Quantum distribution processes and associated telecommunication devices

Abstract

The invention relates to a quantum key distribution method between a first and a second telecommunications device (D_ALICE, D_BOB) connected by a quantum channel (30) and a classical channel (40), comprising: the transmission of bits by emission on the quantum channel of light pulses having quantum states encoding said bits; the distribution of at least some of the bits of the generated sequence into 3 distinct sets of bits, each bit being associated with an index number depending on its position within at least said some of the bits: a first set of bits to define the secret key, a second set of bits equal to 0 and a third set of bits equal to 1; each bit of at least the second and third sets being associated, in a memory of the first device, with its index number;information received from the second device comprising a sequence ind1 ind2 …indn where indi, i = 1 to n with n ≥ 1, indicates an index number associated with a bit in the second or third set, for each of the parity bits calculated by the second device on the first set: determination of the value of the bit bi associated, in the memory of the first device, with the index number indi for i = 1 to n, and decoding according to a determined code, of the value of each parity bit as a function of the sequence of bits b1 b2…bn determined for said parity bit. Figure for the abbreviation: Fig. 1;

Description

Title of the invention: Quantum distribution methods and associated telecommunications devices Technical field

[0001] The invention lies in the field of generating and sharing a symmetric secret key between two remote telecommunications devices associated with their respective users, hereinafter referred to as Alice and Bob: Alice and Bob must use a strictly identical key to be able to encrypt / decrypt their messages. The invention relates more particularly to quantum key distribution (QKD) and the underlying communication of parity-type information. Prior art

[0002] Quantum cryptography relies on the transmission of qubits (quantum bits) or randomly generated coherent states, to develop and distribute secret keys usable by classical encryption protocols such as one-time pad encryption. Since the first protocol proposed in 1984 (BB84), multiple QKD protocols have been defined. We distinguish between protocols with discrete variables (qubits, DV-QKD) and those with continuous variables (CV-QKD). Some protocols (BB84, DV-QKD) rely on random choices of a generation and measurement basis, and involve the communication of these choices of bases. Other protocols (CV-QKD with heterodyne receiver) do not involve communications on the choice of a measurement basis. Some protocols based on photon entanglement involve a photon source external to Alice and Bob.But all QKD protocols integrate a residual error correction step to develop a shared key between Alice and Bob, implementing the communication of parity bits, for various error detection or correction techniques (FEC (Forward Error Correction code) codes such as LDPC (Low Density Parity Code), interactive and iterative protocols such as Cascade or Winnow, etc.). For illustration purposes, we will subsequently refer to the BB84 protocol.

[0003] During a quantum cryptography protocol, the two remote interlocutors Alice and Bob have: - quantum objects, that is, physical objects that behave according to the laws of quantum physics; in practice, these objects are light pulses (photons), which can take several forms: single photons, coherent states, pairs of entangled photons, etc.; the photon allows the encoding of information on observable variables such as the polarization of light, its frequency, its phase, etc.;

[0004]

[0005]

[0006]

[0007]

[0008] - a quantum channel, which allows the transit of light pulses; - a classic channel (also called a public channel) of communication (typically Internet, radio, optical transmission over fiber or in free space). Quantum Key Distribution (QKD) is a technique that exploits quantum properties to guarantee randomness, allowing the detection of interception and re-transmission by a malicious third party, let's call it Eve (Eavesdropper), of an initial message generated by Alice to Bob. Since it is impossible to clone unknown quantum information without destroying it, or to measure an unknown quantum state without modifying it, the reading of qubits during their transmission between two interlocutors wishing to encrypt their communications with a secret key derived from these qubits by an intruder can be immediately detected: an interception will be immediately detected by Alice and Bob, who will give up this key. A reference QKD technique is the BB84 protocol published by C. Bennett and G. Brassard in 1984 and using discrete variables: qbits. A qubit takes a value of 0 or 1, and is represented by the polarization of a single photon, on two possible quadratures (bases): H / V or D / A (the capital letter H, V, D, A indicates the type of polarization: H for horizontal, V for vertical, D for diagonal and A for Antidiagonal). The steps are then classically the following. The main steps of quantum key distribution are as follows: - Alice generates a sequence of random bits and encodes each bit on each light pulse, then transmits it to Bob through the quantum channel. - This then measures the information carried by the impulse it received. - Alice and Bob evaluate a level of interception of the information exchanged on the quantum channel based on the differences between the data transmitted and those measured and if the level is higher than a fixed threshold, the quantum distribution operation is terminated. - If not, the extraction of the secret key from the correlated data is carried out via a step called data reconciliation: in this reconciliation step, a bit string shared by Alice and Bob is determined from the correlated data and an error correction algorithm implementing parity bits. - A secrecy amplification step is generally implemented to neutralize the information leak during reconciliation. For each qubit (0 / 1) in a series of qubits randomly generated by Alice, the latter generates on the quantum channel a photon whose polarization depends on the random choice of a quadrature (H / V or D / A) and the binary value considered (0 / 1). At the other end of the quantum channel, on the receiving side, Bob randomly selects, for each qubit, a quadrature to perform the detection (either on H / V, or on D / A). Any qubit measured on the same quadrature as the quadrature used for transmission is normally correctly transmitted: 100% to within e, (typically the value of e is in the range [0; 10%]. When the Tx / Rx quadratures are not identical, the transmission is false with a probability of 50% to within e.

[0009] After the transmission, Bob therefore has a set of measurements which are correlated with the data sent by Alice, but which could have been spied on by Eve.

[0010] Then the so-called reconciliation phase takes place using only the classic communication channel, where: - a so-called sifting step selects the transmitted qubits for which Alice and Bob use the same generation and detection quadrature: to do this, Alice and Bob communicate in clear on the classical channel to broadcast the quadratures used; this makes it possible to develop two versions of a key called a "sifted key" respectively on the side of Alice and Bob, by discarding on average 50% of the qubits (different Tx / Rx quadratures); - an estimate of the error rate is made, to determine the possible presence of Eve (case of key rejection), and to select an error-correcting code (choice of code and yield) or to configure an interactive and iterative error-correcting protocol by request / response for the rest of the processing; - a step of detection and correction of residual errors comprising exchanges of parity bits calculated by Alice and / or Bob on their respective "sifted key" then takes place (Cascade or Winnow protocol, FEC LDPC error correcting code, etc.), following which Alice and Bob share a strictly identical key, for which Eve has certain information.

[0011] Alice and Bob then share a secret key (after an additional step of secret amplification).

[0012] The dissemination on the public channel of the information shared between Alice and Bob (“side information”) concerning the values ​​of the parity bits, during the reconciliation phase, constitutes a harmful information leak likely to favor Eve in her search for the key. This disclosure goes against the secrecy of the key, and requires a secret amplification process, at the cost of a reduction in the size of the key.

[0013] Indeed, knowing the choice of bases used for each qubit, Eve knows which qubits are reliable (to within 1-e) among those she has measured. From the reliable qubits, and knowing the (reliable) parity values ​​and the residual error correction method, Eve can deduce values ​​of other qubits, either in terms of value or in probability term. In any case, this information broadcast on the public channel makes it possible to reduce the combinatorics of exploring the key for Eve.

