(e.g., 25), Bob detects and reads the random information (p_n and d_n for each n<N) from the quantum sequence sent by Alice. Bob will not receive all of the biphotons sent by Alice. Due to various phenomena, not all of the biphotons transmitted by Alice will cross the communications channel (e.g., 30) successfully and reach the receiver (e.g., 25). For those biphotons that do reach Bob, Bob randomly chooses a basis and detects and records the delay byte d„ and the polarization bit p„ .

[0063] Over a public channel, Bob tells Alice the basis b„ that he used to read each of the biphotons that he received from Alice (n and b_n for n<N). The public channel is different from the private channel used to transmit the quantum sequence from sender 20 to receiver 25. The public channel can be any conventional communications channel such as radio, telephone, wireless, optical, or satellite. Further, the communications across the public channel need not be secure. Since Alice and Bob are only exchanging the information related to the polarization basis and not the actual polarization bits or delay bytes, Alice and Bob are not giving away information that can be used, without more, to form the quantum key. Therefore, Eve will not gain enough key information to generate the secret key used by Bob and Alice by eavesdropping on the communications across the public channel.

[0064] In step 4, Alice compares the polarization bases used by Bob to the actual polarization bases that Alice randomly selected for each of the biphotons that were transmitted from the sender (e.g., 20) to the receiver (e.g., 25). In step 4, Alice then tells Bob over the public channel the numeric identity (π) of each of the biphotons for which Bob selected the conect basis. Alice will have transmitted an N biphoton sequence to Bob. A portion of the N biphotons will never be received by Bob. For the biphotons that are received, Bob will select the wrong polarization basis with a polarization selector (e.g. , 80) for a portion of the received biphotons. However, Bob will also randomly guess the correct basis for a portion of the received biphotons. In the message transmitted from Alice to Bob in step 4, Bob is told which of the N sent biphotons he has selected the correct basis for. It is from this group of received biphotons for which Bob selected the conect basis that a quantum key is created. The quantum key is created from key information transmitted from Alice to Bob across the private channel (e.g., 30). The key information is composed of any, or a combination, of the delay bytes and polarization bits contained on each of the biphotons for which Bob selected to correct basis. [0065] Once the key information has been collected, Alice and Bob in step 5 go through the process of forming a secret quantum key. Alice and Bob utilize a sequence of enor detections on the data in order to eliminate the effects of a noisy channel (e.g., 30). Alice and Bob compare the parity of the publicly agreed subsets of their blocks of key information. If an enor is found, the block is subjected to a bisective search. This process continues until the enor is found and coπesponding bits removed. As a precaution, Alice and Bob preferably discard the last bit in any block in order to prevent information leaking to Eve. This process is repeated a number of times until Alice and Bob are satisfied that the information used to form the key now contains no more errors. The size of the blocks depends upon the frequency with which errors are thought to occur in the channel. With the enors removed from the data, Alice and Bob form the secret quantum key that they can use to foim enciypted communications between them. [0066] The protocol of Figure 3 is further analyzed presently. Consider, by way of non- limiting example, the apparatus of Figure 1 where a polarization bit and a delay byte are encoded. Each biphoton is encoded with a basis b, a. delay byte d, and polarization bit p. Assume by way of non-limiting example that the efficiency of detecting a given biphoton can be low (efficiency η' for Bob and 77" for Eve). Break the time history into bins each Δr iong and label them in sequence with the integer t. The probability η for Alice to transmit a biphoton that is modulated with a polarization bit and delay byte pair in bin t is η<\. For each time bin, Alice encodes a random polarization bit p(t), a random delay byte d(t), and a random basis choice b(t). Bob then selects his own random basis choice b'(t) and makes a measurement of biphoton detection events p t) during a corresponding interval, accounting for propagation time. With 50% probability, Bob made the same basis choice as Alice, b t) = b(t), in which case p'(t) = p(t) and d'(t) = d(t). If Bob makes the opposite basis choice as Alice (50% probability), 1/2 the polarization bits cannot be detected since the members of the pair went in opposite detector arms, VΛ are correctly detected, p'(t) = p(t), and ^lΛ are incorrectly detected. This gives an overall detection probability for the polarization bits of 67_/7/78, 5ηη'β of which are coπect, p'(t) = p(t), and 777778 are incorrect. If Bob reports back to Alice via a public channel the subset { t; } that gave detected events ({t;} should be 677/778 the size of the set {t}), Alice can then transmit publicly to Bob the set of her basis choices {b(t_/)}, which he can compare with his basis choices {b'(t;)}and a refined data set {t₂}with b'(t₂) = b(t?) publicly agreed upon. If no eavesdropper has intraded, then 2/3 of the basis choices should agree, giving a valid data transfer probability per time bin of ηη'/2.

[0067] If an eavesdropper, Eve, employs an attach whereby she measures and retransmits any sequence _/?"(t), "(t) that she receives with her random basis choice b"(t), then the polarization bits ?'(t) received by Bob are affected in several ways, such as depicted in Table 1. In Table 1, "B&A" stands for Bob and Alice, "E&A" stands for Eve and Alice, the terms "agree" and "disagree" refer to the basis for a particular biphoton, whether imparted or measured, as the case may be. The terms "correct," "blank" and "incorrect" refer to whether a particular polarization bit is measured correctly, not at all, or incorrectly, respectively. Each fraction in Table I represents a probability of the corresponding event depicted by its corresponding column and row. Note that a polarization bit is not detected at all if the signal photon and idler photon of a single biphoton travel to different detectors 11_,5, 110. The total transmitted probability per time bin is 57777' 77' 78, which is smaller than without Eve. This is even true if 77"=1. More definitively, the ratio of the number of ^"time bins where Bob and Alice choice of basis agree/disagree falls from 2/1 without Eve to 3/2 with Eve. Finally, the error rate that Bob sees for the data in set {r_?} rises from zero to 1/6. Thus, statistical analysis of any of these parameters will serve to reveal the presence of Eve. An important feature here is that Bob can have a relatively low efficiency 77' and still defeat an Eve with perfect efficiency 77"= 1.

Table 1 [0068] If Eve's efficiency 77" is small, then she can only intercept a portion 77" of the data set {t₂}. If Eve reintroduces the data she does detect into the undetected data stream, then the evidence of her tampering will be reduced (prob/binfø) = ηη'(6(l- η^{, ,})+5η^,')/S; basis ratio = 2(1- 77")+1.5τ7"; error rate 77" /6). Such a partial-transparency attack can be foiled in a number of ways (e.g. combining pairs of data points from set {t }, to reduce the intercept rate to 77" ², etc.). However, unlike, for example, the protocol BB84, further sacrifice of valid data is not necessary for this method. If the data set {t } is N bits long then the basis ratio 2- 77" /2 can be used to test for partial intercept down to the η"=(72fN) level (this is assuming that background rate in the detector, which could mimic Eve in this ratio, is small b« ηη' 77" /2). [0069] By comparison, BB84 with single photons has no change in data rate or basis choice ratio. Thus, real data must be sacrificed to determine the enor rate which is 1/8 for opaque intercept as noted below in Table 2.

