Special issue: Quantum information technology

Progress in Informatics, No. 8, pp.57–63, (2011) 57

Research Paper

Passive preparation of BB84 signal states withcoherent light

Marcos CURTY1, Xiongfeng MA2, Hoi-Kwong LO3, and Norbert LUTKENHAUS4

1ETSI Telecomunicacion, University of Vigo, Spain2,4Institute for Quantum Computing, University of Waterloo, Canada3Center for Quantum Information and Quantum Control, University of Toronto, Canada

ABSTRACTIn a typical optical implementation of the Bennett-Brassard 1984 (so-called BB84) quantumkey distribution protocol, the sender uses an active source to produce the required signalstates. While active state preparation of BB84 signals is a simple and elegant solution in prin-ciple, in practice passive state preparation might be desirable in some scenarios, for instance,in those experimental setups operating at high transmission rates. Passive devices usuallyinvolve parametric down-conversion. Here we show that coherent light is also suitable forpassive generation of BB84 signal states. Our method does not require any externally-drivenelement, but only linear optical components and photodetectors. The resulting key rate issimilar to the one delivered by an active source.

KEYWORDSQuantum key distribution, quantum communication, quantum-state engineering, passive transmit-ter

1 IntroductionQuantum key distribution (QKD) is the first com-

mercial application of quantum information that of-fers efficient and user-friendly cryptographic systemswith an unprecedented level of security [1], [2]. Itexploits quantum effects to establish a secure secretkey between two distant parties (typically called Aliceand Bob) despite the computational and technologicalpower of an eavesdropper (Eve), who interferes withthe signals in the channel. This secret key is the es-sential ingredient of the one-time-pad or Vernam ci-pher [3], the only known encryption method that canprovide information-theoretic secure communications.

Most experimental realizations of QKD are based onthe so-called BB84 QKD scheme introduced by Ben-nett and Brassard in 1984 [4]. In a typical quantum opti-cal implementation of this protocol, Alice sends to Bobphase-randomized weak coherent pulses (WCP) with

Received October 30, 2010; Revised December 20, 2010; Accepted December27, 2010.1) mcurty@com.uvigo.es, 2) xfma@iqc.ca, 3) hklo@comm.utoronto.ca,4) nlutkenhaus@iqc.ca

usual average photon number of 0.1 or higher. Eachlight pulse may be prepared in a different polarizationstate, which is selected, independently and randomlyfor each signal, between two mutually unbiased bases.On the receiving side, Bob measures each incomingsignal by choosing at random between two polarizationanalyzers, one for each possible basis. Once this quan-tum communication phase is completed, Alice and Bobuse an authenticated public channel to process theirdata and obtain a secure secret key. A full proof of thesecurity of this protocol has been given in Refs. [5], [6].Its performance can be improved further if the originalhardware is slightly modified. For instance, one can usethe so-called decoy-state method [7]–[9], where Alicevaries the mean photon number of each signal state shesends to Bob. This translates into an enhancement ofthe achievable secret key rate, which can now basicallyreach the performance of single photon sources.

The preparation of the BB84 signal states is usu-ally realized by means of an active source. There aretwo main configurations. In the first one, Alice usesfour laser diodes, one for each possible BB84 signal.

DOI: 10.2201/NiiPi.2011.8.7

c©2011 National Institute of Informatics

58 Progress in Informatics, No. 8, pp.57–63, (2011)

These lasers are controlled by a random number gener-ator (RNG) that decides each given time which one ofthe four diodes is triggered. The second configurationuses only one single laser diode in combination with apolarization modulator which is controlled by a RNG.This modulator can rotate the state of polarization ofthe signals produced by the source.