[0014] There is therefore a need for a quantum key distribution solution that can better preserve secrecy and reduce the risk of information leaking onto the public channel. Summary of the invention

[0015] To this end, according to a first aspect, the present invention describes a method for quantum key distribution between a first and a second telecommunication device (connected by a first and a second telecommunication link,

[0016] said first link being an optical transmission link and being hereinafter called a quantum channel, said second teletransmission link being hereinafter called a conventional channel;

[0017] said method comprising the following steps implemented by the first device: - generation of a random sequence of bits by the first device; - for each bit considered successively in the generated sequence, coding of said bit at least by a value of a parameter defining a quantum state of a respective light pulse comprising at least one photon, said value of the parameter being determined as a function of at least the value of said bit; a light pulse having said parameter value then being emitted on the quantum channel and to the second device following said coding; - at least one step among steps j and jj below: - (j) a step j comprising at least

[0018] - a calculation of parity bits as a function of bits of the generated sequence; and

[0019] - a transmission, to the second device, of information relating to the calculated parity bits;

[0020] - (jj) a step jj comprising at least:

[0021] - a reception of information from the second device and relating to parity bits calculated by said second device as a function of the reception, by the second device, of the light pulses emitted by the first device; then

[0022] - a detection of errors in said sequence of bits as a function of the values ​​of said information relating to the parity bits received;

[0023] said method being characterized in that the following steps are further implemented by the first device: - distribution of at least some of the bits of the generated sequence into 3 sets of distinct bits, each bit being associated with an index number depending on its rank within at least said certain bits: a first set of bits to define the secret key, a second set of bits equal to 0 and a third set of bits equal to 1; each bit of at least the second and third sets being associated, in a memory of the first device, with its index number; - if step (j) is implemented, said step (j) comprises the following steps: (j0) the parity bits are calculated as a function of bits of the first set;

[0024] (j 1 ) according to a predetermined code, coding the value of each calculated parity bit by a sequence of bits bl b2.. .bn of length n greater than or equal to 1;

[0025] (j2) for each bit bi, i = 1 to n: if and only if bi = 0, selection of one of the bits of the second set and if and only if bi = 1, selection of one of the bits of the third set;

[0026] (j3) said transmission of information relating to the calculated parity bits comprises the transmission, on the conventional channel, for each calculated parity bit, of a sequence indl ind2 .. .indn where indi, i=l to n, indicates the index number associated with said bit selected in the second or third set at step j2 for the bit bi; - if step (jj) is implemented, said step (jj) comprises the following steps: (jjO) the information received from the second device comprising, for each of said parity bits, a sequence indl ind2 .. .indn where indi, i = 1 to n with n > 1, indicates an index number associated with a bit in the second or third set, for each parity bit: determination of the value of the bit bi associated, in the memory of the first device, with the index number indi for i = 1 to n, and decoding according to a determined code, the value of each parity bit as a function of the sequence of bits bl b2.. .bn determined for said parity bit;

[0027] (jjl) said error detection is an error detection in the first set of bits for defining the secret key and is carried out according to said values ​​of the parity bits thus decoded.

[0028] The proposed solution greatly reduces information leakage and improves secrecy: the values ​​of the parity bits for residual error detection / correction are not transmitted over the public channel. This information is transmitted indirectly and in two stages: by transmitting a random signal of qubits over the quantum channel, then after sifting, by transmitting the index numbers of the parity qubits over the public channel. Therefore, to know the values ​​of the parity bits, it is necessary to have the qbits and their index number, half of the qubit values ​​remaining inaccessible to Eve.

[0029] In embodiments, such a method will further comprise at least one of of the following characteristics:

[0030] - the quantum key distribution method comprises at least, for step j, one provisions among:

[0031] if the value of bi is 0, the information transmitted relating to bi indicates the index number of the selected bit of the second set and if the value of bi is 1, the information transmitted relating to said bit thus indicates the index number of the selected bit of the third set; said selection being carried out by drawing;

[0032] - the first device comprises at least two distinct coding bases between values ​​of said parameter and the values ​​0 or 1 of a bit; and the first device randomly selects, for each bit considered in the generated sequence, a base from among the at least two distinct bases, to carry out said bit coding by said value of said light pulse parameter and stores, for each bit of the sequence, an indication of the selected base;

[0033] after the transmission step, transmission by the first device to the second device on the conventional channel of the indication of the base that the first device has selected for each bit of the sequence and reception from said second device, on the conventional channel, of the indication, for each bit of the sequence, of the base that said second device has selected to evaluate the value of said bit of the sequence;

[0034] comparison, for each bit of the sequence, of the stored and received base indications and identification of the bits of the sequence for which the base selected by the first device and the second device are identical;

[0035] the first, second and third sets of bits are composed of bits thus identified.

[0036] According to another aspect, the invention describes a computer program intended to be stored in the memory of a first device and further comprising a microcomputer, said computer program comprising instructions which, when executed on the microcomputer, orchestrate the steps of a method according to the first aspect of the invention.

[0037] According to another aspect, the invention describes a telecommunications device being adapted to be connected to another telecommunications device by a first and a second telecommunications links,

[0038] said first link being an optical transmission link and being hereinafter called quantum channel, said second teletransmission link being hereinafter called classical channel;

[0039] said device being adapted to generate a random sequence of bits and for each bit considered successively in the generated sequence, to code said bit at least by a value of a parameter defining a quantum state of a pulse respective light comprising at least one photon, said parameter value being determined as a function of at least the value of said bit, and to emit, on the quantum channel and to the other device, a light pulse having said parameter value;

[0040] said device being adapted to carry out at least one operation among operations j and jj below:

[0041] - (j) an operation] comprising at least

[0042] - a calculation of parity bits as a function of bits of the generated sequence; and

[0043] - a transmission, to the other device, of information relating to the calculated parity bits;

[0044] - (jj) an operation jj comprising at least:

[0045] - a reception of information from the other device and relating to parity bits calculated by said other device based on the reception, by the other device, of the light pulses emitted by the device; then

[0046] - a detection of errors in said sequence of bits as a function of the values ​​of said information relating to the parity bits received;

[0047] said device being characterized in that it is adapted to distribute at least some of the bits of the generated sequence into 3 distinct sets of bits, each bit being associated with an index number depending on its rank within at least said certain bits: a first set of bits to define the secret key, a second set of bits equal to 0 and a third set of bits equal to 1; each bit of at least the second and third sets being associated, in a memory of the device, with its index number; - if the device performs operation (j), the device is suitable for, during said operation: (jO) calculating the parity bits based on bits of the first set;

[0048] (j 1 ) encode, according to a predetermined code, the value of each parity bit calculated by a sequence of bits bl b2.. .bn of length n greater than or equal to 1;

[0049] (j2) for each bit bi, i = 1 to n: if and only if bi = 0, select one of the bits of the second set and if and only if bi = 1, select one of the bits from the third set;

[0050] (j3) to transmit the information relating to the calculated parity bits: transmit, on the conventional channel, for each calculated parity bit, a sequence indl ind2 .. .indn where indi, i=l to n, indicates the index number associated with said bit selected in the second or third set in step j2 for bit bi; and / or - if the device performs operation (jj), the device is adapted to, during said operation: (jjO) the information received from the other device including, for each of said parity bits, a sequence indl ind2 .. .indn where indi, i = 1 to n with n > 1, indicates an index number associated with a bit in the second or third set, for each parity bit: determine the value of the bit bi associated, in the memory of the device, with the index number indi for i = 1 to n, and decode according to a determined code, the value of each parity bit as a function of the sequence of bits bl b2.. .bn determined for said parity bit;

[0051] (jjl) performing, as a function of said values ​​of the parity bits thus decoded, said error detection in the first set of bits to define the secret key.