Table 2 - BB84 [0070] However, with 2'¹ regions in the linear aπay of BSM 120 in detectors 110 and

115, the protocol of Fig. 3 delivers n additional bits of information encoded in the time delay between signal photons and idler photons and sent with the same security as outlined above. The protocol of Figure 3 is thus superior to BB84. [0071] Figure 4 illustrates a biphoton 200 having a basis, a polarization bit, and delay byte. Biphoton 200 is composed of an idler photon 205 and a signal photon 210. Biphoton 200 is produced with type II parametric down conversion and has an entanglement time T_e. Photons 205 and 210 preferably have slightly different frequencies. Each photon 205 and 210 may have a vertical polarization 215 or a horizontal polarization 220. Depending upon the horizontal polarization 220 and the vertical polarization 215 of photons 205 and 210, biphoton 200 may represent a classical bit of "0" or "1." Through using polarizations 215 and 220, biphoton 200 can represent a bit of information. This bit of information is encoded onto biphoton 200 through the use of polarization selector 60.

[0072] Photons 205 and 210 are entangled, which is represented with wavy lines 225.

This entanglement persists between photons 205 and 210 even when photons 205 and 210 are separated using a polarizing beam splitter (e.g., 45), given a selected polarization by a polarization selector (e.g., 60), imposed with a basis by a sender basis selector (e.g., 65) and pass through a receiver basis selector {e.g., 80), independent of whether the basis selector (e.g., 80) is activated or not.

[0073] Photons 205 and 210 may also have a circular polarization 230, depending on the choice of basis. Circular polarization 230 may be imparted onto biphoton 20O through the use of a basis selector (e.g., 65). Biphoton 200 may or may not . have circular polarization_, 230 depending upon the random selection of the basis selector (e.g., 65).

[0074] The delay byte is imprinted upon biphoton 200 through the introduction of time delay T sepaiating photon 205 from 210. The time delay T may be imparted to the biphoton 200 through the use of a photon delay (e.g., 55). Note that each biphoton 200 has an inherent entanglement time T_e. The time delay T is generally longer than the entanglement time T_e. [0075] Figure 5 illustrates a block diagram of another quantum key distribution embodiment. This embodiment has two basis selectors 135 and 136 within sender 20. Basis selectors 135 and 136 are able to impart separate basis polarizations to the idler and signal photons. In order to detect the separate basis polarizations of the idler and signal photons imparted by basis selectors 135 and 136, receiver 25 of the this embodiment has a pair of basis selectors 137 and 138 that independently randomly guess at the polarization basis of the incoming biphoton transmitted by sender 20. In addition, this embodiment has coincidence detectors 140 coupled to a minor 145 for each detector 110 and 115. If both photons have either vertical or horizontal polarization, the photons are detected by coincidence detectors 140. Thus, if a signal photon goes through detector 110 and its entangled idler photon goes through detector 115, or vice versa, a coincidence will be detected between detectors 141 and 143 or between detectors 142 and 144. Such a situation may occur, for example, when basis selectors 137 and 138 selecting a wrong basis, or from interference from Eve. Coincidence detectors 140 are coupled to a computer to record detection events, as are detectors 110 and 115 as described above in reference to Figure 1.

[0076] Coincidence detectors 140 enable receiver 25 to determine a ratio of the number of biphotons detected by BSM regions 120 to the number of biphotons that are detected by coincidence detectors 140. More particularly, this ratio is computed by adding the numbers of detection events that occur in BSM 120, the number of coincidences between events detected at detectors 141 and 142, and the number of coincidences between events detected at detectors 143 and 144, and dividing the resulting sum by the sum of the number of coincidences between events detected at detectors 141 and 143 and the number of coincidences between events detected at detectors 142 and 144. Statistical analysis of this ratio is one method of determining whether an eavesdropper Eve is present. Without the presence of an eavesdropper, the ratio of biphotons detected with BSM regions 120 to those detected with coincidence detectors- 140 is -three-to-one. When Eve makes an opaque intercept, the ratio of biphotons detected with BSM regions 120 to those detected with coincidence detectors 140 becomes about five-to-three. The use of coincidence detectors thereby provides a method for statistically detecting Eve without revealing information about the key.

[0077] Figure 6 is a block diagram of a further embodiment of the invention. This embodiment of the invention does not include a photon delay (e.g., 55). In this system, the biphotons are encoded with a polarization bit ("1" or "0") by polarization selector 60, and no delay byte is encoded. This embodiment includes separate basis selectors 135 and 136 in sender 20 such that the idler and signal photons have individual polarization bases. Consequently, receiver 150 has two basis selectors 137 and 138 in order to randomly select the basis for the idler and signal photons incoming from sender 25. Polarizing beam splitters 160 and 165 separate the signal and idler photons based upon whether they are encoded with a "1" bit polarization or a "0" bit polarization in combination with minors 166 and 167. Detectors 168 and 169 register when a biphoton impacts the detector. In the embodiment of Figure 6, detectors 168 and 169 may be either detectors incoiporating a BSM or may be standard electronic coincidence counters.

[0078] Figure 7 is a block diagram of a further embodiment of the invention. This embodiment is configured with a sender 400 that has a laser 410 and PDC 420 that produce biphotons. PBS 430 separates the idler photon from the signal photon so that ttiey may propagate on different pathways. A mirror 440 reflects one of the photons of the biphoton in a pathway toward polarization selector 450. Polarization selector 450 imparts a bit of information onto both the signal and idler photons through manipulation of the photon's polarization. Basis selector 460 imparts a basis onto the biphoton through manipulation of the photon's polarization. Minors 470 and 480 direct the photons into channel 490.

[0079] The biphotons propagate through channel 490 to receiver 500. Receiver 500 is configured with a basis selector 510 to randomly guess at the basis of the incoming biphotons. Photon system 520 uses a pair of PBSs 530 and 560 along with a pair of minors 540 arid 550 to separate and direct the biphotons to either the "1" bit detector 570 or the "0" bit detector 580. Minor 590 directs the "1" bit biphotons to a Pockel cell or half-wave plate 610, which imparts a λ 2 phase shift to each photon passing through (converting vertical polarization to horizontal polarization and vice versa). Mirror 600 directs the "0" bit biphotons directly to PBS 620. PBS 620 separates and directs the incoming biphotons to biphoton detectors 640 and 630. With the system illustrated in Figure 7, receiver 500 can examine the ratio of biphotons detected by detectors 570 and 580 to biphotons that are detected by detectors 630 and 640. Without an eavesdropper present in the system, the ratio should be 3:1. If an eavesdropper Eve intercepts and retransmits, the ratio becomes approximately 5:3. Statistical analysis of this ratio thereby reveals the eavesdropper. Each of detectors 570, 580, 630, and 640 use a BSM and a fluorophoton monitor, such as a CCD or PMT. Each of detectors 570, 580, 630, and 640 are coupled to a computer, which monitors and records detection events. The same computer preferably reports the above ratio to a user of the system and suggests whether an eavesdropper is present.