While active state preparation is a simple and ele-gant solution to implement the BB84 protocol in prin-ciple, in practice passive state preparation might bedesirable in some scenarios [10]–[15]; for instance, inthose experimental setups operating at high transmis-sion rates, since no RNG is required in a passive de-vice. For example, Alice can use one or more lightsources to produce different signal states that are sentthrough a linear optics network. Depending on the de-tection pattern observed in some properly situated de-tectors, she can infer which signal states are actuallygenerated. Typical passive schemes involve paramet-ric down-conversion [10], [16]. For instance, Alice andBob can use a beamsplitter (BS) to passively and ran-domly select which bases is used to measure each in-coming pulse. More recently, it has been shown thatphase-randomized weak coherent pulses can be used topassively generate decoy states for QKD [13], [15]. In-tuitively speaking, the authors of Refs. [13], [15] exploitthe random phases of the different incoming pulses topassively generate states with distinct photon numberstatistics. This paper follows a similar spirit; in par-ticular we show that phase-randomized coherent lightis also suitable for passive generation of BB84 signalstates. That is, one does not need a nonlinear opticsnetwork preparing entangled states in order to passivelygenerate BB84 signals, but one can exploit the arbitraryphases of the incoming signals to prepare the desiredstates at random [17]. Our method requires only linearoptical elements and photodetectors. In the asymptoticlimit of an infinite long experiment, it turns out that theresulting key rate of a passive transmitter is similar tothe one delivered by an active source, thus showing thepractical interest of the passive setup.

Passive schemes might also be more robust than ac-tive systems to side-channel attacks hidden in the im-perfections of the optical components. If a polariza-tion modulator is not properly designed, for example,it may distort some of the physical parameters of thepulses emitted by the sender depending on the particu-lar value of the polarization setting selected. This factcould open a security loophole in the active schemes.

2 Passive QKD transmitterThe basic setup is rather simple. It is illustrated in

Fig. 1. Suppose two phase-randomized strong coher-ent pulses prepared, respectively, in +45◦ and −45◦ lin-

Fig. 1 Basic setup of a passive BB84 QKD source withcoherent light.

ear polarization, interfere at a polarizing beamsplitter(PBS). These states can be written as

ρ±45◦ = e−υ2

∞∑n=0

(υ/2)n

n!|n±45◦〉〈n±45◦ |, (1)

where |n±45◦〉 denote Fock states with n photons in ±45◦linear polarization. The mean photon number, υ/2, ofeach signal can be chosen very high; for instance, ≈ 106

photons. This kind of states can be generated, for in-stance, using a laser diode biased with a DC current farbelow threshold and directly modulated with a strongradio frequency current [18]. In Ref. [19], for exam-ple, Jofre et al. reported recently on an optical sourceof up 100 MHz repetition rate, which emits phase-randomized strong coherent pulses with mean photonnumber ≈ 6 · 106 photons centered at 850 nm. More-over, as emphasized by the authors, this source mightbe easily scalable to higher repetition rates.

In this scenario, it turns out that the signals σout atthe output port of the PBS (see Fig. 1) can be expressedas [17]

σout =1

2πe−υ

∞∑n=0

υn

n!

∫θ

|nθ〉〈nθ| dθ, (2)

where the Fock states |nθ〉 are given by

|nθ〉 =[

1√2

(a†+45◦ + eiθa†−45◦

)]n√

n!|vac〉. (3)

The state |vac〉 represents the vacuum state, and a†±45◦are the creation operators for the ±45◦ linear polariza-tions modes.

Now, to prepare the signal states that are sent to Bob,Alice performs a polarization measurement followed bya post-selection step. By assumption, we have that theintensity υ of the signals σout is very high. Therefore,Alice can always employ, for instance, a BS of verysmall transmittance (t � 1) to split these states into

Passive preparation of BB84 signal states with coherent light 59

Fig. 2 Example of a polarization measurement based onthe passive BB84 detection scheme with classical photode-tectors. H stands for horizontal polarization, V for verticalpolarization, L for circular left polarization and R for circu-lar right polarization. The different intensities observed inthe four classical photodetectors determine the value of theangle θ.

two light beams: one very weak suitable for QKD, andone strong. The weak signal is sent to Bob through thequantum channel (see Fig. 1). The strong beam is usedto measure its polarization by means of a polarizationmeasurement which, for simplicity, we assume is per-fect. For each incoming signal, this device provides Al-ice with a precise value for the measured angle θ. Thiscan be achieved, for example, by means of a passiveBB84 detection scheme where the basis choice is per-formed by a 50 : 50 BS, and on each end there is a PBSand two classical photodetectors. Such a detection de-vice is illustrated for completeness in Fig. 2. From thedifferent intensities observed in each of the four classi-cal photodetectors, Alice can determine the value of theangle θ. In this scenario, the conditional states emittedby the source can be described as

ρout,θ = e−μ∞∑

n=0

μn

n!|nθ〉〈nθ|, (4)

where θ denotes the value of the angle obtained byAlice’s polarization measurement, and μ is given byμ = υt.

