Simon Neves - Thesis

Photonic Resources for the Implementation of Quantum
Network Protocols
Simon Neves
To cite this version:

Simon Neves. Photonic Resources for the Implementation of Quantum Network Protocols. Quantum
Physics [quant-ph]. Sorbonne Université, 2022. English. �NNT : 2022SORUS364�. �tel-04026239�
HAL Id: tel-04026239

https://theses.hal.science/tel-04026239
Submitted on 13 Mar 2023
HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est

archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents
entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non,
lished or not. The documents may come from émanant des établissements d’enseignement et de
teaching and research institutions in France or recherche français ou étrangers, des laboratoires
abroad, or from public or private research centers. publics ou privés.
Photonic Resources for the
Implementation of Quantum
Network Protocols
S IMON N EVES
Sorbonne Université
Network Protocols
S IMON N EVES
Thèse de Doctorat de Sorbonne Université.

Ecole Doctorale Informatique, Télécommunications et Electronique (n° 572).
Specialité Physique Quantique.
Thèse présentée et soutenue à Paris le 2 décembre 2022,

en présence du jury suivant:
M. Nicolas Brunner: Rapporteur, M. Jean-Marc Merolla: Examinateur,

Professeur, Université de Genève, Suisse. Chargé de recherche, CNRS, Université
M. Fabio Sciarrino: Rapporteur, de Besançon, France.
Professeur, Université de Rome Mme. Virginia D’Auria: Examinatrice,
- Sapienza, Italie. Maîtresse de Conférence, Université
Mme. Eleni Diamanti: Directrice de thèse, de Nice, France.
Directrice de recherche, CNRS, Sorbonne M. Nicolas Treps: Examinateur,
Université, France. Professeur, Sorbonne Université, France.
Frontpage artwork: K78 - Tangled, by Rémi Meyer
Formerly scientist at the French national research agency (CNRS) and

specialized in ultrafast laser-matter interaction, Rémi Meyer is today a
photographer and plastic artist. The heart of his artistic research still lies
in laboratory and borrows the very same material as the one used for his
scientific work.
Previously shaping the laser light to investigate how it interacts with

matter, Rémi today explores the properties of supercontinuum laser beams
as a plastic object, which he bends, curves and textures as it propagates,
until it hits the sensitive surface of the camera to create in a single image
a whole new universe.
Imprimé à Sorbonne Université, Paris, France.
Contact: [email protected]
A mon grand-père.
A BSTRACT (E NGLISH )
he security of modern communication networks can be enhanced thanks
T to the laws of quantum mechanics. In this way, important tasks such as

encryption key distribution, anonymous transmissions or electronic vot-
ing can be made secure without computational assumptions. In this thesis, we
develop a source of photonic quantum states which we use to demonstrate new
quantum-cryptographic primitives: quantum weak coin flipping, and the certified
transmission of quantum information through an untrusted quantum channel.
Our source produces photon-pairs via spontaneous parametric down-conversion

in the telecom range. Pairs can be used as heralded single-photons, or as close-to-
maximally entangled pairs. We show this source is suitable for the implementation
of quantum protocols. We also provide a novel design in order to adapt this source
to multipartite entanglement generation.
Weak coin flipping allows two distant players to decide of a random winner.
Using quantum resources allows to enforce information-theoretic security and
cheat-sensitivity. We demonstrate a refined and loss-tolerent version of a recently
proposed theoretical protocol, using heralded single-photons mixed with vacuum
to produce entanglement. Cheating players are detected in a verification step,
which involves a carefully optimized linear optical interferometer including beam
splitters with variable reflectivities and a fast optical switch. We demonstrate
high values of our protocol benchmarks for attenuations corresponding to several
kilometers of telecom optical fiber.
Finally, we provide a new protocol for certifying the transmission of an unmea-

sured qubit through a lossy and untrusted channel. The security of the primitive is
based on new fundamental results of lossy quantum channels. Probing the channel
with part of a maximally-entangled state allows to device-independently test its
quality, using self-testing of Bell or steering inequalities. We demonstrate that
protocol using photon-pairs entangled in polarization to probe the channel. We
show it allows the certification of quantum communication for a large amount of
losses induced by the channel.
A BSTRACT (F RANÇAIS )
a sécurité des réseaux modernes de communication peut être renforcée grâce
L aux lois de la mécanique quantique, permettant d’effectuer sans hypothèse

d’importantes tâches telles que la distribution de clés de cryptage, les trans-
missions anonymes ou le vote électronique. Dans cette thèse, nous développons une
source d’états quantiques photoniques grâce auxquels nous démontrons de nou-
velles primitives cryptographiques : le tirage à pile-ou-face faible et la transmission
certifiée via un canal quantique non-fiable.
Notre source produit des paires de photons par conversion paramétrique de-
scendante spontanée à longueurs d’onde télécoms. Les paires sont utilisées comme
des photons uniques annoncés ou des paires intriquées. Nous montrons que cette
source est adaptée à la mise en œuvre de protocoles quantiques, et proposons une
méthode afin d’adapter cette source à la génération d’états intriqués multipartites.
Le tirage à pile-ou-face faible permet à deux joueurs distants de décider d’un
gagnant aléatoire. L’utilisation de ressources quantiques rend le protocole sensible
à la triche et sécurisé par la théorie de l’information. Nous démontrons une version
retravaillée et tolérante aux pertes d’un protocole théorique récemment proposé.
Nous utilisons des photons uniques annoncés, mélangés avec le vide pour produire
de l’intrication. Un joueur malhonnête est détecté lors d’une étape de vérification,
incluant un interféromètre optique linéaire comprenant des séparateurs de faisceau
à réflectivités variables et un commutateur optique rapide. Nous démontrons des
valeurs de référence élevées pour des atténuations correspondant à plusieurs
kilomètres de fibre optique télécoms.
Enfin, nous fournissons un nouveau protocole pour certifier la transmission
d’un qubit non-mesuré à travers un canal non-fiable présentant des pertes. Il
est possible de tester la qualité du canal en le sondant avec une moitié d’état
maximalement intriqué, et ce indépendamment du système de mesure, en utilisant
la technique de self-testing des inégalités de Bell ou de steering. Nous démontrons
ce protocole en utilisant des paires de photons intriqués en polarisation pour sonder
le canal. Nous montrons qu’il permet la certification de communications quantiques
pour une grande quantité de pertes induites par le canal.
R EMERCIEMENTS
e travail réalisé pendant cette thèse n’aurait été possible sans l’aide et le
L soutien de nombreuses personnes. Je m’appliquerai ici à les mentionner

avec le plus d’exhaustivité possible. Si toutefois vous ne vous retrouvez pas
dans ces lignes malgré votre contribution, fut-elle directe ou indirecte, je vous
prie d’attribuer cette négligence à la faillibilité de ma mémoire, plutôt qu’à de
l’ingratitude de ma part, et je vous fais part de ma plus grande reconnaissance.
Tout d’abord, j’aimerais exprimer ma plus sincère gratitude à ma directrice

de thèse, Eleni, pour m’avoir permis de vivre cette expérience exceptionnelle. Je
suis particulièrement reconnaissant pour la confiance que tu m’as accordée dès
le début de ce projet, ainsi que pour ton soutien indéfectible. Un grand merci
pour tout ce que tu m’as appris, autant sur le plan humain que scientifique. Je
tiens aussi à remercier Damian, pour avoir supervisé une grande partie de mon
travail, et pour m’avoir ainsi accordé une part considérable de ton temps. À vous
deux, comme à Elham, Fred, Alex et Marco, je vous fais part de ma plus grande
reconnaissance pour avoir donné à cette équipe une atmosphère si chaleureuse,
par votre bienveillance, votre enthousiasme, et votre générosité.
J’aimerais ensuite remercier toutes les personnes que j’ai eu l’honneur de

rencontrer au sein de l’équipe QI et du LIP6. Ma reconnaissance va en premier
lieu à Verena et Laura, avec qui j’ai eu la chance de travailler sur ces expériences
naissantes, qui n’auraient pu aboutir sans votre contribution. Un grand merci
à vous deux d’avoir partagé avec moi les victoires comme les galères. J’ai hâte
de voir où vous porterez nos expériences ! Je tiens ensuite à remercier Mathieu,
pour toute l’aide que tu m’as apportée, ainsi que pour tes conseils avisés et ton
soutien, même après ton départ. De même, j’aimerais dire un grand merci à Adrien
et Amine, là aussi pour votre soutien, mais aussi pour tout ce que vous avez fait
pour l’installation de la salle d’expérience. Dans ce sens, j’ai aussi une pensée
particulière pour Alisa et Eugène, sans qui je n’aurais jamais pu commencer ces
expériences à temps. Je souhaite ensuite exprimer ma reconnaissance à Matteo et
Pascal, pour les conseils que vous m’avez donnés au laboratoire, ainsi que pour les
super parties de Magic The Gathering. Pour les passionnantes collaborations scien-
tifiques, je remercie également Ulysse, Iordanis, Ivan, Anu et Raja. À ce dernier,
comme à Luka, Léo et Gabriel, je dis aussi un grand merci pour les moments mili-
tants que nous avons partagés, ainsi que pour les discussions passionnées. Enfin,
j’aimerais exprimer ma plus profonde gratitude à toutes les autres formidables
personnes rencontrées au cours de ma thèse, et qui ont toutes contribué à leur
échelle à cette ambiance si chaleureuse (dans un ordre aléatoire): Yoann, Valentina,
Adriano, Andrea, Uta, Dominik, Clément, PE, Nathan, Rawad, Robert, Yao, Vic-
tor, Federico, Rhea, Natansh, Anthia, Ilektra, Majid, Harold, Shraddha, Ioanna,
Luis, Paul Hermouet and Paul Hilaire, Hela, Kim, Ellen, George, Salomé, Shane,
Michael, Luís, Niraj, Tom, Shouvik, Santiago, Ieva, Mina, Bo, Damien, Gozde,
Francesco, ... et tant d’autres que j’ai sans doute oubliés, et qui j’espère ne m’en
tiendront pas rigueur !
Tout au long de mon parcours j’ai pu compter sur l’appui de nombreuses per-
sonnes extérieures au laboratoire. Je pense bien sûr à Nicolas Treps, Francesco
Graffitti et Massimiliano Smania, pour les conseils que vous m’avez donnés au dé-
marrage de mes expériences. Pour vos conseils avisés liés au monde de la recherche,
je tiens aussi à remercier Quentin Bodart, ainsi que Rémi Meyer que je remer-
cie également pour la magnifique illustration de première de couverture de ce
manuscrit. J’aimerais ensuite exprimer ma gratitude aux enseignants remar-
quables qui ont su cultiver ma passion des sciences, et m’ont guidé tout au long
de ma scolarité. Je mentionnerais notamment Arnaud De Araujo, Anna Oblak,
Stéphane Carbonneau, Laurence Baulu et Marc Tuloup, et nombre de vos col-
lègues qui m’ont poussé sur cette voie. Je remercie également François Courvoisier,
pour ton rôle déterminant dans mon orientation vers l’optique expérimentale. Je
souhaite enfin rendre hommage à Edouard Oblak, qui le premier m’a ouvert au
monde de la recherche. Nos rencontres, bien que trop brèves, auront été des plus
décisives dans mon parcours.
Finalement, j’aimerais remercier du fond du coeur tous mes proches qui m’ont
encouragé et soutenu pendant toutes ces années. Je mentionnerai notamment
Guillaume, Nicolas et Julien, éternels compagnons de questionnements existentiels,
ainsi que Magdalena, pour tous ces fabuleux ‘weightless moments’, les incroyables
découvertes musicales, et ta présence, tout simplement. À tous mes amis avec
qui j’ai passé des moments inoubliables à Paris ou ailleurs, je vous dis un grand
merci. Finalement, ma plus grande reconnaissance va à ma famille, notamment
à mes parents, pour m’avoir toujours soutenu et avoir cru en moi. Un hommage
particulier va à mon grand-père, dont je regrette l’absence à la fin de cette aventure,
et à qui je dédie ce manuscrit.
L IST OF A BBREVIATIONS
APD Avalanche photo-diode

BBO β-barium borate
BS Beam splitter
BSM Bell-state measurement
c.c. Coincidence counter
CHSH Clauser, Horne, Shimony, Holt
CKA Conference key agreement
conj. Complex conjugate
CPTD Completely-positive trace-decreasing
CPTP Completely-positive trace-preserving
CW Continuous-wave
DC Dark count
DI Device-independent
1sDI One-sided device-independent
DM Dichroic mirror
EM Electromagnetic
EPR Einstein, Podolsky, Rosen
FWHM Full-width at half-maximum
GHZ Greenberger, Horne, Zeilinger
HOM Hong-Ou-Mandel
HWP Half-wave plate
IID Independent identically distributed rounds
JSA Joint spectral amplitude
KTP Potassium Titanyl Phosphate
LHV Local hidden variables
MLE Maximum likelihood estimation
PA Polarization analyzer
PBS Polarizing beam splitter
PC Polarization controller
POVM Positive operator-valued measurement
PP Periodically-poled
QKD Quantum key distribution
QPM Quasi-phase-matching
QST Quantum state tomography
QWP Quarter-wave plate
RSA Rivest, Shamir, Adleman
SCF Strong coin flipping
SM Single-mode
SNSPD Superconducting nanowire single-photon detector
SPDC Spontaneous parametric down-conversion
VOA Variable optical attenuator
WCF Weak coin flipping
WP Wave plate
L IST OF N OTATIONS
|ψ〉 State vector, or ket

〈ψ| Dual vector, or bra
|ψ〉〈ψ| Projector on ket |ψ〉
〈ψ|φ〉 Hermitian inner product (quantum states)
a·b Inner product (complex vectors)
a×b Vector product
∥r∥ Norm of vector r
1 Identity operator
〈 Â 〉 Expected value of observable Â
Â † Hermitian conjugate of matrix Â
Tr( Â ) Trace of matrix Â
TrH ( Â ) Partial trace of matrix Â on space H
L (H ) Endomorphism space on H
dim H Dimension of H
⊗ Tensor product
N
i Tensor product over the index i
P
i Sum over the index i
P Probability
|·| Absolute value
TABLE OF C ONTENTS
Page
1 Introduction 1
1.1 Thesis Outline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.2 Publications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2 Preliminaries 7
2.1 Mathematical Framework . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.1.1 Quantum State . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.1.2 Quantum Measurements . . . . . . . . . . . . . . . . . . . . . 8
2.1.3 The Quantum Bit . . . . . . . . . . . . . . . . . . . . . . . . . . 10
2.1.4 Quantum Entanglement . . . . . . . . . . . . . . . . . . . . . . 11
2.1.5 Closeness of Quantum States . . . . . . . . . . . . . . . . . . . 15
2.1.6 Quantum Operations . . . . . . . . . . . . . . . . . . . . . . . . 17
2.2 Optics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
2.2.1 Classical Linear Optics . . . . . . . . . . . . . . . . . . . . . . 18
2.2.2 Nonlinear Optics . . . . . . . . . . . . . . . . . . . . . . . . . . 21
2.2.3 Quantum Optics . . . . . . . . . . . . . . . . . . . . . . . . . . 23
2.2.4 Common Optical Components . . . . . . . . . . . . . . . . . . 25
2.2.5 Optical Interference . . . . . . . . . . . . . . . . . . . . . . . . 29
2.3 Quantum Cryptography . . . . . . . . . . . . . . . . . . . . . . . . . . 32
2.3.1 From Classical to Quantum Cryptography . . . . . . . . . . . 32
2.3.2 Quantum Cryptography and Adversary Scenarios . . . . . . 34
3 Source of Entangled-Photon Pairs 37

3.1 Prerequisite: Photon-Pair Generation . . . . . . . . . . . . . . . . . . 38
TABLE OF CONTENTS
3.2 State of the Art . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

3.2.1 Bulk Crystal Sources . . . . . . . . . . . . . . . . . . . . . . . . 41
3.2.2 Periodically-Poled Crystal Sources . . . . . . . . . . . . . . . . 42
3.3 Design of the Source . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
3.3.1 Pump Beam . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
3.3.2 Sagnac Interferometer and PPKTP Crystal . . . . . . . . . . 48
3.3.3 Coupling and Filtering . . . . . . . . . . . . . . . . . . . . . . . 51
3.3.4 Photon Processing and Measurement . . . . . . . . . . . . . . 53
3.4 Characterization of the Source . . . . . . . . . . . . . . . . . . . . . . 56
3.5 Toward a Multi-Photons Source . . . . . . . . . . . . . . . . . . . . . . 60
3.5.1 Key Ingredient: Two-Photons Interference . . . . . . . . . . . 61
3.5.2 Spatial Multiplexing and Layered Sagnac Source . . . . . . . 62
3.5.3 Pump-Shaping for Layered Sagnac Source . . . . . . . . . . . 64
3.6 Discussion and Future Improvement . . . . . . . . . . . . . . . . . . . 66
4 Quantum Weak Coin Flipping with a Single Photon 69

4.1 Proposed Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
4.2 Experimental Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
4.2.1 Heralded Single Photon . . . . . . . . . . . . . . . . . . . . . . 74
4.2.2 Optical Switching . . . . . . . . . . . . . . . . . . . . . . . . . . 74
4.2.3 Error Management . . . . . . . . . . . . . . . . . . . . . . . . . 76
4.2.4 Losses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
4.2.5 Measurement of Outcome Probabilities . . . . . . . . . . . . . 79
4.3 Results for Honest Players . . . . . . . . . . . . . . . . . . . . . . . . . 80
4.3.1 Reflectivities with Honest Players . . . . . . . . . . . . . . . . 81
4.3.2 Protocol Results . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
4.4 Results for Dishonest Players . . . . . . . . . . . . . . . . . . . . . . . 85
4.4.1 Dishonest Bob . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
4.4.2 Dishonest Alice . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
4.4.3 Case of two dishonest parties . . . . . . . . . . . . . . . . . . . 89
4.5 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
5 Theory of Probabilistic Quantum Channels 91

TABLE OF CONTENTS
5.1 Preliminary Notions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92

5.2 Extended Process Inequality . . . . . . . . . . . . . . . . . . . . . . . . 94
5.3 Topology of Quantum Channels . . . . . . . . . . . . . . . . . . . . . . 96
5.3.1 Equivalence Classes of Quantum Channels . . . . . . . . . . 97
5.3.2 Closeness of Probabilistic Quantum Channels . . . . . . . . . 98
5.3.3 Comparison of Quantum Channels Distances . . . . . . . . . 101
5.4 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
6 Certified Quantum Transmission via Bell Theorem 105

6.1 Genesis: Authenticated Teleportation . . . . . . . . . . . . . . . . . . 107
6.2 Prerequisite: Self-Testing of Quantum States . . . . . . . . . . . . . 109
6.2.1 Self-Testing via CHSH Inequalities . . . . . . . . . . . . . . . 109
6.2.2 Self-Testing via EPR-Steering . . . . . . . . . . . . . . . . . . 110
6.2.3 On the Isometries Formalism . . . . . . . . . . . . . . . . . . . 111
6.3 The Problem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
6.4 Theoretical Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
6.4.1 Certification Bound and General Recipe . . . . . . . . . . . . 115
6.4.2 Protocol with One-Sided Trust . . . . . . . . . . . . . . . . . . 118
6.4.3 Protocol with No Trust . . . . . . . . . . . . . . . . . . . . . . . 121
6.5 Experimental Implementation . . . . . . . . . . . . . . . . . . . . . . 123
6.5.1 Results for a Honest Channel . . . . . . . . . . . . . . . . . . . 126
6.5.2 Results for a Dishonest Channel . . . . . . . . . . . . . . . . . 128
6.5.3 Additional Implicit Assumptions . . . . . . . . . . . . . . . . . 130
6.6 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
7 Conclusion 135
A Quantum State Tomography 139

A.1 General Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139
A.2 Error Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140
B Sagnac Source Alignment 143
C Quantum Weak Coin Flipping: Predictions 149

TABLE OF CONTENTS
C.1 Photon Propagation in the Interferometer . . . . . . . . . . . . . . . 149

C.2 Phase Fluctuations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
C.3 Predictions with Honest Players . . . . . . . . . . . . . . . . . . . . . 153
C.4 Predictions for a Dishonest Alice . . . . . . . . . . . . . . . . . . . . . 156
D Security for Quantum Channel Certification 157

D.1 Bounding the Transmission Fidelity . . . . . . . . . . . . . . . . . . . 157
D.1.1 Average Channel and Expected States . . . . . . . . . . . . . 158
D.1.2 Bounding Channel Fidelity with State Fidelities . . . . . . . 159
D.1.3 Certifying the average Bell output state . . . . . . . . . . . . 162
D.1.4 Errors due to Post-Selection and Finite Statistics . . . . . . . 164
D.1.5 Certifying the Output State of the Protocol . . . . . . . . . . 169
D.1.6 Full-Device Independence: Probe State Certification . . . . . 170
D.2 Detectors Model in Experiment . . . . . . . . . . . . . . . . . . . . . . 173
Bibliography 177
‘Pearls in oysters may take years
CHAPTER
1
to swell around the sand.’
— An Pierlé, Certain Days.
I NTRODUCTION
he ongoing development of modern communication technologies allows
T more and more users to connect in an ever growing global network, with
high-speed data transmissions and strong data-processing capabilities. On
a more local scale, the emerging idea of smart cities promises to connect even
the most simple devices in order to improve our everyday quality of life. Despite
these seemingly desirable aspects, such new technologies also raise the awareness
and skepticism regarding potential threats to privacy and general security of the
network. In this context, secure methods allowing to perform a collection of ele-
mentary tasks or primitives, including private and anonymous communications,
remote shared randomness, or faithful message transmission, are needed in order
to build more complex and concrete procedures, such as online banking, electronic
voting or digital signatures.
The security of current cryptographic primitives generally relies on so-called

computational assumptions. In other words, with the known calculation power
of classical computers, cracking such a protocol is a near-impossible task, or re-
quires an amount of time so big it makes the task useless. For instance, the RSA
cypher [1], used for the encryption of world-wide banking transactions, relies on
finding the prime factors of a large integer, which is an exponentially-hard problem
1
CHAPTER 1. INTRODUCTION
even for modern classical computers. Still, the security of RSA holds only thanks
to our knowledge of currently available computational power, which may change
as new types of computers emerge.
With the rapid development of quantum technologies, such computers may well
appear in the near-future. The idea of building a quantum computer is attributed
to R. Feynman in 1982 [2] and was further detailed by D. Deutsch in 1985 [3].
By exploiting the fundamental laws of quantum systems, a whole new variety
of algorithms can be developed, where the classical bit of well-defined value "0"
or "1" makes way for a quantum bit. The value of such qubit is undefined until its
measurement, the result of which is fundamentally probabilistic. The arising new
logic of quantum algorithms goes out of the scope of computational assumptions
made to secure classical protocols, therefore threatening the security of modern
encryption algorithms. In particular, P. Shor proposed in 1994 a quantum algorithm
allowing to find the prime factors of any integer in polynomial time [4], showing
the vulnerability of the RSA cyper to quantum attacks. The development of more
resistant cryptographic primitives has since grown into one of the most prolific
fields of research of the past decades.
If the existence of quantum systems has threatened the security of classical

primitives, it has also allowed the development of new quantum cryptography
protocols. For instance different protocols were proposed for quantum key distribu-
tion (QKD), by C. Bennett and G. Brassard in 1984 [5], and by A. Ekert in 1991
[6]. Such protocols allow two players Alice and Bob to share a private random
key, that they can later use to encrypt their messages with optimal security [7, 8].
Contrary to RSA cypher, this security does not rely on any computation assumption,
but solely on laws of quantum physics, such as the collapse of quantum states
under measurement, Bell theorem [9] relating to quantum entanglement, or the
no-cloning theorem [10, 11]. Since then, various quantum protocols have been
developed to solve new cryptographic problems, including secret sharing [12–14],
bit commitment [15], multipartite QKD [16], or anonymous communications [17],
feeding the hope for the development of a world-wide quantum internet [18, 19].
2
Interestingly enough, the resilience of quantum protocols to malicious attacks
can take different forms. In the case of a the protocol proposed by R. Spekkens and
T. Rudolph for remote weak coin flipping [20], the resources’ quantumness provides
an advantage over classical protocols in the form of cheat-sensitivity. This prim-
itive allows two remote players Alice and Bob to fairly design a winner between
them two, using the randomness of two entangled qubits. The cheat-sensitivity
arises when, after the protocol, players verify the entanglement, which unveils a
potential cheating player with non-zero probability. Regarding the resilience of
entanglement-based protocols, the case of device-independent verification proce-
dures may be even more striking. Such procedures allow to certify a wide range of
quantum resources, including quantum states [21, 22], measurements [23, 24] or
channels [25], while making very few assumptions on the certified systems and
measurement devices. In practice, device-independent verification protocols can
be used as building blocks to perform more complex tasks involving untrusted
resources, such as the recently proposed authenticated teleportation [26].
States of the quantified electromagnetic field, also known as photons, have since
proven to be promising candidates for the implementation of quantum communica-
tions protocols, thanks to their relative ease of manipulation and transmission over
large distances with limited decoherence and losses. Thus, quantum information
can be encoded in various photonic degrees of freedom, including photon’s path [27],
orbital angular momentum [28], spectral state [29] or emission time [30]. Most
importantly, the polarization degree of freedom has been widely used to demon-
strate fundamental quantum properties, such as the most notorious experiment
of A. Aspect in 1981 [31] proving the nonlocality of entangled quantum systems,
or to implement quantum protocols such as quantum key distribution [32–35],
quantum money [36–38], secret sharing [39], or conference key agreement [40, 41].
In general, the generation of entangled- and single-photons of high state quality,
detection rates or purity, has become a very active research area, in order to meet
the needs for complex communication and cryptography tasks. This way, sources
based on spontaneous parametric down-conversion in nonlinear crystals have been
used to generate close-to-maximally entangled qubits [42], probabilistic but her-
alded single-photons [43–45], and multipartite entangled states [46, 47]. The rapid
3
improvement of these photonic resources, together with the rising enthusiasm

surrounding the future development of a quantum internet, further motivates the
experimental implementation of new cryptographic primitives, which is the main
scope of this thesis.
1.1 Thesis Outline

Chapter 2 introduces the most important concepts and tools required in this
thesis. We first go through the mathematical framework of quantum mechanics
and information, then we give some insight on classical and quantum optics, and
we finally introduce some notions linked to quantum cryptography.
Chapter 3 gives the details of our photon-pairs source. Pairs are generated via
spontaneous parametric down-conversion in a periodically-poled KTP crystal, and
either used as heralded single-photons, or entangled in their polarization degree of
freedom in a Sagnac interferometer [42]. The source’s characterization shows in
particular that it produces single-photons with relatively high heralding efficiency,
and close-to-maximally entangled qubits, proving it is suitable for the implemen-
tation of quantum network protocols. In addition, we provide a novel design to
upgrade our source to a multipartite source, with relatively few adjustments.
Chapter 4 presents the first implementation of a cheat-sensitive weak coin flip-

ping protocol, based on a heralded single-photon emitted by the source detailed
in chapter 3. We follow a refined recipe inspired from [48]. In this protocol, a
winner is randomly designated among Alice and Bob, by measuring a photon-
path entangled-state generated by Alice from a single-photon. Cheat-sensitivity
arises from the entanglement-verification performed by Bob. Simulating fiber-
communication losses, we show the correctness and fairness of our protocol over
up to 7 km of communication distance between Alice and Bob. Implementing ex-
amples of behavior of dishonest Alice and Bob, we then demonstrate our method’s
cheat-sensitivity, enabled through quantum properties of photons.
4
1.1. THESIS OUTLINE
Chapter 5 develops some important fundamental results of quantum channels.

These objects describe the most general operations undergone by quantum states,
and are therefore a necessary ingredient to describe a secure quantum network.
Our result includes the extension of different metrics of non-lossy channels to
lossy channels, a theorem showing the equivalence of those metrics, and another
theorem extending the kwown processing inequality of non-lossy channels to lossy
quantum channels.
Chapter 6 builds a protocol for certified quantum communication through an

untrusted and lossy quantum channel. Our method consists in probing the channel
with maximally-entangled pairs of qubits, and hiding quantum information among
those probe states. The security is derived in a device-independent setting, and
built in particular from our new fundamental results presented in chapter 5, and
from generalizing the verification of lossless quantum channels from [25]. The
protocol is particularly robust, as very few assumptions are made on the quantum
channel and measurement devices. Using polarization-entangled pairs of photons
emitted by our source detailed in chapter 3, we perform the first proof-of-principle
implementation of this protocol, in a semi-device independent setting, where the
sender’s resources are trusted. For this task, we use recent self-testing results
from [26]. We simulate an honest but untrusted and lossy quantum channel using
a variable optical attenuator, and a dishonest channel by randomly performing
bit and phase flips. In this way, we show our procedure can be used in practice to
detect malicious channels and certify undisrupted quantum information, which is
a fundamental building block of quantum networks.
Chapter 7 discusses the main results of this thesis, and provides potential new
perspectives. We summarize the new key ideas presented in the last chapters, and
point out some unsolved challenges which may be overcome in the future.
5
1.2 Publications
The results from chapter 4 were submitted for publication in the following manuscript:
• [49] Experimental cheat-sensitive quantum weak coin flipping,

with V. Yacoub, U. Chabaud, M. Bozzio, I. Kerenidis, and E. Diamanti,
The results from chapters 5 and 6 are about to be submitted for publication, in the
following manuscript:
• Experimental Certification of Quantum Transmissions via Bell Theorem,

with L. dos Santos Martins, V. Yacoub, P. Lefebvre, I. Šupić, D. Markham,
and E. Diamanti.
Some results from chapter 3 are also included in these two manuscripts, although
the multipartite source is still under preparation. Results on that source will be
presented when it is ready and characterized. In addition, a contribution was made
in the following manuscript, which was submitted for publication:
• [50] Quantum City: a Realistic Metropolitan Quantum Network Architecture,

with R. Yehia, E. Diamanti, and I. Kerenidis,
The results in this thesis were also presented as poster talks in international con-
ferences and summer schools such as CEWQO 2019, QLight 2019, and QCMC 2022,
and disseminated in nationwide public outreach event Fête de la Science and in a
scientific radio show from radio station France Culture.
6
‘L’homme est également sous le joug
de ces lois qu’il feint d’ignorer, se
croyant exceptionnel et le fruit d’une
CHAPTER
2
opération divine.’
— Edouard Oblak.
P RELIMINARIES
e first introduce the most fundamental concepts this thesis is built upon.
W First we go through the basic mathematical framework of quantum

mechanics and information, including details on quantum entanglement,
which is at the heart of this work. Then we give some insight on classical and
quantum optics, including nonlinear phenomena that later allow entanglement
generation. Finally we introduce some notions linked to quantum cryptography.
2.1 Mathematical Framework
2.1.1 Quantum State

Each isolated quantum system can be associated with a quantum state, which
gathers all the properties of the system, and can be used to predict its behaviour.
We adopt the Dirac notation, such that the quantum state is a vector, or ket |ψ〉 in
a Hilbert space H . The bra 〈ψ| is the associated element of the dual space H ∗ of
H , and P̂ψ = |ψ〉〈ψ| is the projector on state |ψ〉. The probability of measuring a
particle of state |ψ〉 in a state |φ〉 is given by the inner product 〈.|.〉:
P(ψ → φ) = |〈φ|ψ〉|2 . (2.1)
7
CHAPTER 2. PRELIMINARIES
The specific case φ = ψ imposes any quantum state to be normalized, 〈ψ|ψ〉 = 1.