[0080] Through the public channel, receiver 500 reports to sender 400 the bases of the biphotons and the number of biphotons that coincide. For each occurrence of coincidence, about one in every three pairs that Eve intercepts will be from the set where sender 400 and receiver 500 agree on the basis, making Eve's presence quickly apparent. As a result, there is an eavesdropping check with this system that does not reveal any information on the data that will be used for the key distribution.

[0081] Figure 8 is a block diagram of another embodiment of the present invention. This embodiment is configured to support one bit of time delay coding. A sender 700 has a laser 710 and PDC 720 that produce biphotons. PBS 730 separates the idler photons from the signal photons so that they may propagate on different pathways. A minor 740 reflects the idler photon toward photon delay 55 while the signal photon of the biphoton propagates in a pathway toward polarization selector 750. Photon delay 55 imparts a landomly-chosen time delay byte (in this embodiment, one bit) to the biphoton. Alter imparting the time delay byte, photon delay 55 directs the idler photon to polarization selector 750. Polarization selector 750 is divided into two sections so that it may separately impart polarizations onto the signal and idler photons. Polarization selector 750 is therefore able to impart two bits of information onto the biphoton through manipulation of each of the signal and idler photons' polarizations. Basis selector 760 randomly imparts a circular basis or leaves the existing linear basis on the biphoton. Mirrors 770 and 780 direct the photons into channel 790. The configuration of sender 700 to send a single bit of time delay information is purely exemplary. It is possible to encode and send additional bits of time delay information through the use of the appropriate photon delay 55. [0082] The biphoton propagates through channel 790 to receiver 800. Receiver 800 is configured with a basis selector 810 to randomly guess at the basis of the incoming biphotons. Receiver 800 is configured to receive a biphoton with one bit of time delay and two polarization bits. With a total of three bits of information on the biphoton (not counting the basis choice), there are eight possible combinations. As a result, receiver 800 is provided with eight detectors 830, 840, 850, 860, 870, 880, 890, and 900 to detect the eight possible bit combinations. Each detector uses a BSM and a fluorophoton monitor, such as a CCD or PMT. Each such monitor is coupled to a computer, which records detection events and analyzes data using statistical methods, for example, as described below. The same computer preferably presents results to a user. The eight detectors 830, 840, 850, 860, 870, 880, and 900 are grouped in pairs (830, 840), (850, 860), (890, 900), and (870, 880) in order to detect the two possible delays of each polarization configuration. The four pairs of grouped detectors are organized as such to detect the four possible states of the two polarization bits.

[0083] Photon system 820 uses a pair of PBS devices 910 and 920 along with a pair of minors 930 and 940 to separate and direct the biphotons to one of the first two pairs of detectors, 830 and 840, or 850 and 860. Detectors 830 and 840 both detect the first of the four possible combinations represented by the two bits of polarization information. Detectors 850 and 860 both detect the second of the four possible combinations represented by the two bits of polarization information. Detectors 830 and 850 detect the first of the two possible states of the time delay bit. Detectors 840 and 860 detect the second of the two possible states of the time delay bit.

[0084] Two additional pairs of detectors, 870 and 880, and 890 and 900, are provided to detect the third and fourth possible_. combinations of the two. bits of polarization information on the biphoton^'. The pair of detectors 870 and 880 are configured fo detect the. third of the four two-bit polarization states. The pair of detectors 890 and 900 are configured to detect the fourth of the four two-bit polarization states. Detectors 870 and 890 detect the first of the two possible states of the single time delay bit. Detectors 880 and 900 detect the second of the two possible states of the single time delay bit. The configuration of receiver 800 to receive a single bit of time delay information is purely exemplary. It is possible to detect additional bits of time delay information through the use of additional detectors. Alternately, the embodiment of Figure 8 may omit photon delay 55 and detectors 840,- 860, 880, and 900, in which case no time delay information would be encoded or detected.

[0085] Flat mirrors 950 are provided to direct the path of propagation of the signal and idler photons through the aπay of detectors 830, 840, 850, 860, 870, 880, 890, and 90O. PBS 960 is provided between the first pairs of detectors, 830 and 840, and 850 and 860, and the second pairs of detectors 870 and 880, and 890 and 900. PBS 960 is provided to separate the signal and idler photons into the third and fourth possible states in the two-bit polarization information. Curved mirrors 970 are provided to direct the path of photons from the first pairs of ^'detectors, 830, 840, 850 and 860 to the second pairs of detectors 870, 880, 890, and 900. Curved minors 970 are also provided to direct the photons to additional detectors if desired (not shown). A half-wave plate 980 is provided to rotate the polarization of the signal and idler photons λ/2 between the first and second pairs of detectors. [0086] Figure 9 is a schematic diagram illustrating a quantum key distribution protocol.

Consider the system of Figure 8 in usage. Assume for purposes of exposition that the efficiency of detecting a given biphoton can be low (efficiency if for receiver 800 Bob and if for an eavesdropper Eve, not shown). The transmission of biphotons occurs over a period of time that is broken into individual time bins of width AT labeled in sequence by an integer t, thereby comprising a set {t} identified with the time bins. The probability for Alice, the sender 700, to transmit a biphoton in a given bin t is η<\. Since Alice generally cannot control when a biphoton is produced, she preferably limits her transmission rate so that most inLeivals are empty (by way of non-limitmg example, sent biphoton probability per interval has ;; equal to about 0.1). For each time bin t, Alice encodes two random polarization bits p(t) with polarization selector 750, one random delay bit d(t) with photon delay 55. and a random one bit basis choice b(t) with basis selector 760. (Note that the use of a single time delay bit d(t) is purely exemplary. The information encoded on the time delay may comprise any number of bits.) Alice then sends 902 these packets of bits, each encoded in a single biphoton, to Bob through communications channel 790. (In figure 9, the letter "Q" designates a quantum communication, and "C" designates a classical communication. It is contemplated that any information transmitted on classical channels may alternately, or in addition, be transmitted on a quantum channel.) [0087] Bob selects his own random one-bit basis choice b'(t) and takes a measurement of biphoton detection events p'(f ), d t) with detectors 830, 840, 850, 860, 870, 880, S90, and 900. Bob makes these measurements during a coπesponding set of time intervals of width AT, adjusted to account for propagation time and labeled {t} , as above. If Bob happens to choose the same basis b(t) as Alice for a biphoton in some time bin t, then Bob will measure the same data that Alice sent in that packet for polarization and delay, i.e., p(t) = p t) and d(t) = d'(t). The probability that Bob chooses the same basis as Alice for a particular packet is 50%. Likewise, the probability that Bob chooses a different basis from Alice is 50%. When Bob chooses a 1 if different basis, the signal photon and idler photon each have a (1/2) " quantum wave function amplitude to be transmitted and reflected from their respective polarizing beam-splitter. This distribution of amplitudes results in the detection of the biphoton, with equal probability (1/4), in one and only one of the four detection regions that have the correct delay. Regardless of what basis Bob chooses, he will measure the coπect delay d(t) = d'(t), and this is independent of which polarization bits were encoded. On the other hand, if Bob chooses the incoπect basis, his two measured polarization bits p t) will be random, with 25% probability of measuring each of the four possibilities for p'(t).