Note, for instance, that whenever θ = 0, π/2, π, or3π/2, Alice can generate one of the four BB84 polariza-tion states perfectly. In practice, however, Alice doesnot need to restrict herself to only those events whereshe actually prepares a perfect BB84 state, since theprobability associated with these ideal events tends tozero. Instead, she can also accept signals with a polar-ization sufficiently close to the desired ones. This sit-uation is illustrated in Fig. 3, where Alice selects somevalid regions for the angle θ. These regions are markedwith gray color in the figure. They depend on an accep-tance parameter Ω ∈ [0, π/4] that we optimize. Specif-

Fig. 3 Graphical representation of the valid regions for theangle θ. These regions are marked in gray.

ically, whenever the value of θ lies within any of theintervals ψ ± (π/4 − Ω) with ψ ∈ {0, π/2, π,3π/2}, thenAlice considers the pulse emitted by the source as avalid signal. Otherwise, the pulse is discarded after-wards during the post-processing phase of the protocol,and it does not contribute to the key rate. The probabil-ity that a pulse is accepted, pacc, is given by

pacc = 1 − 4Ωπ. (5)

To increase this probability, one can reduce the valueof Ω. Note, however, that this action also results in anincrease of the quantum bit error rate (QBER) of theprotocol, that we shall denote as E. On the other hand,when Ω increases, we have that both pacc and E de-crease. There is a trade-off on the acceptance parame-ter Ω. A high acceptance probability pacc favors Ω ≈ 0,whereas a low QBER favors Ω ≈ π/4. In the limitwhere Ω tends to π/4 we recover the standard BB84protocol.

3 Lower bound on the secret key rateWe use the security analysis provided by Gottesman-

Lo-Lutkenhaus-Preskill in Ref. [6]. It considers thatEve can always obtain full information about the partof the key generated from the multiphoton signals. Thispessimistic assumption is also true for the passive trans-mitter illustrated in Fig. 1 when Alice and Bob useonly unidirectional classical communication during thepublic-discussion phase of the protocol. This resultarises from the fact that all the photons contained ina pulse are prepared in the same polarization state and,therefore, no secret key can be distilled with one-waypost-processing techniques [20]. Note, however, thatsuch security analysis could still leave room for im-provement when Alice and Bob employ two-way clas-sical communication. In this situation, it might be pos-sible to obtain secret key even from the multiphotonpulses since the signal states prepared by the passive

60 Progress in Informatics, No. 8, pp.57–63, (2011)

device are already mixed at the source. This last sce-nario, however, is beyond the scope of this paper.

We further assume the typical initial post-processingstep in the BB84 protocol, where double click eventsare not discarded by Bob, but they are randomly as-signed to single click events [21], [22]. The secret keyrate formula can be written as [6]

R ≥ qpacc

{(Q − pmulti)

[1 − H(E1)

]− Q f (E)H(E)

}. (6)

The parameter q is the efficiency of the protocol (q =1/2 for the standard BB84 protocol, and q ≈ 1 for itsefficient version [23]); Q is the gain, i.e., the probabilitythat Bob obtains a click in his measurement apparatuswhen Alice sends him a signal state; f (E) is the effi-ciency of the error correction protocol as a function ofthe error rate E, typically f (E) ≥ 1 with Shannon limitf (E) = 1; H(x) is the binary Shannon entropy functiondefined as

H(x) = −x log2 (x) − (1 − x) log2 (1 − x); (7)

pmulti is the multiphoton probability of the source, i.e.,

pmulti = 1 − e−μ(1 + μ); (8)

and E1 denotes an upper bound on the single photonerror rate. In the case of the standard BB84 protocolwithout decoy-states, this last quantity is given by

