Provably Secure Experimental Quantum Bit-String Generation

Coin tossing is a cryptographic task in which two parties who do not trust each other aim to generate a common random bit. Using classical communication this is impossible, but nontrivial coin tossing is possible using quantum communication. Here we consider the case when the parties do not want to toss a single coin, but many. This is called bit-string generation. We report the experimental generation of strings of coins which are provably more random than achievable using classical communication. The experiment is based on the “plug and play” scheme developed for quantum cryptography, and therefore well suited for long distance quantum communication.

Figure 1

Optical setup. LD: laser diode; ${\mathrm{C}}_i$ ($i=1$, 2, 3): coupler; Att: attenuator, $\Phi$: phase modulator; FM: Faraday mirror; ${\mathrm{D}}_{\mathrm{c}\mathrm{l}}$: classical detector.

Figure 2

Optical setup equivalent to Bob’s measurement, including its imperfections.

Figure 3

Measured bounds on average bias and on entropy of bit strings for different values of the average photon number ${\alpha }^2$. Open squares: bounds on $\overline{{ϵ}_B}$ obtained using Eq. (3); open circles: bounds on $\overline{{ϵ}_A}$ obtained using Eq. (5); filled squares: bounds on $\overline{{ϵ}_A}+\overline{{ϵ}_B}$. Classically the sum is always greater than $1/2$. The bit strings are clearly more random than is allowed by the best classical protocol. The same expressions which give bounds on $\overline{{ϵ}_A}$, $\overline{{ϵ}_B}$ also give lower bounds on the entropies $H_{A(B)}$ of the bit string if Alice (Bob) is dishonest (see 10). Filled triangles: bounds on the entropy per bit $(H_A+H_B)/n$. It is conjectured in 10 that for any classical protocol $(H_A+H_B)/n$ is bounded by $1$ for large $n$. The experimental points are clearly above this bound. The error bars for $\overline{{ϵ}_A}+\overline{{ϵ}_B}$ and $(H_A+H_B)/n$ describe systematic errors arising from incorrect calibration of detector efficiency $\eta$ and incorrect estimation of ${\alpha }^2$. The plotted curves are theoretical predictions based on the observed optical visibility of 96.5%. For $\overline{{ϵ}_B}$ the curve is given by Eq. (3) and for $\overline{{ϵ}_A}$ it is given by Eq. (5) using the fact that, for small ${\alpha }^2$, $(\kappa -{\kappa }_{\mathrm{d}\mathrm{a}\mathrm{r}\mathrm{k}})/A_{0}T\eta \simeq (1-V){\alpha }^2/2$.