As part of the Hilbert H , the normalized sum of two quantum states is still a
quantum state. This is commonly known as the principle of superposition.
In our experiments, most systems are not isolated, such that the quantum
state does not provide a sufficient description. Often the quantum state is indeed
degraded by noise, induced by interactions with a fluctuating environment, or with
other quantum systems in the form of entanglement. In such cases, the system is
said to be in a mixed state, as opposed to a pure state described in the beginning of
the paragraph, as it displays statistical fluctuations. Therefore, one can only know
the statistical probability p i that the system is in the pure state |ψ i 〉. With the set
{(|ψ i 〉, p i }, we define the density operator of the system:
X X
ρ= p i |ψ i 〉〈ψ i |, with 0 < p i ≤ 1 and p i = 1. (2.2)
i i
In general, a density operator is a Hermitian, nonnegative and normalized operator

from L (H ):
ρ ∈ L (H ), ρ † = ρ , ρ ≥ 0, Tr(ρ ) = 1. (2.3)
The hermiticity allows for the diagonalization of the operator, such that we can
choose a set of orthonormal vectors {|ψ i 〉} in eq. 2.2. Finally, we define the purity
P (ρ ) of the state:
P (ρ ) = Tr(ρ 2 ) ∈]0; 1]. (2.4)
In particular, P (ρ ) = 1 when ρ 2 = ρ = |ψ〉〈ψ| such that the system is in a pure state

|ψ〉. In this case we sometimes use the notation ψ = |ψ〉〈ψ|.
2.1.2 Quantum Measurements

Projective Measurements - The most intuitive way to grasp measurements in
quantum physics is through the consideration of observables. These are physical
quantities that can be measured on a quantum system, such as the polarization
or wavelength of light. An observable A is represented by a Hermitian operator
8
2.1. MATHEMATICAL FRAMEWORK
Â ∈ L (H ), the eigenvalues {a m } of which give the possible outcomes when measur-

ing that observable. Knowing the associated orthogonal projectors {P̂ m }, one can
diagonalize the operator:
X
Â = a m P̂ m . (2.5)
m
Quantum measurements are inherently probabilistic, the probability of the out-
come a m being given by:
P(a m |ψ) = 〈ψ|P̂ m |ψ〉 for a pure state, (2.6)

P(a m |ρ ) = Tr(P̂ m ρ ) for a mixed state. (2.7)
The expectation value of observable A therefore reads:
〈A 〉ψ = 〈ψ| Â |ψ〉 for a pure state, (2.8)

〈A 〉ρ = Tr( Â ρ ) for a mixed state. (2.9)
After the measurement, the state is projected onto the corresponding subspace:
P̂ m |ψ〉
|ψ〉 −→ p for a pure state, (2.10)
P(a m |ψ)
P̂ m ρ P̂ m
ρ −→ for a mixed state. (2.11)
P( a m | ρ )
This last property shows another well-known specificity of quantum measurements,
namely the alteration of the quantum state by the observer.
General Measurements - Although projective measurements are the most intu-

itive way of considering quantum measurement, they do not cover the entirety of
possible measurements. Indeed, postulates of quantum mechanics allow for more
general measurements, based on arbitrary sets of operators { M̂ m } such that
†
X
M̂ m M̂ m = 1. (2.12)
m
Such a set is known as a Positive Operator-Valued Measurement (POVM). In that

case, the different outcomes’ probabilities are given by:
†
P(m|ψ) = 〈ψ| M̂ m M̂ m |ψ〉 for a pure state, (2.13)
†
P(m|ρ ) = Tr( M̂ m ρ M̂ m ) for a mixed state. (2.14)
9
† †
Note that in the specific case ( M̂ m M̂ m )2 = M̂ m M̂ m , the measurement is projective. In
some practical situation, the observer might be limited to a partial set of outcomes,
such that accessible measurement operators { M̂ m } only verify
†
X
M̂ m M̂ m ≤ 1. (2.15)
m
We call such measurement a partial POVM. Note that in this case, one can always
complete the set { M̂ m } with a failure operator:
r
†
X
M̂∅ = 1− M̂ m M̂ m , (2.16)
m
which is the no-outcome measurement operator. This way, the set { M̂ m } ∪ { M̂∅ }
forms a full POVM.
2.1.3 The Quantum Bit

Most simple quantum systems are 2-dimensional, and are known as qubits. They
can be seen as the quantum analogue of the classical bit of information. The qubit
Hilbert space H is generated by 2 orthogonal vectors, |0〉 and |1〉, forming the
so-called computational basis. Common observables are the Pauli operators, of
eigenvalues ±1, and their associated eigenstates given in Table 2.1.
Eigenvectors
Operator Matrix
+1 −1
· ¸
0 1
σ̂1 or σ̂ x |+ x 〉 = p1 (|0〉 + |1〉) |− x 〉 = p1 (|0〉 − |1〉)
1 0 2 2
· ¸
0 −i
σ̂2 or σ̂ y |+ y 〉 = p1 (|0〉 + i |1〉) |− y 〉 = p1 (|0〉 − i |1〉)
i 0 2 2
· ¸
1 0
σ̂3 or σ̂ z |+ z 〉 = |0〉 |− z 〉 = |1〉
0 −1
Tab. 2.1: Pauli Operators and their eigenstates.
10
Together with the identity 12 = σ̂0 , these operators form an orthogonal basis of
the operators on the qubit space, for the inner product ( A, B) = Tr( A † B). Therefore,
any density operator can be written in the form:
1
ρ = (12 + r · ⃗
σ), (2.17)
2
with ⃗
σ = (σ̂ x ; σ̂ y ; σ̂ z ) and r = ( x; y; z) with ∥r∥ ≤ 1. r is the Bloch vector, in the Bloch
sphere (see Figure 2.1).
Fig. 2.1: Representation of the state of a qubit in the Bloch sphere.
The coordinates of the Bloch vector are the expectation values of the Pauli
operators. This way, the qubit’s density operator can easily be evaluated by mea-
suring these expectation values, which is the root of quantum state tomography
[51, 52]. Note that in case of a pure state ρ = |ψ〉〈ψ|, the vector is at the surface of
the sphere, and we get:
θ θ
|ψ〉 = cos |0〉 + e iφ sin |1〉, (2.18)
2 2
where ( r = 1, θ , φ) are the spherical coordinates of r.
2.1.4 Quantum Entanglement

Definition - First mentioned by Erwin Schrödinger in 1935 [53], quantum entan-
glement is a fundamental property of composite quantum systems. Let us consider
n quantum systems of Hilbert spaces H 1 , H 2 , ...,H n . Then the tensor product of
all these spaces is a valid Hilbert space:
11
n nX o
H = Hk = λ j |ψ1, j 〉 ⊗ |ψ2,i 〉 ⊗ ... ⊗ |ψn, j 〉, λ j ∈ C, |ψk, j 〉 ∈ H k ,
O
(2.19)
k=1 j
such that the ensemble of n systems is also a valid quantum system, that we can
describe by its quantum state |ψ〉 ∈ H . That state is separable when it can be
written as the tensor product of the states of its subsystems:
n
|ψk 〉, with |ψk 〉 ∈ H k .
O
|ψ〉 = (2.20)
k=1
The subsystems are then independent from one another, and can be described
separately. When the overall state |ψ〉 cannot be written in such a tensor product,
the state is entangled. In this case, we cannot define the state of a part of the
system independently from the other parts. This leads to correlations between
parts of the system that cannot be explained classically, even when said parts are
separated by large distances.
EPR Paradox and Non-locality - On a fundamental level, the possibility of

such entangled states, allowed by quantum theory, was the source of one of the
most important scientific debates of the past century. It started with the so-called
EPR paradox in 1935 [54], as Einstein, Podolsky, and Rosen claimed quantum
theory to be incomplete, such that the apparent quantum randomness should in
fact arise from deterministic local hidden variables (LHV). This claim relied on
the assumption that laws of nature should be both realist and local, meaning that
physical quantities should be defined independently of whether they are observed
or not, and that a measurement performed on a system should not influence the
result of another measurement performed on a remote system. Later work from
Bell in 1964 [9], and J. Clauser, M. Horne, A. Shimony and R. Holt (CHSH) in 1969
[55], showed that in a local realist theory the correlations measured by Alice and
Bob on two remote particles should always verify the following inequality:
I = 〈 Â 0 B̂0 〉 + 〈 Â 1 B̂0 〉 + 〈 Â 1 B̂1 〉 − 〈 Â 0 B̂1 〉 ≤ 2, (2.21)
where Â 0 , Â 1 and B̂0 , B̂1 are observables measured by Alice and Bob, respectively.
Yet, this CHSH inequality can be violated by the following 2-qubits entangled state,
known as the singlet or simply Bell state:
12
1 ¡ ¢ 1 ¡ ¢ 1 ¡ ¢
|Ψ− 〉 = p |0〉 A ⊗ |1〉B − |1〉 A ⊗ |0〉B = p |0〉|1〉 − |1〉|0〉 = p |01〉 − |10〉 . (2.22)
2 2 2
Here we simply display equivalent notations for bipartite states. If Alice and Bob
measure the following observables:
1
Â 0 = σ̂ z , B̂0 = − p (σ̂ z + σ̂ x ),
2
(2.23)
1
Â 1 = σ̂ x , B̂1 = p (σ̂ z − σ̂ x ),
2
p
we indeed expect a maximum violation of CHSH inequality I = 2 2 [56]. The ex-
periment of A. Aspect [31] demonstrated such violation in 1981, therefore refuting
the LHV model, and proving the inherent non-locality of quantum theory, in the
form of entangled states. Interestingly enough, the violation of Bell inequality
is a sufficient (but not necessary) condition for the presence of entanglement. In
p
particular, a maximal violation I = 2 2 , with unknown observables Â 0 , Â 1 , B̂0
and B̂1 , can only be achieved by measuring a singlet state, up to local rotations.
This is root idea for device-independent cryptography, from which we can certify
quantum states with minimal assumptions, and that is the scope of chapter 6. For
more details on Bell non-locality, the reader can refer to [57].
Examples of Entangled States - The term Bell state generally refers to the whole
class of states which are equal to the singlet up to local unitaries. In particular,
this includes the four following states, which together form a basis of the 2-qubits
Hilbert space:
1 ¡ ¢ 1 ¡ ¢
|Φ± 〉 = p |00〉 ± |11〉 , |Ψ± 〉 = p |01〉 ± |10〉 . (2.24)
2 2
They are the main resource of numerous protocols such as Quantum Teleportation
[58] or Ekert’s entanglement-based Quantum Key Distribution (QKD) [6]. In this
manuscript we also use a generalization of Bell states to d -dimensions systems,
also called qudits:
d 1 dX−1
|Φ+ 〉= p | k〉| k〉. (2.25)
d k=0
13
We can also generalize Bell states to N qubits, as the Greenberger-Horne-Zeilinger

(GHZ) state [59, 60]:
1 ¡
|GHZ N 〉 = p |0〉⊗ N + |1〉⊗ N .
¢
(2.26)
2
The latter is at the center of multipartite protocols such as conference key agree-
ment [61] (CKA) or anonymous communications [62], and is the basis of the GHZ
paradox which also refutes the EPR theory.
Entanglement and Density Operators - A key feature of entanglement is the

impossibility to attribute a well-defined quantum state to a portion of the en-
tangled system. Still, density operators can help us predict the local behaviour
of said portion. Let us take the example of a bipartite system of quantum state
|ψ〉 ∈ H = H A ⊗ H B . Using the Schmidt decomposition, one can write |ψ〉 in the
form:
X
|ψ〉 = λk |αk 〉|βk 〉 (2.27)
k
where {|αk 〉} and {|βk 〉} are orthonormal bases of H A and H B respectively, and λk
are positive real coefficients such that k λ2k = 1, called Schmidt coefficients. Taking
P
ρ = |ψ〉〈ψ|, the reduced density operator of system A is then defined as
λ2k |αk 〉〈αk |,

X X
ρ A = TrB (ρ ) = 〈β k | ρ | β k 〉 = (2.28)
k k
where TrB is the partial trace on system B. This density operator ρ A describes the
behaviour of system A regardless of system B. Similarly, we can define the reduced
density operator of system B, ρ B = Tr A (ρ ). The purity of these two operators reads:
1
λ4k =
X
P (ρ A ) = P (ρ B ) = , (2.29)
k K
where K ≥ 1 is called the Schmidt rank. It is maximal when ρ A and ρ B are max-
imally mixed, indicating we cannot define local states for systems A and B: the
bipartite system is maximally entangled. Conversely, K = 1 when ρ A and ρ B are
pure, such that the states of A and B are locally defined: the system is fully separa-
ble. The Schmidt rank is therefore a a good measure of the amount of entanglement
in a bipartite state.
14
Interestingly enough, any density operator can be interpreted as a reduced

density operator, computed from the pure state of a larger entangled system. This
is the philosophy of state purification, which ensures that for any density operator
ρ ∈ L (H A ), there exists a Hilbert space H B with dim H A = dim H B , and a pure
state |ψ〉 ∈ H A ⊗ H B such that ρ = TrB (|ψ〉〈ψ|). This shows a close connection
between mixed state and entanglement, such that a limited purity in the state of a
system can always be attributed to some entanglement with another system. Far
from being a simple conceptual curiosity, this idea can have very concrete uses in
experiments, particularly when searching for the source of some noise.
2.1.5 Closeness of Quantum States

Different functions can be defined in order to evaluate the closeness of two quantum
states, a first common one being the trace distance:
1 1
q
D (ρ , σ) = Tr (ρ − σ)2 = Tr |ρ − σ|. (2.30)
2 2
It can be characterized as the maximum probability of distinguishing the two
states by performing a single measurement:
D (ρ , σ) = max Tr P̂ (ρ − σ) ,
¡ ¢
(2.31)
0≤P̂ ≤1
where the maximization can alternatively be restricted to projectors. The trace

distance is indeed a distance, as D (ρ , σ) = 0 implies ρ = σ, it is symmetric D (ρ , σ) =
D (σ, ρ ), and it verifies the triangular inequality
D (ρ 1 , ρ 2 ) ≤ D (ρ 1 , ρ 3 ) + D (ρ 3 , ρ 2 ). (2.32)
Another important function is the Ulhmann fidelity [63] between two density
operators:
· ³q ¸2
p p ´
F (ρ , σ) = Tr ρσ ρ . (2.33)
The formula is in fact symmetric in ρ and σ. This function was first defined as a
generalization of the transition probability from one mixed state to another. More
precisely, it can be written as the maximum overlap between two purifications of ρ
and σ:
F (ρ , σ) = max |〈ψ|φ〉|2 , (2.34)
|ψ〉,|φ〉
15
where the maximization is carried over all purifications |ψ〉 and |φ〉 of ρ and σ
respectively (one can alternatively fix the purification of one state and perform
the maximization on the other). The fidelity is not a distance, as it measures the
closeness of states instead of their separation. In particular, it does not verify the
triangular inequality, and F (ρ , σ) = 1 when ρ = σ. Still, one can define metrics from
the fidelity, such as the angle A (ρ , σ) and the sine distance C (ρ , σ) [64, 65]:
p p
A (ρ , σ) = arccos F (ρ , σ) , C (ρ , σ) = 1 − F (ρ , σ) . (2.35)
This way, A (ρ , σ) is the angle between two purifications of the states, and F (ρ , σ) ,
p
C (ρ , σ) are the cosine, sine of that angle, respectively. When one of the states is a
pure state σ = |φ〉〈φ|, the fidelity simply reads:
F (ρ , σ) = 〈φ|ρ |φ〉, (2.36)
and when ρ is also pure ρ = |ψ〉〈ψ| we have
F (ρ , σ) = |〈ψ|φ〉|2 . (2.37)
Finally, these different functions are always ordered as follows:

p
1 − F ≤ D ≤ C ≤ A. (2.38)
When one of the state is pure, we get a tighter inequality 1 − F ≤ D , and D = C

when both states are pure. This gives a characterization for the sine distance:
C (ρ , σ) = min D (|ψ〉, |φ〉), (2.39)

|ψ〉,|φ〉
where the minimization is carried over all purifications |ψ〉 and |φ〉 of ρ and σ
respectively, or once again only over the purifications of one state by fixing a purifi-
cation of the other one.
The choice of these functions will depend on the context. We generally try to
derive results on the fidelity, which can be interpreted as a success probability
of our protocols. However, we will often use the trace distance in order to derive
interesting results, and then use its proximity with the sine distance in order to
generalize these results to the fidelity. The angle distance will be used mostly for
deriving a tight triangular inequality.
16
2.1.6 Quantum Operations

Quantum states can undergo various transformations through their evolution. In
most cases, we consider an isolated system, so the transformation is unitary:
|ψ〉 −→ Û |ψ〉, with Û †Û = Û Û † = 1. (2.40)
Important unitaries are qubit logic gates, that we provide in Table 2.2. Note the
Controlled-NOT is a 2-qubits gate, which allows for the construction of an entan-
gled state from a product state.
Name Notation Matrix Examples

· ¸
1 0
Phase Flip Ẑ Ẑ |+ x 〉 = |− x 〉 Ẑ |+ y 〉 = |− y 〉
0 −1
· ¸
0 1
Bit Flip X̂ X̂ |0〉 = |1〉 X̂ |+ y 〉 = |− y 〉
1 0
· ¸
0 −1
Bit & Phase Flip Ŷ i X̂ Ẑ = i Ŷ |0〉 = |1〉 Ŷ |+ x 〉 = |− x 〉
1 0
· ¸
1 1 1
Hadamard Gate Ĥ p Ĥ |0〉 = |+ x 〉 Ĥ |+ x 〉 = |0〉
2 1 −1
· ¸
12 0
Controlled-NOT CˆX CˆX |+ x 〉|0〉 = |Φ+ 〉
0 X̂
Tab. 2.2: Most important logic quantum gates.
An important property of unitaries is the invariance of the closeness functions over

their application:
M (Û ρÛ † , Û σÛ † ) = M (ρ , σ), (2.41)
where M stands for A , C , D , or F . Unitaries can be generalized to transforma-
tions between two different Hilbert spaces H A and H B . Such transformations
Γ : H A −→ H B , that verify Γ† Γ = ΓΓ† = 1, are called isometries, and are of partic-
ular use in the context of device-independent protocols, such as those studied in
chapter 6. Finally, when the quantum system is not isolated, transformations can
involve interactions with other unknown systems, and cannot be described by
unitary operators or isometries. In such cases we adopt a more general formalism,
using quantum channels, that we detail in chapter 5.
17
2.2 Optics
2.2.1 Classical Linear Optics

Free-space optics - In numerous cases the electromagnetic field can be described
as a classical wave, following Maxwell’s equations. In this thesis, we only consider
non-magnetic dielectric media, in absence of free charges and currents, so the
equations read:
∂D
∇ × B = µ0 , ∇ · B = 0,
∂t
(2.42)
∂B
∇×E = − , ∇ · D = 0,
∂t
where E(r, t) is the electric field, D(r, t) is the electric displacement, and B(r, t) is
the magnetic field. In addition, the medium equation relates E(r, t) and D(r, t):
D = ε0 E + P, (2.43)
where P(r, t) is the dipole-moment density, also called medium polarization, which
gives the reaction of the medium to the electric field. In free-space we have P = 0,
so we derive specific solutions to Maxwell’s equations. Monochromatic plane-waves
are of the form:
E(r, t) = E0 e i(ω t−k·r) + conj., (2.44)
where E0 = (E 0x , E 0 y , E 0 z ) is the complex amplitude vector, ω is the angular fre-
quency, and k the wavevector, that verifies
∥k∥ = ω/c, and E0 · k = 0. (2.45)
The amplitude vector gives the polarization of the wave p0 = E0 /∥E0 ∥. We also
define the wavelength in vacuum λ = 2π c/ω. Such a plane wave does not describe
any real physical field, as it would otherwise be infinitely extended in space and
time. Still it can be used as a limit case or a mathematical tool, as any physical
field can be decomposed in an infinite sum of plane waves by Fourier transform. A
more physical solution of Maxwell’s equation is the monochromatic Gaussian beam.
Considering such beam propagates along z-axis, the expression in the focusing
plane z = 0 reads
³ r2 ´
E( x, y, z = 0, t) = E0 exp( i ω t) exp − 2 + conj., (2.46)
w0
18
2.2. OPTICS
where r 2 = x2 + y2 , and w0 is the beam radius, or waist. The general expression of

the field in every point of space can be found in [66], but we give here some useful
intuition. First we define the Rayleigh length:
zR = πw02 /λ. (2.47)
For | z| < zR , the beam can be approximated as a plane wave with k = u z ω/c. We
say the beam is collimated at the scale of zR . For | z| > zR , the beam progressively
diverges and spreads, with an increasing radius:
s
³ z ´2
w ( z ) = w0 1 + , (2.48)
zR
so the beam intensity at any point of space reads:

³ w ´2 ³ 2r2 ´
0
I ( x, y, z) ∝ exp − . (2.49)
w( z ) w( z)2
The beam can ultimately be approximated by a spherical wave for z ≫ zR . The
divergence angle is given by
λ λ
θ = arctan ≃ . (2.50)
π w0 π w0
Fig. 2.2: Intensity profile of a Gaussian beam (w0 = 70 µm, λ = 775 nm), (a) in the
z = 0 plane, (b) in the y = 0 plane, in which we display the waist w( z), the Rayleigh
length zR and the divergence angle θ .
A typical Gaussian intensity profile is displayed in Fig. 2.2, which also shows
its significant characteristics. Beams emitted by a Laser or emerging from a
19
single-mode optical fiber are typically approximated by Gaussian beams, which

therefore cover most beams studied in our experiments. Still some beams have
a non-negligible spectral bandwidth, and therefore cannot be approximated with
monochromatic beams. In such cases, we again decompose our beam as a sum of
monochromatic waves via Fourier transform, which gives the beam’s spectrum.
Linear optics in dielectric media - When electromagnetic waves propagate in

a dielectric medium, it induces a non-zero dipole-moment density P, that we can
decompose into a linear part PL and a nonlinear part P NL :
P = PL + P NL = ε0 (χ(1) E + χ(2) E2 + χ(3) E3 + ...), (2.51)
where χ(1) is the linear first order susceptibility, and χ(n) for n > 1 is the n-th order
nonlinear susceptibility, which is a tensor of order n + 1. For low power densities
the nonlinear moment density P NL can be neglected, such that we have
D = ε0 (1 + χ)E = ε0 εr E, (2.52)
where χ is a 3 × 3 symmetric, real and positive matrix, and εr is the relative

permittivity of the medium. εr can be diagonalized along 3 privileged axes of the
medium  
n2x 0 0
εr = 
 
0 n2y 0
 (2.53)
0 0 n2z
where n x , n y , and n z are the optical indices the wave experiences when it is po-
larized along x-, y-, or z-axes respectively. In general, the medium is dispersive,
so the optical indices depend on the frequency ω. When n x = n y = n z = n, then the
medium is isotropic: the wave propagates at the same velocity v = c/n no matter its
polarization or propagation direction. This is the case for media like air, glass or
optical fibers in the absence of stress.
When at least two optical indices among n x , n y , and n z are different, then the
medium is called anisotropic or birefringent. This includes crystals or optical fibers
under stress for instance. In that case the calculation of the wave properties is
more complicated than in the isotropic case (see [66] for details on that matter).
20
2.2. OPTICS
In this thesis we only consider specific cases, in which the beam propagates along
one of the dielectric axes that is normal to the dielectric interface (we choose the
(Oz)-axis by convention). Hence a horizontally-polarized wave (p0 = u x ) experiences
the so-called ordinary index n x = n o , while a vertically-polarized wave (p0 = u y )
experiences the extraordinary index n y = n e .
2.2.2 Nonlinear Optics

For relatively high power densities, the nonlinear dipole-moment density P NL in
eq. 2.51 cannot be neglected, which leads to diverse phenomena. The second term
in this equation involves the second order susceptibility χ(2) , which is only non-zero
in anisotropic materials. It gives rise to processes such as sum-frequency generation
(SFG, the emission of a field of frequency ω1 = ω2 + ω3 , from two fields of respective
frequencies ω2 and ω3 ), second-harmonic generation or frequency doubling (SHG,
or SFG with ω2 = ω3 , so ω1 = 2ω2 ), difference-frequency generation (DFG, a field of
frequency ω3 = ω1 − ω2 is emitted from two fields of respective frequencies ω1 and
ω2 ), or optical parametric amplification (OPA, a field of frequency ω1 amplifies a
field of frequency ω2 , and generates a field of frequency ω3 = ω1 − ω2 ). Most impor-
tantly, spontaneous parametric down-conversion (SPDC), allowed via a quantum
description of the electromagnetic fields, describes the spontaneous conversion of a
field of frequency ω1 into two fields of frequencies ω2 and ω3 , with ω1 = ω2 + ω3 . This
process can only be interpreted as a transformation of a photon of high energy into
two photons of lower energies. We introduce this description in the next paragraph.
In crystals of homogeneous susceptibility, also called bulk crystals, all these

processes occur only when the different fields verify the energy conservation and
phase-matching conditions:
Δω = ω2 + ω3 − ω1 = 0, (2.54) Δk = k3 + k2 − k1 = 0, (2.55)
where ∥k j ∥ = n(ω j )ω j /c, and n is the extraordinary or ordinary index which de-
pends on the field’s frequency and polarization. We distinguish two types of phase-
matching depending on the fields’ polarizations:
21
• Type-I phase-matching: the two fields with lower frequencies have the same
polarization, that is orthogonal to the third field’s polarization
• Type-II phase-matching: the two fields with lower frequencies have orthogo-
nal polarizations, one of which is parallel to the third field’s polarization.
The phase-matching condition ensures that the different fields are in phase all
throughout the propagation, so that all the waves generated at different points of
the crystal add up in a constructive interference. If this condition is not fulfilled,
then a destructive interference occurs at the scale of the crystal, and the new field
cannot emerge. A priori, one has to choose specific orientations of the crystal in
order to fulfill that condition at specific wavelengths. This limits the choices of
parameters for our experiments, which is why we generally prefer periodically-
poled crystals [67–69]. The nonlinear susceptibility of such crystals periodically
changes sign (see Fig. 2.3):
£ ¡ 2π ¢¤
χ(2)
PP
= χ(2)
sgn cos Λ z , (2.56)
Fig. 2.3: Sketch of a periodically-poled
crystal. The sign of χ(2) changes periodi-
cally.
where Λ is the poling period which, if chosen carefully, allows to correct the potential
phase mismatch. This results in the quasi-phase-matching condition (QPM):
2π
Δk′ = k3 + k2 − k1 + u z = 0. (2.57)
Λ
In this case, an additional phase-matching type is possible:
• Type-0 phase-matching: the three fields have the same polarization.
Thanks to periodic-poling, one can choose the nonlinear material and its orientation
to promote a high nonlinear interaction at the desired wavelengths, and choose the
22
2.2. OPTICS
appropriate poling period Λ to enforce the phase-matching. In general, we choose

the crystal’s orientation such that the propagation axis (Oz) coincides with one of
the crystal’s axes in eq. 2.53.
The second term in eq. 2.51 involves the third order susceptibility χ(3) . The
resulting phenomena are generally undesired in this thesis, as are those induced
by higher terms χ(k) for k ≥ 3. This includes the Kerr-effect for instance [70, 71],
in which the field effectively experiences an intensity-dependent optical index
n( I ) = n 0 + n 2 I , where I is the power density or intensity. This leads to self-phase
modulation, which degrades the beam’s spectrum, or self-focusing, which can
increase the beam’s intensity up to the local ionization of the material. All materials
display a non-zero χ(3) , so that we have to limit the field’s power density in order to
minimize such undesired phenomena.
2.2.3 Quantum Optics
In previous paragraphs, we have followed a classical-wave description of the electro-

magnetic field. However, only a quantum description can encompass all phenomena
linked to this field, such as the black-body radiation [72], the photoelectric effect
[73], or spontaneous parametric down-conversion (SPDC) [74, 75], which is at the
heart of this thesis. In this quantized description, the field energy cannot increase
in a continuous way, but only with finite energy increments. These so-called photons
can be seen as finite excitations of the field, in specific modes that are defined by
the field’s properties (polarization, wavelength, spatial profile...) in said modes [76].
The addition or subtraction of such an excitation in a mode ν is mathematically
described by the corresponding creation operator â†ν and annihilation operator â ν
respectively. We define the photon number states {| n ν 〉}nν ∈N also known as Fock
states (we omit the ν subscripts in the following), as the eigenstates of the field’s
Hamiltonian (or energy observable) in free space:
³
† 1´ ³ 1´
Ĥ = ℏω â â + = ℏω N̂ + , (2.58)
2 2
23
where ω is the mode’s angular frequency. Using these Fock states we explicit the
action of the creation and annihilation operators:
p
â† | n〉 = n + 1 | n + 1〉 , (2.59)
p
â| n〉 = n | n − 1〉, (2.60)
and N̂ is the photon-number observable, with N̂ | n〉 = n| n〉. This way the energy of
a Fock state can only take values which are half-integer multiples of ℏω:
³ 1´
Ĥ | n〉 = ℏω n + | n〉. (2.61)
2
Interestingly, the no-photon state |0〉, also known as vacuum state, still has a
non-zero energy ℏω/2. Different superpositions of Fock states give rise to various
photonic statistics, such as the coherent state:
−|α|2 /2
+∞
X αn †n −|α|2 /2
+∞
X αn
|α〉 = e â |0〉 = e p | n 〉, (2.62)
n=0 n! n=0 n!
where |α|2 = µ is the average number of photons. Such a state displays poissonian
photonic statistics
2 µn
P ( n) = |〈 n|α〉|2 = e−|µ|
. (2.63)
n!
It is typical of the field emitted by a Laser. Another typical photon state is the
(mixed) thermal state:
+∞
X µn
ρ= | n〉〈 n| (2.64)
n=0 (1 + µ)
n+1
where µ is the average number of photons, which gives geometric statistics P ( n) =

1 ³ µ ´n
.
1+µ 1+µ
Photonic qubit - In this thesis, we use the photon’s polarization degree of freedom
in order to encode a qubit. Such a photonic qubit can easily be manipulated,
measured and transmitted, making it one of the best platforms for implementing
quantum protocols. First we define the horizontal and vertical polarizations:
| H 〉 = â†H |0H , 0V 〉 = |1H , 0V 〉 ≡ |+ z 〉, (2.65)

|V 〉 = â†V |0H , 0V 〉 = |0H , 1V 〉 ≡ |− z 〉, (2.66)
24
2.2. OPTICS
where the H and V subscripts stand for modes that are identical except for the
polarization that is either directed along the (Ox)- or the (O y)-axis. These two
orthogonal modes form the qubit computational basis. We also define the diagonal
and anti-diagonal polarizations, which form the diagonal basis:
1 ¡ ¢ 1 ¡ ¢
|+ x 〉 ≡ |D 〉 = p | H 〉 + |V 〉 , (2.67) |− x 〉 ≡ | A 〉 = p | H 〉 − |V 〉 , (2.68)
2 2
as well as the left and right circular polarizations, which form the circular basis:
1 ¡ ¢ 1 ¡ ¢
|+ y 〉 ≡ |L〉 = p | H 〉 + i |V 〉 , (2.69) |− y 〉 ≡ |R 〉 = p | H 〉 − i |V 〉 . (2.70)
2 2
Finally, we define the photonic Bell states of polarization:
1 ¡ ¢ 1 ¡ ¢
|Φ± 〉 = p | H A H B 〉 ± |VA VB 〉 |Ψ± 〉 = p | H A VB 〉 ± |VA H B 〉
2 2
(2.71)
1 ¡ † † 1 ¡ † †
= p â H b̂ H ± â†V b̂†V |0〉, = p â H b̂ V ± â†V b̂†H |0〉,
¢ ¢
2 2
with â†H , â†V the creation operators associated with the first photon and b̂†H , b̂†V
those of the second photon. Generating such states is the main focus of chapter 3.
Another encoding of qubits can also be adopted, by taking the vacuum state |0m 〉
and single-excitation state |1m 〉 = â†m |0m 〉, in a mode m, as the computational basis.
We use this encoding in chapter 4.
2.2.4 Common Optical Components