E1 =E

1 − pmulti

Q

. (9)

3.1 EvaluationFor simplicity, we shall consider that Bob employs

an active BB84 detection setup. Moreover, we assumea simple model of a quantum channel in the absence ofeavesdropping; it just consists of a BS of transmittanceηchannel. This model allows us to calculate the observedexperimental parameters Q and E. These quantities aregiven in an Appendix. Our results, however, can also bestraightforwardly applied to any other quantum chan-nel or to the case where Bob uses a detection apparatuswith passive basis choice, as they depend only on theobserved gain and QBER.

The resulting lower bound on the secret key rate isillustrated in Fig. 4 (dashed line). In our simulationwe employ the following experimental parameters: thedark count rate of Bob’s detectors is εB = 1 × 10−6,the overall transmittance of his detection apparatus isηB = 0.1, and the loss coefficient of the quantum chan-nel is α = 0.2 dB/km. We further assume that q = 1/2,and f (E) = 1.22. With this configuration, it turns outthat the optimal value of the mean photon number μ

Fig. 4 Lower bound on the secret key rate R given byEq. (6) in logarithmic scale for the passive source illustratedin Fig. 1 (dashed line). The solid line represents a lowerbound on R when Alice employs an active source. The in-set figure shows the value for the optimized parameters μ(dashed line) and Ω (solid line) in the passive setup.

decreases with the distance, while the value of the pa-rameter Ω increases. In particular, μ diminishes from≈ 0.084 to approximately 4 × 10−3, while Ω augmentsfrom ≈ 0.365 to ≈ 0.76. This result is not surprising.At long distances the gain Q of the protocol is very lowand, therefore, it is especially important to keep boththe multiphoton probability of the source, and the in-trinsic error rate of the signals ρout,θ, also low. Fig. 4includes an inset plot with the optimized parameters μ(dashed line) and Ω (solid line). This figure shows aswell a lower bound on the secret key rate for the caseof an active source. The cutoff point where the secretkey rate drops down to zero is basically the same inboth cases. It is given by l ≈ 67.5 km. This resultarises from two main limiting factors: the multipho-ton probability of the source, and the dark count rateof Bob’s detectors. Note that in these simulations wedo not consider any misalignment effect in the chan-nel or in Bob’s detection apparatus. From the resultsshown in Fig. 4 we see that the performance of the pas-sive scheme is similar to the one of an active setup. The(relatively small) difference between the achievable se-cret key rates in both scenarios is due to two main fac-tors: (a) the probability pacc to accept a pulse emittedby the source, which is pacc < 1 in the passive setup,and pacc = 1 in the active scheme, and (b) the intrinsicerror rate of the signals accepted by Alice, that is zeroonly in the case of an active source.

4 Alternative implementation schemeInstead of using the scheme shown in Fig. 1, Alice

could as well employ, for instance, the device illustratedin Fig. 5. This setup has only one laser diode, but fol-

Passive preparation of BB84 signal states with coherent light 61

Fig. 5 Alternative implementation scheme with only onepulsed laser source. The delay introduced by one armof the interferometer is equal to the time difference be-tween two consecutive pulses. The polarization rotatorR−45◦ changes the +45◦ linear polarization of the incomingpulses to −45◦ linear polarization.

lows a similar spirit like the original scheme shown inFig. 1, where a polarization measurement is used to de-termine the polarization of the incoming signals. Themain idea is just to replace two single light pulses emit-ted by two different diodes with two consecutive lightpulses generated by only one laser diode.

To keep the analysis simple, the scheme includes aswell an intensity modulator (IM) to block either all theeven or all the odd pulses in mode a (see Fig. 5). Themain reason for blocking half of the incoming pulses isto suppress possible correlations between them. The IMguarantees that the signals that go to Bob are preciselytensor product of states of the form given by Eq. (4). Tosee this, note that the signal states in mode a (before theIM) can always be written as

ρout =1

(2π)n+1

∫φ0

∫φ1

∫φ2

. . .