[0052] According to another aspect, the invention describes a method for quantum key distribution with respect to a first and a second telecommunications device each connected to a respective first telecommunications link and connected to each other by a second telecommunications link,

[0053] said first link being an optical transmission link and being hereinafter called quantum channel, said second teletransmission link being hereinafter called classical channel;

[0054] said method comprising the following steps implemented by the second device: - receiving a sequence of light pulses on the quantum channel such that for each light pulse of the received pulse sequence, a measurement of a parameter of the light pulse is carried out; - for each light pulse, estimation of the value of at least one bit coded by said pulse as a function of said measurement of the parameter; the bits estimated as a function of the light pulses of the sequence defining a sequence of bits; - at least one step among steps j and jj below: - (j) a step j comprising at least:

[0055] - a calculation of parity bits as a function of bits of said sequence; and

[0056] - a transmission, to the first device, of information relating to the calculated parity bits;

[0057] (jj) a step jj comprising at least:

[0058] - a reception of information from the first device and relating to parity bits calculated by said first device as a function of at least bits corresponding to the bit sequence; then

[0059] - error detection in the bit sequence based on the information received relating to parity bits;

[0060] said method being characterized in that the following steps are further implemented by the second device: - distribution of at least some of the bits of the sequence into 3 sets of bits distinct, each bit being associated with an index number depending on its rank within at least said certain bits: a first set of bits to define the secret key, a second set of bits equal to 0 and a third set of bits equal to 1; each bit of at least the second and third sets being associated, in a memory of the second device, with its index number; - if step (j) is implemented, said step (j) comprises the following steps: (j0) the parity bits are calculated as a function of bits of the first set;

[0061] (j 1 ) according to a predetermined code, coding of the value of each calculated parity bit by a sequence of bits bl b2.. .bn of length n greater than or equal to 1;

[0062] (j2) for each bit bi, i = 1 to n: if and only if bi = 0, selection of one of the bits of the second set and if and only if bi = 1, selection of one of the bits of the third set;

[0063] (j3) said transmission of information relating to the calculated parity bits comprises the transmission, on the conventional channel, for each calculated parity bit, of a sequence indl ind2 .. .indn where indi indicates the index number associated with said bit selected in the second or third set in step j2 for the bit bi; - if step (jj) is implemented, said step (jj) comprises the following steps: the information received from the first device comprising, for each of said parity bits, a sequence indl ind2 .. .indn where indi, i = 1 to n with n > 1, indicates an index number associated with a bit in the second or third set, for each parity bit: determination of the value of the bit bi associated, in the memory of the second device, with the index number indi for i = 1 to n, and decoding according to a determined code, the value of each parity bit as a function of the sequence of bits bl b2...bn determined for said parity bit;

[0064] said error detection is an error detection in the first set of bits for defining the secret key and is carried out according to said values ​​of the parity bits thus decoded.

[0065] In embodiments, such a method will further comprise at least one of the following features:

[0066] - the quantum key distribution method comprises one or the other of the dis positions among:

[0067] - if the value of bi is 0, the information transmitted relating to bi indicates the number index number of the selected bit of the second set and if the value of bi is 1, the information transmitted relating to said bit thus indicates the index number of the selected bit of the third set; said selection being carried out by drawing;

[0068] - the second device comprises at least two distinct correspondence bases between values ​​of the parameter and the values ​​0 or 1 of an estimated bit, from among several distinct bases, and the second device randomly selects, for each pulse considered in the sequence of pulses, a base from among the at least two distinct bases, to carry out the estimation of the value of at least said bit as a function of the measurement of said parameter and stores, for each bit of the sequence, which base has been selected;

[0069] after the receiving step, the second device sends to the first device on the conventional channel the indication of the base that the second device has selected for each bit of the sequence of bits, as stored and receives from said first device on the conventional channel the indication of the base that said first device has selected to encode each bit of the sequence;

[0070] comparison, for each bit of the sequence, of the stored and received base indications and identification of the bits of the sequence for which the base selected by the first device and the second device are identical;

[0071] the first, second and third sets of bits are composed of bits thus identified.

[0072] According to another aspect, the invention describes a computer program intended to be stored in the memory of a second device and further comprising a microcomputer, said computer program comprising instructions which, when executed on the microcomputer, orchestrate the steps of a method according to this previous aspect of the invention.

[0073] According to another aspect, the invention describes a telecommunications device adapted to be connected to a first telecommunications link and to be connected to a second telecommunications link connecting said device to another telecommunications device,

[0074] said first link being an optical transmission link and being hereinafter called quantum channel, said second teletransmission link being hereinafter called classical channel;

[0075] said device being adapted to receive a sequence of light pulses on the quantum channel and for each light pulse of the received pulse sequence, to carry out a measurement of a parameter of the light pulse;

[0076] said device being adapted to estimate, for each light pulse, the value of at least one bit coded by said pulse as a function of said measurement of the parameter; the bits estimated as a function of the light pulses of the sequence defining a sequence of bits;

[0077] said device being adapted to carry out at least one operation among operations j and jj below:

[0078] - (j) an operation] comprising at least:

[0079] - a calculation of parity bits as a function of bits of said sequence; and

[0080] - a transmission, to the other device, of information relating to the calculated parity bits;

[0081] (jj) an operation jj comprising at least:

[0082] - a reception of information from the other device and relating to parity bits calculated by said other device as a function of at least bits corresponding to the bit sequence; then

[0083] - error detection in the bit sequence based on the information received relating to parity bits;

[0084] said device being characterized in that it is adapted to distribute at least some of the bits of the sequence into 3 distinct sets of bits, each bit being associated with an index number depending on its rank within at least said certain bits: a first set of bits to define the secret key, a second set of bits equal to 0 and a third set of bits equal to 1; each bit of at least the second and third sets being associated, in a memory of the device, with its index number; - if the device performs operation (j), the device is suitable for, during said operation: (jO) calculating the parity bits based on the bits of the first set;

[0085] (j 1 ) encode, according to a predetermined code, the value of each parity bit calculated by a sequence of bits bl b2.. .bn of length n greater than or equal to 1;

[0086] (j2) for each bit bi, i = 1 to n: if and only if bi = 0, select one of the bits of the second set and if and only if bi = 1, select one of the bits from the third set;

[0087] (j3) to transmit the information relating to the calculated parity bits: transmit, on the conventional channel, for each calculated parity bit, a sequence indl ind2 .. .indn where indi indicates the index number associated with said bit selected in the second or third set in step j2 for the bit bi; - if the device performs the operation (dd), the device is suitable for, during said operation: the information received from the other device comprising, for each of said parity bits, a sequence indl ind2 .. .indn where indi, i = 1 to n with n > 1, indicates an index number associated with a bit in the second or third set, for each parity bit: determining the value of the bit bi associated, in the memory of the device, with the index number indi for i = 1 to n, and decoding according to a determined code, the value of each parity bit as a function of the sequence of bits bl b2.. .bn determined for said parity bit;

[0088] carry out, as a function of said values ​​of the parity bits thus decoded, said error detection in the first set of bits to define the secret key. Brief description of the drawings

[0089] The invention will be better understood and other characteristics, details and advantages will appear more clearly on reading the following description, given without limitation, and thanks to the appended figures, given by way of example.

[0090] [Fig-1] [Fig.l] schematically represents a QKD key generation system in one embodiment of the invention;

[0091] [Fig.2] [Fig.2] represents the steps of a quantum key distribution method in one embodiment of the invention;

[0092] [Fig.3] [Fig.3] illustrates the transmission and detection of a sequence of qubits in one embodiment of the invention;

[0093] [Fig.4] [Fig.4] represents an example of partitioning the random sequence of qubits into three sets carried out in D_ALICE and D_BOB;

[0094] Identical references may be used in different figures when they designate identical or comparable elements. Description of the embodiments

[0095] [Fig.l] represents a system for generating a symmetric key by QKD in one embodiment of the invention, comprising two telecommunication devices 10, 20 connected to each other by a quantum channel 30 and a conventional channel 40. Each or one of the telecommunication devices 10, 20 is for example on the ground, or on board a satellite, an aircraft, etc.

[0096] The quantum channel 30 is a telecommunications channel which allows the transit of information (binary in DV-QKD or continuous in CV-QKD) carried by a property of a quantum object (e.g.: polarization of a photon) transmitted on this channel; here the quantum channel 30 is adapted to transmit light pulses (an optical link of the optical fiber type or simply implemented by a directional photon source in the open air, the atmosphere, Space, etc.).