Optical fibers - Optical fibers are particularly convenient for quantum commu-
nications, as they allow to carry photons over large distances, with relatively low
losses (0.2 dB/km for telecom wavelengths ≈ 1550 nm). Such fibers are composed
of a silica-core, surrounded by a fluorine-doped-silica-cladding of lower optical
index [77]. The fiber therefore acts as a wave-guide, carrying the field from one end
to the other. In this work we mostly use single-mode (SM) fibers, with a ≈ 10 µm-
diameter, optimized for telecom wavelengths. Such fibers also act as a spatial filter,
25
projecting the coupled mode on a close-to-Gaussian spatial mode, which is con-

served over the propagation. Birefringence can be locally induced by stress in the
fiber, which can be intentional when using so-called polarization-controllers (PC), or
unintentional when casually bending the fiber. The resulting polarization rotation
may be undesired in some applications. For this reason, SM fibers can be modified
with two stress-rods on opposite sides of the core, which fixes the birefringence-axes
along the propagation. This way, light that is polarized along one of these axes does
not experience polarization rotation. Such polarization-maintaining (PM) fibers
are useful for applications which do not involve polarization manipulation. In
our experiments, these should therefore be avoided, as birefringence over long
distances causes decoherence in photons’ polarization, which destroys our quantum
states. Such fibers can be distinguished by the color of their protective jacket, or by
checking the normal cut with a fiberscope (see Fig. 2.4).
(a) Multi-mode fiber, with (b) Single-mode fiber, with (c) Polarization-maintaining
typical orange jacket and typical yellow jacket and fiber, with blue jacket, small
relatively large core. relatively small core. core and stress rods.
Fig. 2.4: Schematic normal cut of different optical fibers used in our experiments,
with their typical protective jacket (not-to-scale).
We also use multi-mode (MM) fibers in rare cases, when the spatial mode is not
a concern. Their core can take various sizes (typically ≈ 200 µm), in order to couple
more light than SM fibers. Consequently MM fibers are generally less lossy than
SM fibers, but cannot be used as spatial filters.
Wave-plates - These are made of a birefringent crystal, so that light polarized along
one axis of the crystal, called fast axis, propagates with an optical index n f , and
light polarized along the orthogonal axis, called slow axis propagates with an index
26
2.2. OPTICS
n s > n f . The behaviour of any polarization can be deduced by linearity. Because n s

and n f are different, a phase shift is introduced between the polarizations along
the two axes. This way, if the slow axis is horizontal (θ = 0◦ ), one can write the
transformation matrix of the wave plate, in the | H 〉, |V 〉-basis:
" #
1 0
Ŝ (φ) = , (2.72)
0 e− iφ
(n s − n f )
where φ = 2π λ
d, d is the thickness of the wave plate, and λ is the wavelength
of the field. The transformation of the wave plate for any value of θ reads:
Ŵ (θ , φ) = R̂ (θ )Ŝ (φ)R̂ (−θ ), (2.73)
where R̂ (θ ) is the rotation of angle θ (see Fig. 2.5). The cases φ = π and φ = π2 are
called respectively Half-wave plates (HWP) and Quarter-wave plates (QWP), with
the following matrix representations:
" #
cos 2θ sin 2θ
Ĥ (θ ) = Ŵ (θ , π) = ,
sin 2θ − cos 2θ
π (2.74)
Q̂ (θ ) = Ŵ (θ , ) =
2 Fig. 2.5: Axes of a wave plate,
" #
cos θ − i sin2 θ
2
(1 + i ) cos θ sin θ
. relatively to | H 〉 and |V 〉 axes.
(1 + i ) cos θ sin θ sin2 θ − i cos2 θ
The fast and slow axes are la-
beled by n f and n s respectively.
Each one-qubit logic gates from Tab. 2.2 can be applied to the polarization state
of a single-photon, by using a single HWP or QWP at the proper angle. Moreover,
any one-qubit unitary can be implemented by using three WPs in a row, a QWP,
followed by a HWP, and another QWP. Finally, one can also use WPs at θ = 0◦ to
change the phase between | H 〉 and |V 〉. To do so, one tilts the WP around its verti-
cal axis, which increases the thickness d of the crystal the photon goes through,
therefore changing the phase in equation (2.72). When used that way, the WP is
referred to as a phase plate.
27
Beam Splitters - A beam splitter (BS) is an optical component that transmits a

photon with probability t, and reflects it with probability r , with r + t = 1. We often
consider the case t = r = 0.5, which gives a 50 : 50 beam splitter. They can be made
of a semi-reflective plate, of two prism glued together as a cube, or as a fibered
component. The general transformation can be expressed using two input spatial
modes â† and b̂† , with output modes ĉ† and d̂ † (see Fig. 2.6):
" # " p p # " †#

â† t r ĉ
−→ p p · † . (2.75)
b̂† − r t d̂
Fig. 2.6: Spatial modes in the BS

transformation
Polarizing beam splitters (PBS) ideally reflect the entirety of vertically-polarized

light, and transmit the horizontally-polarized light. To express the transformation
of such a PBS, we also consider the polarization-mode when writing the creation
operators, as shown in Figure 2.7. This way, the transformation reads:
   
â† ĉ†
 H # H
 b̂†  † 
" 
 H 12 0  d̂
 †  −→ · †H  . (2.76)
 
 â  X̂ Ẑ 
0  ĉ V 

 V
b̂†V d̂ V†
Fig. 2.7: Spatial and polarization

modes in the PBS transformation
The PBS effectively entangles spatial and polarization modes of the photon, which
is the first step to polarization measurement. When the polarization is an unused
degree of freedom, one can use a PBS and some waveplates in order to implement
a tunable BS. Fibered PBS can also be used, but generally give access to three
modes only, the fourth being discarded, as shown in Fig. 2.8.
28
2.2. OPTICS
Finally, beam splitters can also be wavelength-dependent, transmitting light

below a certain wavelength, and reflecting the rest (or the other way round). Such
beam splitters are called dichroic mirrors (DM), and are generally used as spectral
filters.
(a) Beam splitter configuration (b) Beam combiner configuration
Fig. 2.8: Fibered PBS and the equivalent configuration with a free-space cube
PBS. Two ends are each dedicated to one polarization | H 〉 or |V 〉. The correspond-
ing fibers are generally PM (in blue). The other end can carry any polarization,
either combined from the other two ends (b), or split into those ends (a). In our
experiments, the corresponding fiber is SM (in yellow).
2.2.5 Optical Interference

In its classical description, the EM field is described as a wave verifying the
Maxwell equations (2.42). Thus when two EM waves hit the same point, an in-
terference phenomenon can occur. Here we take a simple example of a plane
and monochromatic wave in a Mach-Zehnder interferometer [78, 79], sketched in
Fig. 2.9. The wave enters a first BS, giving two beams of same angular frequency
ω, propagating with different phase retardance ϕ1 and ϕ2 :
E0 E0
E 1 ( t) = p cos(ω t + ϕ1 ), and E 2 ( t) = p cos(ω t + ϕ2 ), (2.77)
2 2
with E 0 the amplitude of the input beam. The beams are then recombined in a
second BS. The average power on the two outputs of the interferometer reads
E 20 ¡ E2 ¡
P1 (Δϕ) ∝ 1 + cos(Δϕ) , and P2 (Δϕ) ∝ 0 1 − cos(Δϕ) ,
¢ ¢
(2.78)
2 2
with Δϕ = ϕ2 − ϕ1 . This way P1 = E 20 /2 is maximal and P2 = 0 for Δϕ = 0, such that

the second output is extinguished. Conversely, P1 = 0 and P2 = E 20 /2 when Δϕ = π.
29
Fig. 2.9: Sketch of a Mach-Zehnder interferometer. A beam is separated in two

paths, which are recombined after undergoing a phase retardance.
In real-world situations, different factors may degrade the interference, such

that no phase difference Δϕ can extinguish either of the sides. These factors may
include phase noise, imperfect alignment, or Laser pulses with limited size hitting
the BS at different times. In practice the fields take the expressions
E 20 ¡ E 20 ¡
P1 (Δϕ) ∝ 1 + v · cos(Δϕ) , and P2 (Δϕ) ∝ 1 − v · cos(Δϕ) ,
¢ ¢
(2.79)
2 2
with 0 ≤ v ≤ 1 is called the interference visibility. In experiment we measure that
visibility with the following formula:
P1 (0) − P1 (π) P2 (π) − P2 (0)
v= = . (2.80)
P1 (0) + P1 (π) P2 (π) + P2 (0)
In general, we tend to maximize this visibility by isolating our optical setup from
noise, and paying particular attention to the alignment and timing of the pulses on
the BS. For the latter factor, we carefully minimize the path difference Δ l , such
that Δ l ≪ l c , with l c the coherence length of pulses, which is simply the spatial
extension of said pulses.
Interference of the EM field can also be predicted in the quantum formalism.

In that case two modes of a same single-photon may interfere together, so the
interference pattern described in equations (2.79) now applies to the probability of
the photon to go out of the BS on one side or the other. We grasp this intuition we
the following transformation of the photon modes:
i ϕ1
1st BS e e iϕ2 2nd BS ¡ Δϕ ¢ ¡ Δϕ ¢
|1〉 −−−−→ p |11 , 02 〉 + p |01 , 12 〉 −−−−−→ cos 2 |11 , 02 〉 + sin 2 |01 , 12 〉. (2.81)
2 2
30
2.2. OPTICS
From the last state we get the expressions (2.79), for detection probabilities of the
photon. Such single-photon interference is at the heart of chapter 4, in order to
ensure cheat-sensitivity in our weak coin-flipping protocol.
In that last case we emphasized, the photon displays a wave-like behaviour,

which can still be predicted via a classical description of the field. Still, photons
can display purely quantum behaviour, when performing two-photons interference,
also-called Hong-Ou-Mandel (HOM) interference [80]. Here two single-photons
hit a BS, and systematically output the BS on the same side as long as they are
indistinguishable (see Fig. 2.10). This photon-bunching results in the state
1
| HOM 〉 = p (|21 , 02 〉 + |01 , 22 〉). (2.82)
2
Interestingly, this interference is not phase-sensitive. Still a significant hardness
lies in making the two photons indistinguishable. We tackle this aspect in the end
of chapter 3, when detailing our plans to build a multi-photon source.
Fig. 2.10: Sketch of the Hong-Ou-Mandel interference. Indistinguishable photons

hitting a BS at the same time bunch on one side of the BS or the other.
31
2.3 Quantum Cryptography
2.3.1 From Classical to Quantum Cryptography

Cryptography is the ensemble of knowledge and techniques one can use in order to
secure, conceal, degrade or unveil information. Although encryption and decryp-
tion of information are often associated with futuristic technologies in modern
fictional representations, such techniques are actually as old as human civilization.
They have often relied on simple nonetheless smart ideas, such as the antique
Spartan scytale device (see Fig. 2.11a), or Caesar’s cipher [81]. The birth of modern
cryptology can be dated back to the early 1930’s, with the breaking of German
ENIGMA machine (see Fig. 2.11b) by Polish mathematician Marian Rejewski and
his team, later attributed to British mathematician Alan Turing and his team for
their invention of the first digital computer. From then on, modern ciphers have
relied on more and more sophisticated techniques, in order to catch up with rapidly
increasing computational power.
(a) A home-made scytale, ancient Spartan de- (b) The Enigma machine, used by
vice used around 400 BC. One simply rolls a Germans during WWII, displayed at
strip of parchment around a wooden stick of spe- Museo Nazionale Scienza e Tecnologia
cific shape, an write lengthwise. The message is Leonardo da Vinci, Milan, Italy. Source:
then scrambled when unrolling the strip. Wikipedia.
Fig. 2.11: Example of pre-modern encryption-decryption devices, both used for

military applications.
Nowadays most encryption methods have built their security on computational

hardness assumptions, meaning they rely on complex problems which are assumed
unsolvable in polynomial time by classical computers. This is the case of the RSA
protocol in particular, mentioned in the introduction [1]. However, the ongoing
32
2.3. QUANTUM CRYPTOGRAPHY
race for the quantum computer [82] has since questioned the reliability of such
classical algorithms, as powerful quantum attacks such as Shor’s algorithm [4]
are assumed impossible under computational assumptions. For the past decades,
this has largely motivated investigations on new qubit-based algorithms and proto-
cols, also known as quantum cryptography. Post-quantum cryptography has also
provided candidates for classical algorithms which would be resistant to quantum
attacks (see [83] for a review on the matter).
First quantum encryption protocols, which were actually proposed a decade

before Shor’s algorithm, were S. Wiesner’s unforgeable quantum money [84], and
C. Bennett and G. Brassard’s quantum key distribution (QKD), also called BB84
protocol [5]. The latter allows Alice and Bob to generate and share a private ran-
dom key, that they can use later as a one-time pad to encrypt their messages
with optimal security [7, 8]. In order to generate that key, Alice sends a random
sequence of bits to Bob, encoded on single-photons’ polarization taken in random
rectilinear and diagonal bases. Bob then measures each photon in another random
basis, chosen again between rectilinear and diagonal. Both Alice and Bob then
publicly announce their basis choices, and discard all outcomes for which said bases
did not match. The resulting shared bit string forms the encryption key. The power
of this method resides in the impossibility for a potential eavesdropper to copy the
photonic qubits, thanks to the no-cloning theorem [10, 11]. Moreover, any attempt
of said eavesdropper to measure the qubits will fatally degrade the states, which
Alice and Bob can detect by simply comparing portions of their bit strings, and
checking for differences. The encryption key is therefore secured by unbreakable
laws of quantum physics, instead of computational assumptions.
Since then the QKD research area has been the focus of growing interest,
leading to several long-distance on-ground experimental implementation of the
BB84 protocol [32–35], and the encryption of an intercontinental video-conference
between Graz and Hefei thanks to a satellite-relay [85]. In parallel, the alter-
native entanglement-based QKD of A. Ekert [6] was demonstrated in numerous
experimental implementations [86–90], using polarization-entangled photon pairs.
Moreover, other quantum protocols were developed in order to perform new cryp-
33
tographic tasks, with corresponding experimental demonstrations. These include

secret sharing [12–14, 39], bit commitment [15], conference key agreement (the
multipartite version of QKD) [16, 40, 41], or implementations of Wiesner’s unforge-
able quantum money [36–38]. In chapter 4 we focus on one of such primitives,
known as quantum weak coin flipping [20, 91].
2.3.2 Quantum Cryptography and Adversary Scenarios
When studying cryptography protocols, one can put more or less trust in the dif-
ferent parties involved and devices used. We expect such protocols to be used in
so-called adversary scenarios, in which players, devices or outside parties might de-
viate from the protocol’s recipe in order to disrupt the outcome or gain information.
This way, a strong security comes by making as few assumptions as possible. In the
following, we define a few important notions that allow us to clarify our protocols’
scenarios and the assumptions made.
Assumptions on players - A player is honest when it does not try to deviate from
the protocol’s recipe. On the contrary, a dishonest or malicious player might at-
tempt to disrupt the protocol by different strategies. Such strategies might involve
lying on a measurement result, preparing different states than those expected,
disrupting the behavior of a device, or gaining some information using powerful
measurements and quantum memories. Such a player might be involved in the
original protocol recipe, or be an outside party trying to attack the protocol.
Assumptions on devices - Devices in a protocol may include sources of quantum

states, operations, classical and quantum channels, and measurement apparatuses.
A device is trusted when it follows a behavior that is predicted by the honest players.
Such a device can be ideal when it has the optimal expected behavior, or noisy
when its behavior is imperfect but can still be characterized to a certain extent. On
the contrary, an untrusted device does not follow the predictions of honest players,
and might be used by malicious players to disrupt the protocol.
34
2.3. QUANTUM CRYPTOGRAPHY
Protocol Robustness - A protocol can be more or less robust to imperfect devices

and attacks from dishonest players. We distinguish three significant cases. A noise-
tolerant or fault-tolerant protocol can operate even if some of the devices are noisy.
In such cases it is essential to estimate the influence of noise on the protocol’s
outcomes and performances. A cheat-sensitive protocol allows honest players to
detect, and eventually sanction malicious players. Finally a device-independent
protocol operates regardless of the devices’ internal function. In that case, the
measurements apparatuses, operations and channels are treated as potentially un-
trusted black boxes, and no assumption is made on the quantum states, which are
therefore taken in an unkwown and arbitrarily large Hilbert space. If only parts of
the devices are treated as black boxes, then the protocol is semi device-independent.
Device-independent protocols are particularly secure in adversary scenarios, as
their security relies on very few assumptions on the systems involved. This feature
is specific to quantum cryptography, as allowed only by Bell non-locality.
Different kind of protocols are detailed in this thesis. We put a particular

emphasis on the cheat-sensitivity of our weak coin-flipping implementation (see
chapter 4) and the device-independence of our quantum channel certification proto-
col (see chapter 6). Both of these robustness properties are ensured by quantum
phenomena, namely superposition and entanglement.
35
‘Un scientifique dans son laboratoire est
un enfant placé devant des phénomènes
naturels qui l’impressionnent comme
CHAPTER
3
des contes de fées.’
— Marie Skłodowska-Curie.
S OURCE OF E NTANGLED -P HOTON PAIRS
n the context of the potential near-future development of a world-wide quan-
I tum network, the design of entangled- and single-photons sources has risen
significant interest in the past decades, in order to meet the needs for complex
communication and cryptography tasks. Photons have been promising candidates
for the implementation of such tasks, thanks to their relative ease of manipulation
and transmission over large distances with limited decoherence and losses. Still,
the generation of photonic quantum states remains a relatively open and active re-
search area, as protocols often require more and more demanding features, such as
on-demand state generation, high detection rates or photonic purity, all the while
maintaining a high quality of the states. Sources based on spontaneous parametric
down-conversion (SPDC) have been some of the most investigated solutions, as
they can be used to generate pairs of close-to-maximally entangled qubits [42],
encoded in photons’ polarization, probabilistic but heralded single-photons [43, 44],
and multipartite entangled states [46, 47]. All of these aspects motivate our choice
to build such a SPDC-based source.
In the following, we start by recalling some basic notions on SPDC, and review-
ing the most important SPDC-based sources of polarization-entangled photons. We
then detail the design of the source that was built from scratch during this thesis,
37
CHAPTER 3. SOURCE OF ENTANGLED-PHOTON PAIRS
specifically for the implementation of quantum network protocols and multi-qubits

states generation. Because of those applications, the source needs to follow certain
requirements. First, it should provide photon pairs around telecom wavelengths,
between 1.5 µm and 1.6 µm, where optical fibers are the least lossy. Then it should
be able to produce close-to-maximally entangled photons, with > 99% fidelity to
Bell states. In addition, we should have the possibility to use it as a heralded
single-photon source. Finally, the source should be adaptable for multi-qubits
states emission. In this chapter we provide a full characterization of our source, as
well as some perspectives to adapt it to multipartite-states emission, showing it
indeed meets those requirements.
3.1 Prerequisite: Photon-Pair Generation

In paragraph 2.2.2 we mentioned photon pairs could be generated via SPDC in a
nonlinear crystal. In the following we give more details on this phenomenon, which
is at the heart of most of nowadays’ entangled-photons sources, including ours.
SPDC is the probabilistic conversion of a high-energy photon into two photons
of lower energy. One can interpret this process as the reverse of classical sum
frequency generation, or as optical parametric amplification of vacuum fluctuations.
The prediction of this phenomenon comes by deriving the interaction Hamiltonian
in the crystal. For that purpose, we write the energy of interaction per volume unit:
h I ∝ E(+) (r, t) · P(−) (r, t) + conj., (3.1)

¢∗
where E(+) is the complex electric field, and P(−) = P(+) is the complex dipole-
¡
moment density in the crystal. Only the second order dipole-moment is relevant
here, such that
2
h I ∝ E(+) (r, t) · χ(2) (r)E(−) (r, t) + conj., (3.2)
(+) ∗
where E(−) = E
¡ ¢
. We decompose the electric field into three interacting fields:
E(+) = E(p+) + E(s+) + E(i+) , (3.3)
where E(p+) , E(s+) and E(i+) are the pump, signal and idler fields, respectively. As
a first approximation we only consider monochromatic plane waves, of angular
38
3.1. PREREQUISITE: PHOTON-PAIR GENERATION
frequencies {ωl }l=p,s,i , wavevectors {kl }l=p,s,i , and polarization {el }l=p,s,i (the reader
can refer to [92, 93] for a more general derivation). We then express the quantified
electric field operators:
(+)
Ê p (r, t) ∝ e p eω p t−k p ·r â†p , (3.4)
(+)
Ês (r, t) ∝ es eωs t−ks ·r â†s , (3.5)
(+)
Ê i (r, t) ∝ e i eω i t−k i ·r â†i , (3.6)
where â†p , â†s and â†i are the creation operators in the pump, signal and idler modes,
respectively. Thus we deduce the Hamiltonian of interaction, by injecting these
operators in eq. 3.2 and by integrating over the volume V of the crystal:
Z Z
i(k p −ks −k i )·r 3 †
Ĥ I ∝ η(r) e †
d r · â p â s â i + η∗ (r) e− i(k p −ks −k i )·r d 3 r · â p â†s â i , (3.7)
V V
where η(r) = e p · χ(2) (r)es e i , and we only keep the terms which respect the energy
conservation principle ω p = ω i + ωs . The first term describes the SFG and SHG
which were mentioned earlier, while the second term is linked to DFG and OPA.
This way all classical phenomena described in paragraph 2.2.2 can be interpreted
through photon transformations (see Fig. 3.1). But most importantly, the second
term in eq. 3.7 also predicts the spontaneous conversion of a high-energy pump
photon into two lower-energy signal and idler photons, namely SPDC. This phe-
nomenon is allowed purely by the quantization of electromagnetic field.
The phase-matching condition comes by assuming the second order suscepti-

bility is homogeneous in the crystal η(r) = η, and by integrating on a large volume
V . Then the Hamiltonian vanishes except for k p − ks − k i = 0. The quasi-phase-
matching condition, on the other hand, comes by considering a periodic variation
of the susceptibility along the (Oz)-axis η(r) = η · p( z). By approximating this vari-
ation as a harmonic function p( z) = exp( i 2π z/Λ) with Λ the poling period, the
Hamiltonian becomes:
Z Z
Ĥ I ∝ η e i Δ k· r 3 †
d r · â p â s â i + η∗
e− iΔk·r d 3 r · â p â†s â†i , (3.8)
V V
with Δk = k p − ks − k i + 2Λπ u z , such that Ĥ I vanishes except for Δk = 0 (see Fig. 3.2).
39
Fig. 3.1: Energy conservation in SPDC: a

photon is annihilated, and two photons of Fig. 3.2: Quasi-phase-matching
the same total energy are created. In SFG SPDC, and other nonlinear effects,
and SHG, two photons are annihilated, and in a periodically-poled crystal.
a photon of the same total energy is created.
Now we can grasp an idea of the photon statistics. Making the non-depleted
pump assumption, meaning the pump field is strong enough to be unaffected by the
interaction, and under the phase-matching condition, the Hamiltonian becomes:
Ĥ I = C â†s â†i + conj., (3.9)
where C is a constant. Then the signal-idler quantum state reads

i Ĥ I t p +∞
X n/2
|ψ〉 = e ℏ |0s , 0 i 〉 −−−−→ 1− p p | n s , n i 〉, (3.10)
t→+∞
n=0
where p is a constant that can be interpreted as the probability of emitting exactly

one photon pair, as long as p ≪ 1. The pairs statistics therefore follows a geometric
law, with a probability P( n) = (1 − p) p n of emitting exactly n pairs. Besides the
reduced density operator of the signal (or idler) mode gives a thermal state:
+∞
X µn
ρ s/i = | n s/i 〉〈 n s/i |, (3.11)
n=0 (1 + µ)
n+1
with an average number of photons µ = p/(1 − p). This can be used in experiments
in order to verify the spectral purity of down-converted photons (see [94, 95]
for more details on that matter). Finally, as p ≪ 1 we can simplify the state as
ρ s/i ≃ |1s/i 〉〈1s/i | which is a single-photon state. This way measuring a photon from
a SPDC pair allows to announce its twin, which becomes a heralded single-photon.
In general, we may not be able to assume the pump is a monochromatic plane

wave, and the crystal has a finite size. In such cases the signal and idler photons
can be emitted in a superposition of different spatial and spectral modes, and
40
3.2. STATE OF THE ART
therefore display some entanglement in those modes. Then photon-pairs can still
be used in order to generate heralded single-photons, but the spectral and spatial
state is mixed. The full derivation of that state remains an open question, and
attempts can be found in different studies [92–96]. For the rest of this thesis, we
consider the photons spectral and spatial state to be close-to-separable, such that
the statistics is approximated with a geometric law.
3.2 State of the Art

In the following we give a non-exhaustive review of the most significant demon-
strations of entangled-photon sources, based on SPDC in a nonlinear crystal,
which allows the spontaneous transformation of a high-energy photon into two
lower-energy photons. Our own design takes inspirations from these sources.
3.2.1 Bulk Crystal Sources
The first experimental SPDC-based entangled-photon source was built by Z. Y.

Ou and L. Mandel in 1988 [97], using a potassium dihydrogen phosphate crystal.
Photons are generated in the same polarization, via type-I SPDC, and projected
onto the singlet state |Ψ− 〉 = |HV p
〉−|V H 〉
using a BS. Many bulk crystal-based sources
2
were later demonstrated, such as that of P. G. Kwiat et al. [98], in which photons
are emitted in a β−BaB2 O4 crystal (BBO), via type-II SPDC (see Fig. 3.3a). There
photons are distributed on two cones of orthogonal polarizations, such that entan-
glement can be measured at the two intersections of the cones. A type-I source
was also demonstrated using the same BBO crystal [99]. For this experiment, two
identical crystals were used in cascade, rotated by 90◦ (see Fig. 3.3b). In this way
the pump-photon is down-converted either in the first crystal, giving a pair of
horizontally-polarized photons, or in the second one, giving a pair of vertically-
polarized photons. Thus, photons can be distributed on two rings, one for each
polarization. Where the rings overlap, and therefore interfere, the photons are in
| HH 〉+|V V 〉
the entangled state |Φ+ 〉 = p . Here the entanglement can in principle be
2
collected over the whole ring, contrary to the type-II version.
41
(a) Type-II source. Two cones of (b) Type-I source. Two overlapping cones
orthogonally-polarized photons are of photons are emitted by pumping two
emitted by pumping a single BBO cascaded BBO crystals with orthogonal
crystal. Entanglement is generated at the axes. Entanglement is generated all over
intersections of the rings [98]. the rings [99].
Fig. 3.3: Common sources photon pairs entangled in polarization, based on bulk-
BBO crystals.
By collecting photons on parts of the type-I ring, 21 × 103 pairs/s could be mea-
sured [99], with a pump power of 150 mW. The number of pairs measured is
proportional to the pump power, so we give the rate of pairs per mW of pump
power, also called brightness of the source. In this demonstration the brightness
is 140 pairs/s/mW. The fidelity of the states generated to the target Bell state was
> 88%, which was mostly limited by the delay between the rings that limits the
interference quality. Radhika Rangarajan et al. demonstrated a compensation
of this so-called walk-off [100], reaching a brightness of 5400 pairs/s/mW, and a
fidelity of 99 ± 2% to the Bell state.
3.2.2 Periodically-Poled Crystal Sources
Alternatively to bulk crystals, periodically-poled crystals have become widespread,

as they can be tailored for colinear emission in a wide range of wavelengths,
thanks to the QPM condition. In the following, we focus on a source based on
type-II periodically-poled KTiOPO4 (PPKTP), in a Sagnac interferometer [101],
as shown in figure 3.4. Other common sources use periodically poled LiNbO3
(PPLN) [30, 102–106], which was shown to be particularly adapted to integrated
optics [107].
42
3.2. STATE OF THE ART
Fig. 3.4: Scheme of the Type-II PPKTP-Sagnac source of entangled photons. The
pump is diagonally polarized, and is converted into lower energy photons. The
dichroic mirror reflects the pairs and transmits the pump. The HWP implements a
bit flip X̂ . All components are adapted to both wavelengths of pump and pairs.
In the Sagnac-PPKTP scheme, a diagonally polarized pump goes into a Sagnac

interferometer, where the beam is split by the PBS. There, two situations can occur:
• If the pump photon is in state |V 〉, it is reflected on the PBS and is down-

converted into signal and idler photons, in state |V H 〉. Then, they are trans-
formed by a bit flip X̂ , so their state becomes | HV 〉. Finally, the signal photon
is reflected by the PBS while the idler is transmitted.
• If the pump photon is in state | H 〉, it goes through the PBS and is flipped
into the state |V 〉 by the bit flip X̂ . Then, it is down-converted into signal and
idler photons, in state |V H 〉. Finally, the signal photon is transmitted by the
PBS, and the idler photon is reflected.
A dichroic mirror is used in order to separate the pump from the photons. Provided
the interferometer is properly aligned, we get a superposition of the two situations,
| HV 〉+|V H 〉
and we collect the entangled state |ψ+ 〉 = p at the output of the interfer-
2
ometer. Note the Sagnac interferometer is intrinsically stable, as the interfering
beams take the same round path in opposite directions. Thus a phase change in one
path also affects the other path, so no relative phase appears between the paths.
Thus no phase stabilization is needed for generating high-quality states [108].
43
Over the past decades, this PPKTP-Sagnac scheme has become widespread,
thanks to its stability, adaptability and ease of conception. It was first demon-
strated in 2006 by T. Kim et al. [109], with a brightness of ∼ 5000 pairs/s/mW and
a fidelity of more than 94.3% to the target Bell state. Considerable efforts have
been made to increase these numbers, and extremely high performances were
later achieved by Alessandro Fedrizzi et al. [42]. By optimizing the focusing of
the pump, they could reach a brightness of ∼ 82 × 103 pairs/s/mW with a fidelity
as high as 99.6% to the target Bell state, making it one of the best sources ever
made. Furthermore, high coupling efficiencies could be demonstrated, thanks to
the Gaussian colinear emission allowed by periodically-poled crystals [45, 95, 110].
It was also shown that such PPKTP-based sources can emit completely separable
pairs of photons at telecom wavelength, by carefully tailoring the crystal and laser
properties [111–113], which is fundamental when generating pure heralded single-
photons and multipartite entangled-states [95, 111–113]. Finally, this scheme was
used to perform the first satellite-to-ground entanglement distribution in 2017,
where the whole source was sent into orbit [114], showing the extreme stability
of such a setup. All these high performances motivate our choice to adopt this
Sagnac-PPKTP scheme for our own source of entangled-photons.
3.3 Design of the Source
Our source is made of three main blocks (see Fig. 3.5). The first one is the pump
emission and shaping, including the laser source, its spatial filtering and focusing.
The second part is the heart of the source, made of the Sagnac interferometer and
the nonlinear PPKTP crystal, in which the photons pairs are generated. Finally
the third block is the photon collection, which encompasses the photon filtering and
coupling into optical fibers. One could also identify a fourth block as the photons
processing and measurement, though it may differ from one experiment to another.
A full recipe for the alignment of that source was given in D.H. Smith’s thesis [115],
though our method differs slightly. We detail that method in appendix B.
44
3.3. DESIGN OF THE SOURCE
Fig. 3.5: Outline of our source, with the three main blocks described in this chapter.
3.3.1 Pump Beam
The pump beam is emitted via a Titanium-Sapphire Laser (Mira 900HP from
Coherent), of ≈ 4 W average power. Ideally, the Laser is mode-locked, so that 2 ps-
pulses are emitted at a f = 76 MHz rate. The spectral intensity is approximately
Gaussian (see Fig. 3.6), centered around a tunable wavelength 775 nm ± 15 nm with
a 0.33 nm full-width at half-maximum (FWHM).
Fig. 3.6: Measured spectrum of the mode-locked pump Laser, with a Gaussian fit
giving the 770 nm central wavelength and 0.48 nm FWHM.
45
Assuming thermal statistics of photons emitted in the crystal, the rate of

simultaneous detection of 2 N photons is given by:
R2N = f p N η2N , (3.12)
where f is the pump repetition rate, p is the probability of emitting a pair in a

pump pulse, and η is the detection efficiency of one photon. The probability p is
proportional to the energy U p in a pump pulse, so that
R2N = f κN U pN η2N , (3.13)
where κ is the number pairs emitted by Joules of pump pulse, which depends on
the characteristics of the crystal, and the pump focusing mode in the crystal. The
pair detection-rate is directly proportional to the average pump power P = f U p .
This way, when only the two-photons state matters, we try to keep p quite low,
typically p ≲ 0.01, in order to avoid noise coming from double-pair emission, with
a rate R4 . We therefore limit the energy U p while keeping the average power
P at a high value. This can be achieved by increasing the repetition rate via a
temporal multiplexer for instance, as demonstrated in [116, 117]. In some specific
applications we can even use the Laser in continuous-wave mode (CW), instead of
the pulsed mode. Thus the energy is maximally spread in time, but the different
frequencies composing the Laser’s spectrum are not mode-locked anymore, which
effectively makes the photons’ spectrum mixed. This is the method we use in
chapter 6, where the spectral state has little importance. On the contrary, when
attempting to prepare 4-photons states, we want to increase the probability of
emitting two pairs in a pump pulse, and therefore the energy per pulse U p . This is
the approach we suggest for multipartite-states emission.
Fig. 3.7: Pump-beam shaping apparatus. In addition to the components mentioned

in the main text, two waveplates are displayed, for polarization management.
46
The spatial profile of the Laser is of major importance in our experiments, as

it conditions the spatial modes of the photons, and therefore their coupling into
SM fibers. As the beam emitted by our Laser displays some distortions, we filter
the spatial mode in order to make it close to a Gaussian beam, which fits the mode
of a SM fiber. The beam-shaping apparatus is displayed in Fig. 3.7. It is made of
two 50 mm-focal length lenses, forming a telescope, with a pinhole in the middle.
The beam that outputs the telescope is then an Airy disk, with a close-to-Gaussian
profile surrounded by lower intensity rings. Blocking the rings with a diaphragm
allows to retrieve a satisfying Gaussian profile (see Fig. 3.8).
Fig. 3.8: Intensity profile measured in the focal plane of the last lens with a CCD
camera, after spatial filtering of the pump beam (a) when the Airy rings are left
unfiltered, (b) when the diaphragm is closed, letting the central disk through and
filtering the Airy rings out. We retrieve a satisfying Gaussian profile.
Finally, the beam is focused inside the Sagnac interferometer, thanks to a