∫φn

|α(φ0,φ1)〉〈α(φ0,φ1)| ⊗ |α(φ1,φ2)〉〈α(φ1,φ2)| ⊗ . . . ⊗

|α(φn−1,φn)〉〈α(φn−1 ,φn)| dφ0dφ1dφ2 . . . dφn, (10)

where the coherent states |α(φi ,φi+1)〉 have the form|α(φi ,φi+1)〉 = exp [

√υ(eiφia†i − e−iφiai)]|vac〉, and the op-

erators a†i are given by

a†i =1√2

(a†+45◦ + ei(φi+1−φi)a†−45◦

). (11)

If now Alice blocks, for instance, all the even pulsesin mode a, we obtain that the output state σout can bewritten as

σout =

� n−12 ⊗

i=0

1(2π)2

∫φ2i

∫φ2i+1

|α(φ2i,φ2i+1)〉

〈α(φ2i ,φ2i+1)| dφ2idφ2i+1 =

� n−12 ⊗

i=0

σiout, (12)

with σiout of the form given by Eq. (2). This way we

can directly apply the security evaluation provided in

Sec. 3. This transmitter requires, therefore, an activecontrol of the functioning of the IM. Note, however,that this configuration might still be much less of aproblem than using a polarization modulator to activelygenerate BB84 signal states at high rates, since no RNGis needed to control the IM. Thanks to the one-pulse de-lay introduced by one arm of the interferometer, it canbe shown that both setups in Fig. 1 and Fig. 5 are com-pletely equivalent, except from the resulting secret keyrate. More precisely, the secret key rate in the passivescheme with two lasers is double than that in the setupillustrated in Fig. 5, since half of the pulses are now dis-carded.

5 ConclusionWe have presented a method to passively generate

the signal states of the Bennett-Brassard 1984 QKDprotocol with coherent light. It needs only linear opti-cal components and photodetectors, and constitutes analternative to those active sources that use externally-driven elements. In the asymptotic limit of an infinitelong experiment, we have shown that the secret key ratedelivered by a passive transmitter is similar to the oneprovided by an active source, thus showing the practicalinterest of the passive scheme.

AcknowledgementThis work was supported by CFI, CIPI, the CRC

program, CIFAR, MITACS, NSERC, OIT, Quantum-Works, and by Xunta de Galicia (Spain, grant IN-CITE08PXIB322257PR).

References[1] N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, “Quan-

tum cryptography,” Rev. Mod. Phys., vol.74, pp.145–195, 2002.

[2] V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf, M.Dusek, N. Lutkenhaus, and M. Peev, “The security ofpractical quantum key distribution,” Rev. Mod. Phys.,vol.81, pp.1301–1350, 2009.

[3] G. S. Vernam, “Cipher printing telegraph systems forsecret wire and radio telegraphic communications,” J.Amer. Inst. Elec. Eng., vol.45, pp.109–115, 1926.

[4] C. H. Bennett and G. Brassard, “Quantum cryptogra-phy: public key distribution and coin tossing,” in Proc.IEEE Int. Conference on Computers, Systems and Sig-nal Processing, Bangalore, India, IEEE Press, NewYork, pp.175–179, 1984.

[5] H. Inamori, N. Lutkenhaus, and D. Mayers, “Uncon-ditional security of practical quantum key distribution,”Eur. Phys. J. D, vol.41, no.3, pp.599–627, 2007.

[6] D. Gottesman, H.-K. Lo, N. Lutkenhaus, and J. Preskill,“Security of quantum key distribution with imperfect

62 Progress in Informatics, No. 8, pp.57–63, (2011)

devices,” Quantum Inf. Comput., vol.4, pp.325–360,2004.

[7] W.-Y. Hwang, “Quantum key distribution with highloss: toward global secure communication,” Phys. Rev.Lett., vol.91, 057901, 2003.

[8] H.-K. Lo, X. Ma, and K. Chen, “Decoy state quantumkey distribution,” Phys. Rev. Lett., vol.94, 230504, 2005.