[0097] The classic channel 40 is a communication channel, for example a standard one (e.g. radio frequency link, internet network, optical fiber, etc.), assumed to be accessible in clear by all (including a malicious third party Eve), to allow the telecommunications devices 10 and 20 to converge towards the definition of a secret key on the basis of transmitted qubits, as described below for the BB84 protocol.

[0098] The telecommunications device 10, hereinafter called D_ALICE, of user Alice, comprises a control block 11, a quantum transmission block 12, a radio frequency (RF) transmission / reception block 13 and a memory 14.

[0099] The telecommunications device 20, hereinafter called D_BOB, of user Bob, comprises a control block 21, a quantum reception block 22, a block radio frequency (RF) transmission / reception 23 and a memory 24.

[0100] The radio frequency (RF) transmit / receive blocks 13 and 23 are adapted to communicate together via the conventional channel 40.

[0101] The control block 11, respectively 21, comprises for example a memory and a microprocessor (not shown). In one embodiment, the memory of the control block 11, respectively 21, comprises software instructions, which when executed on the microprocessor of the control block 11, respectively 21, implement the steps incumbent on the control block 11, respectively 21, and described later, in particular with reference to [Fig.2].

[0102] The radio frequency (RF) transmission / reception block 13, respectively 23, typically comprises a modem and a radio frequency transmission and reception antenna (not shown).

[0103] The quantum emission block 12 comprises a generation block, named GEN 121, and a polarization block, named Pol 122.

[0104] The GEN 121 block is adapted to randomly generate a sequence of bits to be transmitted.

[0105] The Pol 122 block is adapted to randomly choose, for each bit to be transmitted, a base from among several reference polarization bases (these bases are also called modes or quadratures) and to transmit a light pulse with a polarization corresponding to the value of the bit to be transmitted in the base randomly chosen for this bit.

[0106] The Pol 122 block comprises, for example, a polarization rotator, capable of rotating the polarization of the emitted light signal, selectively by 0° (if the H / V base is chosen by the Pol 132 block) or by 45° (if the D / A base is chosen), the selection between 0° and 45° being carried out randomly. For example, the polarization rotator is produced with a half-wave delay plate whose rotation is ensured by an actuator.

[0107] The bases, in this case, include for example: - a first Horizontal / Vertical (H / V) base in which "1" is coded by a photon with a 0° polarization axis and "0" by a 90° polarization photon; - a second Diagonal / antidiagonal (D / A) basis in which "0" is coded by a photon with a 45° polarization axis and "1" by a photon with a 135° polarization axis.

[0108] The quantum reception block 22 comprises a polarization block, named Pol 132, and a measurement block 131.

[0109] Before the expected arrival of a photon, the Pol 132 block is adapted to carry out a polarization rotation in order to randomly choose a base from the two H / V and D / A bases. The Pol 132 block comprises a polarization rotator, capable of rotating the polarization of the emitted light signal, selectively from 0° (if choice of H / V base by the Pol 132 block) or 45° (if D / A base chosen). For example, the polarization rotator is made with a half-wave delay blade whose rotation is ensured by an actuator.

[0110] The measuring block 131 is adapted to measure two light components in quadrature at the output of the polarization rotator Pol 132, either on the H / V basis if the polarization rotation is 0°, or on the D / A basis if the polarization rotation is 45°. For example, the measuring block is produced with a polarizing beam splitter (PBS) generating a quadrature, and two photon detectors (SPD) for the two components of the quadrature.

[0111] It is recalled here that a photon can be polarized along any axis. A photon polarized along an axis of angle 'a' passing through a polarizing filter along an axis of angle 'b' has a probability equal to cos2(ba) of passing the polarizing filter, according to Malus's law.

[0112] According to the quantum properties used by quantum cryptography: - when the probability of passing the filter is neither 0 nor 1, the passage of an individual photon through the filter is fundamentally unpredictable and indeterministic; - the polarization axis can only be known by using a polarizing filter (or more generally, by making a measurement whose result is YES or NO) and with a large number of measurements to estimate the probability of passage; there is no direct measurement, giving an angle for example, of the polarization axis of the photon; - the initial polarization axis of the photon can only be known if the filter axis is oriented precisely at 0° or 90° relative to that of the photon. In the case of another orientation of the filter (45° for example), there is fundamentally no way of knowing what the initial polarization axis of the photon was.

[0113] The steps of a QKD method are now described with reference to [Fig.2].

[0114] The starting context is as follows: Alice wants to share a secret key with Bob to enable them to carry out encrypted transmissions with maximum security. For her part, Eve attempts to intercept the communications to determine the key. In accordance with Kerckhoff's principles (worst-case hypothesis), we assume, for example, that Eve has access to the communication channels used by Alice and Bob, that she knows the protocol used perfectly and has unlimited computing resources. The security of encrypted communications between Alice and Bob is then ensured solely by the secret key that the process described below results in generating and distributing.

[0115] QUANTUM PHASE

[0116] Generally, only this phase uses the quantum channel, the post-processing phase does not use it.

[0117] Step 101

[0118] In this step 101:

[0119] - in response to a corresponding command from control block 11 to block GEN 121, the GEN 121 block randomly generated a sequence of N0 qubits therefore taking the value 0 or 1;

[0120] - following receipt of a respective command from control block 11 to block Pol 122, the Pol 122 block randomly chooses, for each generated bit, a polarization base from among the two polarization bases and emits on the quantum channel 30, photon by photon, a photon whose polarization is a function of the value of the generated bit and the polarization base chosen for this qubit; each photon is emitted at regular intervals. The qubits are thus transmitted.

[0121] The generated qubit sequence is then stored by the control block 11 in the memory 14 and the value of each bit is stored there, associated with the rank of the bit in the sequence and the polarization base chosen for the bit by the Pol block 122.

[0122] Step 102

[0123] Under the control of the control block 21, before the expected arrival of each photon, the Pol block 132 randomly chooses a base (by positioning the rotator randomly). At the expected time of arrival of a photon, under the control of the control block 21, the measurement block 131 performs a measurement of what comes out of the filter on the selected components. The control block 21 determines the value of the qubit corresponding to the received photon as a function of the measurement carried out and the base chosen for the measurement (corresponding to the orientation chosen of the filter by the polarizing filtering block 132) and stores in the memory 24, for each received photon, the value of the determined qubit, in association with the reception rank of the photon (and therefore of the qubit) and the chosen base.

[0124] [Fig.3] represents in a table, the rank number of the first 8 bits of a sequence generated in step 101 (first line of the table) and the randomly generated value for these bits (second line). These bits thus take the following values: 0 for the bit of rank 1, 4, 6 and 7 and 1 for the bit of rank 2, 3, 5 and 8.

[0125] The third line indicates the base chosen for the emission of each bit by the D_ALICE 10 device: the “+” sign indicates that the H / V base has been chosen while the “x” sign indicates that the D / A base has been chosen. Thus for bits of rank 1, 2, 4 and 8, the H / V base has been chosen, and the D / A base has been chosen for bits of rank 3, 5 to 7.

[0126] The 4th line indicates the polarization of the emitted photon: vertical for the bit of rank 1, 4, horizontal for the bit of rank 2 and 8, diagonal for the bit of rank 6 and 7, anti- diagonal for bits of rank 3 and 5.

[0127] The fifth line of the table indicates the base chosen by the D_BOB 20 device, in reception: H / V for the photon received at rank 1, 5, 7 and 8 and D / A for the photon of rank 2, 3, 4 and 6.