750 mm-focal length lens. The resulting Gaussian beam has a waist of w p ≃ 315 µm,
for a Rayleigh length zR,p ≃ 40 cm. The choice for this waist is the result of a
compromise, between a high photon-pair emission probability p, ensured by a
strong focusing, and a high separability of photons spectral modes, ensured by the
collimation of the pump beam, among other factors. This last point is addressed in
the following paragraphs.
47
3.3.2 Sagnac Interferometer and PPKTP Crystal

Our entangled photon-pairs are emitted by SPDC in a nonlinear PPKTP-crystal,
placed in a Sagnac interferometer. The principle of that Sagnac source is given in
precious paragraph 3.2.2, and a photograph of our setup is displayed in Fig. 3.9.
Fig. 3.9: Photograph of our Sagnac source. The achromatic HWP was removed
from the source while taking the picture, for more clarity in the beams’ paths. We
display a green rectangle where it usually lies during the experiments. Part of the
coupling and filtering block is displayed, for the signal photon, with a spectral filter
(SF) and a SM-fiber coupler. Photograph made in collaboration with Julien Déoux.
The interferometer is made of a PBS, two mirrors and a HWP, all these compo-
nents being compatible with the pump and photons wavelengths. Because of this
last condition, these four components are chosen with special care. Our custom
dual-wavelength PBS was provided by Spectral Optics, and provides a relatively
high extinction ratio (> 1000 : 1) for two ranges of wavelengths, centered around
775 nm and 1550 nm. An achromatic HWP was provided by Thorlabs, made of six
48
different birefringent crystals ensuring a π phase-retardance between horizontal

and vertical polarizations, for the whole range of wavelengths between 600 nm and
2700 nm [118]. Corners of the Sagnac are made of metallic silver mirrors, which
provide a relatively high reflectivity for our wavelengths. DMs are placed at the
outputs of the Sagnac, in order to separate the pump from the photon pairs.
The PPKTP crystal lies in the center of the Sagnac interferometer, in an oven
that allows to tune the phase matching condition. The crystal was tailored by Raicol
for type-II quasi-phase-matching at room temperature ≃ 20 ◦ C, from a vertically-
polarized pump photon at λ p = 775 nm, to a vertically-polarized idler photon and
a horizontally-polarized signal photon, at degenerate wavelengths λ i = λs . The
QPM condition Δk′ = 0 (see eq. 2.57), along with the energy conservation condition
λ i = λs = 2λ p = 1550 nm, gives the poling period:
λp
Λ= 1
¢, (3.14)
n p (λ p ) − n i (λ i ) + n s (λs )
¡
2
where n p , n i and n s are the respective optical indices of KTP for the pump, idler
and signal modes. These depend on the wavelength and polarization of the modes,
and are given by the empirical Sellmeier equations [119, 120]:
n p (775 nm) = 1.76,

n s (1550 nm) = 1.73, (3.15)
n i (1550 nm) = 1.82,
which gives the poling period Λ = 46.2 µm. Even though our crystal was optimized
for 775 nm pump and 1550 nm signal and idler photons, we later tuned the pump
wavelength to λ p = 770 nm in order to maximize the coupling of our photons (this
can be explained by the variation of diverse component’s transmission with the
field’s wavelength). This way photons still verify the QPM condition, but at non-
degenerate wavelengths λs = 1541.5 nm and λ i = 1538.5 nm. During the course of
these projects, choosing this non-degenerate configuration over the degenerate case
did not cause any significant drawback. For other projects, the degenerate emission
might still be required, for which one could tune the QPM condition by setting up
the crystal’s oven temperature.
49
We predict the photon’s spectral state from the crystal and pump’s characteris-
tics. Our crystal’s length is L = 30 mm, so the focusing parameter reads
L λpL
ξp = = ≃ 0.04. (3.16)
n p zR,p n p πw2p
As ξ p ≪ 1, meaning L is far smaller than the pump’s Rayleigh length, the pump
is collimated in the crystal. Thus we adopt the same approach as N. Bruno in
[95], and consider the pump, signal and idler spectral modes do not entangle with
spatial mode (see [92, 93] for a more general derivation). In addition, the latter are
considered to be plane waves of respective vectors:
ω p n p (ω p ) ωs n s (ωs ) ω i n i (ω i )
kp = z, ks = z, ki = z, (3.17)
c c c
where ω p , ωs and ω i are the angular frequencies of the pump, signal and idler
modes, respectively. In that case, it was shown that the interaction Hamiltonian
(eq. 3.1) leads to the following state for the photon pairs [94, 111]:
Ï
|ψsi 〉 = d ω i d ωs γ(ω i , ωs )â†ω i â†ωs |0 i , 0s 〉, (3.18)
where γ(ω i , ωs ) is the so-called joint spectral amplitude (JSA) that takes the form:
γ(ω i , ωs ) ∝ α(ω i + ωs ) · β(ω i , ωs ), (3.19)
where α(ω i + ωs ) is the pump envelope, that gives the frequencies allowed by
energy conservation, and β(ω i , ωs ) is the phase-matching envelope, that gives
the frequencies allowed by the QPM condition. In a periodically-poled crystal,
under collinear-emission approximation, and assuming the pump spectrum to be
Gaussian (when the Laser is mode-locked), we can express these functions:
³ Δω2 ´
|α(ω i + ωs )| = exp − 2 ,
2σ p (3.20)
|β(ω i , ωs )| = sinc(Δ k · L),
where Δω = ω p − ωs − ω i , ω p is the central wavelength of the pump Laser, σ p its

spectral bandwidth, L the length of the crystal and Δ k is the phase mismatch:
ωs n s (ωs ) ω i n i (ω i ) (ω i + ωs ) · n p (ω i + ωs ) 2π
Δk = + − + . (3.21)
c c c Λ
50
In Fig. 3.10, we display a simulation of the photon pairs’ JSA in our experiments.
Performing the Schmidt decomposition of the spectral state, we expect a Schmidt
number K = 1.18, and a high single-photon purity P = 1/K = 0.85, indicated by the
central close-to-Gaussian lobe in the JSA. Thus the photons are close-to-spectrally-
separable, which is a fundamental feature when performing 2-photons interference
in multipartite protocols or quantum teleportation, as we will see at the end of the
chapter. Still side lobes from the sinc function are responsible for some correlations
in the pairs’ spectral modes, which limits the purity. These can be suppressed by
filtering the spectral state.
Fig. 3.10: Simulated joint spectral amplitude of the photon pairs emitted in our
experiment, when the pump center wavelength is 770 nm.
3.3.3 Coupling and Filtering

Before being processed, the photons have to be cleaned from parasitic signals, such
as remnants of the pump, undesired reflections and photons emitted in unwanted
modes. The spectral filtering is performed in three steps. First, we already men-
tioned the longpass dichroic mirrors, which separate most of the pump beam from
the signal and idler photons. Then, longpass filters suppress the last remnants of
51
the pump, while transmitting the photons. Finally, custom ultra-narrow bandpass
filters, provided by Alluxa, suppress most parasitic signals emitted in the telecom
range. The central wavelength can be tuned from 1550 nm to 1530 nm by tilting
the filter around its vertical axis, and the FWHM is 1.3 nm as seen in Fig. 3.11.
These narrow filters also allow to suppress the side lobes displayed in Fig. 3.10,
which increases the purity, but induces additional losses.
Fig. 3.11: Transmission of the ultra-narrow bandpass filters depending on the

wavelength, when placed normally to the beam. The central wavelength goes down
when tilting the filter. Data provided by Alluxa.
Spatial filtering is performed by coupling the photons into single-mode fibers

thanks to a short focal-length lens. Tuning the distance of the lens from the fiber
and the crystal center allows to select the Gaussian mode selected by the SM
fiber. We wish to set these coupling modes in order to maximize the probability
of detecting the signal photon, knowing the idler photon was measured. This
probability is also called the asymmetric heralding efficiency, and reads:
P si
η s| i = , (3.22)
Pi
where P si is the probability of detecting both signal and idler photons, and P i is
the probability of measuring the idler photon. It was shown that when the pump is
collimated at the scale of the crystal, as it is in our case (ξ p = 0.04), then signal and
idler spatial modes are highly correlated [45, 110], such that measuring the idler
photon in a Gaussian mode of waist w i projects the signal photon in a Gaussian
52
mode of similar waist ws ≃ w i . Thus, choosing carefully the coupling waists allows
to maximize the heralding efficiency. In our experiment, this maximum heralding
efficiency was reached for ws = 190 µm and w i = 218 µm. The corresponding focusing
parameters read
L λs L L λi L
ξs = = ≃ 0.24, ξi = = ≃ 0.17, (3.23)
n s zR,s n s πw2s n i zR,i n i πw2i
such that both modes are also collimated at the scale of the crystal. This comforts
the assumption taken in the last paragraph, considering signal and idler as plane
waves when calculating the spectrum, leading to eq. 3.17.
The heralding efficiency effectively varies from one experiment to another, de-
pending on losses induced by various components. The maximum value reached
was η s| i = 66%, in a specific situation where the pump was going through one
side of the Sagnac interferometer only, and the achromatic HWP was removed
from the photons’ path. By discarding the losses induced by fiber connectors, and
detectors efficiency, we get a corrected coupling efficiency η′s| i > 81%, comparable to
state-of-the-art sources [45, 95]. This value might increase even more by choosing
more transmissive optical components, in particular the Sagnac PBS which only
transmits 90% of the light at maximum.
3.3.4 Photon Processing and Measurement

Photons can undergo different operations after being coupled into SM fibers. Typi-
cally, we manage their polarization via different sets of WPs, or more conveniently
by using fibered polarization controllers (PC). The rest of the photon processing
apparatus depends on the implemented protocol. A common processing block is
the polarization-analyzer (PA), that we use to measure the photon’s polarization
in any qubit basis mentioned in paragraph 2.1.3. An example of such an appa-
ratus is shown in Fig. 3.12. A HWP and a QWP are used in order to rotate the
photon polarization, or equivalently the measurement basis. These are followed by
a PBS, which converts two orthogonal polarization modes into spatial modes, later
measured by single-photon detectors.
53
Fig. 3.12: A polarization analyzer used in our experiment. WPs are motorized,
PBS is fibered, a PC ensures the PBS axes are aligned with those of the WPs.
In table 3.1, we give the different bases that we measure in our experiments,
along with the ocrreponding WPs configurations. In our setup, WPs are mounted
into fast and precise motorized stages, in order to automatically and swiftly change
the measurement basis. This is of particular convenience when performing quan-
tum state tomography, or quantum information protocols, as in chapter 6.
Basis HWP angle QWP angle

σ̂ z : {| H 〉, |V 〉} 0◦
0◦
σ̂ x : {|D 〉, | A 〉} 22.5◦ 0◦
σ̂ y : {|L〉, |R 〉} 0◦ 45◦
p
(σ̂ x + σ̂ z )/ 2 11.25◦ 0◦
p
(σ̂ x − σ̂ z )/ 2 33.75◦ 0◦
Tab. 3.1: Common polarization bases and the corresponding WPs angle used to
measure the photon in said bases.
After being discriminated by the PBS, photons are carried by optical fibers to
superconducting nanowire single-photon detectors (SNSPDs, ID281 by IDQuan-
tique). These consist of an electronic circuit made of a conductor material (see
Fig. 3.13), that becomes superconducting when cooled down to a cryogenic temper-
ature ≈ 0.8 K (see Fig. 3.14). When the photon hits the circuit, the energy income
heats the conductor up, which loses its superconductivity. The resulting increase
in resistivity is then converted into an electric pulse that can be measured and
54
timed with maximum uncertainty (timing jitter) of ≈ 40 ps. The detection efficiency
for telecom photons is typically ≈ 90%, and the rate of false detections, called
dark counts (DC), is as low as ≈ 50 Hz, due to the cryogenic temperature. After
the detection of a photon, the detector is fully operational past a recovery time of
≈ 100 ns at maximum. The characteristics of the detectors are given in table 3.2.
Detector Efficiency DC rate Timing Jitter Recovery Time

1 84% ± 4% 41.5 Hz 30.5 ps 50 ns
2 89% ± 4% 33 Hz 30.6 ps 46.6 ns
3 86% ± 4% 61 Hz 30.9 ps 79.7 ns
4 96% ± 5% 58 Hz 40.7 ps 97.5 ns
Tab. 3.2: Characteristics of our first four SNSPDs, provided by IDQuantique.
Fig. 3.13: Picture of a superconduct-

ing nanowire circuit used as SNSPD, Fig. 3.14: Cryostat containing the
taken via scanning electron micro- SNSPDs, and keeping them at < 0.8 K.
scope. Source: IDQuantique. Picture by IDQuantique.
The electric signal of each detector is then sent to a time tagger (Ultra from
Swabian Instruments), also called coincidence counter (c.c.), that times the dif-
ferent detection events with picosecond-precision. The simultaneity of different
detection events can then be assessed, by setting up the right coincidence window,
which is the maximum time interval between two simultaneous detection events.
Timing delays can also be added or subtracted after recording the events, in order
to compensate for differences in each photons’ paths. We choose a coincidence
55
window of 500 ps, which is long enough compared to timing uncertainties, but
small enough to cancel-out most of the noise. A summary of the setup used to
measure the correlation between two photons is displayed in Fig. 3.15.
Fig. 3.15: Full apparatus used to analyze the bi-photon polarization state. Two
polarization analyzers allow the local measurement of each photon of the pair.
Correlations between detection events are then assessed by the time tagger and
computer.
3.4 Characterization of the Source

Thanks to the biphoton polarization analyzer shown in Fig. 3.15, we could measure
the most important characteristics of our source. First, sending 1 W of pump
power, we measured a maximum pair-detection rate of R 2 ≃ 400 kHz, depending
on the alignment of the source. Accounting for the detection efficiencies, we get
an emission rate R 2′ ≃ 1.1 MHz, and hence a brilliance B ≃ 1.1 × 103 pairs/s/mW.
This is significantly lower than previous sources [42, 95], which can be explained
by the collimation of the pump beam in the crystal. When the pump is in pulsed-
mode, we derive the probability of emission of a pair from a pump pulse p =
R 2′ / f ≃ 0.015, where f is the Laser repetition rate. This way, we have p ≫ p2 , so
the double-pairs emission rate is negligible compared to the pair emission rate.
This feature, together with the high-heralding efficiency η s| i = 66 %, indicates our
source approaches a heralded single-photon source. Another common benchmark of
single-photon sources is the autocorrelation function g(2) (0) of the heralded photon,
detailed in [43], which quantifies the importance of higher-order effects compared
56
3.4. CHARACTERIZATION OF THE SOURCE
to photon pair emission. To evaluate this quantity, we herald the signal photon
with its idler twin detected in a detector D 1 , and we measure the signal photon in
two detectors D 2 and D 3 after a 50/50 beam splitter. This way the autocorrelation
function reads:
4 · R 1 · R 1,2,3
g(2) (0) ≃ , (3.24)
(R 1,2 + R 1,3 )2
where R 1,2 , R 1,3 and R 1,2,3 give the rates of simultaneous detections in the cor-
responding combination of detectors, and R 1 is the rate of detection of the idler
photon in D 1 . In Fig. 3.16 we display g(2) (0) as a function of the average pump
power, in pulsed mode. At low power, our source indeed approaches the behaviour
of a true heralded single-photon source with g(2) (0) = 0.
Fig. 3.16: Autocorrelation function g(2) (0) of the heralded signal photon, as a
function of the average pump power, in pulsed mode.
Most importantly, the biphoton polarization states emitted by our source can
be evaluated on quantum state tomography (QST) [51, 52], which allows to re-
construct the full density matrix of our 2-qubits state, by measuring a finite set
of Pauli observables σ̂ i A ⊗ σ̂ i B . These are easily accessible in our experiment, by
measuring the two photons in all combinations of two configurations displayed
in table 3.1. Details on this method are given in appendix A. Thanks to the WPs
motorized stages and the relatively high pair detection rate, it typically takes only
15 min to 30 min to acquire a full data set needed for this state reconstruction.
57
Using the pump Laser in continuous-wave mode, double-pair emissions are

negligible, such that the state quality is maximized. We display a typical density
operator ρ emitted by our source in Fig. 3.17. This state displays a fidelity to
maximally entangled state
F (ρ , Ψ+ ) = 〈Ψ+ |ρ |Ψ+ 〉 = 99.32% ± 0.05%. (3.25)
(a) Real part. (b) Imaginary part.
Fig. 3.17: Typical biphoton polarization quantum state emitted by the Sagnac
source, reconstructed by QST. We measure a fidelity F (ρ , Ψ+ ) = 99.32% ± 0.05% to
the Bell state |Ψ+ 〉. Real and imaginary parts are not at the same scale.
We mentioned in paragraph 2.1.4 that 2-qubits maximally-entangled Bell states

form a whole class of states that are all equal up to local unitary transformations.
Hence in many cases the absolute closeness of the 2-qubits state to |Φ± 〉 or |Ψ± 〉
is less relevant that its closeness up to local unitaries. This is the case of device-
independent protocols in particular, as we will see in chapter 6. For this reason
we often maximize the fidelity of our state ρ to |Φ+ 〉 = |HHp
〉+|V V 〉
, by applying local
2
unitaries Û A ⊗ ÛB . This way, with an optimal alignment of the source, we measure
Fmax (ρ , Φ+ ) = max 〈Φ+ |Û ρÛ † |Φ+ 〉 = 99.43% ± 0.05%, Û = Û A ⊗ ÛB , (3.26)
Û A ,ÛB
which is comparable to state of the art sources [42]. Note that in practice, it is
particularly convenient to tune the different WPs angles and fibered polarization
controllers, in order to experimentally perform the maximization on Û A and ÛB .
58
3.4. CHARACTERIZATION OF THE SOURCE
When the Laser is in pulsed mode, the energy is concentrated in time, resulting
in a higher probability of double-pair emission. This induces noise in the effec-
tive state, caused by accidental coincidences between uncorrelated photons. The
consequent decrease in the fidelity of the state to a maximally-entangled state is
displayed in Fig. 3.18.
Fig. 3.18: Fidelity of the biphoton polarization quantum state emitted by the
Sagnac source evaluated by QST, to the maximally-entangled state |Φ+ 〉, as a
function of the pulsed-pump power.
Using the state emitted by our source, we could test the violation of Bell
inequality 2.21. In CW-mode, we measure the observables Â 0 = σ̂ x and Â 1 = σ̂ z on
the first photon, and the observables B̂0 = − p1 (σ̂ z + σ̂ x ) and B̂1 = p1 (σ̂ z − σ̂ x ) on the
2 2
second photon. This way, we measure a ϵ-close-to-maximum violation
p
I = 2 2 − ϵ = 2.8142 ± 10−4 , with ϵ = 0.0142 ± 10−4 . (3.27)
Finally, we show the relatively strong stability of our source over time, by per-
forming a series of QST of the state emitted by the source, for an 8 hours duration.
From the data acquired during these tomographies, we deduce the evolution of both
the source’s state fidelity to a maximally-entangled state and the pairs’ detection
rate, over time (see Fig. 3.19). By fitting the data we conclude the drift in state
quality and coupling to be negligible.
59
Fig. 3.19: Features of the source measured over an 8-hours time-span. The 1-hour
gap at the end of the data series is due to a cooling cycle of the detectors.
(a) Fidelity of the source’s state to a Bell state. (b) Biphoton detection rate R 2 .
3.5 Toward a Multi-Photons Source
Numerous quantum network primitives require more than one pair of photons to
operate. This includes authenticated teleportation [26], composable multipartite
entanglement verification [121], or quantum anonymous communications [17, 122],
which we would like to experimentally implement in our laboratory in a near
future. Here we detail our new design for a source of multiple pairs of photons,
which only requires some mild adaptations of our pair source to operate. These
adaptations are currently being made in the lab.
60
3.5. TOWARD A MULTI-PHOTONS SOURCE
3.5.1 Key Ingredient: Two-Photons Interference

The most common SPDC-based multipartite layout is made of at least two sources
of pairs of photons, and at least one bipartite operation in order to make two pairs
interact. This operation generally consists of making two photons from separate
pairs interfere, in a Hong-Ou-Mandel-like setting (see paragraph 2.2.5). We display
the typical experimental setting in Fig. 3.20. We can for instance use a BS, and
post-select on the detection of one photon in each one of its outputs. We say photons
anti-bunch, which effectively performs a Bell-state measurement (BSM), projecting
| HV 〉−|V H 〉
the interfering photons on the antisymmetric state |Ψ− 〉 = p . This is a
2
fundamental ingredient for quantum state teleportation [58]. When using a PBS,
two maximally-entangled states |Φ+ 〉 = |HHp
〉+|V V 〉
, and with the same post-selection,
2
then we effectively perform entanglement-fusion [46, 123]. This way we prepare a
GHZ state
1 ¡ ¢
|GHZ4 〉 = p | H1 H2 H3 H4 〉 + |V1 V2 V3 V4 〉 . (3.28)
2
Fig. 3.20: Typical layout of a optical multipartite quantum experiment.
A wide variety of other two-photons operations are possible, summarized in

the following review [124]. The quality of the operation is quantified by the HOM-
interference visibility, which reads:
P (ρ 2 ) + P (ρ 2 )− ∥ ρ 2 − ρ 3 ∥22
V (ρ 2 , ρ 3 ) = , (3.29)
2
where ρ 2 and ρ 3 are the reduced states of photons 2 and 3 in Fig. 3.20, P (ρ ) is
the purity of state ρ , and ∥ ρ 2 − ρ 3 ∥22 = Tr(ρ 2 − ρ 3 )2 is the Hilbert-Schmidt distance.
This way, a high-quality GHZ state or BSM relies on generating separable pairs of
photons (except in the polarization degree of freedom), and in indistinguishable
61
states. The design of our PPKTP crystal and pump beam, as well as mild spectral
filtering, ensures the photons are spectrally-separable photons, and therefore
display an optimal purity. In the following we focus on the problem of generating
indistinguishable pairs of photons.
3.5.2 Spatial Multiplexing and Layered Sagnac Source

A naive way to generate independent pairs of photons is to pump different non-
linear crystals with the same Laser. This solution is wide-spread and functional,
and was used in particular to successfully generate a 12-photons GHZ state [47].
Still the hardness of this solution resides in making all independent sources in-
distinguishable, such that all crystals and alignment should be rigorously the same.
An interesting solution was proposed by H. Guilbert et al. [125] and demon-

strated by the KIKO team of M. Bourennane [126, 127] in the form of spatial
multiplexing. It exploits the ring-distribution of entangled pairs emitted via type-I
SPDC in a bulk BBO crystal. In this way, independent pairs can be collected in
different parts of the ring, as shown in Fig. 3.21. These pairs are indistinguishable,
as they come from the same source.
Fig. 3.21: Spatial multiplexing: independent and indistinguishable pairs of photons

can be collected in different points A, B, C or D of the same type-I SPDC ring.
For now, spatial multiplexing was only proposed for bulk crystals. Thus all
multipartite sources based on periodically-poled crystals have so far relied on
building multiple separate interferometers, with two different crystals. This was
pointed out as a limitation for the emission of indistinguishable pairs [128], aris-
62
ing from mild differences in separate crystals or alignments. Here we provide an

original adaptation of the standard PPKTP-Sagnac source, in order to get two
sources into one by spatial multiplexing. This method exploits the 2-dimension
geometry of periodically-poled-crystal-based sources, which therefore allows to
vertically stack different sources of entangled-photons in the same Sagnac inter-
ferometer and PPKTP crystal. We display this Layered-Sagnac configuration in
Fig. 3.22. Alternatively, we call this configuration Sagnac Mille-Feuille in French,
or even Lasagnac in Italian, as a tribute to the layered dishes from these two
countries. In addition to ensuring the indistinguishability of photons, this layout is
particular compact, such that we can consider stacking more layers in a limited
space. Also, the alignment of such a layered source is expected to be particularly
simple. Indeed, provided one is able to generate two parallel pump beams (by
using the setup shown in Fig. 3.23 for instance), the whole source can be aligned
by performing a single alignment of the Sagnac interferometer, detailed in annex B.
Fig. 3.22: Scheme of the Layered-Sagnac source. Two parallel beams pump the
same PPKTP crystal at different heights.
63
3.5.3 Pump-Shaping for Layered Sagnac Source

Converting our source into a Layered Sagnac source should only require a few
adaptations, the main one being the pump shaping. The main hardness comes from
generating two vertically-stacked parallel beams. A spatial multiplexer made of two
calcite crystals can generate two such beams, as shown in Fig. 3.23. Interestingly,
as the two beams have exactly the same path, one can set the focusing optics before
the multiplexer. This ensures both beams are focused inside the crystal with the
same waist.
Fig. 3.23: A spatial multiplexer used to generate two parallel beams. Calcite
crystals separate two parallel beams of orthogonal polarization. We use two such
crystals, rotated at 180◦ , so the optical path-length is the same for both beams.
For this first demonstration, we consider this solution based on calcite-crystals

does not provide enough degrees of freedom in order to ensure the beams are
perfectly parallel. Furthermore, a multipartite source requires to use the Laser in
pulsed mode, in order to maximize the probability of simultaneously emitting two
pairs (see eqs. (3.12,3.13) ), and thus the 4-photons emission rate:
R4 = f κ2 U p2 η4 . (3.30)
Here we recall f is the pump-pulse repetition rate, U p the energy per pulse, κ the
number of pairs emitted per Joules of pump pulse, and η the detectors efficiency.
Increasing the pulse-energy also increases higher-order emissions, and therefore
limits the state quality. For this reason, we propose to use a temporal multiplexer
[116, 117], as shown in Fig. 3.24. Such multiplexer consists of dividing the energy
of pump pulses by 2, all the while doubling the repetition rate, so the 4-photons
emission rate becomes:
1
R′4 = 2 f κ2 (U p /2)2 η4 = f κ2 U p2 η4 . (3.31)
2
64
This way, we divide the rate of emission by 2, instead of 4 if we simply had

divided the pump power by 2. At the output of the temporal multiplexer, we get
two separate beams, that we propose to use for parallel spatial-multiplexing in
the layout shown in Fig. 3.24. We first recombine the beams in a Mach-Zehnder
interferometer, where the second cube is a PBS. This way, we can finely control
the alignment of the beams by measuring the interference visibility. Then we tilt
two glass plates (windows) in opposite angles, such that one beam is displaced
downward and the other is displaced upward. Such glass plates are generally
particularly flat, such that the two beams stay parallel.
Fig. 3.24: Temporal and spatial multiplexer being built in our experiment. In the
temporal multiplexer, half of the pulse power is delayed, in order to make two
pulses with lower power. The windows are tilted around the horizontal axis that
is perpendicular to the beams. The orange beam is displaced upward, while the
magenta beam is displaced downward.
This layout is more complex than the one shown in Fig. 3.23, but can be tuned
more finely. For instance, we can control the focusing of the two parallel beams
separately, by adding lenses in the arms of the spatial multiplexer. Also, the
parallelism and separation of the beams can be controlled finely thanks to the
mirrors and glass plates. This way, we expect the multiplexer from Fig. 3.24 to
be more practical in first laboratory experiments, though that of Fig. 3.23 would
require more investigations for more compact and stable applications.
65
3.6 Discussion and Future Improvement

Combining a previously developed PPKTP-Sagnac scheme [42], with more recent
adaptations for the emission of telecom photons [95, 111], we demonstrated a
source of close-to-maximally entangled qubits, encoded on the polarization state of
a photon pair. We showed this source to be quite flexible, as it can also be used in
pulsed mode, to generate heralded single-photons with high heralding efficiency,
spectral purity and low higher-order emissions. All those characteristics make our
source particularly suitable for the implementation of quantum network protocols,
such as weak coin-flipping with a single-photon (see chapter 4) or channel certifica-
tion allowed via the self-testing of maximally-entangled states (see chapter 6).
A significant flaw of our source is its relatively low brilliance, which is limited by
the weak focusing of the pump Laser. This latter feature is necessary for emitting
separable photons with high coupling efficiency, as well as for our novel design of
a multi-qubits source. A low brilliance is not limiting in our protocols, in which
enough pump power is available for high emission rates, but may be a limitation
for wider-scale applications in a near-future, in a context of energy scarcity.
A few improvements may maximize some characteristics of our photon-pair

source. First, the heralding efficiency and detection rates could be improved by
using more transmissive components, particularly the Sagnac PBS and achromatic
HWP. Second, for applications relying mostly on maximally-entangled states, a con-
tinuous diode Laser could replace the Titanium-Sapphire Laser, which is relatively
noisy when used in CW-mode. This would improve the purity of the emitted states,
and thus their fidelity to Bell states. Finally, recent studies demonstrated close-
to-unity spectral purity of telecom single photons emitted via SPDC [112, 113], by
tailoring a custom poling pattern in the KTP crystal. In the future, such solutions
could be applied in our experiments, eliminating the need for narrow spectral
filtering.
66
3.6. DISCUSSION AND FUTURE IMPROVEMENT
Finally, we proposed a novel layout for adapting our source to multipartite-

entanglement emission, with only a few adjustments. This uses the spatial multi-
plexing technique, which had already been demonstrated for bulk-crystal sources,
emitting photons in a ring-geometry. In our case, we would stack different sources
in the same PPKTP-Sagnac interferometer, exploiting the plane geometry of
periodically-poled-crystal-based sources. The resulting layered-Sagnac source should
be particularly compact, stable and simple to align, compared to the more usual
setting, which uses several separate PPKTP-Sagnac sources. At the time of the
writing of this thesis, this new source is being built in our lab, so we hope to
demonstrate new multipartite communication protocols in a near-future, such as
authenticated teleportation [26], composable GHZ-states verification [121], and
quantum anonymous transmissions [122].
67
‘Nic dwa razy si˛e nie zdarza
i nie zdarzy. Z tej przyczyny
zrodziliśmy si˛e bez wprawy
CHAPTER
4
i pomrzemy bez rutyny.’
— Wisława Szymborska, Nic dwa razy.
Q UANTUM W EAK C OIN F LIPPING

WITH A S INGLE P HOTON
he security of a potential future quantum network relies on assembling
T different cryptographic primitives, allowing to perform elementary tasks

with a certain resilience to malicious attacks and cheating strategies [129].
In particular, cheat-sensitive protocols display a form of resilience, as they can
expose cheating players with a certain probability, although those players might be
able to cheat and bias the protocol in their favor. This way, sanctions can be taken
against players who are caught, in order to deter them from cheating.
Coin flipping is one of these fundamental building blocks, and comes in two
versions. Strong coin flipping (SCF) allows two players to remotely agree on a
random bit, such that none of the players can bias the outcome with probability
higher than 1/2 + ϵ, where ϵ is the protocol bias [130]. It is essential for multiparty
computation [131], online gaming and more general randomized consensus proto-
cols involving leader election [132]. Weak coin flipping (WCF), on the other hand,
allows the same task when both players have a preferred, opposite outcome. This
way the protocol effectively designates a winner or a loser, and players may try to
bias the protocol toward their preferred outcome.
69
CHAPTER 4. QUANTUM WEAK COIN FLIPPING WITH A SINGLE PHOTON
With classical communication resources, SCF and WCF protocols are only pos-
sible through computational assumptions or trusting a third party [130, 133–135].
For instance the players may trust a clock, in order to simultaneously broadcast
two random bits, the sum of which provides the outcome. This implies no player
would corrupt the third party to favor an outcome over another (by desynchronizing
the clock for instance). In turn, such an assumption limits the protocol’s security.
Using quantum properties, however, one can derive information-theoretic security
for SCF and WCF. Interestingly, quantum SCF can only limit the protocol bias to a
p
minimum value ϵ = 1/ 2 − 1/2 [136], whereas quantum WCF may reach arbitrarily
small values of ϵ [137, 138]. The latter can also be used for the construction of
optimal quantum SCF and quantum bit commitment schemes [139, 140]. While
quantum SCF protocols were experimentally demonstrated [141–143], only re-
cently a practical implementation of WCF was proposed by M. Bozzio et al., using a
single-photon and simple linear-optics [48]. Still the proposed quantum advantage
provided by this implementation, in terms of outcome-bias from cheating players,
is extremely sensitive to losses. Indeed a dishonest party may always declare an
abort when they are not satisfied with the outcome of the coin flip.
In the following chapter, we present the first experimental demonstration

of quantum WCF, that we performed using a single-photon, heralded from our
photon-pairs source (see chapter 3), and later mixed with vacuum on a beam
splitter. This effectively entangles two path-modes of the electromagnetic field, and
gives the flip outcomes after detecting the presence or absence of a photon in said
paths. Our protocol is a refined version of the theoretical protocol from [48], which
provides a new form of quantum advantage, even in the presence of losses. This
advantage relates to cheat sensitivity rather than bias from cheating players. By
dropping the condition from [48] that both players should have equal probability of
winning when cheating, our protocol allows them to detect whether their opponent
is cheating during a verification step, and does not sanction an honest party. To
this day, no classical protocol displays such cheat sensitivity with information-
theoretic security [144, 145]. In order to emphasize the robustness of this quantum
advantage to losses, we show that our protocol remains secure over an attenuation
that corresponds to several kilometers of telecom optical fiber.
70
4.1. PROPOSED PROTOCOL
4.1 Proposed Protocol