[9] X.-B. Wang, “Beating the photon-number-splitting at-tack in practical quantum cryptography,” Phys. Rev.Lett., vol.94, 230503, 2005.

[10] J. G. Rarity, P. C. M. Owens, and P. R. Tapster, “Quan-tum random-number generation and key sharing,” J.Mod. Opt., vol.41, no.12, pp.2435–2444, 1994.

[11] W. Mauerer and C. Silberhorn, “Quantum key distribu-tion with passive decoy state selection,” Phys. Rev. A,vol.75, 050305(R), 2007.

[12] Y. Adachi, T. Yamamoto, M. Koashi, and N. Imoto,“Simple and efficient quantum key distribution withparametric down-conversion,” Phys. Rev. Lett., vol.99,180503, 2007.

[13] M. Curty, T. Moroder, X. Ma, and N. Lutkenhaus, “Non-Poissonian statistics from Poissonian light sources withapplication to passive decoy state quantum key distribu-tion,” Opt. Lett., vol.34, pp.3238–3240, 2009.

[14] Y. Adachi, T. Yamamoto, M. Koashi, and N. Imoto,“Boosting up quantum key distribution by learningstatistics of practical single-photon sources,” New J.Phys., vol.11, 113033, 2009.

[15] M. Curty, X. Ma, B. Qi, and T. Moroder, “Passivedecoy-state quantum key distribution with practicallight sources,” Phys. Rev. A, vol.81, 022310, 2010.

[16] W. Tittel, J. Brendel, H. Zbinden, and N. Gisin, “Quan-tum cryptography using entangled photons in energy-time Bell states,” Phys. Rev. Lett., vol.84, pp.4737–4740, 2000.

[17] M. Curty, X. Ma, H.-K- Lo, and N. Lutkenhaus, “Pas-sive sources for the Bennett-Brassard 1984 quantum keydistribution protocol with practical signals,” preprintarXiv:1009.3830.

[18] K. Peterman, Laser Diode Modulation and Noise,Kluwer Academic Publishers, New York, 1991. ISBN:978-0792312048.

[19] M. Jofre, A. Gardelein, G. Anzolin, G. Molina-Terriza,J. P. Torres, M. W. Mitchell, and V. Pruneri, “100 MHzAmplitude and Polarization Modulated Optical Sourcefor Free-Space Quantum Key Distribution at 850 nm,” J.of Lightwave Tech., vol.28, no. 17, pp.2572–2578, 2010.

[20] T. Moroder, M. Curty, and N. Lutkenhaus, “One-wayquantum key distribution: simple upper bound on thesecret key rate,” Phys. Rev. A, vol.74, 052301, 2006.

[21] N. Lutkenhaus, “Estimates for practical quantum cryp-tography,” Phys. Rev. A, vol.59, pp.3301–3319, 1999.

[22] N. J. Beaudry, T. Moroder, and N. Lutkenhaus, “Squash-ing models for optical measurements in quantum com-munication,” Phys. Rev. Lett., vol.101, 093601, 2008.

[23] H.-K. Lo, H. F. C. Chau, and M. Ardehali, “Efficientquantum key distribution scheme and a proof of Itsunconditional security,” J. Cryptology, vol.18, pp.133–165, 2005.

Appendix. Gain and QBERIn this Appendix we provide a mathematical expres-

sion for the observed gain Q and error rate E. In par-ticular, it can be shown that, in the scenario considered,the gain is independent of the actual polarization of thesignals ρout,θ given by Eq. (4) and the basis used to mea-sure them. After a short calculation, we find that thisparameter has the form

Q = 1 − (1 − εB)2e−μηsys , (13)

for all θ, where εB denotes again the dark count rate ofBob’s detectors and ηsys is the overall transmittance ofthe system.

