DARPA Quantum Network

This information is sourced from:
Chip Elliot (3 December 2004) The DARPA Quantum Network.

DARPA QKD network
QKD is limited by distance through either fiber channels or freespace, which cannot be combined due to ‘frequency propagation and modulation’ problems. Often this can result in quantum links having a single point of failure due to only having a single channel. The DARPA network has attempted to resolve this by creating a QKD network ‘rather than stand-alone links’.

The DARPA network (when this article was published) consisted of six QKD nodes, of which four are weak-coherent systems and the other two are high-speed freespace systems.

The weak coherent system consists of two transmitters, Alice and Anna, which followed the BB84 protocol, and two receivers, Bob and Boris. This system also contained a 2×2 switch to allow the coupling of any of the transmitters with any of the receivers. ‘Alice, Bob, and the switch are in BBN’s laboratory; Anna is at Harvard; and Boris is at Boston University (BU). ‘ The switch is located 10km from Harvard and 19km from BU, which results in the Harvard-BU fiber path being 29km long.

The transmitter, Anna, has a mean photon number of 0.5, with the Anna-Bob path having a delivery speed of ‘1000 privacy-amplified secret bits/second’ with an average QBER of 3%.

The BBN-BU path has attenuation of 11.5dB, which results with the network having a mean photon number of 1.0, but a secret key yield of zero.

The freespace system consists of Ali and Baba, which are ‘electronic subsystems for a high-speed freespace QKD system’. The same BBN QKD protocols are run on this system, and have a link into the network via a key relay between Ali and Alice. (This system, in December 2004, contained ENT nodes that weren’t fully operational.)

This article provides a list of parameters that can be considered for classical encryption methods.

  • Protection of keys
    QKD systems provide keys that have not been encrypted via an algorithm, which provides greater long term security with respect to the processing ability of supercomputers and quantum computers.
  •  Authentication
    QKD doesn’t provide authentication of the key.
  • Robustness
    Point-to-point links contain a single point of failure unless there is redundancy created by creating multiple point-to-point interconnected links.
  • Distance and location Independence
    Due to attenuation in fiber and sensitivity of freespace environments, QKD systems to do not have large distances or location independence.
  • Resistance to traffic analysis
    This is weak due to the point-to-point link approach of most QKD systems.

The conclusive summary of these parameters for QKD, is that although QKD provides great protection of keys, it doesn’t have an intrinsic authentication system, nor does it have strong results for the other parameters.

The DARPA network attempts to increase the robustness and distance of a QKD system by creating a network that contains the links and endpoint all connected together.


In the above diagram, A1 and B1 are the Alice/Bob pair, A2 and B2 are the freespace Ali/Baba pair, A3 and B3, and A4 and B4, are also fiber-connected pairs. QKD networking protocols allow the A1 node to agree on a key with nodes that are multiple ‘hops’ away. For instance, two transmitting nodes A1 and A3 can agree on a key pair via the B1 node as a trusted intermediary.

A photon can be transmitted across an untrusted network to its endpoint node without being measured by the switches. In other words, the information is shared between two nodes within the network, without being shared within the network itself. The negative aspect of untrusted switched, is that each switch ‘adds at least a fractional dB insertion loss along the photonic path.’

A photon can also be transmitted across a trusted network to an end path node, where the intermediary nodes have ‘pairwise agreed-to keys’, which are used to ‘securely relay a key “hop-by-hop” from one endpoint to another.’ Each node along the transmission pathway decrypts then encrypts the photon using the pairwise keys. This results in the key being securely encrypted across each link.

The benefits of a QKD network are as follows:

  • Longer distance
    As a single key can now be distributed over multiple nodes, the ‘geographic reach’ of the quantum key has been increased.
  • Heterogeneous channels
    The links between nodes do not need to be homogeneous, indeed one could use fiber channels and the other use freespace.
  • Greater robustness
    An interconnected network results in multiple pathways between two endpoints. This resolves the single point of failure issue that occurs between single links.
  • Cost savings
    Large scale interconnectivity lowers costs by reducing the ‘required (N x N-1)/2 point-to-point links to as few as N links in the case of a simple star topology’.

BBN QKD Protocols
The software architecture for the BBN network is shown in the diagram below**:
DARPA BBN Protocol

‘The QKD protocols gave been integrated into a Unix operating system and provide key material to its indigenous Internet Key Exchange (IKE) daemon for use in cryptographically protecting Internet traffic via standard IPsec protocols and algorithms.’

The protocol stack contains a ‘traditional sifting protocol and the newer ‘Geneva’ style sifting’ (now commonly referred to as SARG, after the initials of those who produced it.)