[0128] Finally, the sixth line illustrates the result of the measurement by the device D_BOB 20: for photons of rank 1, 3, 6, 8 the measurement base corresponds to the emission base and the polarization of the detected photon generally corresponds to the polarization at the emission of the photon; for photons of rank 2, 4, 5, 7 the measurement base is different from the emission base and the polarization of the detected photon is totally random. The value of the determined qubit stored in the memory 24 is 0 for the photon of rank 1 and 6 and is 1 for the photon of rank 3 and 8. POST-PROCESSING PHASE

[0129] Step 103 (sifting)

[0130] In a step 103:

[0131] - the controller 11 of the D_ALICE 10 device indicates to the D_BOB 20 device, via the RF transmission / reception block 13, by a message transmitted on the conventional channel 40, the polarization base chosen for each qubit of the sequence transmitted in step 101;

[0132] - the controller 21 of the device D_BOB indicates to the device D_ALICE, via the block RF transmission / reception 23, by a message transmitted on the conventional channel 40, the polarization base chosen for each photon of the sequence received in step 102;

[0133] - each controller 11, respectively 21, then compares for each rank in the sequence, the chosen polarization base received on the classical channel 40 and the polarization base associated with this rank which is stored, in the memory of the device 10, respectively 20; it selectively retains (Sifting step) only the qubits generated (D_ALICE 10) and measured (D_BOB 20) on the same base. Statistically only 50% of the bits are retained.

[0134] All these retained qubits were transmitted to Bob, with a probability of 1-e, that is to say, to the errors induced by noise, adjustment / synchronization defects and implementation imperfections. Sifting made it possible to discard the qubits whose detection was carried out on a basis other than the generation basis, these qubits being unreliable (50%: therefore random). Each retained qubit is identified by its rank in the sequence emitted by D_ALICE / received by D_BOB.

[0135] In the example in [Fig.3], the bits of rank 1, 3, 6 and 8 are thus the only ones retained, among the first eight bits of the sequence, for the rest of the steps.

[0136] Step 104

[0137] Control blocks 11 and 21 then evaluate the transmission error rate of the qubits (QBER for 'Quantum Bit Error Rate') separating their respective sets of bits retained in step 103 of sfiting, in order to detect possible interception by Eve, to evaluate the quantity of information intercepted by Eve on the quantum channel during transmission in step 101 and to possibly select, depending on the evaluated error rate, an error-correcting code (choice of code and efficiency) or to configure an iterative error-correcting protocol by request / response for the rest of the processing. To do this, a certain number of qubits are "sacrificed" since they are communicated on the classical channel 40: they are also removed from the bits retained by the control blocks 11 and 21 for the rest of the post-processing.

[0138] Depending on the comparison between this error rate evaluation and a given threshold (determining whether a third party has listened to the quantum channel during the transmission of the qubits), the present distribution operation is terminated (which can then be reinitiated from step 101); otherwise, step 105 is implemented.

[0139] Step 105

[0140] In this step 105, with reference to [Fig.4], each control block 11, respectively 21, in parallel with one another, partitions into three sets the M qubits resulting from the sifting 103 and retained at the end of step 104, according to a common and predefined partition rule: - a set 60_l of N qubits, intended to constitute the Sifted Key respectively for Alice and Bob (the partition rule defines them for example as the N bits of lowest rank, or of highest rank); - and the remaining MN qubits are divided into two sets: a set of 60_2 qubits with value 0 and a set of 60_3 qubits with value 1.

[0141] The control block 11, 21 stores in memory 14, 24, for each of the M bits, an indication of the set 60_l, 60_2 or 60_3 to which this bit has been assigned, in association with the value of the bit.

[0142] The set 60_2 of bits with value 0 has P bits and the set 60_3 of bits with value 1 has Q bits. Random generation is assumed to produce '0's and '1's independently and equi-probably. For MN large enough, for example greater than 20, in general P ~ Q.

[0143] In the example shown in [Fig.3], M = 105, N = 100, P = 3 and Q =2.

[0144] The list 61 of index numbers in [Fig.4] indicates the index number associated with each of the M qubits. Depending on the embodiments, the index number is equal to the rank (i.e. order number) of the qubit in the transmitted / received sequence (before sifting), or is equal to the rank of the qubit in the M qubits retained (after sifting) among the N0 bits transmitted or more generally determined as a function of such a rank of the qubit among the qubits. In particular, if the index number is different from the rank, the control block 11, 21 further stores in memory 14, 24, for each of the M bits, the index number associated with this bit. The rule for defining the index number is of course common to the D_ALICE 10 and D_B0B 20 devices and is predefined.

[0145] In the example of [Fig.4]:

[0146] - the index numbers of the qubits assigned to the set 60_2 of qubits equal to 0 are: 101, 102 and 104, while the index numbers of the qubits assigned to the set 60_3 of qubits equal to 1 are: 103, 105;

[0147] - the Sifted Key is defined by the sequence of qubits associated with index numbers 1 to 100.

[0148] The qubits of sets 60_2 and 60_3 are intended to subsequently and possibly carry parity information, as will be described below: in fact, only some of them will a priori actually be used, chosen according to the parity values ​​which will have to be transmitted between devices 10 and 20.

[0149] Due to limitations of photon sources and photon detectors, imperfections in implementation, adjustments or synchronization, the N bits of the Sifted Key retained at this stage by D_ALICE and D_BOB are not generally perfectly identical. Step 106 below of the reconciliation phase aims to detect / correct the residual errors of the N qubits of the “Sifted Key” key determined respectively by D_ALICE and D_BOB, using an error correcting code of the FEC (Forward Error Correction code) type, or an interactive and iterative request / response protocol between Alice and Bob, to determine and transmit parity bits associated with subgroups (i.e. packets) of the N qubits of the “Sifted Key”, in order to detect / correct the residual errors between Alice’s key and Bob’s key and so that they then have a strictly identical key.

[0150] Redundant parity type information is then generated either by D_ALICE 10, or by D_BOB 20, or by both.

[0151] As described below, these parities are transmitted (indirectly via the public channel and the quantum channel) to the other party, so that the latter can identify the residual errors on a sifted key relative to the other (Alice / Bob), in accordance with the error detection and correction protocol selected, depending on the parities received and its own sifted key.

[0152] Step 106

[0153] In one embodiment, in a step 106, each control block 11, 21, in parallel with one another, calculates parity bits from subgroups of the N bits of the Sifted Key in step 105, according to the error detection and correction protocol chosen (here iterative protocol of Cascade or Winnow type) (the value of the parity bits is therefore not dependent on the bits of the sets 60_2 and 60_3).

[0154] The values ​​of the parity bits calculated by each control block 11, respectively 21 are stored in memory 14, 24.

[0155] To inform D_ALICE 10, respectively D_BOB 20, of the values ​​of the bits calculated parity bits, the control block 21, respectively 11, does not transmit the values ​​of these parity bits on the classical channel 40, but instead, it transmits on the classical channel 40 the index numbers of qubits selected from the sets 60_2 and 60_3 which encode the value of the parity bits.

[0156] For example, for each parity bit considered, the control block 11, respectively 21, if the parity bit is equal to 0, selects (for example randomly) a bit from the set 60_2, and transmits on the conventional channel to D_BOB 20, respectively D_ALICE 10, the index number (101, 102 or 104 in the case of [Fig.4]) associated with the selected bit to indicate the value of the parity bit considered (the chosen QKD protocol defines the bits of the sifted key according to which the parity bit was calculated). If the parity bit is equal to 1, a bit from the set 60_3 is selected (for example randomly), and the control block 11, respectively 21, transmits on the conventional channel to D_BOB 20, respectively D_ALICE 10, the index number (103 or 105) associated with the selected bit to indicate the value of the parity bit considered.

[0157] Step 107

[0158] In one embodiment, in a step 107, each control block 11, 21, in parallel with one another, receives on the conventional channel a message comprising the bit index number of one of the sets 60_2 and / or 60_3 which codes the parity bit for a subgroup of bits of the Sifted Key 60_1; it finds in its memory 14, 24, the value 0 or 1 of the bit associated with the index number received. It then compares with the value of the parity bit that it itself calculated for this same subgroup of bits. The residual errors between the Sifted Key 60_1 held by D_ALICE 10 and D_BOB 20 can thus be detected and corrected according to this comparison carried out for each parity bit. This process makes it possible to obtain, in D_ALICE and D_BOB, a strictly identical secret key, shared between Alice and Bob.