[0088] The probabilities of what Bob measures when Alice sends a particular biphoton in the embodiment of Figure 8 are given below in Table 3. In Table 3 "B&A" is short for Bob and Alice. "E&A" is short for Eve and Alice. The abbreviations "cor" and "inc" are used in place of correct and incorrect. The pairs (cor, cor), (inc, inc), (cor, inc), and (inc, cor) denote whether the polarizations of the signal and idler photons, respectively, are measured correctly or incorrectly. By associating the symbols 0, 1, 2, and 3, with each of the four possibilities of the two polarization bits p(t), Table 3 also illustrates the particular case of what happens when Alice sends a biphoton with a polarization that conesponds to 0. The fractional numbers represent the probabilities of occuπence for the situation coπesponding to the row and column in which the fraction occurs. That is, when Bob measures something in a particular time bin, Table 3 represents the probabilities of the various outcomes. Thus, the sum of the probabilities (for each of the "with eavesdropper" and "without eavesdropper" portions of Table 3) is one. For example, the probability that Bob and Alice disagree on their basis, Bob coπectly measures the signal photon polarization p(t) and incoπectly measures the idler photon^' polarization p(f) in the absence of an eavesdropper is 1/8. Note that, regardless of Bob's choice of basis, he will coπectly detect the delay byte, d'(t) = d(t). Thus, Table 3 does not depict the results of measuring the delay byte.

Table 3. Probabilities for what Bob receives when Alice sends p(t)=Q [0089] The first part of Table 3 represents the probabilities of detection events in the presence of an eavesdropper, Eve. If Eve is an opaque eavesdropper, i.e., she retransmits any signal that she measures as p' t) with her random basis choice b"(t), then the data received by Bob is affected as represented in the first part of Table 3. Such an opaque eavesdropper performs what is known as a measure-and-resend attack.

[0090] Bob has an overall detection probability per time bin of ψf . Note that there may be many time intervals in the set {/} for which Alice did not transmit a biphoton. The subset of [t] consisting of the packets for which Bob has a measurement is designated as {te} . [0091] With the sacrifice of privacy of one of the polarization bits, it is possible to test the security of the remaining two bits (the other polarization bit and the delay bit) with any, or a combination, of the following three exemplary tests. After the quantum data are sent by Alice and received by Bob, Alice publicly transmits 904 a parity bit for each time bin {tβ}, e.g., whether the polarization choices for the signal photon and idler photon are the same or different. [0092] One security test for the embodiment of Fig. 8 has Bob using the parity bit to determine whether to expect valid data in

or 1, or in p(tβ)-2 or 3 where 0, 1, 2, and 3 are the four possible combinations of the two polarization bits. Without Eve's presence, only about '4 of the data received by Bob should be invalid, i.e., have a parity different from what Alice transmitted. If Eve is an opaque eavesdropper, 3/8 of the data will be invalid (this 3/8ths coπesponds to the 3^rd, 4^th, and 5^th columns of the last two rows in Table 3, each of which contains a 1/16 probability). A beam-splitter attack by Eve (also known as a partially opaque or partially transparent attack) gives a probability of invalid data in subset {t_B} of (2+//")/8, where ?/" is Eve's intercept-to-resend ratio. Such a beam-splitter attack is performed by Eve by placing a beam-splitter in the quantum transmission channel between the receiver and sender in order to read the information. By statistically analyzing Bob's invalid detections, a measure-and-resend or beam-splitter attack may be detected.

[0093] A second security test for the embodiment of Fig. 8 is described presently. Bob reports back to Alice via a public channel the subset {t_/} of {ts} that gave invalid detected events. That is, Bob reports 908 the addresses of incoπect polarization parity data. Alice then transmits 912 publicly to Bob the set of her basis choices (b(t_/)}, which Bob can compare with his basis choices (b'(t_/)}. In the absence of Eve, all of the basis choices in (b(t_/)} should disagree with those in (b'(t_/)}. Thus, this test almost completely thwarts detect and resend (opaque eavesdropper) attacks. With Eve partially intercepting and retransmitting data, b(t_/) = b'(tz) events should arise with an approximate probability of 77' 73. Accordingly, an arbitrarily small intercept rate rf can be detected, limited only by random dark counts or noise in Bob's detector. At this point in the process, the security of the quantum data is highly assured and no information about the ultimate data set (the non-public bit of pit) - p'(t), and d(t) = d'(t) for a particular choice of t) has been publicly revealed, including the set of time bins {t_v} in which valid data were received. In addition, multiple accidental biphotons in one time bin do not give a false eavesdropper indication.

[0094] A third security test for the embodiment of Fig. 8 is discussed presently. This test is especially useful to foil a beam-splitter attack. By performing this test, Alice and Bob will have common knowledge of the subset of {tβ} in which they share a common basis. Bob publicly transmits 914 a set {tv;} of thirty addresses randomly-chosen from {tv} (the addresses of valid parity bits in their corresponding biphotons) to Alice. The corresponding basis and data bits (b(tyι) = b'(tvi), p(tvύ =

are secure as assured by the above tests. About two-thirds of {tvi } (about twenty) will have agreeing basis choices b(t_vf)= b'(tw)- Denote this set by {t_Fj}. Alice and Bob share much more information about b(tγi) and b'(tw) than Eve has. These bases are either linear or circular with equal probability. Alice and Bob can find the subset { tp } of time bins with agreeing bases while revealing little about the basis choices that they made as follows.

[0095] Alice divides {t_vl} into the two subsets _VIAL} , {tviAc} coπesponding to her basis choices, linear or circular, respectively. Bob also divides {tvi} into the two subsets {tvi_BL}, {tvi_Bc} conesponding to his basis choices, linear or circular, respectively. Alice and Bob then each publicly reveal 916 the addresses of one of their respective sets ({t_vlXL} or {tvixc}), chosen at random, without revealing which set it is, where the subscript "x" is to be read as "A" or "B," conesponding to Alice's set or Bob's set. The ratio of agreeing basis choices will be about 2/3. This is because each of these sets is a subset of {ty}, the time bins that have valid parity bits. (The time bins {ty} comprise about % of the total set {t_#} of events detected by Bob. One-third of any subset of {ty} will correspond with valid parity bits but incoπect basis. The other two- thirds of any such subset of {ty} will coπespond to accurately measured parity bits, i.e., parity bits measured using the correct basis.) Thus, both Alice and Bob can determine which subset, {tvixd or {tγiχc}_> was revealed by the other using statistical analysis. Bob can also determine Alice's basis choices b(tyι) for all thirty members of {ty_/} by process of elimination. Both Alice and Bob thereby determine {? ; } ■

[0096] To check for transmission errors or dark noise, Bob and Alice publicly agree 918 on the number of bins in {ty_/ } in which their bases agree (which will be about twenty) If they agiee, Alice and Bob can be confident that they have the same data subset, that is, know that their bases agree on those about twenty bits in [tπ }