Photonic Switching for untrusted network
For an untrusted network, the switch needs to be optically passive in order to not disturb the quantum states of the exchanged photons. For the DARPA network, there exists two transmitters, Alice and Anna, and their two ‘compatible’ receivers, Bob and Boris (as described at the start). In this situation, the transmitters and their receivers are not mutually exclusive, i.e. Any transmitter can organize key exchange with any receiver. The switch was designed to change the connectivity between each transmitter and receiver every 15 minutes. This resulted in the ‘receivers autonomously discover they are receiving photons from a new transmitter, and realign their Mach-Zehnder interferometers to match the tranmsitter’s interferometer.’ This purpose of this is to create multiple different keys. The switch does take time, 8 ms, and causes an optical loss of less than 1 dB.

BBN key relay protocols for trusted networks
For endpoints that are not directly connected, a path is created from links connecting to them. The BBN networking protocol ‘allows them to agree upon shared QKD bits.’ The path through the network is determined with a new random number, R, and ‘sending R one-time-pad encrypted across each link’, termed key relay.

**From a more extensive article on the DARPA network, published in 2005[1], the protocol are expanded upon as follows:

This enables the reconciliation of raw bit streams to reduce and remove such errors as photon loss, incorrect basis symbols, multiple detection symbols. Once sifted, the rest of the bit stream is discarded and only the sifted bits are used.

Error detection and correction
This occurs after the bit stream has been sifted, and is carried out in order to remove any damaged bits. However, Alice and Bob do not want to reveal the entirety of the sifted secret bit stream. This results in the following:
-The error correction is probabilistic, which results in the potential for Alice and Bob to not have completely identical sets.
-As error correction requires that Bob and Alice disclose information across a separate public channel, there is the potential for Eve to observe and obtain the information in plaintext, if she can decipher the communication.
-Error detection is used to estimate the QBER of the quantum channel.
The DARPA network used two types of error detection and modification: a modified version of the Cascade protocol (Brassard and Salvail’s protocol[I]), and a Forward Error Correction technique coined ‘Niagara[II]‘.

Entropy Estimation
The DARPA network used four different entropy techniques: Slutsky, Bennet, Myers-Pearson, and Shor-Preskill. The entropy is calculated in order to ensure that the privacy amplification is correct. If the entropy isn’t correctly calculated, this can result in a lower than possible privacy amplification, which would provide Eve greater accessibility to secret bits than the potential least amount.

Privacy Amplification
This process involves minimizing Eve’s knowledge of the shared bits to an ‘acceptable level’. A process otherwise known as distillation or advantage distillation. The amplification is completed by an algorithm which is designed to ‘operate on bits in computer memory’ and ‘”smears out” the value of each initial shared bit across the shorter resulting set of bits’. The purpose behind this, is that the shorter the resultant bit set, the less that Eve can know.  For the DARPA network, ‘the QKD node initiating privacy amplification selects a linear hash function over the Galois Field[IV] GF[2n] where n is the number of error-corrected bits in a block. ‘It then transmits four items to the other end -the number of bits m of the shortened result, the (sparse) primitive polynomial of the Galois field, a multiplier (n bits long), and an m-bit polynomial to add (i.e a bit string to exclusive-or) with the product. Each side then performs their corresponding hash and truncates the results to mbits to perform privacy amplification.’

Authentication involves the assurance that each endpoint is confident that they are communicating with their intended endpoint. For a QKD link between Alice and Bob, this is not only a preliminary action, but also continuous for the ensuing interactions. The DARPA network used Universal hash functions, based upon the authentication scheme outlined in the BB84 paper. Their Internet security architecture (IPsec) still utilizes standard authentication methods, and those described in the IKE. Their plan ‘is to extend this architecture by further incorporating those BB84 Universal Hash Functions described above in order to achieve continuous authentication based on secret bits derived from ongoing QKD.’


[I] Brassard and Salvail’s Cascade protocol
This protocol was the first error correction protocol for QKD, and requires an initial input of the error rate (QBER). It has an performance efficiency of working within 15-20% of the Shannon Limit[III], and a speed efficiency of being able to process key rates that are less than 5×104 bits-1.

[II] BBN Niagara
This is a type of Low-Density Parity Check (LDPC) code that has been newly designed for QKD applications, which doesn’t need the many protocol interactions between Alice and Bob, that entail a Cascade protocol.

[III] Shannon Limit
The Shannon Limit is a maximum rate for a channel, in which data can be sent without any error.[2]

[IV] Galois Field
A mathematical term for a finite field.[3]


[1] Elliot C., et al. (17 March 2005) Current Status of the DARPA Quantum Network.

[2] Hardesty Larry. (19 January 2010)Explained: The Shannon Limit, MIT News.

[3] Moreira J. and Farrell P. (06 November 2006) Essentials of Error-Control Coding. John Wiley & Sons. Sourced from:


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s