We first introduce our protocol for quantum weak coin flipping using a single
photon protocol, which accounts for potential losses and the detection of a cheat-
ing party. We provide the recipe in Protocol 4.1, built on the proposition from
M. Bozzio et al. [48]. In the end we discern five mutually incompatible outcomes:
• Alice wins when ( b, v1 , v2 ) = (0, 1, 0),
• Alice is sanctioned if ( b, v2 ) = (0, 1),
• Bob wins when ( b, a) = (1, 0),
• Bob is sanctioned if ( b, a) = (1, 1),
• The protocol aborts if ( b, v1 , v2 ) = (0, 0, 0).
The protocol uses three beam splitters, whose reflectivities x, y, and z are
chosen in order to satisfy two conditions on these events. Firstly, the fairness
condition, which states that Alice and Bob have equal winning probabilities when
both of them are honest, i.e. Ph (A. wins) = Ph (B. wins), or
£ ¤ £ ¤
Ph (b, v1 , v2 ) = (0, 1, 0) = Ph (b, a) = (1, 0) . (4.1)
Secondly, the correctness condition, which states that an honest party should never
be sanctioned for cheating, i.e. Ph (A. sanctioned) = Ph (B. sanctioned) = 0, or
£ ¤ £ ¤
Ph (b, v2 ) = (0, 1) = Ph (b, a) = (1, 1) = 0. (4.2)
Note that contrary to the previous protocol [48], we drop the balancing condition,
which states that Alice and Bob should have equal probabilities of winning when
using an optimal cheating strategy, as it cannot be satisfied together with the
correctness condition in presence of experimental imperfections. Consequently,
a practical balanced protocol would sanction an honest Alice for cheating, with
non-zero probability. This impacts the cheat sensitivity, as one cannot trust the
verification step if it sanctions honest parties. For more details on the protocol and
the chosen conditions, the reader may refer to appendix C.
71
Protocol 4.1: Cheat-sensitive weak coin flipping with a single photon.
1. Preparation. Alice sends a single photon on a beam splitter of reflectiv-

ity x, keeps the reflected mode, and sends the other to Bob.
2. Decision. Bob sends the state he receives on a beam splitter of reflec-

tivity y, measures the transmitted mode with a single-photon detector
D B , and broadcasts the outcome b ∈ {0, 1}.
3. Verification. If b = 0, Alice sends her reflected mode to Bob, who mixes

it with his own reflected mode on a beam splitter of reflectivity z, and
measures the two outputs with single-photon detectors D V1 and D V2 .
He distinguishes three cases depending on the outcome (v1 , v2 ):
• v2 = 1: Alice is sanctioned for cheating,
• (v1 , v2 ) = (1, 0): Alice wins,
• (v1 , v2 ) = (0, 0): the protocol aborts.
If b = 1, Bob discards his state. Alice measures her state with a single-
photon detector D A . She then discerns two cases depending on the
outcome a:
• a = 0: Bob wins,
• a = 1: Bob is sanctioned for cheating.
72
4.2. EXPERIMENTAL SETUP
4.2 Experimental Setup

Our implementation of Protocol 4.1 relies on the emission of heralded single-
photons on Alice’s side, using the source described in chapter 3. Operations de-
scribed in the protocol are implemented using fibered components at telecom
wavelength. As the polarization degree of freedom is not used for encoding, Alice
entangles it with the spatial modes, using PBSs. In this way, the BSs reflectivities
x, y, and z, can be effectively tuned by rotating the single-photon polarization
before each PBS, using polarization controllers. We use a fast optical switch in
order to select the party who performs the verification step, depending on the
outcome b. During this operation, the photon is delayed in 300 m-long optical fiber
spools. In order to simulate communication distance between Alice and Bob, and
the corresponding losses induced by the photon storage that is necessary in this
case, we use variable optical attenuators (VOAs). Photons are finally detected
by single-photon detectors, and the measurement results are processed via our
coincidence counter (c.c., see paragraph 3.3.4). The detailed setup is shown in
Fig. 4.1, and discussed in the following paragraphs.
Fig. 4.1: Experimental setup for cheat-sensitive quantum weak coin flipping. Signal
and idler photons are generated using the source presented in the chapter 3. The
idler photon is detected in D herald , heralding the signal photon which is used to
perform the protocol and detected in D A , D B , D V1 , and D V2 . The dashed line marks
visually the separation between Alice and Bob.
73
4.2.1 Heralded Single Photon

Most important details on the heralded single photon source are given in chap-
ter 3. Still, a few additional details are worth mentioning. Firstly, the maximally-
entangled states of polarization are not required in this protocol, so we only use
one side of the Sagnac interferometer to produce photons in a product state of
polarization | H i Vs 〉. We also remove the achromatic HWP from the Sagnac in order
to minimize the losses on photons. After being collected into SM fibers, the idler
photon is detected in order to herald the signal photon and trigger a protocol
run. The resulting single-photon is then processed by the players to perform the
protocol, and ultimately detected in 4 different path-modes with our 4 SNSPDs,
which optimizes the heralding efficiency. Losses on the idler photon were not lim-
iting, so we detect it with a 25 %-efficiency InGaAs avalanche photo-diode (APD,
ID230 from IDQuantique). This way, protocol runs are triggered at a rate of 51 kHz,
and without adding the fibered components we measured a maximum heralding
efficiency η s = 63% of the signal photon.
4.2.2 Optical Switching

During the decision step of the protocol, Bob’s detection determines which party is
winning, and which one has to perform the verification. In our experiment, this
decision is effectively taken into account by Alice via her optical switch (Nanospeed
from Agiltron, see Fig. 4.2). Hence, if Bob does not claim victory, the switch is in
state "0" in order to send Alice’s state to Bob, who performs the verification. If
Bob claims victory, the switch goes to state "1" such that Alice keeps her state
and performs the verification. In practice, we send the electronic signal from Bob’s
detector, together with the heralding signal, to a fast programmable logic AND
gate, integrated in a time controller (ID900 from ID Quantique). This gate filters
out potential detection events outside of the protocol, which might saturate the
optical switch. The gate’s output signal is then sent to the optical switch, which
executes the decision.
74
Fig. 4.2: Optical switch Nanospeed provided by Agiltron
Two timings must be set carefully in order to send the photon in the appropriate
direction. First, the two detection electronic signals must be synchronized inside
the AND gate in order to perform the logic operation. These timings can be tuned by
programming the time controller, and we check that synchronization by measuring
the rate of coincidences between the AND gate output, and the detections in the
heralding detector and in Bob’s detectors. Second, the wave-packet on Alice’s side
must pass through the switch when the latter is in the appropriate state. As it
takes approximately ≃ 800 ns to perform the logic gate and the potential shift of
the optical switch’s state, we use 300 m-long optical fiber spools, on each party’s
side, in order to delay the photon for ≃ 1.5 µs. We can then tune the timing of the
AND gate’s output electronic signal, again by programming the time controller,
so that the photon enters the switch right after its state was set. We check the
synchronization by implementing a dishonest Bob who constantly claims victory
by sending a continuous electronic signal to the AND gate. Then the timing is
appropriately set when the rate in Alice’s verification detector is maximized.
Note that when performing the protocol with honest parties and a true single-
photon, then Alice activates her switch only when Bob measures the photon, so
ideally she cannot measure any signal in her verification detector. This is expected
as we tend to minimize the probability of sanctioning an honest Bob, for optimal
correctness. However, this questions the point of using such an optical switch
and fast electronics, just to send void on Alice’s verification detector. Physically
speaking, this seems equivalent to using the exact same setup with no switch, and
send all photons to Bob’s verification apparatus. However, we cannot assume Bob
75
to be honest, even when he is. Therefore, it is of major importance that Alice checks
that her state actually is projected on the void, in a cryptographic context.
(a) With no insulation (right), and partial (b) With full sound insulation, as used in
insulation (left). our experiments.
Fig. 4.3: Optical fiber spools used to delay the photon while the optical switch is
being operated, with the sound insulation mentioned in the next paragraph.
4.2.3 Error Management
Various factors can generate undesired detection events in our protocol. This is true
in particular for sanction outcomes, triggered by a detection in D A or D V2 which
should never occur when a party is honest. Thus managing these error sources is
of major importance in order to satisfy the correctness condition in particular, but
also to minimize undesired outcomes in general.
Most of these outcomes arise from Bob’s verification procedure, which relies
on a Mach-Zehnder interferometer. If this interference is of poor visibility, then
D V2 can be triggered even if Alice is being honest, and her winning probability is
also substantially lowered. Considering the length of this interferometer (> 300 m
because of the fiber spools), the visibility is limited by two main factors, namely
the coherence length and phase fluctuations. The coherence length of photons is ≃
2.4 mm (see the pairs’ spectrum in figure 3.10), which is small enough to start losing
coherence after a few hours of experiment runs. This is mostly caused by length
variations in the interferometer arms due to thermal fluctuations (≃ 2.4 mm/◦ C
for a 300 m arm). We therefore regularly fine tune the length of one arm of the
interferometer, using a free-space micro-metric delay line.
76
Phase fluctuations can be separated into two regimes. Slow phase fluctuations,
of typical frequency ≲ 1 Hz, are again caused by thermal variations, and can be
easily monitored. Fast phase fluctuations, however, are caused by noise spanning
the audible spectrum from 20 Hz to 2 kHz. This noise is amplified by the 300 m fiber
spools, which act as a sort of microphone. These fluctuations are hard to resolve
with our single-photon rate of a few 10 kHz, such that the interference pattern
is averaged on that noise, and we witness an interference visibility of approxi-
mately v ≃ 80%. In order to characterize that noise, we measure the interference
pattern with a continuous diode laser and a fast photodiode (see Fig. 4.4). Without
any sound insulation, the noise in the interference fluctuation spans the audible
spectrum with a power spectral density ≃ 7 × 10−3 V2 /Hz. In order to mitigate this
noise, we wrap the fiber spools into several layers of sound-absorbing floating
parquet underlay (see Fig. 4.3). The power spectral density then drops to less than
10−3 V2 /Hz except for some specific frequencies. The total noise power is divided by
≳ 11. The measured visibility then reaches v ≳ 96%. Under these conditions, the
thermally-induced fluctuations are slow enough such that we can easily post-select
the protocol runs in which there was no phase difference between the two arms
of the interferometer. This post-selection does not threaten the protocol security,
as the parties could monitor the interference before performing the coin flip, and
agree on starting the protocol only when the phase difference is null.
Undesired outcomes can also be triggered by double-pair emission inside the

crystal, and dark counts in the detectors. The double-pair emission rate is limited
in our experiment, as the probability of emitting a photon-pair in a pump pulse
is p ≃ 0.015 (see the source’s characterization in chapter 3), so the double-pair
emission probability is negligible p2 ≪ p. Dark counts rates are made particularly
low thanks to the use of SNSPDs for detecting the signal photon. Furthermore
we use the pump internal signal in order to synchronize a 500 ps detection gate
with each of the detectors signals, and all signal-photon detections are conditioned
on a heralding photon detection. The probability of detecting a dark count during
a protocol run is then 5 · 10−8 , such that undesired outcomes due to dark counts
are negligible. However, the heralding photon is detected by an APD of 1 kHz dark
counts rate, which is substantially higher than SNSPDs. Such dark counts trigger
77
protocol runs while no photon was emitted, and therefore slightly increase the
abort probability. Still we evaluate the rate of such runs to be as low as ≲ 40 Hz,
thanks to the gating applied by the pump laser signal. This way the surplus of
abort probability caused by dark count is about 8 · 10−4 , which is negligible.
Fig. 4.4: Noise spectrum measured in the interferometer, using a continuous laser
and a fast photodiode, with and without sound insulation on the fiber spools. When
adding the insulation, the noise is low enough to distinguish peaks coming from
the main sources of sound in the lab: 48 Hz, 99 Hz, and 199 Hz are emitted by the
compressor plugged to the detectors cryostat, 290 Hz and 580 Hz are emitted by
the pump in the cold water circuit, which cools down the compressor, and 412 Hz
and 418 Hz are emitted by the laser chiller.
4.2.4 Losses
Because of their central role in the analysis of the protocol, we wish to distinguish
the BS reflectivities from the losses induced by the rest of the components in the
setup. For that purpose we define different transmission (or heralding) efficiencies,
measured when the reflectivities and the state of the switch are set to trivial
values x, y, z, s ∈ {0, 1}. These values reflect the losses in every possible path in the
experiment, which are induced for instance by fiber spools, VOAs, fiber coupling
and mating, or detectors. We detail the notations for the efficiencies corresponding
78
to each path and their measured values in Tab. 4.1. Each path is defined by the
detector it ends in and the arm it goes through (Alice’s or Bob’s).
Notation Path x y z s Efficiency

ηsA x → switch → D A 1 1 0.315 ± 0.008
y
ηB x → y → DB 0 0 0.303 ± 0.008
V
η A1 x → switch → z → D V1 1 1 0 0.231 ± 0.008
V
η A2 x → switch → z → D V2 1 0 0 0.219 ± 0.008
V
η B1 x → y → z → D V1 0 1 0 0.184 ± 0.008
V
η B2 x → y → z → D V2 0 1 1 0.175 ± 0.008
Tab. 4.1: List of notations and measured values for the efficiencies corresponding
to the different paths involved in the experiment. The paths are described by
the PBSs (labelled by the corresponding reflectivities) and/or the switch they go
through, as well as the detector at the end of the path. We also list the values of x,
y, z, and the state of the switch s, required to measure these efficiencies. Values
are given for VOAs set at 0 dB.
4.2.5 Measurement of Outcome Probabilities
The probabilities of the different outcomes are evaluated by measuring the different
detection rates and coincidence rates, provided by simple functions of our time
tagger. However, the time tagger does not provide a direct way of measuring the
rate of an event excluding some other event. For instance, in order to measure
the rate of "Bob wins" event, we need to measure the rate of detection in Bob’s
detector, that did not occur at the same time as a detection in Alice’s verification
detector. In logical notation, we need the event b ∧ ¬a. Yet for any pair of detection
events u, v, we have u ∧ ¬v = u ∧ ¬(v ∧ u) such that the rate R u\v of that event can
be calculated as R u\v = R u − R uv , with R u the rate of detection u and R uv the rate
of simultaneous detections u and v. In this way, we can easily deduce the formula
for the rates of different outcomes in the protocol, summarized in Tab. 4.2.
79
Outcome a b v1 v2 Logical Rate

R hV1 − R hV1 V2
Alice wins 0 1 0 ¬ b ∧ v1 ∧ ¬ v2
−R hBV1 + R hBV1 V2
Bob wins 0 1 b ∧ ¬a R hB − R hAB
Alice sanctioned 0 1 ¬ b ∧ v2 R hV2 − R hBV2
Bob sanctioned 1 1 b∧a R hAB
R h − {Rates of all
Abort 0 0 0 ¬ b ∧ ¬ v1 ∧ ¬ v2
other outcomes}
Tab. 4.2: Different protocol events, with the corresponding detection outcomes,
logical formula and combination of coincidence rates needed to compute the cor-
responding probability. The rates subscripts correspond to the detectors which
simultaneously trigger, h for the heralding, B for Bob’s detector, A for Alice’s verifi-
cation detector, V1 and V2 for Bob’s verification detectors.
4.3 Results for Honest Players

We first perform the protocol for different communication distances between Alice
and Bob, when both of them are honest. These distances are simulated by setting
each of the VOAs to a transmission η = e−0.02L with L the distance in kilometers,
introducing additional losses to each arm of the setup. In our experiments, because
of dark counts, double-pair emission, or imperfect interference visibility, Alice
and Bob can still be sanctioned even though they are honest and the setup is
optimized. In general, we cannot tune the reflectivities perfectly, so Alice and Bob
may have slightly different winning probabilities. This means our implementation
cannot satisfy perfectly the fairness and correctness conditions. Therefore, we
define the fairness F and correctness C in order to quantify the closeness to these
two conditions as follows:
¯ P (A. wins) − P (B. wins) ¯
¯ h h
F = 1−¯ (4.3)
¯
¯
Ph (A. wins) + Ph (B. wins)
Ph (A. sanctioned) + Ph (B. sanctioned)

C = 1− (4.4)
Ph (A. wins) + Ph (B. wins)
Both quantities are equal to 1 when the corresponding conditions are perfectly
fulfilled, and C , F < 1 otherwise. In the following we first show how honest Alice
80
4.3. RESULTS FOR HONEST PLAYERS
and Bob should tune the reflectivities x, y and z, in order to maximize these two
quantities. We then provide the results of our implementations of the protocol with
such honest players.
4.3.1 Reflectivities with Honest Players

We first provide the theoretical values of reflectivities xh , yh and z h that honest
players should set. In our implementation, double-pair emissions and dark counts
are very unlikely, so only the interference visibility v significantly limits C and F .
This way, we show that the correctness and fairness conditions are optimally
approached by setting the following reflectivities:
V V
h η A1 η A1 i−1
xh = 1 + + y (1 + v) (4.5)
V
η B1 ηB
V
h η 1 i−1
yh = 1 + By (1 + v) (4.6)
ηB
1
zh = (4.7)
2
The reader can refer to appendix C for the detailed proof. In particular, we show in
this proof that the effective interference visibility can be expressed as the average
on the fast phase fluctuations displayed in Fig. 4.4, v = |〈cos ΔΦ f 〉|.
In practive, these reflectivities are set by directly optimizing the correctness

and fairness of the protocol. Bob first sets z = 1/2 by blocking Alice’s signal, and
equalizing the detection rates in D V1 and D V2 . This later ensures an optimized
interference, and therefore the correctness condition. Then he can tune y such
that the detection rate in D B equals twice the total rate in D V1 and D V2 , which
should ensure the fairness condition. Alice then tunes x in order to optimize the
interference visibility, which should complete the setting of reflectivities. If v is
significantly lower than 1, Alice and Bob might have to perform some mild adjust-
ments on x and y in order to maximize the fairness and correctness.
After performing a protocol, we easily evaluate the reflectivities x, y, z by forcing

the switch in state s = 0 or s = 1, measuring the different detection probabilities and
81
dividing with the different paths’ efficiencies given in Tab. 4.1. We display those
experimental reflectivities in Fig. 4.5, for different implementations of the protocol
with honest players. We see these reflectivities can deviate from the theoretical
predictions derived from the efficiency values. The most plausible explanation is
that we might not perfectly set the expected reflectivities in each protocol run.
This could happen if the fairness F and the correctness C are hardly sensitive
to reflectivities around the optimal configuration. Also some undetected errors
might have occurred when measuring the efficiencies in Table 4.1, because of some
undetected fluctuations, or if we did not perfectly set the reflectivities x, y, z to
trivial values when performing that measurement.
Fig. 4.5: Reflectivities measured in protocols with honest parties, for different
communications distances simulated with VOAs. The lines show the prediction
from eqs. (4.5) to (4.7), with efficiencies given in Table 4.1, and with additional
factors e−0.02L induced by VOAs. The error bars are mainly due to error propagation
on the efficiencies.
4.3.2 Protocol Results
For each distance L, we set the VOAs to a transmission η = e−0.02L , and we optimize
the fairness and correctness at each distance by tuning the reflectivities. When
these are properly set to values from eqs. (4.5) to (4.7), we obtain the following
probabilities for significant events (see appendix C):
82
4.3. RESULTS FOR HONEST PLAYERS
Ph Alice wins = Ph B. wins = xh ηVA1 (1 + v),

¡ ¢ ¡ ¢
(4.8)
¡ ¢
Ph Bob sanctioned = 0, (4.9)
Ph Alice sanctioned = xh ηVA2 (1 − v).
¡ ¢
(4.10)
Note here the importance of maximizing the interference visibility v so that Alice
is not sanctioned while being honest. We continuously run the protocol and record
all detection events regardless of the phase difference between the two arms of the
interferometer. As if Bob was monitoring the phase difference, we post-select the
runs for which the phase spontaneously goes to zero thanks to slow temperature
fluctuations, such that the rate in D V2 (which essentially corresponds to the proba-
bility of honest Alice being sanctioned) is minimized. In this way, we measure at
least 1.5 × 105 valid iterations of the protocol for a 15-minutes run, making the
Poisson noise negligible. In Fig. 4.6 we give the probabilities of the different events
for several distances.
We notice that the abort probability takes relatively high values, even when
we trivially set the communication distance to L = 0 km. This has to do with impor-
tant losses, particularly in mating sleeves connecting the numerous optical fiber
components, the delay line, or in crystalline components such as the PBSs or the
optical switch. Significant improvements could be made, using integrated optics
for instance. Other critical features are the single-photon coupling and SNSPD
efficiencies. Both of these aspects are being actively studied [146–150] and could
see significant improvement in the near future. We also notice that the winning
probabilities of Alice and Bob are indeed very close and the probability of an honest
party to be sanctioned is minimized.
To further illustrate the performance of our protocol, we show the fairness F

and correctness C in Fig. 4.7. Thanks to the appropriate tuning of reflectivities x,
y, and z, as well as low dark count rates and high visibility, we were able to keep
both of these quantities very close to 1, thus approaching the ideal conditions.
83
Fig. 4.6: Probability of each outcome of the protocol, measured for different com-
munication distances between Alice and Bob. The abort probability is shown on the
right axis, in magenta. The lines represent the theoretical evolution of probabilities,
calculated via eqs. (4.5) to (4.10), with efficiencies given in Table 4.1. The error
bars are mainly due to error propagation on these efficiencies.
Fig. 4.7: Correctness C and fairness F measured in our experimental implementa-

tion of the protocol with honest parties, for different communication distances. The
dashed line gives the target value for an ideal protocol.
84
4.4. RESULTS FOR DISHONEST PLAYERS
4.4 Results for Dishonest Players

Now we highlight the cheat sensitivity of our protocol, by implementing attacks
by dishonest parties. We consider one party to be dishonest, the other one being
honest. Firstly, we implement a cheating Bob, and show the dependence of cheat-
sensitivity with losses and communication distance. We then implement a cheating
Alice, and show how the protocol’s cheat sensitivity dissuades her from performing
an optimal cheating strategy.
4.4.1 Dishonest Bob

Bob’s optimal cheating strategy is quite straightforward, and consists in claiming
b = 1 regardless of the actual measurement in detector D B [48]. As Alice is honest
she sets the reflectivity x = xh given in eq. (4.5). When Bob claims b = 1 then Alice’s
switch directs her mode in detector D A so that she can verify whether Bob is being
honest. She then detects a photon with probability:
P(a = 1|Bob cheats) = xh ηsA , (4.11)
in which case Bob is sanctioned for cheating. Otherwise, Bob wins with probability:
P(a = 0|Bob cheats) = 1 − P(a = 1|Bob cheats)
(4.12)
= 1 − xh ηsA .
In this way, Alice’s conditional verification, enabled in our setup by the fast optical
switch, allows for a first kind of cheat sensitivity.
In order to illustrate this aspect, we implement Bob’s optimal cheating strategy

by systematically forcing the switch to send the photon to D A . We measure the
probability of sanctioning Bob for each of the communication distances simulated
in the honest case. As displayed in Fig. 4.8, we show experimentally that the
probability of sanctioning Bob decreases as communication-induced losses increase,
therefore limiting Alice’s cheat sensitivity. This gives a substantial advantage to
Bob when Alice’s arm is particularly lossy. Note that when Bob implements that
strategy, only two events are possible, namely Bob winning or Bob being sanctioned;
Alice can never win except if the sanction is precisely giving Alice the win (see
discussion below).
85
Fig. 4.8: Probabilities of Bob winning or being sanctioned, when he is performing

an optimal attack, measured for different communication distances between Alice
and Bob. Only one set of points is shown for the two axes, as these two events are
complementary. The line is plotted from eqs. (4.11) and (4.12), with ηsA given in
Table 4.1. The error bars are mainly due to error propagation on this efficiency.
The observed deviation from the theory is linked to systematic errors when setting
the reflectivities.
4.4.2 Dishonest Alice
On the other hand, when Bob is honest and Alice is dishonest, her optimal cheating
strategy is less straightforward. In particular, the security proof from [48] does
not derive her optimal strategy but rather derives a security bound valid for all
strategies. Nevertheless, we can illustrate this scenario using suboptimal strategies
by simply tuning the reflectivity x, so that Alice sends the photon to her side with
higher probability. Intuitively, without taking the verification setup into account,
we can naively expect Alice’s winning probability to increase as she increases the
reflectivity x. We experimentally perform the protocol for different values of x, all
of them higher than the honest value (4.5). In that case, we derive the expected
event probabilities (see appendix C for the detailed proof):
86
4.4. RESULTS FOR DISHONEST PLAYERS
1 ³ V1
q ´
P(Alice wins) = xη A + (1 − x) yh ηVB1 + 2v x(1 − x) yh ηVA1 ηVB1 , (4.13)
2
1³
q ´
P(Alice sanctioned) = xηVA2 + (1 − x) yh ηVB2 − 2v x(1 − x) yh ηVA2 ηVB2 , (4.14)
2
P(Bob wins) = (1 − x)(1 − yh )η By . (4.15)
In Fig. 4.9, we show the probabilities of significant events. Contrary to our naive
conjecture, we see that thanks to Bob’s verification, and thus cheat sensitivity, Alice
does not have a clear interest in forcing x = 1, as her winning probability peaks
around x ≃ 0.78. Alice’s interest in cheating actually depends on how deterrent
the sanction is. We define a factor δ ≥ 0, which quantifies that deterrability, or
alternatively how harmful the sanction is for a cheating party. From this parameter
we can derive an empirical function that quantifies Alice’s interest in cheating:
P(A. wins) − P(B. wins) − δP(A. sanctioned)

I A (δ) = . (4.16)
P(A. wins) + P(B. wins) + δP(A. sanctioned)
This function is built such that it can be linked to the fairness (4.3) when taking the
appropriate sanction. Indeed, if for δ ∈ [0, 1] we sanction a cheating Alice by giving
the win to Bob with probability δ, then the relation F = 1 − |I A (δ)| holds. In this
way, δ = 0 corresponds to a protocol that simply aborts without sanction when Alice
is caught, and δ = 1 gives a protocol that always declares Bob the winner when
Alice is caught. Ultimately I A (δ) can be interpreted as a sort of expectation value
of a cheating Alice, or a comparison between what she can gain by cheating and
what she can lose. In Fig. 4.10 we plot Alice’s cheating interest for different values
of δ and x. If no sanction is taken (δ = 0), we see that her interest in cheating grows
with x. Indeed, even if her winning probability decreases for high values of x, Bob’s
then approaches zero, such that Alice wins with absolute certainty as long as the
protocol does not abort. On the contrary, as the sanction is tightened and the value
of δ increases, Alice has less interest in cheating for a given value of x. Furthermore,
the value of x that maximizes I A also goes down, showing how strengthening the
sanction actually forces Alice to adopt a strategy that leaves a chance for Bob to win.
87
Fig. 4.9: Probabilities of different outcomes measured when Alice cheats, setting
different values of x than the honest value. The lines show theoretical predictions,
calculated from eqs. (4.13)-(4.16), with efficiencies given in Table 4.1.
Fig. 4.10: Alice’s cheating interest for different deterrent factors δ. The dashed
black line indicates the points of maximum interest.
88
4.5. DISCUSSION
4.4.3 Case of two dishonest parties
Most quantum two-party computation security models do not consider both parties
being dishonest at the same time, since security makes sense from the perspective
of an honest party willing to protect against a malicious adversary. This threat
model is still very general however, as one does not make any assumption on which
of the two parties is dishonest: the protocol is therefore always secure for both an
honest Alice and an honest Bob. In the case of our protocol however, understanding
the double-dishonest scenario is fairly straightforward, and in fact reduces to a
fully classical protocol. Since the protocol is designed in such a way that the same
party (Bob) always declares the outcome of the flip first (while the verification
is then performed by the losing party), Bob cannot win in any other way than
declaring himself as the winner. The best that Alice can do is to then stop Bob from
winning, claiming that she caught him cheating. Thus, the protocol will always
abort, which is a desirable outcome in such a dishonest scenario. The case only
becomes a little more complex when one considers sanctioning dishonest aborts. In
that case, Bob will always be sanctioned for cheating first, even though Alice was
also dishonest.
4.5 Discussion
After refining a previous theoretical proposal for a practical quantum weak coin
flipping protocol [48], we were able to perform the first implementation of this pro-
tocol by generating a heralded single photon, and entangling it effectively with the
vacuum. Thanks to the use of low dark counts SNSPDs, tunable beam splitters and
a fast optical switch, while keeping a high visibility in our fibered interferometer,
we demonstrated a fair and cheat-sensitive protocol. This last property allows to
detect a cheating party with non-negligible probability, which to this day is not
accessible to classical protocols.
Note that in order to sanction a dishonest party with high probability, one could
systematically sanction the winning party, regardless of their honesty. Thus, in
order to display genuine cheat sensitivity, we highlight the primary importance
89
of the correctness condition, which ensures an honest party is never sanctioned

for cheating. This forced us to ignore the balancing of the benefit gained by each
party when adopting an optimal cheating strategy, which was previously assessed
as a necessary condition for a weak coin flipping protocol [48]. Still, we propose a
way of restoring this balance, by using the deterrent factor and interest function
introduced in the previous paragraphs.
The balance could indeed arise from choosing different sanctions for Alice and
Bob, associated with different deterrent factors δ A and δB , in order to equalize
the corresponding interest functions I A (δ A ) and I B (δB ). A dishonest party who
could dramatically increase their winning probability would therefore take a bigger
risk of being harshly sanctioned when cheating. Interestingly enough, one could
actually set arbitrarily big deterrent factors δ > 1 in order to account for harsher
sanctions. We leave the evaluation of these sanctions, deterrent factors and poten-
tial alternative interest functions as an interesting game theory open question.
From an experimental perspective, we remark that the robustness to losses

in our implementation was illustrated by simulating communication distance
with variable optical attenuators. In a practical implementation of the protocol,
it would be necessary to maintain a high visibility for a longer interferometer,
which could be achieved with active stabilization techniques used in twin-field
quantum key distribution implementations for instance [151, 152]. Furthermore,
optical implementations of quantum WCF with arbitrarily small biases are yet to
be discovered—such implementations would be challenging since they require a
rapidly growing number of rounds of communication between the parties [153].
90
CHAPTER
5
T HEORY OF P ROBABILISTIC Q UANTUM C HANNELS
ransformations undergone by quantum states are oftentimes described
T by unitary operators, assuming the system is isolated. However, such a

formalism cannot describe more general transformations, which may in-
volve interactions with an unknown outside system. For instance, this includes
random noise introduced in a photon’s polarization state during its propagation
in optical fibers. Therefore, quantum channels are more suitable to describe gen-
eral transformations undergone by a quantum system. In general, deterministic
quantum channels are considered, that transform a quantum state with absolute
certainty. The behavior of such channels is extensively detailed in quantum the-
ory books [154], and different distances can be used to define a topology on the
quantum channels’ space [64]. Still, little is known about probabilistic quantum
channels, which only operate with a potentially state-dependent probability. These
channels describe more accurately experimental situations which involve losses
and post-selection. In this chapter, we derive fundamental results related to the
behavior and topology of probabilistic quantum channels. These have concrete ap-
plications in chapter 6, for deriving the security of our protocols for the certification
of quantum communication through an untrusted and lossy quantum channel.
91
CHAPTER 5. THEORY OF PROBABILISTIC QUANTUM CHANNELS
5.1 Preliminary Notions