[0097] The parties can use secret data from {ty;} to select the time bins of the next thirty addresses {ty }. This leads to a bootstrap address selection technique. For example, Bob can use the thirty basis bits from {ty_/} to select the addresses of a next set of thirty randomly-chosen time bins {t\ }- Alternately, or in addition, Bob can use a number (e.g., log{t}) of the polarization bits from {ty_/ } to select the addresses {t ₂} To accomplish this, Bob randomly selects thirty addresses from {ty}. Bob then performs an XOR operation on each chosen address with the secret data taken from {ty_/ }. Bob publicly transmits 922 the results of the thirty XOR operations to Alice, preferably in the same sequential order in which he selected them. Alice can decode the addresses selected by Bob because she shares the secret data from {ty_/}. Eve, acting as a passive receiver of accidental multiple biphotons, can generally (e.g., if η <0.1) receive at most one or two of the thirty basis bits, and cannot even determine either the basis choices for these bits or which of the thirty addresses they represent. Thus, Eve has virtually no idea what bins are referred to when the data in {ty₂} are determined. [0098] The bootstrap process of encoding the addresses of the next group of thirty time bins {tw} for N=3, 4, ... proceeds 924 as described above until all of {ty} has been determined. In general, the parties may use secret data from a given {ty_/v} to select the addresses of the next vw₊₇)}- The final set {tp} is the union of each {tp,} for i=l, 2, ... . Eve knows at most {ty_/}, so these are discarded. Additionally, the parties share two enumerations of {t_/?}: the natural, sequential enumeration, and the enumeration defined by Bob's random address selection. Thus, in this latter enumeration (which may be denoted {fr-}), the order is randomized. Note that the numbers thirty and twenty are exemplary only; other numbers may be used. In particular, the sizes of each {ty/v} may be any number.

[0099] In summary, if the number of bins in the entire time sequence {t} is on the order of 2³⁰ (about 10⁹), then the number of bins in {fø}, the set received by Bob, will be about 10⁷, the number of bins of totally usable data {tp } (i.e., the bins in which both Alice an Bob agree on the bases) will be about 5x10 , and Eve will have about six bits of data if she launches a measure- and-resend attack and less than one bit knowledge of which bin coiresponds to which intercepted data bit for eithei eavesdropping attack, measuie-and-resend or beam-splitter. [0100] The parties may perform error collection on the sets [t/ } and {tp }. In particular, parity checks on the data in {t_/r-} can find and coπect enors in {tp}. To accomplish this, parity information may be sent in the ordering of {tp-} so as to conect enors. Hashing and a divide- and-conquer technique may then be used to detect and conect enors in {tp-}. The secure enumeration {t_f} minimizes the number of bits that must be dropped to make the parity checks secure. Because most errors may be caught when forming the secure enumeration and because the addresses themselves are highly secure, little secret data must be sacrificed to correct any remaining errors.

[0101] Encoding the time bin sets {ty_/v} helps to foil a potential beam-splitter attack. If

Eve does not retransmit any of the data that she intercepts with efficiency 77", then she can read off those rare events in which two (or more) biphotons were transmitted in the same time bin, which occurs with a probability of about η². Since the usable data bit transfer rate is

η is preferably made as large as possible consistent with foiling a beam-splitter attack. For example, if /; = 0.1,

of Bob's received data is also detected by Eve along with 999 times as much data not seen by Bob. Thus, on average about 1077?7"/4-=0.025 bits of the 10 bits in p t_v) = p(t_v) are available to Eve. As the amount of data transmitted increases, less information is available to Eve in this strategy. Eve is not aware of which ty was employed in a publicly reported b(tγ) = b'(ty), much less for the resultant p'(ty) = p(tv) and d(t ) = d tv).

[0102] Any, or a combination of, the data d(t_v) = d'(ty) and the non-publicly disclosed polarization portion of /?'(t_/?) = pfø) may be used to form the secure quantum key. All of {t_B}, and {b(ts)}, and {b'(ts)} are now known to both Bob and Alice, but not to Eve. All of the subset {tp} of {?_B} that has b'(t) = b(t) (about half) will also be known to Alice and Bob. If no eavesdropper has intruded, then 2/3 of the basis choices should agree, while giving a valid biphoton transfer probability per time bin of ηη'/2.

[0103] The protocol described above in reference to Figs. 8 and 9 is capable of distributing a quantum key that is secure against both beam-splitter and detect/resend attacks with high data rates. Data rate increases arise from both including delay bits and increasing the time bin occupancy η. These capabilities stem from the extra information that can be included on a biphoton and the ability to measure this information by an exclusive two-photon transition that detects and destroys the pair together or not at all.

[0104] A modification of the third security test of the protocol discussed above in reference to Figs. 8 and 9 is disclosed presently. Instead of Alice partitioning {ty;} into {t _/Ar and {tγiAc} conesponding to her basis choices, and Bob dividing {tvi} into {tyiβri and {tyiBc} corresponding to his basis choices, the parties construct and share different partitions. As discussed above in reference to Fig. 1, it is possible to identify each basis choice with a bit value. Such bit values may be operated on by logical operators. In particular, the bit value for a given basis choice may be combined (using, e.g., XOR) with a secret bit to produce a masked basis bit value. Such a secret bit may be encoded on the same entangled photons to which the basis bit it masks is associated. Alternately, the secret bit may come from a different set of entangled photons. Thus, each of Alice and Bob may share a scheme for selecting a sequence of secret bits used to produce masked basis bits. Preferably, the shared scheme for selecting secret bits chooses secret bits primarily from entangled photons other than the entangled photons encoded in the basis to be masked. Once all of the basis bits are masked using secret bits from the transmitted entangled photons, Alice and Bob partition {ty/} based on the masked basis bits. Alice may partition {ty_/} into {tV_/A/ corresponding to the addresses whose masked bit value is "0", and {t'γ _Ac} conesponding to the addresses whose masked bit value is "1". Similarly, Bob may partition {ty/} into {t'y/Bi.} coπesponding to the addresses whose masked bit value is "0", and {t'vi_Bc} conesponding to the addresses whose masked bit value is "1". Because Alice and Bob share the scheme by which they select the masking bits, Alice can determine which subset, {t'viBL} or {t'viBc}, was revealed by Bob, and Bob can determine which subset, {t'yiAi,} or {t'viAc}, was revealed by Alice. Alice and Bob are both able to recover _VIAL}, {tviAc}, { B } _> and {tγi_Bc}- As with the first version of the third security test above, Bob can also determine Alice's basis choices b(tyι) for all thirty members of {tyj } by process of elimination. Both Alice and Bob thereby determine {tpi}. As in the first version of the third security test, this process is extended to {ty_/ } for N=3, 4, ... by a bootstrap technique. The present modified third security test has the benefit of withholding virtually all basis choice information from Eve. [0105] Embodiments of the present invention in which a pluiahty of bits aie encoded into a single entangled photon set have certain benefits. In these embodiments, each entangled photon set encodes at least one bit that may be used as shared secret information, and at least one extra bit that may be used for other purposes. Such extra bits may be used for, by way of non- limiting example, information selection (e.g., address selection), information masking (e.g., address masking), enor detection, enor conection, and/or privacy amplification. The protocols discussed above in lefeience to Figs. 8 and 9 and modifications thereof use extra bits foi exemplary such purposes. For example, according to the embodiments of Figs. 8 and 9, the basis choices are never explicitly revealed in public. In the modified third security test, the basis choices are masked by bits encoded on biphotons, without using all of the bits on such biphotons for masking purposes. As a further example, the addresses in which Bob received data are not explicitly publicly revealed. Because Bob receives data only in about one in one thousand time bins, it is advantageous over Eve to keep secret the addresses of time bins in which Bob detects data. The bootstrap address selection techniques discussed herein mask these addresses using bits present in biphotons, again without using all of the bits on any one biphoton for such masking purposes. As yet another example, techniques discussed herein allow for the reuse of publicly-revealed parity bits, if desired, because the addresses of the biphotons on which these parity bits are present are masked. Thus, the plurality of bits encoded on each biphoton may be used for both enor conection and other uses; the parity bits need not be sacrificed. [0106] In some embodiments of the present invention, the signal and idler photons are polarized at right angles with respect to each-other in the communication channel. In other embodiments, the relative orientation of the signal and idler photons in the communications channel may be parallel or may vary biphoton-to-biphoton. It is also contemplated that a single stream of photons, including both the signal photons and the idler photons, may be used in the communications channel. In such embodiments, the signal and idler photons may be interleaved in a regular or Irregular fashion.