[0159] An iterative protocol of the Cascade or Winnow type involves a variable number of requests / responses between D_ALICE 10 and D_BOB 20, depending on the number of residual errors; an error-correcting code of the FEC (Forward Error Correction code) type involves a single message sent by one of the devices 10, 20 to detect / correct the residual errors. The exchanges take place on the public channel 40.

[0160] Steps 106, 107 above describe by way of example the case of an iterative protocol of the Cascade or Winnow type (calculation of the parity bits in the devices 10, 20 transmission by each device to the other, comparison in each device).

[0161] In the case of the use of a protocol of the LDPC FEC code type, according to the embodiments:

[0162] - the control block D_Alice 11 calculates for example the parity bits from the bits of Alice's sifted key; these parities are passed to check block 21 of D_BOB 20, which decodes them with its version of sifted key, to identify errors on its key (Bob); then D_Bob corrects its errors (in a particular embodiment, there is no calculation of parity bits by D_BOB, nor any comparison between parity bits that it would have received and others that it would have calculated according to its sifted Key); and / or or

[0163] - the control block of D_BOB 21 calculates for example the parity bits from the bits of Bob's sifted key; these parities are transmitted to the control block 11 of D_ALICE 10, which decodes them with its version of the sifted key, to identify errors on its (Alice's) key; then D_ALICE corrects its errors (in a particular embodiment, no calculation of parity bits by D_ALICE, nor comparison between parity bits that it would have received and others that it would have calculated based on its sifted key).

[0164] Whatever the error detection and correction protocol chosen, the principle remains the same: transmit information to the other device to access the parity values ​​on the public channel by transmitting the indexes of the qubits of the sets 60_2 and 60_3 (neither the values ​​of these qubits nor the values ​​of the parity bits being transmitted on the public channel).

[0165] Step 108

[0166] A secret amplification step implements hash functions to combine the bits of the key obtained at the end of step 107 and thus reduce Eve's information on the final key, at the cost of reducing the size of the key. Hash functions are very difficult to invert, with chaotic behavior, and can be used to generate pseudo-random numbers. They often use modular arithmetic.

[0167] Example of a hash function: Carter's original proposal was to choose the first IUI and def rar

[0168] At the end of step 108, Alice and Bob have a shared secret key, which they then each use as a symmetric encryption key to encode and decode messages exchanged between them on the public channel or another channel.

[0169] Variant: several qubits to encode a parity bit

[0170] A variant consists in step 106, of using several qubits (and not just one) to encode the value of a parity bit. This allows Alice / Bob to be given an advantage in developing a shared key, and to penalize Eve in searching for this key. Such a variant allows the use of soft decision error correcting codes (more efficient) and to dilute the reliability of the 50% of parity bits accessible to Eve.

[0171] In such a variant, in the control block 11, 21 of the telecommunications device D_ALICE / D_BOB, the values ​​of the parity bits are determined according to a known coding technique: FEC correcting codes, for example of the soft decoding type such as an LDPC FEC code, iterative protocols (Cascade or Winnow type). For each parity bit to be transmitted, the control block 11, 21 uses a code to represent the binary value with a group of t bits carried by t qubits.

[0172] For example, a 3-bit repetition code (3 qubits associated with the same binary value, but not necessarily the same base) can be used to represent a parity bit. The LLR (Logarithmic Likelihood Ratio) of the value of the bit thus coded is then the sum of the LLRs of the binary values ​​of the 3 qubits. [°1731 LLR(b) = '^^ V 7 log(PO=l))

[0174] TJ n _ TT n parity l—tqubit(i)

[0175] This makes it possible to filter out infrequent cases of transmission / detection error (if 1 qubit is incorrectly transmitted, the other 2 are sufficient to compensate so that the detection is correct on the group of 3 qubits). The control block 11,21 transmits the indexes of all the parity support qubits. For this example, this makes three times as many parity support qubits. The destination block 21,11 receives these indexes, then for each parity bit, accesses in memory 14, 24 the values ​​of the t qubits associated with these indexes and proceeds with decoding to determine a probability of the binary value. For example, with the three-bit repetition code, a weighted sum of the binary values ​​of the three qubits is used. This makes it possible to quantify the likelihood of the binary value more precisely, and to reduce the transmission error rate of the qubits (e).The receiving control block 21.11 then implements a decoding algorithm (for this example: LDPC) with soft decision, using quantified probabilities as input.

[0176] Before sifting, the qubits are transmitted with a typical error rate of 50%. After sifting, the retained qubits are assigned an error rate e (typically a few %). After sifting, the likelihood of the value of a parity bit is reinforced (statistically, on average) when several (t) qubits are used to carry / encode this value. This amounts to using a correcting code for each parity bit, or to reducing the error rate e. This likelihood is then no longer constant (probability of 1- e with a single qubit / parity bit), it is variable depending on the realizations of the p qubits. It is then advantageous to use soft decision decoding techniques (e.g.: LDPC codes) which are more efficient than hard decision (binary) decoding solutions.

[0177] On the other hand, knowing that 50% of the qubits measured by Eve are not reliable (50% reliability: comparable to random noise), the combination of several qubits to represent a parity bit leads to a dilution of the reliability of the parity bits. for Eve.

[0178] According to the invention, the transmission of the information for the parities is carried out indirectly and successively by the quantum channel, then by the public channel: the random qubits serving as a reserve to code the parities are transmitted on the quantum channel, as a potential support for undefined information; after sifting, the retained qubits can be used to carry information and the public channel is then used to transmit qubit indices carrying the parity information. The recipient determines the parity information from the reception of these indices, which it uses as an address for the qubit values ​​(previously received on the quantum channel) stored in memory 14, 24. The parity values ​​are therefore transmitted indirectly by address on the public channel.

[0179] Eve can access the index information of the qubits corresponding to the parity bits, but she cannot access the respective values ​​of all these qubits transmitted on the quantum channel. Eve can typically know 50% of the values ​​of the qubits. The parity values ​​are obtained, for Alice and Bob, by accessing the qubits carrying the parity information via their indexes. Alice and Bob having previously carried out a sifting, they can access the correct values ​​with a probability of 1-e. On the other hand, Eve can access 50% of the correct values ​​of the parities with a probability of 1-e, the remaining values ​​(half) being totally undefined (0 or 1 with a likelihood of 50%).

[0180] As described, several qubits can be used to carry the information of a parity bit, to strengthen the probability of correct value detection by Alice and Bob, and degrade the reliability of estimation of the parity bits by Eve (the 50% of correctly received qubits will be combined with uncertain qubits).

[0181] Generally speaking, all QKD protocols have in common the fact of implementing reconciliation and error correction processing to generate two identical keys from raw keys (qubits transmitted on the quantum channel). The invention proposed here is applicable to all QKD protocols, regardless of the coding mode (e.g.: by polarization / phase / ...) and the variants of these protocols.

[0182] In particular, the invention has been described above with reference to the implementation of the transmission of random binary information by the random polarization of photons, for example in the context of the BB84 protocol; the invention is however applicable to any protocol (e.g.: E91, B92, etc.) and system for generating a symmetric key of the QKD type, among others QKD protocols with discrete variables, with other quantum parameters used to code the bits, for example the frequency or the phase of a photon, optionally in a differential manner (frequency-coded QKD or phase-coded QKD or Differential Phase-coded QKD; in the case of the use of the phase, coding is based on a phase modulator instead of a rotator / polarization modulator) instead of or in addition to photon polarization, protocols (GG02) using continuous variables, and / or using the transmission of several photons per bit...

