Passive switching scheme for two-way quantum key distribution setups G.P. Tempora˜o A simple design for Bob in two-way quantum key distribution schemes that employs only passive linear optical components to perform the necessary switching operations is presented. It is shown that, for some specific protocols and/or practical qubit implementations, the losses in Bob’s station can be made negligible, hence increasing the maximum distance for secret key generation. Introduction: Quantum key distribution (QKD) is a solution to the problem of generating and sharing a secret key between two distant parties, Alice and Bob, which, under idealised conditions, offers high security by utilising the laws of quantum physics [1]. Recently, novel protocols that employ two-way quantum communication have been pro- posed: the qubits must make a full round trip between Alice and Bob, who act both as transmitters and as receivers. One class of such proto- cols, which is the main focus of this Letter, is called semi-quantum key distribution (SQKD), in which one of the parties is classical, whereas the other is quantum [2, 3]. In this case, Alice prepares a qubit and then sends it to Bob, who can perform either one of the follow- ing operations: (i) do nothing, and reflect the qubit back to Alice in the same state (or in a different state obtained by a fixed unitary transform- ation); or (ii) measure the qubit in a fixed predetermined basis and resend a new one, corresponding to the measurement result, back to Alice. It is still unknown whether such protocols offer real benefits over the stan- dard ones; however, two-way communication has already been shown to allow completely new paradigms in cryptography, such as counterfac- tual QKD [4]. In this approach, no information on the secret key is actu- ally transmitted via the quantum channel, and Bob obtains his key from the non-detection events. The simplest and most straightforward way to implement Bob’s pro- cedure is using an optical switch. Depending on his choice, he either switches an incoming photon from the quantum channel to (i) a Faraday mirror (FM) or (ii) a measurement apparatus, usually consisting of a polarising beamsplitter (PBS) and two detectors. A third position of the switch could connect to a single-photon source to resend the measured quantum states. This approach, however, introduces two important limitations. The first one is the high insertion loss of the switch. As the qubits must make a full round trip from Alice to Bob and then back to Alice, the quantum channel must be travelled twice, which dramatically increases the link attenuation if compared to the usual one-way QKD schemes. Therefore, all losses must be kept at a minimum level. The second limitation is the switch response time. This can impose restrictions on Alice’s maximum pulse rate, which has already achieved the mark of a few gigahertz in recent QKD experi- ments [5]. In this Letter, an alternative switching scheme that relies only on passive, low-loss components is presented. It will be considered that the qubits are codified in the polarisation state of a (pseudo-) single- photon pulse; encoding in other degrees of freedom (time-bin, frequency, etc.) would require a completely different setup. Proposed setup: Fig. 1 shows the passive implementation for Bob’s setup. The input/output of Bob’s office is represented by mode a, which will also be referred to as the quantum channel. Whenever a given polarisation state (e.g. one of the four BB84 states) arrives at PBS1 from the quantum channel, its vertical (V) and horizontal (H) components will be split into modes b and c, respectively. Let us first consider the V component. It will be reflected by the first mirror (M1) and subsequently reflected by the second polarising beamsplitter (PBS2) to mode d, impinging on the FM and reflecting back with an orthogonal polarisation – now, H. Then it will pass straight through PBS2 to a half-waveplate (HWP) aligned in such a way that it implements the unitary transformation given by (in the H-V basis): U = cos a −sin a sin a cos a   (1) where a represents the orientation of the waveplate. After reflection on the second mirror (M2), the split pulse can either be transmitted by PBS1 back to the quantum channel in the H state, or be reflected to mode f and detected by detector 2 (D2), with probabilities cos 2 a and sin 2 a, respectively. M2 HWP D1 D2 FM PBS2 PBS1 M1 g c a b h d e f Fig. 1 Proposed experimental setup PBS: polarising beamsplitter; M: mirror; FM: Faraday mirror; D: detector; HWP: half-wave plate Now consider the H component. It is reflected by M2 and rotated by the waveplate in such a way that it can either be reflected and detected by detector 1 (D1) or transmitted to mode d by PBS2, with probabilities sin 2 a and cos 2 a, respectively. In the latter case, incidence on the FM will turn the polarisation to V, forcing it to be reflected in the second interaction with PBS2 towards M1 and then also reflected by PBS1 back to mode a. Note that the optical paths for H and V components of the input polar- isation states have exactly the same optical length, such that the two reflected components add coherently in PBS1. Moreover, the number of reflections is exactly the same for both components. Therefore, if there is no detection (supposing perfect detectors), it means the input polarisation state will be simply reflected back to the quantum channel in its orthogonal state. However, if either D1 or D2 fires, it means that a measurement has been performed. It is clear from Fig. 1 that a click on D1 (D2) means a projection into the horizontal (vertical) polarisation. In the case of SQKD, it is still necessary to resend a qubit in the state corresponding to the measurement result. In the case of faint laser pulses implementation, this can be easily achieved as follows. Bob just needs to add two (identical) attenuated laser sources in modes g and h (shown as dashed lines in Fig. 1), respectively generating V- and H-polarised photons. Considering that mirrors M1 and M2 have nonzero trans- missions, they act as attenuators; in this way, the intensity of a laser pulse leaving mode g (h) can be tuned such that it arrives in the single-photon level in mode b (c). Discussion: Bob’s passive choice scheme is completely determined by the angle a. In the general case, for an arbitrary a, the probabilities for detection in D1 and D2 (neglecting losses in the optical components and assuming perfect detectors) are given by: P(D1) = cos 2 u sin 2 a P(D2) = sin 2 u sin 2 a (2) where the input polarisation state is given by |SOPl in = cos u|H l+ e if sin u|V l. It is straightforward from (2) that the probability of back reflection without measurement is P(R)= 1 − ( cos 2 u + sin 2 u) sin 2 a = cos 2 a. If a ¼ 0, all incident light in mode a is reflected back, irrespective of the polarisation state. If a ¼ p, we obtain the opposite situation: all light from mode a is detected. An unbiased choice can be achieved if Bob selects a ¼ p/2; in this case, an incoming single photon has 50% prob- ability of being both detected or reflected back to Alice. This passive choice setup has many advantages over schemes that rely on active components such as switches. State-of-the-art optical switches have 3 dB insertion loss and 10 ns response time. This means that, for a round trip, an active scheme has around 6 dB more losses than the passive scheme, corresponding to about 30 km of optical fibre (15 km of distance) that could be added while maintaining the same quantum bit error rate (QBER). Moreover, Alice’s maximum pulse generation rate also becomes limited to a few hundred megahertz, whereas the passive scheme is only limited by the response time of the detectors. ELECTRONICS LETTERS 1st April 2010 Vol. 46 No. 7