[0107] Embodiments of the present invention that employ two (or more) basis choices may use various different bases. By way of non-limiting example, embodiments that employ either circular or linear basis choices may instead use two different forms of linear basis choice. Two exemplary, non-limiting linear basis choices include the following. A first linear basis choice for polarization may include as two of its states: photons polarized at 0° and photons polarized at 90°. Such polarization states may be represented as " | " and "— ", with the basis represented as "-{-". A second linear basis choice for polarization may include as two of its states: photons polarized at 45° and photons polarized at 135°. Such polarization states may be represented as "/" and "\", with the basis represented as "x". Any combination of two or more bases chosen from the two exemplary linear basis choices and a circular polarization basis may be used in various embodiments of the present invention. For any two given bases, each basis may be identified with a particular bit value to produce a basis bit.

[0108] In some embodiments of the present invention, the random bits required at various stages by both the sender and the receiver may be generated by a pseudorandom number generator, such as modular exponentiation, or may be truly random, such as bits generated from a radioactive source, weather patterns, radio-frequency noise, or other sources. As used herein, the term "random number generator" includes both truly random and pseudorandom number sources. Among the various stages, different or identical random number generators may be used.

[0109] Various embodiments of the present invention typically employ standard computer hardware; firmware, or software for various functions. Such functions include/by way of non-limiting example: controlling photon delays (e.g., 55), controlling basis selectors (e.g., 65), controlling polarization selectors (e.g., 60), receiving and processing data from random number generators and conveying random information to various components, calculating numerical indications of eavesdropping (e.g., as described in the first, second and third security tests referred to above in reference to Figure 8), performing statistical analysis of eavesdropping numerical indications, receiving and processing detection information (e.g., from detectors 115 and 110), and outputting key information. Standard computer software programming techniques may be used in combination with hardware and/or firmware.

[0110] As used herein, the term "public channel" refers to any communications channel whose secrecy for the particular data in question is not essential. Such a public channel may include portions of quantum channel(s) and/or classical channel(s). The term "private channel" refers to any communications channel whose secrecy for the particular data in question is desirable. Such a private channel is typically a quantum channel in embodiments of the present invention. tOlll] Embodiments of the present invention may employ various configurations of senders and receivers. Typically, each entity in a given communications system includes both a sender and a receiver as described herein. Known techniques for sending and receiving light energy may be used. Such techniques include, but are not limited to, the use of collimating optics and telescopes. Transmission from one terrestrial point to another terrestrial point, from one terrestrial point to a vehicle, from a vehicle to a tenestrial point, or between vehicles is contemplated. In addition, transmission between a tenestrial point or vehicle and a satellite in Earth's orbit is also contemplated.

[0112] In embodiments of the present invention, the designation of information states corresponding to binary bits zero (0) or one (1) is arbitrary. That is, in any embodiment as described herein, the bit value of zero (0) may be interchanged with the bit value of one (1) as long as such interchange is done consistently.

[0113] Many quantities described herein are probabilistic. Thus, such quantities must be viewed as being typical, yet subject to variation. Such quantities include actual' measured indicia of eavesdropping. Further, most of the observations and measurements discussed herein are subject to noise of various forms from various sources. Probabilistic quantities are typically subjected to statistical analysis, known in the art, to ascertain their reliability and assist in drawing conclusions.

[0114] As used herein, the term "encode" means to manifest information in some physical entity in some way, with a non-zero probability of retrieval. Such physical entities include electromagnetic radiation, electrical signals, and storage media. The term "modulate" may be used to describe encoding information into biphotons as discussed herein. [0115] Entangled photons may be produced according to a variety of methods. By way of non-limiting example, entangled photons may be produced according to types I or II parametric down-conversion. Fuitheimore, any nonlinear ciystal, not limited to BBO, may be used. Other ways to produce entangled photons include- excited gasses, matenals without inversion symmetry, and generally any properly phase-matched medium. Furthermore, the entangled photons are not limited to any particular wavelength or frequency. Biphotons whose constituent signal and idler photons are orthogonally polarized may be used as well as biphotons whose constituent signal and idler photons are polarized in parallel,

[0116] In some embodiments of the present invention, various indicia of entangled- photon absorption may be used to detect entangled photons. By way of non-limitmg example, entangled-photon absorption may result in fluorescence, phosphorescence, direct electron transfer, or ionization of the absorbing material. Detecting fluorescence, phosphorescence, direct electron transfer, or ionization may be used to detect entangled-photon absorption. Also by way of non-limiting example, avalanche photodiodes, photo multiplier tubes (PMT), or other devices may be used to detect the fluorophotons, ionization, direct electron transfer, or other absorption indicia. [0117] In addition to the techniques disclosed herein, steganography may also be employed. By way of non-limiting example, quantum steganography may be combined with embodiments of the present invention. See U.S. Patent Application Serial No. 10/849,789, filed May 21, 2004, entitled "Quantum Steganography" to Conti et al In addition, or in the alternative, non-quantum steganography may be combined with the present invention. By way of non-limiting example, the frequency of the laser that produces entangled photons may be modulated with information, which may be decoy information.

[0118] Embodiments of the present invention may include information in entangled photons by modulating the frequency of the laser that produces the entangled photons. The sum frequency of each biphoton is thereby encoded with information. In such embodiments, the receiver is modified to allow for detecting various sum frequencies, which may be accomplished, by way of non-limiting example, using a magnetic field gradient along a BSM. Such embodiments allow for serial information detection, in that a BSM region configured to absorb a particular sum frequency will allow entangled photons not of that sum frequency to pass. Information encoded in sum fiequencies may take the place of, or supplement, the information encoded in inter-biphoton delay.