[0183] Similarly, even if an example of coding a single bit per photon has been considered above, the invention also applies in the case where a parameter of the photon transmitted on the quantum channel codes several bits, based for example on protocols making it possible to code several bits per light pulse such as the GG02, GMCS Gaussian Modulated Coherent-States protocols

[0184] Furthermore, the invention can also be implemented in embodiments without random choice of base used in reception and / or transmission, such as for example in a Differential Phase-coded QKD protocol; the step of correcting residual errors is then nevertheless always necessary.

[0185] The invention can also be implemented in embodiments where the QKD protocol employed uses the polarization of the photons to code the bits, but with a number of states considered different from the four states considered in BB84: for example BB92 uses 2 polarizations, SSP uses 6.

[0186] The steps incumbent on the control block 11, 21 described above may be implemented by the execution of software instructions on a processor. Alternatively, they may be implemented by dedicated hardware, typically a digital integrated circuit, either specific (ASIC) or based on programmable logic (for example FPGA / Field Programmable Gate Array).

[0187] The term “bit” designates the binary information itself (“0” or “1”), the term “qubit” designates more specifically this binary information when it is carried by a quantum state of an elementary particle, in particular of a photon (i.e. generation and polarization in the device 10, propagation in the quantum channel and measurement in the device 20); however, in the preceding description, one or the other of the two terms may have been used indistinctly to designate the corresponding binary information.

[0188] It will be noted that the random choice of the polarization base, both in transmission and in reception, can be achieved in different ways: as described below, with a polarization rotator and beam splitter, or by mechanical switching of a polarization rotator, etc., using known techniques.

[0189] Furthermore, in embodiments, the implemented QKD protocol is based on entanglement (for example E91 protocol) for which the photons are generated by a source which may be external to Alice and Bob. In this case, Alice does not generate the binary sequence: Alice and Bob receive this sequence and are like 2 receivers which agree between them on the decoding of the sequence of qubits received, with random basic choices (A and B), in accordance with steps 103 (for sifting in particular) and following described above.

Claims

Claims

1. Method for quantum distribution of secret key between a first and a second telecommunication device (D_ALICE, D_BOB) connected by a first and a second telecommunication link, said first link (30) being an optical transmission link and being hereinafter called quantum channel, said second teletransmission link being hereinafter called classical channel (40); said method comprising the following steps implemented by the first device (D_ALICE): - generation of a random sequence of bits by the first device; - for each bit considered successively in the generated sequence, coding of said bit at least by a value of a parameter defining a quantum state of a respective light pulse comprising at least one photon, said value of the parameter being determined as a function of at least the value of said bit; a light pulse having said parameter value then being emitted on the quantum channel and to the second device following said coding; - at least one step among steps j and jj below: - a step j comprising at least - a calculation of parity bits as a function of bits of the generated sequence; and - a transmission, to the second device, of information relating to the calculated parity bits; - a step jj comprising at least: - reception of information from the second device and relating to parity bits calculated by said second device as a function of the reception, by the second device, of the light pulses emitted by the first device; then - error detection in said bit sequence based on the values ​​of said information relating to the parity bits received; said method being characterized in that the following steps are further implemented by the first device (D_ALICE): - distribution of at least some of the bits of the generated sequence into 3 separate sets of bits, each bit being associated with an index number depending on its rank within at least said certain bits: a first set of bits to define the secret key, a second set of bits equal to 0 and a third set of bits equal to 1; each bit of at least the second and third sets being associated, in a memory of the first device, with its index number; - if step j is implemented, said step j comprises the following steps: (jO) parity bits are calculated based on bits of the first set; (j 1) according to a predetermined code, coding of the value of each parity bit calculated by a sequence of bits bl b2.. .bn of length n greater than or equal to 1; (j2) for each bit bi, i = 1 to n: if and only if bi = 0, selection of one of the bits of the second set and if and only if bi = 1, selection of one of the bits of the third set; (j3) said transmission of information relating to the calculated parity bits comprises the transmission, on the conventional channel, for each calculated parity bit, of a sequence indl ind2 .. .indn where indi, i=l to n, indicates the index number associated with said bit selected in the second or third set in step j2 for the bit bi; - if step jj is implemented, said step jj comprises the following steps: jjO / the information received from the second device comprising, for each of said parity bits, a sequence indl ind2 .. .indn where indi, i = 1 to n with n > 1, indicates an index number associated with a bit in the second or third set, for each parity bit: determination of the value of the bit bi associated, in the memory of the first device, with the index number indi for i = 1 to n, and decoding according to a determined code, the value of each parity bit as a function of the sequence of bits bl b2.. .bn determined for said parity bit; jjl / said error detection is an error detection in the first set of bits to define the secret key and is performed according to of the said values ​​of the parity bits thus decoded.

2. Method for quantum distribution of secret key according to the preceding claim, according to which: if the value of bi is 0, the information transmitted relating to bi indicates the index number of the selected bit of the second set and if the value of bi is 1, the information transmitted relating to said bit thus indicates the index number of the selected bit of the third set; said selection being carried out by drawing.

3. Method for quantum distribution of secret key according to one of the preceding claims, according to which: - the first device (D_ALICE) comprises at least two distinct coding bases between values ​​of said parameter and the values ​​0 or 1 of a bit; - the first device (D_ALICE) randomly selects, for each bit considered in the generated sequence, a base from among the at least two distinct bases, to carry out said bit coding by said value of said light pulse parameter and stores, for each bit of the sequence, an indication of the selected base;- after the emission of the light pulse, transmission by the first device (D_ALICE) to the second device (D_BOB) on the conventional channel of the indication of the base that the first device (D_ALICE) has selected for each bit of the sequence and reception from said second device (D_BOB), on the conventional channel, of the indication, for each bit of the sequence, of the base that said second device (D_BOB) has selected to evaluate the value of said bit of the sequence; - comparison, for each bit of the sequence, of the stored and received base indications and identification of the bits of the sequence for which the base selected by the first device and the second device are identical; - the first, second and third sets of bits are composed of bits thus identified.;

4. Computer program, intended to be stored in the memory of a first device and further comprising a microcomputer, said

5. computer program comprising instructions which, when executed on the microcomputer, orchestrate the steps of a method according to one of the preceding claims. Telecommunication device (D_ALICE) being adapted to be connected to another telecommunication device (D_BOB) by a first and a second telecommunication link, said first link (30) being an optical transmission link and being hereinafter called quantum channel, said second teletransmission link being hereinafter called classical channel (40); said device (D_ALICE) being adapted to generate a random sequence of bits and for each bit considered successively in the generated sequence, to code said bit at least by a value of a parameter defining a quantum state of a respective light pulse comprising at least one photon, said value of the parameter being determined as a function of at least the value of said bit, and to emit, on the quantum channel and to the other device, a light pulse having said parameter value; said device (D_ALICE) being adapted to carry out at least one operation among operations j and jj below: - an operation j comprising at least - a calculation of parity bits as a function of bits of the generated sequence; and - a transmission, to the other device, of information relating to the calculated parity bits; - a jj operation comprising at least: - reception of information from the other device and relating to parity bits calculated by said other device as a function of the reception, by the other device, of the light pulses emitted by the device; then - error detection in said bit sequence based on the values ​​of said information relating to the parity bits received; said device (D_ALICE) being characterized in that it is adapted to distribute at least some of the bits of the generated sequence into 3 distinct sets of bits, each bit being associated with an index number depending on its rank within at least said certain bits: a first set of bits to define a secret key, a second set of bits equal to 0 and a third set of bits equal to 1; each bit of at least the second and third sets being associated, in a memory of the device, with its index number; - if the device performs operation j, the device is suitable for, during said operation: jO / calculate the parity bits as a function of bits of the first set; j 1 / code, according to a predetermined code, the value of each parity bit calculated by a sequence of bits bl b2.. .bn of length n greater than or equal to 1; j2 / for each bit bi, i = 1 to n: if and only if bi = 0, select one of the bits from the second set and if and only if bi = 1, select one of the bits from the third set; j3 / to transmit the information relating to the calculated parity bits: transmit, on the conventional channel, for each calculated parity bit, a sequence indl ind2 .. .indn where indi, i=l to n, indicates the index number associated with said bit selected in the second or third set in step j2 for the bit bi; and / or - if the device performs operation jj, the device is suitable for, during said operation: jjO / the information received from the other device comprising, for each of said parity bits, a sequence indl ind2 .. .indn where indi, i = 1 to n with n > 1, indicates an index number associated with a bit in the second or third set, for each parity bit: determine the value of the bit bi associated, in the memory of the device, with the index number indi for i = 1 to n, and decode according to a determined code, the value of each parity bit as a function of the sequence of bits bl b2.. .bn determined for said parity bit; / jj 1 carry out, based on said values ​​of the parity bits thus decoded, said error detection in the first set of bits to define the secret key.