The calculation of E is slightly more involved, sincethe error rate varies depending on the value of the angleθ. By symmetry, however, we can restrict ourselves toinvestigate the QBER in only one of the valid regionsillustrated in Fig. 3; note that the error rate is the samein all of them. For instance, let us consider the casewhere θ ∈ [7π/4 + Ω, π/4 − Ω] (which corresponds tothe horizontal polarization interval), and let Eθ denotethe error rate of a signal state ρout,θ in that region. Aftera tedious calculation, it can be shown that this quantitycan be written as

Eθ =1

2Q

{εB(εB − 1) f0,θ +

[2 + εB(εB − 3)

]f1,θ

+[1 + εB(εB − 2)

]fdc,θ + εB(2 − εB)

}, (14)

where the parameters f0,θ, f1,θ, and fdc,θ, have the form

f0,θ = e−ηsysμ[− 1 + e

12 ηsysμ(1+cos θ)

],

f1,θ = e−ηsysμ[− 1 + e

12 ηsysμ(1−cos θ)

],

fdc,θ = 1 + e−ηsysμ − e−12 ηsysμ(1+cos θ)

− e−ηsysμ sin2 ( θ2 ). (15)

The quantum bit error rate E is then given by

E =2

π − 4Ω

∫ π4 −Ω

7π4 +Ω

Eθ dθ, (16)

and we solve this equation numerically.

Passive preparation of BB84 signal states with coherent light 63

Marcos CURTYMarcos CURTY received his M.Sc.and Ph.D in Telecommunication En-gineering from Vigo University in1999 and 2004 respectively. In2001 he joined the Quantum Infor-mation Theory Group at the Univer-

sity of Erlangen-Nurnberg and he obtained a Ph.D inPhysics (2006) under the supervision of Prof. NorbertLutkenhaus. After postdoc positions at Toronto Uni-versity (Prof. Hoi-Kwong Lo) and at the Institute forQuantum Computing, Waterloo University (Prof. Nor-bert Lutkenhaus), he joined the department of Elec-tronic and Communications Engineering at ZaragozaUniversity as Assistant Professor. Currently he is As-sociate Professor at the department of Theory of Signaland Communications at Vigo University. His researchinterest lies in quantum information processing, partic-ularly quantum cryptography.

Xiongfeng MAXiongfeng MA is a post-doctoralfellow at the Institute for QuantumComputing, University of Waterloo.He did his PhD in the Department ofPhysics at the University of Toronto.After earning a BSc in physics at

Peking University in 2003, he joined Prof. Hoi-KwongLo’s group at the University of Toronto as a graduatestudent. His research interest is in Quantum Informa-tion Processing with a special emphasis on QuantumCryptography.

Hoi-Kwong LOHoi-Kwong LO is a Full Professorand a Canada Research Chair at theCenter for Quantum Information andQuantum Control (CQIQC), the De-partment of Physics and the Depart-ment of Electrical and Computer En-

gineering, at the University of Toronto. His researchinterest lies in quantum information processing, partic-ularly quantum cryptography. He received his B.A. inMathematics from Trinity College, Cambridge Univer-sity in 1989 and his M.Sc. and Ph.D. in Physics fromCaltech in 1991 and 1994 respectively. Prof. Lo hadsix years of industrial research experience at Hewlett-Packard Lab., Bristol UK and also as the Chief Scien-tist and Senior Vice President, R&D, of MagiQ Tech-nologies, Inc., New York. He was a co-founder of aleading journal “Quantum Information and Computa-tion” (QIC). He is a Fellow of the Canadian Institutefor Advanced Research (CIFAR).

Norbert LUTKENHAUSNorbert LUTKENHAUS studied atthe RWTH Aachen and the LMUMunich, from which he graduatedwith a thesis in general relativity.Then he changed the field to studyquantum optics and quantum cryp-

tography under the supervision of Stephen M. Barnettat the University of Strathclyde, Scotland, UK. In 1996he obtained his PhD. After postdoc positions in Inns-bruck (Peter Zoller and Ignacio Cirac) and the HelsinkiInstitute of Physics (Kalle-Antti Suominen) he workedfor MagiQ Technologies (New York) to initiate theproject of commercial realisation of quantum key distri-bution. Returning to academia in 2001, he build up andlead an Emmy-Noether Research Group at the Univer-sity of Erlangen-Nurnberg, during which time he didhis habilitation (2004). Currently he is an AssociateProfessor in the Physics Department at the Universityof Waterloo and a member of the Institute of QuantumComputing.