[0119] For the embodiments described herein, portions of one embodiment may be substituted, replaced, or inserted into other embodiments. That is, the teachings disclosed herein should be viewed collectively, with each embodiment capable of employing technologies drawn from other embodiments.

[0120] In embodiments of the present invention disclosed herein, the signal photon may be switched with the idler photon and vice- versa without affecting the overall operation. That is, the embodiments are not completely dependent on which photon is labeled "signal" and which is labeled "idler."

[0121] In some embodiments of the present invention, multiply-entangled photons may be used. Multiply-entangled photons are three or more photons entangled together. By way of non-limiting example, entangled photon triples (three photons entangled together) or quadruples (four photons entangled together) may be used. Multiply-entangled photons consisting of greater than four photons may also be used. Those of ordinary skill in the art will appreciate that the techniques disclosed herein may be used to encode information in multiply-entangled photons. The term "entangled photons" refers to both multiply-entangled photons and to entangled photon pairs.

[0122] In some embodiments of the present invention, standard electronic coincidence counters may be used in place of detectors that incorporate a BSM, e.g., where transparency of detectors is not required. Such electronic coincidence counters use a pair of single-photon detectors and logic to coπelate arrival time and thus detect potential biphotons. By way of non- limiting example, in the embodiment of Fig. 7, a substitution of standard electronic coincidence counters may be made for detectors 630 and 640. In that embodiment, electronic coincidence counters may be substituted for detectors 570 and 580, with a loss of detectible information. Electronic coincidence counters may also be used to detect delays. Thus, for example, electronic coincidence counters may be substituted for detectors 110 and 115 in the embodiment of Fig. 1. Certain losses of information may require modification of the associated protocol when substituting electronic coincidence counters for detectors that employ a BSM. [0123] The particular optical manipulation devices depicted herein are illustrative and representative and are not meant to be limiting. By way of non-limiting example, prisms, apertures, filters, optical fiber, lenses, and particular lasers disclosed herein may be replaced with devices known to those of ordinary skill in the art.

[0124] Embodiments of the present invention may employ optics other than polarizing beam splitters to separate signal photons from idler photons. By way of non-limiting example, the downconverted beam containing signal photons and idler photons may be directed to a pair of apertures, which select beams that respectively include signal photons and idler photons. Such apertures may be formed according to techniques taught in Boeuf et al, Calculating Characteristics of Non-collinear Phase-matching in Uniaxial and Biaxial Crystals (draft 8/27/99), available from the National Bureau of Standards. By way of non-limiting example, apertures at ±3° from the laser polarization direction may be used. Interference filters may further distill signal photons and idler photos from the light that passes through the apertures. [0125] While the invention has been shown and described with reference to a particular embodiment thereof, it will be understood to those skilled in the art, that various changes in form and details may be made therein without departing from the spirit and scope of the invention.

Claims

WHAT IS CLAIMED IS:

1. A system for distribution of private information, the system comprising: a sending unit configured to encode at least one bit onto at least two photons, the at least two photons comprising a first photon and a second photon, the at least two photons being entangled together, the at least one bit being encoded in at least one of: a polarization of at least one of the first photon and the second photon, and a time delay between a propagation of the first photon and the second photon; and a receiving unit configured to detect the at least one bit on the at least two photons transmitted from the sending unit.

2. The system of claim 1 wherein the receiving unit is configured to detect the at least one bit in the presence of ambient light.

3. The system of claim 1 , wherein the at least one bit is cryptographic key information.

4. The system of claim 1, wherein the at least one bit is encoded in a time delay between a propagation of the first photon arid the second photon.

5. The system of claim 1 , wherein the sending unit is configured to impart a basis polarization to the first photon and the second photon.

6. The system of claim 1, wherein the sending unit is configured to impart a bit polarization to the first photon and the second photon.

7. The system of claim 1, wherein the sending unit is configured to impart a time delay through lengthening a propagation distance of a photon.

^■ 42 -

8. The system of claim 1, wherein the receiving unit further comprises at least one coincidence detector.

9. ^■ The system of claim 6, wherein the coincidence detector comprises a biphoton sensitive material.

10. The system of claim 6, wherein the coincidence detector comprises an electronic coincidence counter.

11. A transmission unit for communicating private information, comprising: a generator for creating a plurality of entangled photon sets; time delay optics that introduces, for each entangled photon set, a relative time delay between a first photon and a second photon comprising the entangled photon set; and a basis polarizer that selects a polarization basis for the entangled photon set.

12. The transmission unit of claim 1 1 , wherein the basis polarizer randomly imparts one of a linear polarization and a circular polarization on the entangled photon set.

13. An entangled photon set configured to store information for transmission over a communications channel comprising: a first photon; a second photon, the first photon being entangled with the second photon; and at least one of a time delay between the first photon and the second photon, the time delay representing at least one bit of information, and a pair of polarizations, each of the pair of polarizations manifested on one of the first photon and the second photon, the pair of polarizations representing at least one bit of information; wherein the first photon and the second photon are used for an operation selected from the group consisting of: cryptographic key distribution, encryption, decryption, and authentication.

43

14. A method for communicating secret information, comprising: generating a plurality of entangled photons; introducing a time delay between the propagation of two photons, wherein the time delay represents at least one bit of information; transmitting the plurality of entangled photons; detecting the time delay on received entangled photons; and forming cryptographic information from the at least one bit of information.

15. The method of claim 14, further comprising the step of imparting a separate basis polarization to each photon comprising the entangled photons.

16. A method of communicating private information, comprising: transmitting a first message over a private channel comprised of a plurality of sets of photons entangled together; transmitting a second message over a public channel relating to a basis of each of a subset of the sets of photons entangled together received by a receiver; and transmitting a third message over the public channel relating to a matching basis for a subset of the sets of photons entangled together, wherein the private channel includes the presence of ambient light.

17. A system for quantum key distribution, comprising: a sending unit configured to impart at least one bit onto an entangled photon set and a basis on the entangled photon set; and a receiving unit configured to receive the entangled photon set and detect the at least one bit transmitted from the sending unit, the receiving unit selecting a basis with which to detect the received entangled photon set; wherein the receiving unit is capable of detecting the at least one bit in the presence of random photons.

44

18. A system for providing parties with common secret information, the system comprising: means for producing entangled photons; means for encoding information in at least a portion of the entangled photons; means for sending encoded entangled photons; means for receiving encoded entangled photons; means for detecting at least a portion of information encoded in received entangled photons; means for testing security of at least a portion of information encoded in received entangled photons; and means for forming a common set of secret information derived at least in part from at least a portion of information encoded in entangled photons.