6. Method for quantum distribution of secret key with respect to a first and a second telecommunication device (D_ALICE, D_BOB) each connected to a respective first telecommunication link and connected to each other by a second telecommunication link, said first link being an optical transmission link and being hereinafter called quantum channel, said second telecommunication link transmission being hereinafter called classical channel; said method comprising the following steps implemented by the second device (D_BOB): - receiving a sequence of light pulses on the quantum channel such that for each light pulse of the received pulse sequence, a measurement of a parameter of the light pulse is carried out; - for each light pulse, estimation of the value of at least one bit coded by said pulse as a function of said measurement of the parameter; the bits estimated as a function of the light pulses of the sequence defining a sequence of bits; - at least one step among steps j and jj below: - a step j comprising at least: - a calculation of parity bits as a function of bits of said sequence; and - a transmission, to the first device (D_ALICE), of information relating to the calculated parity bits; - a step jj comprising at least: - receiving information from the first device and relating to parity bits calculated by said first device; then - detecting errors in the sequence of bits as a function of the information received relating to the parity bits; said method being characterized in that the following steps are further implemented by the second device (D_BOB): - distribution of at least some of the bits of the sequence into 3 distinct sets of bits, each bit being associated with an index number depending on its rank within at least said certain bits: a first set of bits to define the secret key, a second set of bits equal to 0 and a third set of bits equal to 1; each bit of at least the second and third sets being associated, in a memory of the second device, with its index number; - if step j is implemented, said step j comprises the following steps: jO / parity bits are calculated based on bits from the first set; j 1 / according to a predetermined code, coding of the value of each parity bit calculated by a sequence of bits bl b2.. .bn of length n greater than or equal to 1; j2 / for each bit bi, i = 1 to n: if and only if bi = 0, selection of one of the bits of the second set and if and only if bi = 1, selection of one of the bits of the third set; j3 / said transmission of information relating to the calculated parity bits comprises the transmission, on the conventional channel, for each calculated parity bit, of a sequence indl ind2 .. .indn where indi indicates the index number associated with said bit selected in the second or third set in step j2 for the bit bi; - if step jj is implemented, said step jj comprises the following steps: the information received from the first device comprising, for each of said parity bits, a sequence indl ind2 .. .indn where indi, i = 1 to n with n > 1, indicates an index number associated with a bit in the second or third set, for each parity bit: determination of the value of the bit bi associated, in the memory of the second device, with the index number indi for i = 1 to n, and decoding according to a determined code, the value of each parity bit as a function of the sequence of bits bl b2.. .bn determined for said parity bit; said error detection is an error detection in the first set of bits for defining the secret key and is carried out according to said values ​​of the parity bits thus decoded.

7. Method for quantum distribution of secret key according to the preceding claim, according to which: if the value of bi is 0, the information transmitted relating to bi indicates the index number of the selected bit of the second set and if the value of bi is 1, the information transmitted relating to said bit thus indicates the index number of the selected bit of the third set; said selection being carried out by drawing.

8. Method for quantum distribution of secret key according to one of claims 6, 7, according to which: - the second device (D_BOB) comprises at least two distinct bases of correspondence between values ​​of the parameter and the values ​​0 or 1 of an estimated bit, from among several distinct bases, and the second device (D_BOB) randomly selects, for each pulse considered in the pulse sequence, a base from among the at least two distinct bases, to carry out the estimation of the value of at least said bit as a function of the measurement of said parameter and stores, for each bit of the sequence, which base has been selected; - after the reception step, the second device (D_BOB) sends to the first device (D_ALICE) on the conventional channel the indication of the base that the second device (D_BOB) has selected for each bit of the bit sequence, as stored and receives from said first device (D_ALICE) on the conventional channel the indication of the base that said first device (D_ALICE) has selected to code each bit of the sequence;- comparison, for each bit of the sequence, of the stored and received base indications and identification of the bits of the sequence for which the base selected by the first device and the second device are identical; - the first, second and third sets of bits are composed of bits thus identified.;

9. A computer program, intended to be stored in the memory of a second device (D_BOB) and further comprising a microcomputer, said computer program comprising instructions which, when executed on the microcomputer, implement the steps of a method according to one of claims 6 to 8.

10. Telecommunication device (D_BOB) adapted to be connected to a first telecommunication link and to be connected to a second telecommunication link connecting said device to another telecommunication device (D_ALICE), said first link being an optical transmission link and being hereinafter called quantum channel, said second teletransmission link being hereinafter called classical channel; said device (D_BOB) being adapted to receive a sequence of light pulses on the quantum channel and for each light pulse of the received pulse sequence, perform a measurement of a parameter of the light pulse; said device (D_BOB) being adapted to estimate, for each light pulse, the value of at least one bit coded by said pulse as a function of said measurement of the parameter; the bits estimated as a function of the light pulses of the sequence defining a sequence of bits; said device (D_BOB) being adapted to carry out at least one operation among operations j and jj below: - an operation j comprising at least: - a calculation of parity bits as a function of bits of said sequence; and - a transmission, to the other device (D_ALICE), of information relating to the calculated parity bits; - a jj operation comprising at least: - receiving information from the other device relating to parity bits calculated by said other device; then - detecting errors in the bit sequence based on the information received relating to the parity bits; said device (D_BOB) being characterized in that it is adapted to distribute at least some of the bits of the sequence into 3 distinct sets of bits, each bit being associated with an index number depending on its rank within at least said certain bits: a first set of bits to define a secret key, a second set of bits equal to 0 and a third set of bits equal to 1; each bit of at least the second and third sets being associated, in a memory of the device, with its index number; - if the device performs operation j, the device is suitable for, during said operation: jO / calculate the parity bits as a function of bits of the first set; j 1 / code, according to a predetermined code, the value of each parity bit calculated by a sequence of bits bl b2.. .bn of length n greater than or equal to 1; j2 / for each bit bi, i = 1 to n: if and only if bi = 0, select one of the bits from the second set and if and only if bi = 1, select one of the bits from the third set; j3 / to transmit information relating to parity bits calculated: transmit, on the classic channel, for each calculated parity bit, a sequence indl ind2 .. .indn where indi indicates the index number associated with said bit selected in the second or third set in step j2 for the bit bi; - if the device performs operation jj, the device is suitable for, during said operation: the information received from the other device comprising, for each of said parity bits, a sequence indl ind2 .. .indn where indi, i = 1 to n with n > 1, indicates an index number associated with a bit in the second or third set, for each parity bit: determining the value of the bit bi associated, in the memory of the device, with the index number indi for i = 1 to n, and decoding according to a determined code, the value of each parity bit as a function of the sequence of bits bl b2.. .bn determined for said parity bit; performing, based on said values ​​of the parity bits thus decoded, said error detection in the first set of bits to define the secret key.

Images