We first recall the definition of a quantum channel, which gives the sufficient
properties for a transformation to send a density operator on another operator:
Definition 5.1 (Quantum Channel). A quantum channel E is a convex completely-

positive non-trace-increasing (CPnTI) map, meaning:
P
1. Convexity: for any sets of probabilities { p k } with p k = 1 and density operators
{ρ k }, we have: hX i X
E p k ρ k = p k E [ρ k ], (5.1)
k k
2. Complete Positivity: for any secondary system of Hilbert space S , (E ⊗ 1S )[K ]

is positive for any positive operator K ∈ L (H i ⊗ S ),
3. Non-Trace Increase: For any operator K ∈ L (H i ), we have Tr E [K ] ≤ Tr K .
When E is also trace-preserving (CPTP map), then we have Tr E [ρ ] = 1 for any state
ρ , so we call E a deterministic or lossless quantum channel. Otherwise, if E is trace-
decreasing (CPTD map), then there exists at least one state ρ such that Tr E [ρ ] < 1,
we call the map a probabilistic or lossy quantum channel. In that case, the axioms
ensure that for any density operator ρ ∈ L (H i ⊗S ), we have 0 ≤ Tr(E ⊗ 1S )[ρ ]) ≤ 1.
This way, the channel does not operate with absolute certainty, but returns a state
only with a certain probability t(E |ρ ) = Tr(E ⊗ 1S )[ρ ], that we call the channel’s
transmissivity. Then for t(E |ρ ) ̸= 0 we define the output state:
ρ o = (E ⊗ 1S )[ρ ]/t(E |ρ ). (5.2)
When t(E |ρ ) = 0, then no state ever outputs the channel when ρ is the input, so we
set ρ o = 1/ dim(H o ⊗ S ) by convention.
Theorem 5.1 (Kraus’ Theorem). The map E : L (H i ) −→ L (H o ) is a quantum

channel if and only if there exists a set of operators {K̂ j }, each mapping H i to H o ,
such that j K̂ †j K̂ j ≤ 1 and:
P
E [ρ i ] = K̂ j ρ i K̂ †j .
X
(5.3)
j
†
E is a deterministic quantum channel when this condition holds and
P
j K̂ j K̂ j = 1.
When j K̂ †j K̂ j < 1, the channel is probabilistic.
P
92
5.1. PRELIMINARY NOTIONS
This theorem gives an operator-sum representation for quantum channels, which

will be most useful in the following. The operators {K̂ j } are called Kraus’ operators
of the channel E , which are not unique in general.
Quantum channels are fundamental objects that describe any transformation

undergone by a quantum state. Still, most studies focus on lossless quantum chan-
nels i.e. CPTP maps, such that any state passes the channel with absolute certainty.
In theory, any situation involving a lossy channel can be described by considering a
CPTP map E [•] = E s [•] ⊗ | s〉〈 s| + E f [•] ⊗ | f 〉〈 f |, with E s the successful branch and E f
the failure branch, where the state might be considered as lost. However in most
experimental situations, we generally have no access to the state when it goes
through the failure branch, such that we are only interested in states sent through
the success branch. This means we post-select states on the success branch, and
we only consider the probabilistic channel E s [ρ ] = 〈 s|E [ρ ]| s〉. The transmissivity is
then the probability that the channel successfully outputs the input state, so that
t(E s |ρ ) = Tr E s [ρ ] = Tr(E [ρ ]1 ⊗| s〉〈 s|). This way, losses are included in the expression
of the channel itself.
Finally we give a few common examples of probabilistic quantum channels. A

trivial probabilistic quantum channel is E = p ·1 with p ∈]0; 1], that models unbiased
losses. In that case the state is simply transmitted without transformation with
probability p, or lost with probability 1 − p. On the contrary, a channel with fully-
biased losses would be a polarizing channel P , with P [ρ ] = |Φ〉〈Φ|ρ |Φ〉〈Φ| for any
state ρ , with |Φ〉 a pure state. In that case t(P |ρ ) = 1 if and only if ρ = |Φ〉〈Φ|. Finally,
probabilistic channels allow us to describe an experiment where one wishes to
measure a POVM { M̂ k }1≤k≤d but only has access to the first m elements, with
m < d . In that case we can define the following channel:
m
M̂ k ρ M̂ k† ⊗ | k〉〈 k|.
X
E [ρ ] = (5.4)
i=1
This example is of particular use for Bell state measurements using linear optics,
where it was shown that one can measure only two elements out of four [155].
93
5.2 Extended Process Inequality

A well-known result of deterministic quantum channels is the process inequality,
also known as monotonicity of fidelity and trace-distance under application of a
quantum channel:
F (E [ρ ], E [σ]) ≥ F (ρ , σ), (5.5)

D (E [ρ ], E [σ]) ≤ D (ρ , σ), (5.6)
where F is the fidelity and D is the trace-distance, defined in paragraph 2.1.5,

and the inequalities are true for any quantum states ρ , σ and quantum channel E .
These inequalities ensure that no quantum process can increase the probability
of distinguishing two quantum states. We provide an extension of this result to
probabilistic quantum channels:
Theorem 5.2 (Extended Processing Inequality). Let E be probabilistic quan-

tum channel (CPTD). For any input states ρ i and σ i , the following inequality
holds for the sine distance C (ρ , σ) = 1 − F (ρ , σ) , and the trace distance D :
p
C (ρ i , σ i ) ≥ t · C (ρ o , σ o ), (5.7)
D (ρ i , σ i ) ≥ t · D (ρ o , σ o ), (5.8)
where ρ o = E [ρ i ]/t(E |ρ i ) and σ o = E [σ i ]/t(E |σ i ) are the output states of the

channel, and t = t(E |ρ i ) or t = t(E |σ i ) is the channel’s transmissivity.
Proof. Let us first prove the inequality for the trace distance D . We follow the
guidelines of the demonstration given in [154] for CPTP maps. As ρ i and σ i have
a symmetric role, let us consider t(E |ρ i ) ≥ t(E |σ i ), without loss of generality. We
can define two Hermitian positive matrices P and Q with orthogonal support
such that ρ i − σ i = P − Q . Therefore, we have Tr(P ) − Tr(Q ) = Tr(ρ i ) − Tr(σ i ) = 0 so
Tr(P ) = Tr(Q ). Moreover, |ρ i − σ i | = P + Q . This way we get:
1
D (ρ i , σ i ) = Tr |ρ i − σ i |
2 (5.9)
1¡ ¢
= Tr(P ) + Tr(Q ) = Tr(P ).
2
94
5.2. EXTENDED PROCESS INEQUALITY
There also exists a projector Π such that D (ρ o , σ o ) = Tr Π · (ρ o − σ o ) . Keeping in

¡ ¢
mind that E is trace-decreasing, it follows that for any t ≤ t(E |ρ i ):
D (ρ i , σ i ) = Tr(P )
≥ Tr(E [P ])
≥ Tr(Π · E [P ])
¡ ¢
≥ Tr Π · (E [P ] − E [Q ])
= Tr Π · (E [ρ i ] − E [σ i ])
¡ ¢
= t(E |ρ i ) Tr(Πρ o ) − t(E |σ i ) Tr(Πσ o )

≥ t(E |ρ i ) Tr Π · (ρ o − σ o )
¡ ¢
= t(E |ρ i ) · D (ρ o , σ o )
≥ t · D (ρ o , σ o ). (5.10)
This way, we have in particular D (ρ i , σ i ) ≥ t · D (ρ o , σ o ) for t = t(E |ρ i ) or t = t(E |σ i ).
In order to prove the same inequality for the sine distance C , let us recall we
can express that distance between any density operators ρ , σ as a minimization
over their purifications | r 〉 and | s〉 respectively:
p
C (ρ , σ) = min 1 − 〈 r | s〉 = min D (| r 〉〈 r |, | s〉〈 s|), (5.11)
| r 〉, | s 〉 | r 〉, | s 〉
where the minimization is taken over all the purifications. This way, we purify
the input and output states in order to extend the inequality from D to C . Let us
choose two pure states | r i 〉, | s i 〉 ∈ H i ⊗ P such that C (ρ i , σ i ) = D (| r i 〉〈 r i |, | s i 〉〈 s i |),
with P a purification space for ρ i and σ i . This purifies the input states. Now let us
define the operator Ê on H i ⊗ P such that for any pure state |ψ〉 in that space:
X
Ê |ψ〉 = (K̂ j ⊗ 1P |ψ〉) ⊗ | e j 〉, (5.12)
j
where {K̂ j } are Kraus operators for E and {| e j 〉} is an orthonormal basis of an

ancillary space A . As E is trace-decreasing, Ê |ψ〉 is not necessarily normalized, but
is a pure state when renormalized. This way, we can define the quantum operation
Ẽ such that for any density operator ρ ∈ L (H i ) ⊗ L (P ), we have Ẽ [ρ ] = Ê ρ Ê † .
This operation conserves the purity of pure states, and verifies TrA (Ẽ [ρ ]) = E [ρ ]
95
for any density operator ρ . This way, Ẽ [| r 〉〈 r |]/t(E |ρ i ), resp. Ẽ [| s〉〈 s|]/t(E |σ i ), is a
purification of E [ρ i ]/t(E |ρ i ) = ρ o , resp. E [σ i ]/t(E |σ i ) = σ o . This purifies the output
states. Now we only have to apply the extended contractivity of D to the purified
states under the quantum operation Ẽ , for t = t(E |ρ i ) or t = t(E |σ i ):
C (ρ i , σ i ) = D (| r i 〉〈 r i |, | s i 〉〈 s i |)
≥ t · D (Ẽ [| r 〉〈 r |]/t(E |ρ i ), Ẽ [| s〉〈 s|]/t(E |σ i ))
≥ t · min D (| r o 〉〈 r o |, | s o 〉〈 s o |) (5.13)
| r o 〉, | s o 〉
= t · C (ρ̂ o , σ̂ o ),
where the minimization is taken over all purifications | r o 〉, | s o 〉, of ρ o , σ o , respec-

tively. This shows the inequality for the sine distance. ■
Note that our theorem is valid also for a trace-preserving quantum operation.
Indeed, when t(E |ρ ) = 1 for any state ρ , we get the well known processing inequality
D (ρ , σ) ≥ D (E [ρ ], E [σ]) or F (ρ , σ) ≤ F (E [ρ ], E [σ]). This indicates that our inequality
is tight.
5.3 Topology of Quantum Channels

In the following we intend to construct different metrics on probabilistic channels,
and derive important properties of these metrics. We first recall different functions
allowing to evaluate the closeness of deterministic quantum channels. We can
derive some first functions from the Choi-Jamiołkowski isomorphism [156, 157]
between quantum states and channel:
J : E −→ ρ E = (E ⊗ 1)[Φ+ ], (5.14)
where |Φ+ 〉 = p1
Pd −1
i=0 | i 〉| i 〉 is the maximally entangled states on H ⊗2 , d = dim H
d
and H is the Hilbert space E acts upon. This way, we define the Choi-Jamiołkowski
fidelity and trace distance:
F J (E 1 , E 2 ) = F (ρ E 1 , ρ E 2 ) = F (E 1 ⊗ 1)[Φ+ ], (E 2 ⊗ 1)[Φ+ ] ,
¡ ¢
(5.15)
D J (E 1 , E 2 ) = D (ρ E 1 , ρ E 2 ) = D (E 1 ⊗ 1)[Φ+ ], (E 2 ⊗ 1)[Φ+ ] .
¡ ¢
(5.16)
96
5.3. TOPOLOGY OF QUANTUM CHANNELS
p
One can also define the Choi-Jamiołkowski sine distance C J = 1 − F J and angle
p
A J = arccos F J . All these functions relate to the average behavior of quantum
channels [64]. In quantum cryptography, we are generally more interested in the
worst case scenario, in which case we favor the diamond fidelity and trace distance:
F ⋄ (E 1 , E 2 ) = min F (E 1 ⊗ 1)[ρ ], (E 2 ⊗ 1)[ρ ] ,

¡ ¢
(5.17)
ρ
D⋄ (E 1 , E 2 ) = max D (E 1 ⊗ 1)[ρ ], (E 2 ⊗ 1)[ρ ] ,

¡ ¢
(5.18)
ρ
where the maximization and minimization are carried out over pure states of H ⊗2 .
p p
We also define the diamond sine distance C ⋄ = 1 − F ⋄ and angle A⋄ = arccos F ⋄ .
The diamond fidelity and distances are generally harder to evaluate than their
Choi-Jamiołkwoski counterparts, which is why we try to link these functions
together, possibly via some equivalence bounds, as attempted in [25]. In this
section, we extend those closeness functions to probabilistic channels, and derive
some important equivalence bounds between them.
5.3.1 Equivalence Classes of Quantum Channels

Let us first consider two channels E 1 and E 2 that are proportional to each other,
i.e. there exists a factor p ∈ ]0; 1] such that E 1 = p · E 2 (or E 2 = p · E 1 which is a
symmetric case). Then their corresponding transmissivities also display the same
proportionality t(E 1 |ρ ) = p · t(E 2 |ρ ) for any input state ρ . The two channels therefore
output the same states when fed the same input state:
E 1 [ρ ] p · E 2 [ρ ] E 2 [ρ ]
= = . (5.19)
t (E 1 | ρ ) p · t (E 2 | ρ ) t (E 2 | ρ )
In numerous practical situations we only consider what happens when the states
are not lost, such that we post-select on the states being detected. This way, two
channels E 1 and E 2 that are proportional to each other actually describe the same
physical situation, and we consider them as equivalent E 1 ≡ E 2 . This defines math-
ematical equivalence classes of channels that output the same quantum states.
All channels from a same class can be compared, such that if E 1 ≡ E 2 , then either
E 1 ≥ E 2 or E 2 ≥ E 1 . In the first case, for instance, we have t(E 1 |ρ ) ≥ t(E 2 |ρ ). For
any class of channel, we can find a maximal channel of that class E max such that
97
E max ≥ E for any channel E of the same class. That maximal channel is therefore
the most transmissive channel, and there always exists a state ρ on which the
channel operates with absolute certainty, i.e. t(E max |ρ ) = 1.
In the following, we will use these equivalence classes in order to define proper
closeness functions on probabilistic quantum channels, with convenient physical
interpretations. In addition, these classes also embody the fact that when certifying
a channel E , one can always consider a more transmissive but equivalent channel
E ′ , with E ′ ≥ E and E ′ ≡ E . We can then use this more transmissive channel in order
to describe the physical process, which falls down to assuming a certain amount of
losses are known and unbiased.
5.3.2 Closeness of Probabilistic Quantum Channels
We can finally extend the previously defined closeness functions of deterministic

channels to probabilistic channels:
Definition 5.2 (Closeness of Probabilistic Quantum Channels). We define

the Choi-Jamiołkowski fidelity and trace distance between two probabilistic
quantum channels E 1 and E 2 :
¡ ¢
F J (E 1 , E 2 ) = F (E 1 ⊗ 1)[Φ+ ]/t(E 1 |Φ+ ), (E 2 ⊗ 1)[Φ+ ]/t(E 2 |Φ+ ) , (5.20)
¡ ¢
D J (E 1 , E 2 ) = D (E 1 ⊗ 1)[Φ+ ]/t(E 1 |Φ+ ), (E 2 ⊗ 1)[Φ+ ]/t(E 2 |Φ+ ) , (5.21)
p
and the associated Choi-Jamiołkowski sine distance C J = 1 − F J and angle
p
A J = arccos F J . We also define the diamond fidelity and trace distance:
F ⋄ (E 1 , E 2 ) = min F (E 1 ⊗ 1)[ρ ]/t(E 1 |ρ ), (E 2 ⊗ 1)[ρ ]/t(E 2 |ρ ) ,

¡ ¢
(5.22)
ρ
D⋄ (E 1 , E 2 ) = max D (E 1 ⊗ 1)[ρ ]/t(E 1 |ρ ), (E 2 ⊗ 1)[ρ ]/t(E 2 |ρ ) ,

¡ ¢
(5.23)
ρ
where the maximization and minimization are carried out over pure states
of H ⊗2 , and the associated diamond sine distance C ⋄ = 1 − F ⋄ and angle
p
p
A⋄ = arccos F ⋄ .
98
None of these quantities are strictly speaking distances of probabilistic chan-

nels. Indeed with M any of the Choi-Jamiołkowski or diamond distances, we can
have M(E 1 , E 2 ) = 0, but still E 1 ̸= E 2 , on the condition that E 1 = p · E 2 or E 2 = p · E 1
with p > 0. However, we prove that M(E 1 , E 2 ) = 0 if and only if E 1 ≡ E 2 and the
channels are equivalent, meaning they are proportional to each other. This shows
the Choi-Jamiołkowski or diamond distances are proper distances for equivalence
classes of probabilistic quantum channels.
Proof. For all the proof, M stands for any of the channel distances A, C or D, the
subscript standing for the Choi-Jamiołkowski or diamond version. If E 1 ≡ E 2 , then
there exists p ∈ ]0; 1] such that E 1 = p · E 2 or E 2 = p · E 1 . Then by definition of M⋄
and M J , we trivially have M⋄ (E 1 , E 2 ) = M J (E 1 , E 2 ) = 0. Now let us assume E 1 and
E 2 are non-zero channels such that M J (E 1 , E 2 ) = 0, and let us show that E 1 ≡ E 2 .
First, we show the following lemma, introduced in [25]:
Lemma 5.1. Let |ψ〉 ∈ H ⊗2 be a pure 2-qudits state, with dim H = d . Then there
exists an operator K̂ ψ = M̂ψÛψ on H , with 0 < M̂ψ ≤ 1 and Ûψ a unitary, such
1 ⊗ K̂ ψ transforms the maximally-entangled state |Φ+ 〉 = p1 di=0
P −1
| i 〉| i 〉 into |ψ〉 with
d
probability 1/d , i.e.:
1
(1 ⊗ K̂ ψ )|Φ+ 〉 = p |ψ〉. (5.24)
d
To show this lemma we use the Schmidt decomposition of |ψ〉:
dX
−1
|ψ〉 = ψ i | i 〉| i ′ 〉, (5.25)
i=0
where {| i 〉} and {| i ′ 〉} are two orthonormal bases of H . There exists a unitary

operator Ûψ acting on H such that:
1 dX−1
(1 ⊗ Ûψ )|Φ+ 〉 = p | i 〉| i ′ 〉, (5.26)
d i=0
with d = dim H . We can then define the operator M̂ψ that probabilistically trans-
forms (1 ⊗ Ûψ )|Φ+ 〉 into |ψ〉:
dX
−1
M̂ψ = ψ i | i ′ 〉〈 i ′ |. (5.27)
i=0
99
Now by we defining the operator K̂ ψ = M̂ψÛψ , we have:
(1 ⊗ K̂ ψ )|Φ+ 〉 = p1 |ψ〉, (5.28)

d
which completes the proof of the lemma.
From here, as we have M J (E 1 , E 2 ) = 0, then we have

¡ ¢
M (E 1 ⊗ 1)[Φ+ ]/t(E 1 |Φ+ ), (E 2 ⊗ 1)[Φ+ ]/t(E 2 |Φ+ ) = 0, (5.29)
where M = A, C or D , so the states in the distance are equal:
E 1 |Φ+ )
(E 1 ⊗ 1)[Φ+ ] = t(
t(E 2 |Φ+ ) · (E 2 ⊗ 1)[Φ+ ]. (5.30)
For any pure state |ψ〉 ∈ H ⊗2 we define the operator K̂ ψ from Lemma 5.1, such
that (1 ⊗ K̂ ψ )|Φ+ 〉 = p1 |ψ〉. We apply that operator on both sides of equation (5.30):
d
E 1 |Φ+ )
†
(1 ⊗ K̂ ψ )(E 1 ⊗ 1)[Φ+ ](1 ⊗ K̂ ψ ) = t( †
t(E 2 |Φ+ ) · (1 ⊗ K̂ ψ )(E 2 ⊗ 1)[Φ+ ](1 ⊗ K̂ ψ ), (5.31)
which, since 1 ⊗ K̂ ψ commutes with E 1 ⊗ 1 and E 2 ⊗ 1, implies:

h i h i
E 1 |Φ+ )
†
(E 1 ⊗ 1) (1 ⊗ K̂ ψ )Φ+ (1 ⊗ K̂ ψ ) = t(
t(E 2 |Φ+ ) · (E 2 ⊗ 1 ) (1 ⊗ K̂ ψ )Φ+ (1 ⊗ K̂ †
ψ ) , (5.32)
or equivalently:
E 1 |Φ+ )
(E 1 ⊗ 1)[ψ] = t(
t(E 2 |Φ+ ) · (E 2 ⊗ 1)[ψ]. (5.33)
E 1 |Φ+ ) t(E 2 |Φ+ )
This way, taking either p = t( t(E 2 |Φ+ ) or p = t(E 1 |Φ+ ) we get (E 1 ⊗ 1)[ψ] = p · (E 2 ⊗ 1)[ψ]
or (E 2 ⊗ 1)[ψ] = p · (E 1 ⊗ 1)[ψ] for all state |ψ〉 ∈ H ⊗2 , with p ∈ ]0; 1]. This gives either
E 1 = p · E 2 or E 2 = p · E 1 , and therefore E 1 ≡ E 2 . This prooves the result for the
Choi-Jamiołkowski distances. For diamond distances, we straightforwardly get the
same result, as we always have M⋄ (E 1 , E 2 ) ≥ M J (E 1 , E 2 ).
The triangular inequality and symmetry of M J and M⋄ come trivially from the
distance properties of A, C and D . Therefore, M J and M⋄ define proper distances
on classes of non-zero probabilistic channels. ■
Note that from the sine or angle channel distances, we also deduce that the
F J (E 1 , E 2 ) = F ⋄ (E 1 , E 2 ) = 1 if and only if E 1 ≡ E 2 .
100
5.3.3 Comparison of Quantum Channels Distances

Choi-Jamiołkowski and diamond metrics underline different properties of quantum
channels. As pointed out in [64], the Choi-Jamiołkowki metrics are linked to aver-
age probability of distinguishing two quantum channels when sending unknown
states, while the diamond metrics are linked to the maximum probability of dis-
tinguishing these channels. Here we show the equivalence of Choi-Jamiołkowski
metrics and their diamond counterpart, which allows to get some information
on the channel’s behavior in the worst-case scenario, based on the sole knowl-
edge of its action on a maximally-entangled state. We mention that an attempt
to show such bounds was done in [25], linking the diamond trace distance with
the Choi-Jamiołkowski sine distance. However, it does not give a direct bound on
the diamond fidelity, which is more suitable in cryptography in order to evaluate a
protocol’s success probability.
Theorem 5.3 (Channels’ Metrics Equivalence). For any probabilistic channel

E 1 , and any E 2 that is proportional to a deterministic channel (CPTP map),
both acting on L (H ), the following inequalities hold:
C J (E 1 , E 2 ) ≤ C ⋄ (E 1 , E 2 ) ≤ dim H × C J (E 1 , E 2 ), (5.34)
D J (E 1 , E 2 ) ≤ D⋄ (E 1 , E 2 ) ≤ dim H × D J (E 1 , E 2 ). (5.35)
Proof. The left-side inequalities are straightforwardly following from the defini-
tion of the distances. The right-side inequalities come from the following lemma:
Lemma 5.2. For any pure state ρ ∈ L (H ⊗2 ) and any pair of probabilistic
quantum channels E 1 and E 2 both acting on L (H ) we have:
x · D (ρ 1 , ρ 2 ) ≤ dim H × D J (E 1 , E 2 ), (5.36)
x · C (ρ 1 , ρ 2 ) ≤ dim H × C J (E 1 , E 2 ), (5.37)
£ t(E |ρ ) t(E |ρ ) ¤
for any x ≤ max t(E 11|Φ+ ) , t(E 22|Φ+ ) , and with ρ k = (E k ⊗ 1)[ρ ]/t(E k |ρ ).
101
Let us proove the lemma. We consider a pure state ρ = |ψ〉〈ψ| with |ψ〉 ∈ H ⊗2 ,
and two probabilistic channels E 1 and E 2 . We define the corresponding transmis-
sivities t(E k |ρ ) and output states ρ k = (E k ⊗ 1)[ρ ]/t(E k |ρ ) for k = 1 and 2. Using the
†
operator K̂ ψ defined in Lemma 5.1, the map O defined as O[ρ ] = K̂ ψ ρ K̂ ψ is a valid
quantum operation on L (H ). Furthermore, 1 ⊗ O transforms |Φ+ 〉 into |ψ〉 with
probability 1/ dim H , and commutes with the channels E 1 ⊗ 1 and E 2 ⊗ 1, such that
for k = 1 or 2 and d = dim H :
1
(1 ⊗ O)[(E k ⊗ 1)[Φ+ ] /t(E k |Φ+ )] = d · t(E k |Φ+ ) (E k ⊗ 1)[ρ ] (5.38)
t(E k |ρ )
= d · t(E k |Φ+ ) ρ k . (5.39)
This way, 1 ⊗ O transforms the state (E k ⊗ 1)[Φ+ ]/t(E k |Φ+ ) into ρ k , with probability
t(E k |ρ )
d · t(E k |Φ+ ) . This way, using Lemma 5.2 for extented metrics monotonicity to the
quantum operation O ⊗ 1, we deduce the following inequality:
M (E 1 ⊗ 1)[Φ+ ]/t(E 1 |Φ+ ), (E 2 ⊗ 1)[Φ+ ]/t(E 2 |Φ+ ) ≥ t · M (ρ 1 , ρ 2 ),

¡ ¢
(5.40)
£ t(E |ρ ) t(E |ρ ) ¤
for any t ≤ max d · t(E11 |Φ+ ) , d · t(E22 |Φ+ ) , and M = C, D . The left term is M J (E 1 , E 2 ) for
£ t(E |ρ ) t(E |ρ ) ¤
M = C , D, and by taking x = t · d ≤ max t(E 11|Φ+ ) , t(E 22|Φ+ ) we get inequalities (5.36)
and (5.37), which shows the lemma.
If one of the channels, E 2 for instance, is proportional to a trace-preserving

channel, then t(E 2 |ρ ) = t(E 2 |Φ+ ) for any ρ . This way, we can take x = 1, so that the
following inequality holds for any pure state ρ ∈ L (H ⊗2 ):
M (ρ 1 , ρ 2 ) ≤ d · M J (E 1 , E 2 ). (5.41)
As it holds for any pure state ρ , we showed that M⋄ (E 1 , E 2 ) ≤ d × M J (E 1 , E 2 ), which

shows the theorem. ■
The lemma we just showed allows us to bound the deviation of any output
states, with the sole knowledge of the operations actions on a maximally-entangled
state, even if both channels are probabilistic. Yet in a lot of cases, such as the
protocol presented in chapter 6, E 2 is a reference quantum channel E 0 that is
deterministic, and we can use the special case M⋄ (E , E 0 ) ≤ dim H × M J (E , E 0 ) from
the theorem, which does not require to evaluate any transmissivity.
102
5.4. DISCUSSION
5.4 Discussion
In this chapter we introduced some novel results on CPTD maps, which model
quantum channels which only operate with a certain probability. This includes
an extension of the process inequality to probabilistic channels, the definition of
classes of channels which perform the same operation with different probabilities,
the construction of different distances on these classes, and an equivalence of Choi-
Jamiołkowski and diamond distances. The latter result is also significant for CPTP
maps, as it shows the behavior of a quantum channel on any quantum state can be
evaluated from the behavior of that channel on one part of a maximally-entangled
pair of qudits. This gives a preliminary idea of the protocol we build in the next
chapter, in which we certify the transmission of an unmeasured qubit through
a quantum channel by testing the behaviour of that channel with a maximally-
entangled state. On a more general note, these results may encourage future
studies focusing on lossy quantum channels, which model experimental situations
involving post-selection with more accuracy than deterministic channels.
103
‘The gardeners dig a hole, drop in a seed and
water it. They know what kind of seed it is,
but as the plant comes up and they water
it, they don’t know how many branches it’s
CHAPTER
6
going to have, they find out as it grows.’
— George R.R. Martin.
C ERTIFIED Q UANTUM T RANSMISSION

VIA B ELL T HEOREM
he potential future development of a quantum network would rely on
T a collection of elementary building-blocks, allowing to generate, process,

transmit and measure quantum information. In the context of potential
malicious attacks and noisy devices, the ability to reliably certify the quality of
these different building-blocks in a scalable way is therefore a fundamental step to
developing world-wide quantum technologies. While methods for certifying quan-
tum states proliferate in the literature [21, 22, 158], similar methods applicable to
quantum channels are much scarcer.
In a cryptographic context, device-independent (DI) certification techniques are

particularly reliable, as all used devices are considered to be completely uncharac-
terized black-boxes [159, 160]. Such certification procedures are highly resilient to
attacks relying on corrupting the inner functioning of quantum devices. A neces-
sary ingredient for DI certification of a quantum channel is channel self-testing
procedure [161]. An important theoretical contribution to self-testing of quantum
channels was recently provided by P. Sekatski et al. [25], allowing the certification
of a lossless quantum channel (CPTP map) even with a certain amount of noise.
105
CHAPTER 6. CERTIFIED QUANTUM TRANSMISSION VIA BELL THEOREM
The first obstacle towards making Sekatski’s result practically applicable is the
fact that the authors consider CPTP maps, which only include lossless determin-
istic operations. Next, as is the case for most self-testing results, its immediate
application to certification is possible only in the case of infinite number of identical
and independent rounds, that is to say it requires the IID assumption. In real-
world conditions, channels are lossy and probabilistic, might evolve through time,
or can even be controlled by a malicious party who could, for instance, perform
powerful quantum memory-based attacks. Therefore, a practical certification proce-
dure should consider general trace-decreasing maps and relax the IID assumption.
In addition, all channel-certification studies so far have focused on verifying the
ability of a tested channel to preserve entanglement [25, 29]. Still, a practical
procedure should not only inform the players about the ability of a previously used
channel to transmit a maximally-entangled state, but it should also certify the
transmission of an arbitrary state through an unmeasured channel.
In the following, we provide a practical method to certify the transmission of a

single qubit through a probabilistic channel, in a semi-device independent scenario,
where the sender trusts their devices but the receiver does not. Thanks to the new
results on lossy quantum channels presented in chapter 5, we deduce a bound
on the diamond fidelity between the untrusted channel and a reference unitary
channel using the sole knowledge of the fidelity of a probe state to a maximally-
entangled state, before and after passing through the channel. From this bound,
we build a protocol that allows to certify with high confidence the fidelity between
an unknown input state and the corresponding output state, received from an
untested quantum channel. This protocol relies on the self-testing through steering
inequalities in a one-sided device-independent and non-IID scenario, building upon
the developments reported in [26, 162]. Finally, we perform a proof-of-principle
experiment, by preparing photon-pairs displaying close-to-maximum entanglement
in polarization and witnessing steering after a lossy and/or malicious quantum
channels. This way we show that such protocol could be used with current technol-
ogy, in order to certify long-distance fibered quantum communications, quantum
teleportation or quantum memories.
106
6.1. GENESIS: AUTHENTICATED TELEPORTATION
6.1 Genesis: Authenticated Teleportation
The original idea of this project came as an attempt to construct a practical protocol
for semi device-independent authenticated teleportation, inspired from the theo-
retical work of A. Unnikrishnan and D. Markham [26]. The original protocol for
quantum teleportation, summarized in Fig. 6.1, was first proposed by C.H. Bennett
and G. Brassard [58], and allows a player Alice to send a qubit to Bob without
sending the physical system. Let us call ρ i ∈ L (H i ⊗ S ) the total input state, with
Alice’s qubit being encoded in Hilbert space H i , and S is the Hilbert space of
a potential secondary system with which the qubit is entangled. Alice and Bob
|0 A 1B 〉−|1 A 0B 〉
share a maximally-entangled state |Ψ− 〉 = p ∈ H A ⊗ H B . Alice performs
2
a Bell state measurement (BSM), jointly on the input qubit from H i and her part
of the maximally-entangled pair from H A . This BSM consists of 4 projectors on
maximally-entangled states {|Φ± 〉, |Ψ± 〉}. Alice then sends the measurement result
to Bob, who applies a unitary operation on his part of the maximally-entangled
state depending on that result, and this way retrieve the quantum state ρ i between
L (S ) and L (H B ).
The authenticated teleportation protocol from [26] proposes to certify the maxi-
mally entangled state shared by Alice and Bob, in order to bound the transmission
fidelity between the input state Alice sends and the ouput state Bob receives. To
derive this result however, the authors assume the BSM is a full POVM made
of 4 perfect projectors on the Bell states. This assumption is not faithful to ex-
perimental linear-optics-based BSM, in which the projectors are noisy, and we
only have access to two elements of the POVM, |Φ± 〉 or |Ψ± 〉 [163]. This way, in ad-
dition to the maximally-entangled state, Alice and Bob also have to certify the BSM.
We discern two possible approaches to tackle this problem, both based on the
consideration of a probabilistic quantum channel. The first approach consists in
separating the teleportation protocol into two blocks, the first one consisting of the
maximally-entangled state preparation, the second of the operations, including
the partial BSM, classical communications and unitary operations. As displayed
in Fig. 6.1a, we can express the probabilistic channel E including all operations
107
performed on the input state and the maximally-entangled state, such that the
output state of the protocol is (1S ⊗ E )[ρ i ⊗ Ψ− ]. This way, one could certify the
maximally-entangled state following the method from [26], and the BSM thanks
to elements provided in [23, 24]. In the second approach, we consider the telepor-
tation protocol consists of feeding the input state ρ i into a probabilistic channel
1S ⊗ E , which includes the BSM and the state preparation, and other operations
(see Fig. 6.1b). Therefore the channel is a black box which is expected to perform
the identity operation. Some elements to certify such a black box are provided
by P. Sekatski et al. [25], though more developments are required to apply such
results to a probabilistic quantum channel. In this work we focus on that second
approach, as it can also be used to certify any untrusted quantum device that is
expected to perform the identity operation, such as quantum memories or any
quantum transmission link. Still, we expect further investigations may show the
first approach provides some advantage in the specific case of quantum teleporta-
tion.
(a) First approach to practical authen- (b) Second approach to practical authenti-
ticated teleportation. The maximally- cated teleportation. The quantum channel
entangled state is certified separately from E is a black box including the maximally-
the operations, which are included in the entangled state and the operations, that we
probabilistic quantum channel E . certify all-together.
Fig. 6.1: Sketch of the quantum teleportation protocol. Alice preforms a BSM on
her part of a maximally-entangled pair, together with the input state. Depending
on the result, Bob applies unitaries on his system to retrieve Alice’s input state.
108
6.2. PREREQUISITE: SELF-TESTING OF QUANTUM STATES
6.2 Prerequisite: Self-Testing of Quantum States
Our method for self-testing quantum channels is built on the self-testing of quan-
tum states. This procedure, first proposed by D. Mayers and A. Yao [161, 164], relies
on Bell theorem (see paragraph 2.1.4) to certify a maximally-entangled state [57],
by making very few assumptions on the underlying quantum systems. In the most
common setting, Alice and Bob measure multiple copies of a bipartite system,
and under the IID assumption (independent, identically distributed rounds of
experiment), they evaluate the probabilities P(a, b| x, y) of measuring the outcome
a, b when adopting different measurement parameters x, y respectively. Then they
can test a Bell inequality, which consists of a function I of these probabilities and
a value β such that
I P(a, b| x, y) ≤ β,
¡ ¢
(6.1)
if the state is not entangled, and I > β for some entangled states. This way, such
inequalities can be used by Alice and Bob in order to certify entanglement. In-
terestingly enough, such a certification does not require any assumption on the
physical system being measured, or on the internal functioning of the measurement
apparatus, meaning it is device-independent.
6.2.1 Self-Testing via CHSH Inequalities
The specific case of CHSH inequalities, defined in equation (2.21), is one of the
most popular example of such inequalities. In this scenario, Alice and Bob wish to
self-test the maximally-entangled state |Φ+ 〉 = |00p
〉+|11〉
∈ H A ′ ⊗ H B′ , in a physical
2
bipartite quantum system of state |ψ AB 〉 ∈ H A ⊗ H B . We consider a pure state, as
Hilbert spaces H A and H B can be taken of arbitrary high dimensions. Alice and
Bob each measure the system with two possible local POVMs { M̂ a| x }a=0,1 for x = 0, 1
and { N̂b| y }b=0,1 for y = 0, 1 respectively. We define the corresponding observables:
Â x = M̂0| x − M̂1| x , (6.2)