19. The system of claim 18, further compπsing means for performing at least one function selected from the group consisting of: detecting eavesdropping, detecting eirors, amplifying privacy, and masking information

20. A system for establishing shared secret information, the system comprising: a source of entangled photon sets, each entangled photon set comprising a first photon and a second photon, the first photon being entangled with the second photon; optics configured to encode each of a plurality of entangled photon sets with a plurality of bits to produce a first quantity of entangled photon sets; optics configured to transmit at least some of the first quantity of entangled photon sets to a receiver; a processor configured to calculate evidence of interference based at least in part on bits detected by the receiver on a second quantity of entangled photon sets; and a processor configured to establish shared secret information derived at least in part from bits encoded on the second quantity of entangled photon sets.

^• 45

21. The system of claim 20, wherein the shared secret information is used for an operation selected from the group consisting of: encryption, decryption, key distribution, and authentication.

22. The system of claim 20, wherein the plurality of bits comprise at least three bits.

23. The system of claim 20, wherein the plurality of bits comprise at least four bits.

24. The system of claim 20, wherein the plurality of bits comprise at least five bits.

25. A method of establishing shared secret information, the method comprising: producing entangled photon sets, each entangled photon set comprising a first photon and a second photon, the first photon being entangled with the second photon; encoding each of a plurality of entangled photon sets with a plurality of bits to produce a first quantity of entangled photon sets; transmitting at least some of the first quantity of entangled photon sets to a receiver; calculating evidence of interference based at least in part on bits detected by the receiver on a second quantity of entangled photon sets; and •^' establishing shared secret information derived at least in part from bits encoded on the second quantity of entangled photon sets.

26. The method of claim 25, wherein the shared secret information is used for an operation selected from the group consisting of: encryption, decryption, key distribution, and authentication.

27. The method of claim 25, wherein the step of encoding comprises encoding each of the plurality of entangled photon sets with at least three bits.

46

28. The method of claim 25, wherein the step of encoding comprises encoding each of the plurality of entangled photon sets with at least five bits.

29. A method of sharing secret information, the method comprising: encoding each of a plurality of biphotons, each biphoton comprising a first photon and a second photon, with a plurality of bits, to produce an encoded plurality of biphotons; transmitting, from a transmitter, the encoded plurality of biphotons to a receiver; transmitting, from the transmitter, polarization information to the receiver; transmitting, from the receiver, information relating to at least one polarization measurement; transmitting, from the transmitter, first basis information; transmitting, from the receiver, first address information related to a first quantity of addresses; transmitting second basis information relating to the first address information; and transmitting, from the receiver, second address information related to a second quantity of addresses; and tiansmitting third basis information relating to the second quantity of. addresses.

30. A method of quantum key distribution, the method comprising: generating a plurality .of entangled, photon sets; selecting a basis for a quantity of the entangled photon sets to produce a quantity of encoded entangled photon sets; transmitting the quantity of encoded entangled photon sets to a receiver; measuring, at the receiver, a quantity of received entangled photon sets, each entangled photon set being measured using a selected basis; transmitting first basis partition information to the receiver; receiving second basis partition information from the receiver; and computing common basis choice information using at least a portion of the first basis partition information and at least a portion of the second basis partition information.

- 47

31. A system for establishing shared secret information, the system comprising: a source of entangled photon sets, each entangled photon set comprising a first photon and a second photon, the first photon being entangled with the second photon; optics configured to encode each of a plurality of entangled photon sets with a plurality of bits to produce a first quantity of entangled photon sets; optics configured to transmit at least some of the first quantity of entangled photon sets to a receiver; a processor configured to determine addresses of a third quantity of entangled photon sets based at least in part on infoπnation retrieved from a second quantity of entangled photon sets; and a processor configured to establish shared secret information derived at least in part from bits encoded on the third quantity of entangled photon sets.

32. The system of claim 31, wheiein the shared secret information is used for an operation selected from the group consisting of. encryption, decryption, key distribution, and authentication.

33. The system of claim 31, wherein the plurality of bits comprise at least three bits.

34. The system of claim 31 , wherein the plurality of bits comprise at least four bits.

35. The system of claim 31, wherein the plurality of bits comprise at least five bits.

36. A method of establishing shared secret information, the method comprising: producing entangled photon sets, each entangled photon set comprising a first photon and a second photon, the first photon being entangled with the second photon; encoding each of a plurality of entangled photon sets with a plurality of bits to produce a first quantity of entangled photon sets;

48 transmitting at least some of the first quantity of entangled photon sets to a receiver; determining addresses of a third quantity of entangled photon sets based at least in part on information retrieved from a second quantity of entangled photon sets; and establishing shared secret information derived at least in part from bits encoded on the third quantity of entangled photon sets.

37. The method of claim 36, wherein the shared secret information is used for an operation selected from the group consisting of: encryption, decryption, key distribution, and authentication.

38. The method of claim 36, wherein the step of encoding comprises encoding each of the plurality of entangled photon sets with at least three bits.

39. The method of claim 36, wherein the step of encoding comprises encoding each of the plurality of entangled photon sets with at least live bits.

40. ,A system for establishing shared secret information, the system comprising: a source of entangled photon sets, each entangled photon set comprising a first photon and a second photon, the first photon being entangled with the second photon; optics configured to encode each of a plurality of entangled photon sets with a plurality of bits to produce a fust quantity of entangled photon sets; optics configured to transmit at least some of the first quantity of entangled photon sets to a receiver; a processor configured to use bits, detected by the receiver on a second quantity of entangled photon sets, for processing- selected from the group consisting of: detecting eavesdropping, detecting enors, amplifying privacy, and masking information; and a processor configured to establish shared secret information derived at least in part from bits encoded on the third quantity of entangled photon sets.

49 -

41. The system of claim 40, wherein the shared secret information is used for an operation selected from the group consisting of: encryption, decryption, key distribution, and authentication.

42. The system of claim 40, wherein the plurality of bits comprise at least three bits.

43. The system of claim 40, wherein the plurality of bits comprise at least four bits.

44. The system of claim 40, wherein the plurality of bits comprise at least five bits.

45. The system of claim 40, wherein masking information comprises masking addresses.

46. A method of establishing shared secret information, the method comprising: producing entangled photon sets, each entangled photon set comprising a first photon and a second photon, the first photon being entangled with the second photon; encoding each of a plurality of entangled photon sets with a plurality of bits to produce a first quantity of entangled photon sets; transmitting at least some of the first quantity of entangled photon sets to a receiver; using bits detected by the receiver on a second quantity of entangled photon sets for processing, wherein the processing is selected from the group consisting of: detecting eavesdropping, detecting errors, amplifying privacy, and masking information; and establishing shared secret information derived at least in part from bits encoded on the second quantity of entangled photon sets.

47. The method of claim 46, wherein the shared secret information is used for an operation selected from the group consisting of: encryption, decryption, key distribution, and authentication.

50 -

48. The method of claim 46, wherein the step of encoding comprises encoding each of the plurality of entangled photon sets with at least three bits.

49. the method of claim 46, wherein the step of encoding comprises encoding each of the plurality of entangled photon sets with at least five bits.

50. The method of claim 46, wherein masking information comprises masking addresses.

51