B̂ y = N̂0| y − N̂1| y . (6.3)
109
By measuring the correlations of these observables, if Alice and Bob measure a

maximum violation of CHSH inequality
p
I = 〈 Â 0 B̂0 〉 + 〈 Â 1 B̂0 〉 + 〈 Â 1 B̂1 〉 − 〈 Â 0 B̂1 〉 = 2 2 , (6.4)
it was shown [165–168] that a maximally-entangled state can be extracted from

their system. More precisely, there exist two local isometries Γ A : H A −→ H A ⊗H A ′
and ΓB : H B −→ H B ⊗ H B′ , with H A ′ and H B′ two qubit spaces, such that:
(Γ A ⊗ ΓB )[|ψ AB 〉] = |Φ+ 〉 ⊗ |ψ trash 〉, (6.5)
where |ψ trash 〉 ∈ H A ⊗ H B corresponds to extra degrees of freedom in the system,

that do not contribute to the entangled state. This result alone is not applicable in
practice, as only ϵ−close to maximum violation of Bell inequality can be measured
p
in experiments, in which noise limits the value I = 2 2 − ϵ. A robust self-testing
method allows to derive a function f (ϵ) such that when we extract the state with
isometries Γ A , ΓB , we can bound the fidelity to |Φ+ 〉:
F Tr A,B (Γ A ⊗ ΓB )[|ψ AB 〉], |Φ+ 〉 ≥ f (ϵ).

¡ ¢
(6.6)
Many examples of such functions f (ϵ) were derived in the last decade [169–173],
and finding one with the best convergence still remains an open question. In this
work, we mostly use the result from A. Unnikrishnan and D. Markham [26]:
F Tr A,B (Γ A ⊗ ΓB )[|ψ AB 〉], |Φ+ 〉 ≥ 1 − α · ϵ with α = 1.19.

¡ ¢
(6.7)
Most importantly, the authors extend this result to a finite number of measurement
rounds in a non-IID setting, which is particularly applicable in a cryptographic
setting. This result is further detailed in paragraph 6.4 and appendix D.
6.2.2 Self-Testing via EPR-Steering

Recently the one-sided device-independent (1sDI) paradigm has been pointed out
as an interesting compromise to derive more practical bounds with a reasonable
amount of assumptions. In this setting, Bob still does not make any assumption on
his part of the quantum system nor his measurement apparatus. Alice, however,
110
6.2. PREREQUISITE: SELF-TESTING OF QUANTUM STATES
measures a qubit, such that H A = H A ′ , and she trusts her measurement apparatus
so that Â 0 = X̂ and Â 1 = Ẑ . In this case, self-testing can be derived from EPR-
steering [174], in the form of a violation of the following inequality [175]:
p
I = |〈 Â 0 B̂0 〉 + 〈 Â 1 B̂1 〉| ≤ 2 . (6.8)
There, a maximum violation I = 2 implies a maximally-entangled state |Φ+ 〉 can

be extracted from the system, by applying an isometry on Bob’s side. Once again,
A. Unnikrishnan and D. Markham provide a robust self-testing bound, when the
players witness an ϵ-close to maximum violation I = 2 − ϵ [26]:
F TrB (1 ⊗ ΓB )[|ψ AB 〉], |Φ+ 〉 ≥ 1 − α · ϵ with α = 1.26,

¡ ¢
(6.9)
which can also extended to a finite non-IID setting. In this work we experimentally
demonstrate a protocol in this 1sDI scenario. It is indeed more practical to achieve
than a full-DI version, all the while being suitable for real-world situations in
which a powerful server (Alice) wishes to provide a weaker receiver (Bob) with
quantum information. We still provide full-DI recipes whenever possible.
6.2.3 On the Isometries Formalism

A counter-intuitive aspect of the self-testing procedure is the fact that states are not
certified in absolute terms, but only up to local isometries Γ A , ΓB . This questions
the validity of such a method, as one might require a more absolute definition
of state. To understand how this method is still valid, we first highlight that the
Hilbert space’s structure, i.e. the scalar product and orthogonality, is conserved
under application of isometries. In addition, quantum states are always defined
from a certain reference in experiments. Typically, the horizontal and vertical
polarizations of photons, defined in the laboratory’s reference frame, may have
different definitions in other reference frames (they even rotate though time in the
geocentric reference frame). This way, quantum states are generally not defined in
absolute terms, but relatively to the experimenter’s perception, in the form of the
measurement apparatus’ calibration. In proofs of self-testing results, isometries
are generally built from Alice’s and Bob’s measurement operators { M̂ a| x }a=0,1 and
{ N̂b| y }b=0,1 (take for instance the Swap isometry, detailed in [26, 176–178]), and
111
therefore encompass this reference frame. Instead of claiming states are certified
"up to isometries", one could more intuitively claim a certification "relatively to
the experimenter’s apparatus". This way, in order to use certified states in later
experiments, one would have to calibrate their own apparatus on the certification
apparatus, which may involve self-testing Alice’s and Bob’s measurement operators
together with the state. In particular, the self-testing results we use in this thesis
were proposed in [26], which also includes such device-independent certification of
the measurement apparatuses.
6.3 The Problem

In our framework, a player Alice wishes to send one part of a 2-qubits state
ρ i ∈ L (H i⊗2 ) to Bob, through a local unitary quantum channel E 0 . This channel
takes any state ρ i ∈ H i to another qubit state ρ o = (E 0 ⊗ 1)[ρ i ] = (Û ⊗ 1)ρ i (Û † ⊗ 1) in
L (H o ⊗ H i ), where Û is a local unitary operator and 1 the identity. Such channel
models perfect unitary gates in quantum computer, quantum transmission links
(carried on through quantum teleportation or a simple optical fiber) or quantum
memories. Without loss of generality, we take Û = 1 and (E 0 ⊗ 1)[ρ i ] = ρ i , as this
case encompasses all unitaries in a device-independent scenario [25]. This channel
is called the reference channel.
In real world situations, the channel would be lossy, noisy, or even operated
by a malicious party Eve. Also, Alice and Bob normally do not have access to
isolated qubit spaces, but operate with physical systems such as photons or atoms,
displaying other degrees of freedom. This way, without further assumptions, Alice
and Bob have access to a CPTD map E , i.e. a probabilistic channel, that sends
density operators from an input Hilbert space H A 1 to positive operators of trace
smaller than 1 on an output Hilbert space H B . This channel is called the physical
channel. Alice possesses a bipartite state Φ i shared between H A 1 and a secondary
Hilbert space H A 2 , that we call the probe input state. She can send the first part of
Φ i through the channel E , resulting in the probe output state Φ o , shared with Bob:
Φ o = (E ⊗ 1)[Φ i ]/t(E |Φ i ), (6.10)
112
6.3. THE PROBLEM
where t(E |Φ i ) = Tr(E ⊗ 1)[Φ i ] is the channel’s transmissivity (see chapter 5 for more
details on that notion). Finally, the players can measure states with 2-outcomes
(POVMs) { M̂ lP| q }l=0,1 where P = A 1 , A 2 or B indicating the Hilbert space on which
the measurement is acting, and q indicates which POVM is measured.
Fig. 6.2: Sketch of the problem. Alice sends a qubit state ρ i to Bob through an
untrusted quantum channel E (green path). Alice can send half of a close-to-
maximally entangled probe state Φ i through E (blue path). Alice and Bob can then
measure the output state Φ o , and try to deduce the probability of applying E 0 to ρ i .
In an adversarial scenario, Alice and Bob wish to draw device-independent

conclusions, making as few assumptions as possible on the states or the measure-
ments. In particular, physical Hilbert spaces H A 1 , H A 2 and H B are of arbitrary big
dimensions, including all degrees of freedom of the physical systems and possible
entanglement with the rest of the universe. This way players only certify objects
up to local isometries, mapping the physical spaces onto the qubit spaces H i and
H o . For this task, we wish to derive a self-testing method for quantum channels,
similarly to quantum states, described in the last paragraph. A first method was
provided by P. Sekatski et al. [25], to device-independently test the equivalence
between the physical deterministic channel E ⊗ 1 and the reference operation E 0 ⊗ 1,
up to local isometries. In our case, a trace-decreasing physical channel only returns
a state with a certain probability, such that it can only be compared to the reference
channel when post-selecting on rounds when the transmission actually happened,
i.e. by using the equivalence classes of lossy channels described in chapter 5. This
way, we provide a new definition for the self-testing of a lossy channel:
113
Definition 6.1 (Self-testing of a CPTD map). Let E : L (H A 1 ) −→ L (H B ) be a

physical lossy channel, and E 0 : L (H i ) −→ L (H o ) a reference channel. With
two local isometries Γ i : H A 1 ⊗H i −→ H A 1 ⊗H iext and Γ o : H B −→ H o ⊗ H oext ,
and an ancillary state ρ A 1 ∈ L (H A 1 ), we can define an extracted channel:
E i,o : ρ ∈ L(H i ) −→ Tr ext (Γo ◦ E ◦ Γ i )[ρ A 1 ⊗ ρ ]

¡ ¢
(6.11)
where the trace is taken over H iext and H oext . The self-testing equivalence
between the physical channel E and the reference channel E 0 is established if:
E i,o ≡ E 0 . (6.12)
Note the equivalence in equation (6.12) is defined in chapter 5, such that

E i,o ≡ E 0 when there exists t ∈]0; 1] giving E i,o = tE 0 . Physically speaking, these two
channels output the same states, on the condition those were not lost. Also, unlike
in self-testing of quantum states, two isometries are required in order to extract
a qubit-to-qubit channel E i,o from a physical channel E , as a quantum channel is
associated to two Hilbert spaces (one in input and the other in output). This way,
the input isometry brings a qubit input state to a physical state that can be fed
into the physical channel, while the output isometry extracts a qubit state from
the physical channel’s output state.
In experiments, we can never perfectly certify E , therefore we quantify the

ability of this probabilistic channel to implement the deterministic channel E 0
by using channels closeness functions defined in chapter 5. In a cryptographic
scenario, we wish to bound that closeness in the worst case scenario, so we favor
the diamond fidelity:
Γ
F ⋄ i,o (E , E 0 ) = F ⋄ (E i,o , E 0 ) = min F (E i,o ⊗ 1)[ρ ]/t(E i,o |ρ ), (E 0 ⊗ 1)[ρ ] ,
¡ ¢
(6.13)
ρ
where the minimization is carried out over all pure states of L (H ⊗2 ). The dia-
mond fidelity is particularly useful here, as it can be interpreted as the minimum
probability that E ⊗ 1 successfully implements the operation E 0 ⊗ 1 on any state,
on the condition that a state successfully passes through the channel. The main
goal of our protocol is therefore to certify that fidelity.
114
6.4. THEORETICAL PROTOCOLS
6.4 Theoretical Protocols

We now propose different protocols that can be used in order to certify the trans-
mission of a qubit through an untrusted quantum channel. These protocols assume
different levels of trust on the probe states and Alice’s measurement apparatus.
The first one assumes Alice can certify her source and measurement system prior
to the protocol, which are therefore trusted. The second one assumes the source and
measurement appartus are untrusted, though we still consider the probe states
to follow an IID statistics. In both protocols, the channel is completely untrusted,
which can possibly evolve through time depending on previous rounds of experi-
ments, and may display state-dependent losses. Bob measurement apparatus is
also untrusted in both protocols.
6.4.1 Certification Bound and General Recipe

The general protocol recipe comes straight from bounding the channel fidelity with
specific states fidelity, that can be evaluated via self-testing. For that purpose, let
us consider the situation where Alice can certify the probe input state Φ i up to
two local isometries Γ A 1 /A 2 : H A 1 /A 2 −→ H A 1 /A 2 ⊗ H i with the following fidelity to
a maximally-entangled state |Φ+ 〉:
F i = F (Λ A 1 ⊗ Λ A 2 )[Φ i ], Φ+ ,
¡ ¢
(6.14)
where Λ j [·] = Tr j (Γ j [·]). We also assume that Alice and Bob are able to certify the
probe output state Φ o up to local isometries Γ A 2 and ΓB : H B −→ H B ⊗ H o with
the following fidelity:
F o = F (ΛB ⊗ Λ A 2 )[(E ⊗ 1)[Φ i ]]/t(E |Φ i )(E 0 ⊗ 1)[Φ+ ] .

¡ ¢
(6.15)
We then show in appendix D that there exist isometries Γ i , Γ o such that we can
lower bound the diamond fidelity on the corresponding extracted channel E i,o :
³ ´
F ⋄ (E i,o , E 0 ) ≥ 1 − 4 sin2 arcsin C i /t(E |Φ i ) + arcsin C o ,
¡ ¢
(6.16)
p
where C j = 1 − F j are sine distances associated to their corresponding fidelities.
This bound generalizes what is shown in [25] to probabilistic channels. It also
115
uses the diamond fidelity F ⋄ , which informs on the behavior of the channel on
any state, instead of the Choi-Jamiołkowski fidelity F J , which only informs on the
behavior of the channel on a maximally-entangled state (see chapter 5). Note that
all isometries involved in the certification and summarized in Fig. 6.3.
Fig. 6.3: Isometries’ involved in the certification, acting on the probe state Φ i (a)
and corresponding output state Φ o (b), and the channel E (c). Γ i encodes a qubit
state onto a physical state that can be fed into E . Other isometries extract a qubit
state from a physical system. Extra degrees of freedom are discarded. Together, Γ i
and Γ o extract a qubit-to-qubit channel from a physical channel.
From bound (6.16) we deduce the recipe for bounding the fidelity of a quantum
channel to a reference channel. Alice first evaluates the fidelity F i of the probe
input state to a Bell state, then sends one part of the probe through the channel,
and finally evaluates the fidelity F o of the corresponding output state to the same
Bell state. Such procedure is possible using recent self-testing results [26, 162],
but requires a very large number of experimental rounds in the absence of IID
assumption, as both input and output probe states require certification. This
number can be significantly decreased by making the IID assumption on the probe
input state, or by leaving its full characterization to Alice’s responsibility. Still, as
we make no IID assumption on the channel, optimal security cannot be reached
by first testing that channel, and only then using it to send the input state, as
Eve may change the channel’s expression in the last moment. Our protocol works
around this problem by allowing Alice to hide the state ρ i among a large number of
116
probe states, at a random position r unknown to Eve. Then we show in appendix D

that bound (6.16) holds for the average channel Ē i,o over the whole protocol:
1 NX +1
Ē = E k|[k−1] , (6.17)
N + 1 k=1
where E k|[k−1] is the channel that operates on the k-th state sent by Alice through
the protocol ([ k − 1] = k − 1, k − 2, ..., 1). In particular, Alice sends the input state
ρ i through channel E r|[r−1] . Then the transmission fidelity between the expected
output state ρ̄ o = (Ē i,o ⊗ 1)[ρ i ]/t(Ē |ρ i ) and the input state ρ i is certified:
F (ρ̄ o , ρ i ) ≥ F ⋄ (Ē i,o , 1). (6.18)
As long as r stays hidden and random, any measurement performed on the output
state later after the protocol would follow the same statistics as if it was performed
on ρ̄ o . Therefore we can use this expected state to describe accurately any ex-
periment that would be carried out after the protocol. The general recipe for the
protocol is summarized in Fig. 6.4, although details depend on the amount of trust
put in the states and player’s apparatuses, and are given in the next paragraphs.
Fig. 6.4: Summary of the protocol for certified quantum transmission: Alice sends
N copies of a probe state Φ i , as well as ρ i at a random secret position r , through an
untrusted channel E that varies with time. If ρ i was lost, then the protocol aborts.
Otherwise, Bob stores ρ i , and tests the violation of steering or CHSH inequalities
with Alice with the output probe states. They deduce the average channel quality
over the protocol, which gives the probability that the state ρ i was accurately
transmitted to Bob, up to isometries.
117
6.4.2 Protocol with One-Sided Trust

We first focus on a 1sDI scenario, where Alice’s measurement setup is trusted, so
her Hilbert spaces are qubit spaces H A 1 = H A 2 = H i , her isometries are trivial
Γ i = Γ A 1 = Γ A 2 = 1, and she performs measurements in the Pauli X̂ and Ẑ bases:
Â 0 = M̂0A|02 − M̂1A|02 = Ẑ, (6.19)

Â 1 = M̂0A|12 − M̂1A|12 = X̂ . (6.20)
Similarly, the probe state Φ i is trusted and characterized. This fits a variety of
scenarios where Alice is a powerful server, trying to provide to a weaker client,
Bob, whose measurement apparatus is still untrusted. This way Bob’s observables
B̂0 = M̂0B|0 − M̂1B|0 , (6.21)

B̂1 = M̂0B|1 − M̂1B|1 , (6.22)
are a priori unknown. Alice and Bob bound F o from eq. (6.15) using self-testing
via steering [26, 174] as detailed in paragraph 6.2.2, and certify the transmission
fidelity from bound (6.16). We give the detailed recipe for the certification protocol
in protocol box 6.1.
Note that the purpose of step 1.(b) is simply to inform Alice of the minimum
amount of states she has to prepare in order to ensure security. If the channel’s
operator Eve overstates the tranmissivity t, then Alice will not prepare enough
probe states, which in turn makes the protocol abort in step 6. On the contrary if
Eve understates t, then Alice is going to prepare more probe states than she and
Bob require, which will in fact improve the certification confidence.
118
Protocol 6.1: Certified quantum transmission via Bell theorem, 1sDI scenario.
1. Prior to the protocol:

(a) Alice characterizes the state Φ i emitted by her source and evaluates
the quantity F i . She also receives or prepares the state ρ i , possibly
shared with an outside party.
(b) Eve announces the minimum transmissivity t of the quantum channel
E for any quantum state.
2. Alice and Bob agree on parameters ϵ, K , depending on their requirements

and experimental limitations.
3. Alice prepares N = ⌈K/t⌉ copies of the probe state Φ i .
4. Alice successively sends each state through E , including ρ i in a random

r -th position, with r ≤ N + 1.
5. Bob establishes the set SP of states which successfully passed through E ,

and broadcasts it publicly.
6. If r ∉ SP or |S/{ r }| < K , Alice aborts the protocol. Otherwise, Alice sends r

to Bob.
7. Alice separates S/{ r } into two random sets S0 and S1 .
8. For each k ∈ S q , q = 0, 1:
(a) Alice measures observable Â q on her part of the k-th state and gets
outcome a k .
(b) She tells Bob to measure observable B̂ q on his part of the k-th state
and he gets outcome b k .
(c) Alice and Bob calculate their correlation for round k as c k = a k b k .
9. Alice and Bob deduce the average value of I = |〈 Â 0 B̂0 〉 + 〈 Â 1 B̂1 〉| over all
rounds.
10. If I ≥ 2 − ϵ, then Alice successfully sent the state ρ o = E [ρ i ]/t(E |ρ i ) to Bob,

with a certified average fidelity to ρ i , up to isometry.
119
Protocol Security. The security of the protocol is in principle ensured by the fact
that the position r of state ρ i stays hidden to Eve. Thus as we mention in paragraph
6.4.1, we derive the minimum transmission fidelity between the expected output
state ρ̄ o and ρ i by applying bound (6.16) to the average channel Ē . In particular,
the output probe state’s fidelity to a maximally-entangled state now reads:
F o = F (ΛB ⊗ Λ A 2 )[(E ⊗ 1)[Φ i ]]/t(Ē |Φ i ), (E 0 ⊗ 1)[Φ+ ] .

¡ ¢
(6.23)
Using the results from [26] for self-testing through steering, in a non-IID and 1sDI
setting, applied to the output probe state, we show in appendix D that for any x > 0,
p
the distance C o = 1 − F o can be bounded by two terms, with confidence of at least
c x = (1 − e− x ) · (1 − 2 e− x )2 :
arcsin C o ≤ arcsin
p
α f x (ϵ, K ) + Δ x (η s , K ), (6.24)
where η s = K/N is the measured transmission ratio, Δ x (η s , K ) is an error function

that goes to 0 for high values of K , α f x gives self-testing bound on the output state,
in a finite non-IID regime, with α = 1.26 and
ϵ ϵ + 8/K
r
x
f x (ϵ , K ) = 8 + + −−−−−→ ϵ, (6.25)
K 2 2 + 1/K K →+∞
such that we get bound (6.9) in the asymptotic regime. Note that the error function
is due to both the non-IID regime and the lack of information on channels that do
not output any state. A similar error occurs when we evaluate the transmissivity
as the measured transmission ratio:
t(Ē |Φ i ) ≳ τ x (η s , K ), (6.26)
where τ x (η s , K ) ≃ η s for high values of K . This way, the actual bound on the fidelity
between the input and output state reads, with confidence c x
³ ´
F (ρ̄ o , ρ i ) ≥ 1 − 4 · sin2 arcsin C i /τ x + arcsin α f x (ϵ, K ) + Δ x ,
¡ ¢ p
(6.27)
which includes additive error terms compared to bound (6.16). Note that the ex-
pressions and proofs for all the mentioned functions are detailed in appendix D.
120
6.4.3 Protocol with No Trust

While the previous protocol has high relevance when devices in Alice’s laboratory
can be trusted, a completely adversarial scenario would demand a fully device-
independent protocol. Theoretically, such a protocol can be formulated, but would
be very resource-demanding and therefore difficult to perform. It could be built
from protocol 6.1, by certifying the fidelity F i in a device-independent manner,
which could be done via self-testing of the violation the CHSH inequality. In the ab-
sence of IID assumption, every single probe state Alice sends through the channel
requires certification, by measuring an additional number M of copies of the probe
state. All in all, assuming M is of the same order as N , a fully device-independent
protocol a priori requires M · N ≈ N 2 copies of the probe state for optimal security.
This corresponds to a very low sample-efficiency of the certification protocol, which
is hardly practical for experimental implementations.
One can simplify the protocol by assuming the source is producing independent
and identically distributed copies, i.e. that the source functions in the IID scenario.
In that case, probe states only require a single certification step with M extra
copies, so the total sample size is M + N instead of M · N . We provide the recipe
for that certification protocol in protocol box 6.2, making the IID assumption on
the input probe state. In this framework, our fully device-independent protocol
simply consists in performing a very similar protocol to the 1sDI one, by replacing
step 1.(a) by a self-testing-based certification, and using the CHSH inequality [55]
instead of the steering inequality for certification, as all measurement apparatus
are untrusted. In that version, Alice measures the observables Â 3 , Â 4 on the part
of the system she can send through the channel.
121
Protocol 6.2: Certified quantum transmission via Bell theorem, DI scenario.
1. Prior to the protocol Eve announces the minimum transmissivity t of E for

any quantum state.
2. Alice and Bob agree on parameters ϵ, η, K , M depending on their require-

ments and experimental limitations.
3. Alice prepares N + M copies of Φ i , where N = ⌈K/t⌉.
4. Alice measures M random copies of Φ i , and deduces the value of

I i = |〈 Â 0 Â 2 〉 + 〈 Â 0 Â 3 〉 + 〈 Â 1 Â 2 〉 − 〈 Â 1 Â 3 〉|.
p
5. If I i < 2 2 − η, Alice aborts the protocol.
6. Alice successively sends each state through E , including ρ i in a random

r -th position, with r ≤ N + 1.
7. Bob establishes the set SP of states which successfully passed through E ,

and broadcast it publicly.
8. If r ∉ SP or |S/{ r }| < K , Alice aborts the protocol. Otherwise, Alice sends r

to Bob.
9. For each k ∈ S q , q = 0, 1:
(a) Alice measures observable Â u on her part of the k-th state with u = 0
or 1 at random. She gets outcome a k .
(b) Bob to measures the observable B̂ v on her part of the k-th state, with
v = 0 or 1 at random. He gets the outcome b k .
(c) Alice and Bob calculate their correlation for round k as c k = a k b k .
10. Alice and Bob deduce the average value over all rounds, of
I o = |〈 Â 0 B̂0 〉 + 〈 Â 0 B̂1 〉 + 〈 Â 1 B̂0 〉 − 〈 Â 1 B̂1 〉|.
p
11. If I o ≥ 2 2 − ϵ, then Alice successfully sent the state ρ o = E [ρ i ]/t(E |ρ i ) to
Bob, with a certified average fidelity to ρ i , up to isometry.
122
6.5. EXPERIMENTAL IMPLEMENTATION
Protocol Security. The security of this protocol can be derived from that of proto-
col 1, with some slight adjustments. First we use another bound for the self-testing
of CHSH inequalities, in a fully device-independent and non-IID scenario [162],
in order to certify the output probe state. We still have the following bound with
confidence at least c x = (1 − e− x ) · (1 − 2 e− x )2
arcsin C o ≤ arcsin
p
α f x (ϵ , K ) + Δ x (η s , K ), (6.28)
though this time α = 1.19 and f x takes another form

p
2 x 3ϵ ϵ + (4 + 2 2 )/K
r
f x (ϵ, K ) = 16 + + . (6.29)
K 4 4 + 4/K
The input state is also certified via self-testing of CHSH inequality in a fully
device-independent scenario but keeping the IID assumption, with a confidence
level (1 − e− x ):
F i = F (Λ A 1 ⊗ Λ A 2 )[Φ i ], Φ+ ≥ 1 − α · g x (η, M ) −→ 1 − α · η,
¡ ¢
(6.30)
M →+∞
p
with Λ A 1 [·] = Tr A 1 (Γ A 1 [·]), Λ A 2 [·] = Tr A 1 (Γ A 2 [·]), α = 1.19, and g x (η, M ) = 8 2 x/M + η.
We can then plug the two certified fidelities in our bound 6.16, so the transmission
fidelity between input and expected output state is bounded with confidence level
c′x = (1 − e− x )2 · (1 − 2 e− x )2
³ ´
F (ρ̄ o , ρ i ) ≥ 1 − 4 · sin2 arcsin α g x (η, M ) /τ x + arcsin α f x (ϵ, K ) + Δ x .
¡p ¢ p
(6.31)
which gives the full certification bound for protocol 6.2.
6.5 Experimental Implementation

In order to test the feasibility of the certification procedure, we perform a proof-of-
principle experiment based on polarization-entangled-photon pairs, emitted by our
Sagnac-PPKTP source, described in chapter 3. A sketch of the experimental setup
is given in Fig. 6.5. For practical reasons, different assumptions are implicitly made
during this first implementation, that we summarize at the end of this paragraph.
123
Fig. 6.5: Experimental setup for photonic certified quantum communication

through an unstrusted channel. Photon pairs are generated by our Sagnac-PPKTP
source, detailed in chapter 3. The idler photon is both used to herald a probe
state, and as Alice’s part of the state. The signal photon is sent to Bob through
the untrusted lossy channel. A VOA allows to simulate an honest channel with
a tunable amount of loss. Quantum correlations and channel transmissivity are
measured via the biphoton polarization analyzer shown in Fig. 3.15.
For this first attempt we focus on protocol 6.1, in the one-sided device-independent
scenario. This way the probe states Φ i emitted by the source are characterized at
each protocol attempt via quantum state tomography (see appendix A), without
inserting any untrusted quantum channel (green box in Fig. 6.5). Polarization
analyzers (PA) are trusted for that task, as it is performed by Alice. Following the
IID assumption, the state Φ i is assumed to remain the same for a whole protocol
run, which is supported by the stability of our source argued in paragraph 3.4. In
order to evaluate the input fidelity F i in equation (6.14), up to local isometries, we
maximize the quantity
FUi = F (1 ⊗ Û )Φ i (1 ⊗ Û † ), Φ+ ,
¡ ¢
(6.32)
on a local unitary Û . This way the fidelity of the probe’s polarization state to a Bell
state is F i = 99.20% ± 0.02% on average over all protocol attempts, with a maximum
reached fidelity of F i = 99.43% ± 0.05%.
We then send the probe states through an untrusted quantum channel. For
this first implementation, we use a variable optical attenuator (VOA) to simulate
124
a quantum channel with different losses. Detecting an idler-photon in Alice’s PA

heralds a signal-photon being sent through the quantum channel, which is then
detected in Bob’s PA. This way, we measure K ≃ 109 copies of the probe state
in order to minimize the error terms in certification bounds, and maximize the
confidence level c x > 99.5%. This takes from 1 to 3 hours in our experiments de-
pending on the channel’s transmissivity. We measure the pairs in random bases
Â 0 B̂0 or Â 1 B̂1 , and evaluate a close-to-maximum violation of steering inequal-
ity I = 2 − ϵ. Players should in principle randomize the measurement basis for
each new photon pair. However, because of technical limitations of our motorized
waveplate stages, we only operate this randomization at a limited rate of 1 Hz. A
fully secure protocol would require faster electronics and active optical components.
In each protocol attempt, the transmissivity is identified as the probability that

Bob detects a state, knowing Alice heralded that state, and is also known as the
heralding efficiency η s :
t(E |Φ i ) ≃ η s = R si /R i , (6.33)
where R si is the pairs’ detection rate and R i the idler’s detection rate. We set dif-
ferent transmissivities of the channel by tuning the VOA, such that η s ranges from
21.9% to 47.3%, the maximum value corresponding to the replacement of the VOA
by a simple fiber connector (η s does not reach 66% as in chapter 3 because of extra
components in the setup). We can consider that a certain fraction of the losses is
not induced by the channel itself, but by other components which are characterized
by Alice, as part of the source. Such losses are considered homogeneous and trusted,
so the channel reads
E = (1 − λ c )E ′ , (6.34)
where λ c is the amount of losses that is trusted and state-independent, and E ′ ≡ E
in the sense defined in chapter 5, meaning both channels return the same output
states (see Fig. 6.6). This way we can certify E ′ instead of E . In that case the
transmissivity in bound (6.16) can be re-written
t(E ′ |Φ i ) = t(E |Φ i )/(1 − λ c ) = η s /(1 − λ c ), (6.35)
which tightens the bound compared to the naive approach where all losses are
attributed to the channel. Adopting this interpretation is quite realistic, considering
125
Alice preforms a full characterization of the probe states, which potentially includes
a lower bound on the coupling losses. In the worst case scenario, she can always
set λ c = 0 and attribute all the coupling and detection losses to the channel.
Fig. 6.6: Schematic decomposition of the untrusted channel E , into an equivalent

channel E ′ that the protocol effectively certifies, and a trusted channel, translating
for the characterized and homogeneous losses λ c .
6.5.1 Results for a Honest Channel

We first test our protocol on an untrusted but honest channel, by tuning the
channel transmissivity with the VOA. We show the results of our implementa-
tions in Figs. 6.7 and 6.8. We measure a close-to-maximum violation of steering
inequality 2 − ϵ with ϵ = 1.42 · 10−2 on average, and ϵmin = 1.32 · 10−2 in the best
case. Thanks to this high violation and a relatively high coupling efficiency, we
are able to certify the sending of an unknown qubit state through the untrusted
channel, with a non-trivial transmission fidelity F (ρ i , ρ o ) > 50%. This is true even
when Alice attributes all losses to the channel, i.e. λ c = 0, for channels with the
highest transmissivities. The certified fidelity increases as Alice trusts a larger
amount of homogeneous losses λ c , reaching value F (ρ i , ρ o ) = 77.1% ± 0.6% when
she assumes a maximum value λ c = 0.526 and the channel is close to lossless.
In any case, the certified fidelity decreases as the channel gets more lossy, as a
direct consequence of bound (6.16), highlighting the difficulties of certifying lossy
channels. This gives further motivation to ensure that a fraction of the losses are
trusted, in order to certify, for example, long-distance quantum communications. In
our implementation, assuming maximum trusted losses λ c = 0.526, we could certify
a non-trivial transmission fidelity F (ρ i , ρ o ) > 50%, for total transmissivities as low
as t(E |Φ i ) = η s ≃ 0.263, while such certification was possible only for η s ≳ 0.44 with
no trusted losses λ c = 0.
126
Fig. 6.7: Minimum fidelity F (ρ i , ρ o ) certified via our protocol, using an honest
channel with different losses induced by the VOA. We display the data as a function
of the measured heralding efficiency, and assume different amounts of trusted
losses λ c . Curves are plotted by taking the average fidelity of the probe state
to a Bell state F i , and the average of the deviation from maximum violation ϵ,
over all protocol iterations. Experimental results deviate from these curves, as
F i and ϵ vary between implementations. Errors induced by the finite statistics
(seen in equations 6.26 and 6.27) are directly subtracted to the certified fidelity.
Error bars include errors induced by the unbalance in detectors’ efficiency, and
the propagation of errors on F i . We also display the fidelity F (ρ i , ρ o ) measured via
quantum state tomography, for ρ i = Φ i .
Fig. 6.8: Measured probe-state fidelity F i to a maximally-entangled state, and

close-to-maximum violation of steering inequality 2 − ϵ.
127
In order to fully demonstrate the protocol, one should send a single input state
ρ i through the channel, hidden among the probe states. The specific choice of
that state does not matter in our implementation as we do not use it in a later
protocol, so we choose ρ i = Φ i and consider that a random copy of the probe state is
actually the input state. To show the correctness of our protocol, we then perform a
tomography of the corresponding output state ρ o after the channel, and evaluate
a transmission fidelity of F (ρ i , ρ o ) = 99.79% ± 0.02% on average over all protocol
attempts, with a minimum value of F (ρ i , ρ o ) = 98.7% ± 0.5%. This is far higher than
the values certified by our protocol, as displayed on Fig. 6.7, which shows the state
was indeed properly transmitted. Note that the channel and measurement stations
are trusted during the output state’s tomography, as it is performed outside of
the protocol. This allows us to measure numerous copies of ρ o , which is necessary
for a full characterization of the state. In order to show the correctness of our
certification protocol would hold for other input states ρ i , we perform a full-process
tomography of the quantum channel [179], and lower-bound the fidelity between
the physical channel and the identity F ⋄ (E , 1) ≥ 94% ± 3%. We expect this bound
to be far from tight, as it is evaluated using the equivalence between diamond
and Choi-Jamiołkowski distances (theorem 5.3 from chapter 5). Still, the fidelity
is greatly above the values certified by our protocol, showing the certification
procedure is indeed valid for any input state ρ i .
6.5.2 Results for a Dishonest Channel

The strength of our certification procedure is further shown by experimentally
simulating examples of dishonest channels. Let us first recall that the channel op-
erator has no information on the position of the input state ρ i before the end of the
protocol. This way, a typical attack consists in applying a disruptive transformation
with small probability, hoping it will be applied to ρ i and stay undetected by Alice
and Bob. Here we consider such a transformation to be a bit flip X̂ or a phase flip
Ẑ . For this experimental demonstration, we remove the VOA and consider that all
losses are trusted. Note that performing a phase flip is equivalent to turning Bob’s
first measurement B0 into −B0 :
B̂0 = M̂0B|0 − M̂1B|0 −→ −B̂0 = M̂1B|0 − M̂0B|0 . (6.36)
128
Similarly, a bit flip is equivalent to turning Bob’s second measurement B1 into −B1 .
Thus, we perform these flips in practice by randomly changing the waveplates’
angles in order to get the opposite measurement bases. This simulates dishonest
channels of the form:
E p,q [ρ ] = (1 − p)(1 − q)ρ + p(1 − q) X̂ ρ X̂ + pqŶ ρ Ŷ + (1 − p) q Ẑ ρ Ẑ, (6.37)
where p, q are the bit flip and phase flip probabilities, respectively. In fact, we
simulate approximately 5000 different channels E p,q by performing a single 7-
hours protocol run, and picking random measurement samples with different
proportions of disrupted measurements. In order to simulate a larger variety of
data samples, we perform that randomization at a 5 Hz-rate. We then generate
the data for the certification of channel E p,q , by picking random samples with the
following proportions:
• q/2 in basis − Â 0 B̂0 , • (1 − q)/2 in basis Â 0 B̂0 ,
• p/2 in basis − Â 1 B̂1 , • (1 − p)/2 in basis Â 1 B̂1 .
The data acquired in basis − Â 0 B̂0 and − Â 1 B̂1 is then treated as if it was acquired
in basis Â 0 B̂0 and Â 1 B̂1 , respectively, when calculating the average violation of
steering inequality I = |〈 Â 0 B̂0 〉 + 〈 Â 1 B̂1 〉|. When performing this data acquisition,
the probe state’s fidelity to a Bell state is F i = 99.16% ± 0.04%, and we trust a
maximum amount of losses λ c = 0.526.
The certification results are displayed in Fig. 6.9, for different bit and phase
flip probabilities. These show that our implementation is quite sensitive to these
attacks, such that a flip probability of 0.01 induces a collapse of 16% of the certified
fidelity, and we only certify F (ρ i , ρ o ) > 58%. The certified fidelity falls below the
trivial value 50% for flip probabilities as low as 0.017. This way, any attempt of
Eve to disrupt the input state ρ i with such method can only succeed with very
small probabilities p, q < 0.02, or will be detected by Alice and Bob.
129
Fig. 6.9: Minimum fidelity F (ρ i , ρ o ) certified via our protocol, for malicious chan-
nels E p,q , with p, q the bit/phase flip probabilities, respectively.
6.5.3 Additional Implicit Assumptions
Due to technical limits, a few additional but reasonable assumptions are made in
the course of our experiments, in order to draw conclusions from these implemen-
tations. We detail these in the following.
First, we assume Alice and Bob can communicate via a trusted private classical
channel. It allows the players to agree on their measurement settings, Alice to
send Bob the position r of the input state ρ i , and Bob to tell Alice if the states
were properly received. This way the players can perform measurements on the
fly, instead of storing all the states, then deciding of the measurement bases and
finally measuring the states, which would require a billion of quantum memories
with hours-long storage-time. This effectively slightly changes the recipe of the
protocol we implement in practice. We detail this recipe in the following protocol
box. We assume the security to be the equivalent to that of protocol 6.1.
130
Protocol 6.3: Practical certified quantum transmission via Bell theorem
1. Prior to the protocol:

(a) Alice characterizes the state Φ i emitted by her source and evaluates
the quantity F i . She also receives or prepares the state ρ i , possibly
shared with an outside party.
(b) Eve announces the minimum transmissivity t of the channel E for any
quantum state.
2. Alice and Bob agree on parameters ϵ, K , depending on their requirements

and experimental limitations. They also privately agree on the random
position of the input state r ≤ N + 1, with N = ⌈K/t⌉.
For k from 1 to N + 1:
3. If k ̸= r :
(a) Alice prepares a copy of the probe state Φ i and sends half of it
through the channel.
(b) Alice and Bob privately agree on a random q ∈ {0, 1} and measure
the observable Â q B̂ q , with an outcome c k = a k b k if Bob received a
state, or no outcome if the state was lost through the channel.
4. If k = r :
(a) Alice sends ρ i through the channel.
(b) If Bob does not receive any state, the protocol aborts. Otherwise,
Bob sets the state aside.
5. If the number of "no-outcome" events during step 3.(b) is bigger than

N − K , then the protocol aborts.
6. From the correlations { c k }, Alice and Bob deduce the average value over
all rounds, of I = |〈 A 0 B0 〉 + 〈 A 1 B1 〉|.
7. If I ≥ 2 − ϵ, then Alice successfully sent the state ρ o = E [ρ i ]/t(E |ρ i ) to Bob,

with a certified average fidelity to ρ i , up to isometry.
131
Secondly, the fair sampling assumption is required on the measurement ap-

paratus for the self-testing procedure, as we allow a large amount of losses to be
induced by the quantum channel. Alice’s measurement apparatus is completely
trusted and characterized, according to the one-sided device-independent scenario.
On Bob’s side, we assume the efficiency of the measurement apparatus to be inde-
pendent of the measurement setting B̂0 or B̂1 . If the efficiency depends on the state
measured, then we consider that dependence to be part of the quantum channel. A
slight unbalance of efficiency is allowed between the two different measurement
outcomes, and we show in the appendix D.2 that the error induced by this unbal-
ance is negligible. Still, this assumption opens the detection loophole [57], which is
therefore inherent to the certification of lossy channels.
6.6 Discussion
In this chapter we have provided a first protocol to certify the transmission of a
qubit through an untrusted and lossy quantum channel, by probing the latter with
close-to-maximally entangled states and witnessing steering at its output. Our
theoretical investigations rely mostly on assumptions made on the probe state’s
source and the sender’s measurement apparatus, while very few assumptions
are made on the quantum channel and the receiver’s measurement apparatus.
This setting proves to be an interesting trade-off between realistic experimental
conditions and reasonable cryptographic requirements. It also embodies a practical
scenario in which a strong server provides a weaker receiver with a quantum bit.
Compared to previously proposed verification procedures, our protocol not only

certifies the probed channels, but also an unmeasured channel through which a
single unknown state can be sent. As quantum measurement deteriorates the
quantum states, this task can only be performed at the price of measuring a huge
amount of probe states, which limits the repeatability of the protocol with current
technology. Until further theoretical considerations or technological improvements
provide higher repeatability, our protocol can still serve as a practical primitive
for other single-shot protocols that require a single quantum state, such as the
quantum weak coin-flipping protocol presented in chapter 4.
132
6.6. DISCUSSION
Our proof-of-principle implementation shows the correctness of this certifi-

cation procedure, and its feasibility with current technology. This way we could
certify non-trivial transmission fidelities for a wide range of losses induced by the
channel, by making some mild but realistic assumptions, such as the characteriza-
tion of a fraction of trusted losses, induced for instance by the coupling of probe
states inside optical fibers. By implementing random bit and phase flips, we could
show that even a highly improbable attempt to disrupt the quantum information
degrades the certified transmission fidelity, and is therefore detected by the players.
Future developments could demonstrate the feasibility of a version of our pro-

tocol with full device-independence, in which Alice’s measurement or even the
probe states’ source are not trusted. Such protocol could be achieved by linking the
probe state’s quality to that of the corresponding output state, or by making the
IID assumption on the probe state’s source. Also, more investigation on quantum-
memory-based attacks could give a sharper idea on the possibilities of deceiving
the certification procedure.
This work opens the way to certification of a wide variety of more sophisti-
cated lossy quantum channels. In particular, the rapid improvements of quantum
technologies could soon provide possible applications of this protocol to the authen-
tication of quantum teleportation, memories or repeaters.
133
‘Le temps est le meilleur des critiques;
CHAPTER
7
et la patience le meilleur des professeurs.’
— Frédéric Chopin.
C ONCLUSION
or the past couple of decades, the field of quantum communications has
F become most fruitful, providing a wide variety of information-theoretic

secure primitives for a potential future quantum network. These have
the potential to ensure a stronger security than the current classical protocols
relying on computation assumptions. Making such quantum protocols concrete has
required to overcome practical and fundamental challenges, some of which are only
starting to be addressed thanks to the availability of new quantum technologies,
such as high-efficiency single-photon detectors and deterministic single-photon
sources [180]. This work has been intended to contribute to this effort, by devel-
oping and demonstrating new quantum primitives in the lab, thanks to a photon
source built from scratch during the preparation of this thesis.
This photon-pair source, presented and characterized in chapter 3, was shown

to be a promising candidate as a resource for the implementation of quantum
network protocols. In particular the high heralding efficiency of the photons makes
it suitable for numerous single-photon based protocols such as quantum weak coin
flipping presented in chapter 4, and the high fidelity of the biphoton polarization-
state to a maximally-entangled state enables device-independent-type protocols,
such as that detailed in chapter 6 for certified quantum transmission through an
135
CHAPTER 7. CONCLUSION
untrusted channel. In the future, some important modifications could be made on

the setup, to improve its performances or provide more complex applications. In
particular, at the time of the writing of this manuscript, a second source is being
built in the lab, with very close characteristics to the one which was detailed here,
but with limited noise, which should enhance the quality of close-to-maximally-
entangled states. In addition, we provided a possible adaptation to our source, in
order to demonstrate a novel compact layout for a multipartite-state generation.
This could be used to demonstrate new protocols such as anonymous transmissions
[122], authenticated teleportation [26] or composable GHZ-state verification [121].
We first used our source to generate heralded single-photons, allowing to demon-

strate the first information-theoretic and cheat-sensitive weak coin flipping protocol
in chapter 4, thanks to path-encoded entanglement. This way, even if players can
bias the protocol in their favor, they can never do so without risking being sanc-
tioned for cheating. Interestingly enough, in the absence of loss in the setup, the
protocol we designed approaches a unit success probability, meaning it always
designates a winner. This motivates further experimental investigations in order to
minimize the losses in our implementation, by using integrated optics for instance.
In addition such an information-theoretically secure and cheat-sensitive protocol
for weak coin flipping was never proposed in classical cryptography, showing a
concrete advantage brought by quantum systems.
We then used the source to generate photon-pairs entangled in polarization,

allowing to demonstrate a novel protocol for the certification of quantum trans-
mission through an untrusted and lossy quantum channel in chapter 6. Building
this protocol required some new fundamental theoretical developments on lossy
quantum channels, which are detailed in 5. This way, thanks to self-testing of
a steering inequality, we could certify the transmission of an unmeasured state
through the channel, in a semi-device independence setting. This assumption was
used as a trade-off, ensuring security in a relatively realistic scenario in which the
sender is trusted, while the channel and receiver’s apparatus are not. More theoret-
ical developments may extend this implementation to a fully device-independent
setting, or experimental authenticated teleportation.
136
This last protocol showed how adapting theoretical quantum primitives for prac-
tical quantum network applications often implies making important assumptions,
therefore deviating from the ideal recipes. What remains of the so-called quan-
tum advantage can then legitimately be questioned. In the case of authenticated
teleportation [26], or more generally the certification of quantum transmission via
untrusted channels presented in chapter 6, realistic but nonetheless important
assumptions are required in order to derive practical applications. This involves
trusting a part of the setup, or assumptions on the statistics of untrusted states
or measurement outcomes. We see then that to build a practical and fully secure
quantum network, one has to address the implication of any assumption made
in the primitives. This may involve stacking different verification procedures, or
developing ways of detecting potential disruption or cheating strategies, such as
the cheat-sensitivity displayed by our weak coin flipping protocol. In this context,
the composability of protocols is an important property to seek out for, as found in
the recently proposed composable GHZ-state verification [121].
Another important aspect of quantum protocols, which was not tackled in

this thesis, is their energetic footprint. In the context of resources scarcity and
climate emergency, this was recently pointed out by A. Auffèves as a major feature
to consider when building quantum computers [181], and by extension a world-
wide quantum network. Let us for instance consider the certification of quantum
transmission through an untrusted channel. With our protocol and the current
technology, certifying the transmission of a single qubit requires a few kJ of pump
power, for a good level of security. For now, this makes it impractical to certify
the sending of every qubit in a quantum network with such a protocol. Different
solutions may be explored to reduce this energy consumption and make quantum
protocols more practical. This includes experimental efforts in order to lower the
energy required to obtain quantum resources, but also theoretical efforts in order
to build protocols which require a minimum amount of quantum resources [182].
Finally, more assumptions may have to be made on protocols, highlighting a trade-
off between energy consumption and optimal network security. This might temper
the quantum advantage of certain primitives.
137
APPENDIX
A
Q UANTUM S TATE T OMOGRAPHY
haracterizing the state of a quantum system remains an open question in
C the field of quantum information, as one cannot get a complete knowledge

of the state of a system by performing a single measurement. Still quantum
state tomography allows to estimate the density operator of a system, by performing
several measurements on different copies of the system. In the following, we detail
that method that is used extensively in polarization-based photonic experiments,
in the specific 2-qubits case.
A.1 General Method

The idea of qubits-state tomography was first presented by D.F. James et al. in
2001 [51]. It makes use of the decomposition of any n−qubits density operator as
a linear combination of tensor products of Pauli operators, which reads, in the
2-qubits case:
1 X 3 1 X 3
ρ= Tr(ρ · σ̂ i A ⊗ σ̂ i B ) · σ̂ i A ⊗ σ̂ i B = 〈σ̂ i ⊗ σ̂ i B 〉ρ · σ̂ i A ⊗ σ̂ i B , (A.1)
4 i A ,i B =0 4 i A ,i B =0 A
where {σ̂k }k=0,...,3 are Pauli operators (see paragraph 2.1.3). The expectation values
〈σ̂ i A ⊗ σ̂ i B 〉ρ can be estimated via the method described in paragraph 3.4. Injecting
139
APPENDIX A. QUANTUM STATE TOMOGRAPHY
these in eq. (A.1), we get an estimation of ρ , called the Direct Inversion Operator (DI
operator). In general, because of fluctuations in the experimental measurements,
this operator is not a physical density operator, as it displays negative eigenvalues.
A common workaround is to use the maximum likelihood estimation (MLE) method
[52], which consists in finding the physical density operator that is the most likely
to return our experimental data. Making a few minor assumptions which are
acceptable in our case such as a Gaussian statistics of measurement data, a fast
version of the MLE can be derived [183]. In this way, one only has to find the density
operator ρ that minimizes its Hilbert-Schmidt distance to the DI operator µ:
4
D 2 (µ̂ − ρ̂ )2 = Tr[(µ − ρ )2 ] = |µ i, j − ρ i, j |2 .
X
(A.2)
i, j=1
Note this distance can be written in an eigenbasis {|µ i 〉} of µ, in which the optimal
ρ should also be diagonal, such that:
4
D 2 (µ̂ − ρ̂ )2 = | µ i − ρ i |2 ,
X
(A.3)
i=1
where {µ i } and {ρ i } are the eigenvalues of µ and ρ̂ respectively, with the two
constraints i ρ i = 1 and ρ i > 0. This way, we find these optimal eigenvalues using
P
a fast algorithm provided in [183]. Hence the optimal matrix would be:
4
X
ρ̂ opt = ρ i |µ i 〉〈µ i |. (A.4)
i=1
This method was demonstrated to be highly efficient, allowing the reconstruction

of 8-qubits states in less than a few minutes. In addition, one can use the linear
regression estimation method [184] to get a better estimation of the DI operator µ.
A.2 Error Analysis

In order to estimate the errors in the reconstructed quantum state, we follow the
method detailed in [52]. In our experiments, the PBSs in polarization analyzers
have a very high extinction ratio, such that the number of | H 〉-polarized photons
going on the |V 〉-side of the analyzer is negligible, and vice versa. Furthermore,
the background noise is negligible, thanks to the low dark-count rates of our
140
A.2. ERROR ANALYSIS
detectors. This way, systematic errors are mostly caused by differences in the
detectors’ efficiencies. Relative efficiencies can be evaluated by exchanging the
roles of detectors in each polarization analyzer, and the measurement data can
then be corrected to account for the potential efficiency unbalance. Another source
of systematic error is the uncertainty in the position of our WPs axis, which is
evaluated when calibrating the polarization analyzers. It potentially induces a
shift in the angles displayed in Tab. 3.1, which we treat as a statistical error.
Another source of statistical error is the Poisson noise in the photon counting,
that we minimize by measuring a large amount of states (more than 107 for
each measurement basis). Uncertainties on the reconstructed states, induced by
this noise and systematic errors in the WPs angles, are evaluated by using the
Monte Carlo method. This way, we simulate 1000 new data samples with random
perturbations, from which we reconstruct 1000 new density matrices. From these
we evaluate the standard deviation on any relevant quantities related to the
quantum state. Finally, tests on the fast MLE method showed that the numerical
reconstruction itself involved no significant error, provided the number of copies of
the state measured was large enough, typically > 107 in each measurement basis.
141
APPENDIX
B
S AGNAC S OURCE A LIGNMENT
ven though Sagnac sources are well known and characterized, we found
E very few recipes for the alignment of the whole optical setup. In the follow-
ing we detail our own recipe, developed with some inspiration from [115].
This recipe is meant to be quite systematic, and was repeated many times in order
to obtain close-to-maximally-entangled states. The main components we refer to
are displayed in Fig. B.1.
Fig. B.1: Configuration of the setup in our alignment recipe, including the most
important components. Numbers label each side of the PBS.
143
APPENDIX B. SAGNAC SOURCE ALIGNMENT
1. Align the pump beam horizontally, and along a row of holes of the optical
table. Place all the optics required for the pump shaping, including focusing
lenses and WPs for polarization control.
2. Place the non-polarizing BS in the path of the beam, such that the reflected
beam is horizontal and approximately perpendicular to the incident beam.
The BS is supposed to stay in place after the alignment of the source.
3. Place the mirror M0 in the path of the reflected beam. Tune the mirror’s
angles in order to make the beam as horizontal as possible, and aligned
along a row of hole of the optical table. This step is of major importance and
determines how many iterations of the Sagnac alignment will be required.
4. Place the dichroic mirror in the path of the beam, at rougly 45◦ . Any optics
that might deviate the pump beam should also be placed at this step.
5. Place the PBS in the path of the beam. Tune its angles so the reflected beam
is as horizontal as possible, and perpendicular to the incident beam (aligned
along a line of holes).
6. Rotate the polarization of the pump beam, such that the reflected and trans-
mitted beam after the PBS are of similar intensity.
7. Place a mirror on each sides of the PBS, at equal distances of the faces. The
incident angle of the beam should be ≈ 22.5◦ on both mirrors, so the beam
coming from side 1 goes back to the PBS on side 2, and vice versa.
8. With a semi-transparent sheet (such as an optical cleaning tissue), check the

beams’ positions on sides 1 and 2 of the PBS. Tune the mirrors’ angles until
clockwise and anticlockwise beams are visibly overlapped on both sides.
9. Equalize the power of clockwise and anticlockwise beams with the help of a
powermeter, by rotating the polarization of the pump beam.
10. Place a QWP after side 3 of the PBS, at 0◦ (axes aligned to horizontal and
vertical polarization, relatively to the PBS), as well as a polarizer at ±45◦ .
144
11. Check the interference pattern after the polarizer with a powermeter, by
tilting the QWP around its vertical axis. If steps 3., 5. and 8. were done
correctly, one should already note a non-zero visibility:
|P (45◦ ) − P (−45◦ )|
V= , (B.1)
P (45◦ ) + P (−45◦ )
where P (±45◦ ) is the power measured when the polarizer is at ±45◦ .
12. Tune the mirrors’ angles in order to maximize the visibility, and write down
the value reached Vmax . This value can be increased by placing a diaphragm
in front of the powermeter, which filters out side-reflections that do not
correspond to the mode coupled in SM fibers.
At this stage, the Sagnac interferometer may seem aligned, particularly if steps
3. and 5. were done properly. However, many geometrical configurations allow the
interference to be optimized at the output of the Sagnac, without the clockwise and
anticlockwise beams overlapping inside the interferometer, as displayed in Fig. B.2.
For this reason, we provide a few additional steps, in order to check the overlap of
the beams, and correct their position.
Fig. B.2: An example of Sagnac configuration, that may display a high visibility
though the beams are not overlapped inside the interferometer.
13. As in step 8. check the overlap of the beams with a semi-transparent sheet.
However this time, instead of tuning mirrors M1 and M2 , tune the angles of
145
mirror M0 , until the beams are seemingly overlapped. Tuning this mirror
allows to control the configuration of the beams inside the interferometer,
while maintaining a relatively high interference at the output of the Sagnac.
14. Place a diaphragm inside the Sagnac, mounted on a fine transversal trans-
lation stage, close to side 1 of the PBS. Remove the polarizer and keep the
powermeter in place.
15. Close the diaphragm, and maximize the transmitted power, by tuning both
the angles of M0 and the diaphragm transversal position. When the trans-
mitted power is maximized, the clockwise and anticlockwise beams are maxi-
mally overlapped inside the interferometer.
16. Open the diaphragm, and place the polarizer back in front of the powermeter.
Check the interference visibility Vfinal as in step 11.. If this visibility is higher
or equal to the value that was previously reached Vmax ≲ Vfinal , then the
Sagnac interferometer is aligned. Otherwise, repeat steps 12. to 16. until
reaching this condition.
Among other factors, the number of iterations of steps 12. to 16. depends on the
precision of the alignments in steps 3. and 5.. After step 16., we should not touch
the mirrors M0 , M1 , M2 , nor the PBS or any optics which might deviate the pump
beam. Now we only need to properly place the HWP and PPKTP crystal.
17. Place the HWP inside of the interferometer, with its axes aligned to horizontal
and vertical polarizations, as perpendicular to the beam as possible.
18. Check the interference visibility, as done in step 11.. Carefully tilt the HWP
until you reach a value Vfinal measured in step 16.. If the visibility cannot
reach this value, try rotate the HWP at ±90◦ or 180◦ and repeat the procedure.
If the visibility is still lower than Vfinal , then the interferometer is probably
misaligned. It is recommended to restart the alignment from scratch.
19. Fix the HWP to the optical table, while checking the visibility remains at
Vfinal . Rotate it at ±45◦ in order to minimize the power that goes out on side
3 of the PBS. This way all power goes backward on side 4. Half of this power
can be measured on the left side of the BS, as shown in Fig. B.1.
146
20. Place the PPKTP crystal on the path of the beam, in the center of the
interferometer. If possible, the crystal should be mounted on a multi-axes
platform. Maximize the power transmitted on the side of the BS, by roughly
positioning the crystal.
21. Measure the interference visibility on the side of the BS, using the same
method as described in step 11. and shown in Fig. B.1. Carefully tilt the
crystal in all possible directions, until you reach a value Vfinal measured in
step 16.. Here it is highly recommended to place a diaphragm in front of the
powermeter, as side reflections are more likely to degrade the interference.
After this last step, provided the visibility Vfinal was reached, the source is
optimally aligned, and no optics should be touched inside or before the Sagnac for
the remainder of the experiment, except for rotating waveplates. Then one just
has to collect the photons inside optical fibers and optimize the state, which is
described in other works [115].
The particularity of our alignment method compared to more common ones

resides in the steps 13. to 16., in which we tune the incidence angle of pump in
the interferometer, though it is seemingly aligned. Adding this procedure seems
indispensable in order to check the beams are overlapped inside the Sagnac, even
when one perfectly aligns the pump beam before alignment of the interferometer.
When using a particularly long crystal, as our 30 mm-long PPKTP, placing it inside
the Sagnac without performing those steps may result in loss of coherence between
the two sides of the interferometer, distortions in the photon’s spectral and spatial
modes, or a drop in the pair’s emission rate.
Also, note that in step 21., we do not measure the interference pattern after
the Sagnac, as in steps 11. and 18.. The reason is that because of the crystal’s
birefringence, placing that crystal inside the Sagnac introduces a path difference
of ≈ 3 mm between the clockwise and anticlockwise beams, as long as the HWP is
at 0◦ . This result in partial or total loss of coherence, particularly in pulsed mode,
where the pump beam has a coherence length of ≈ 0.6 mm. When rotating the
HWP at ±45◦ , the transmitted horizontally-polarized beam is rotated to vertical
147
polarization, so both reflected and transmitted beam enter the crystal with the
same polarization and experience no path difference. This way, we retrieve a high
visibility, and the beam is sent backward, so we can measure the interference
pattern on the left of the BS. Still, this BS can hardly be removed for the pump’s
path without disaligning the setup, such that 50 % of the pump power does not
contribute to the generation of pairs in this Sagnac interferometer. In many cases
though, the pump power that is transmitted through the BS can be sent to another
source of photons. The two sources can be used independently, or to perform multi-
photons experiments. In our specific case, this BS is used as an integral part of the
spatial multiplexer, described in Fig. 3.24.
148
APPENDIX
C
Q UANTUM W EAK C OIN F LIPPING :
P REDICTIONS
n the following we give some theoretical predictions for the results we observe
I in our experimental implementation of cheat-sensitive weak coin flipping,

presented in chapter 4. In the first two sections, we derive general expressions
for event probabilities, for any values of beam splitter reflectivities x, y, and z.
In the third section we obtain the values of these reflectivities which maximize
fairness and correctness, when both parties are honest, as well as the probabilities
of the different outcomes. Finally, we show such predictions when one of the parties
is dishonest and performs an attack which we implement in this work. In general,
these predictions differ from those derived in previous work [48], as we drop the
balancing condition for the correctness, and we adopt a different parametrization.
We give some development on that matter in the last section.
C.1 Photon Propagation in the Interferometer

We first describe the propagation of the photon in the interferometer (see Fig. C.1),
for any values of x, y, z, and deduce the probabilities of the different events. To sim-
plify our proofs, we neglect dark counts and double-pair emissions. Experimental
149
APPENDIX C. QUANTUM WEAK COIN FLIPPING: PREDICTIONS
details in chapters 3 and 4 support the legitimacy of this approximation. In this

scenario, when Alice detects a photon in detector D herald , then exactly one photon
is generated, corresponding to the action of the creation operator a†1 . Some first
losses occur when coupling the photon to single-mode fibers, such that the operator
transforms as:
p
a†1 −→ †
η c a1 , (C.1)
where η c is the induced transmission. Then Alice sends the photon to a BS of

reflectivity x:
p † p †
p †
η c a 1 −→ xη c a 1 + (1 − x)η c a 2 , (C.2)
where 1 (resp. 2) stands for the reflected (resp. transmitted) mode. Alice keeps
mode 1 and Bob gets mode 2. On each side, the photon undergoes losses due to
fiber transmission and connectors, storage, and diverse other components. We note
η A1 (resp. η B1 ) the transmission on Alice’s (resp. Bob’s) side. Some phases are also
induced by the propagation, and we note Φ A1 (resp. ΦB1 ) the phase introduced on
Alice’s (resp. Bob’s) side. In this way, we get the following transformation:
p p
xη c a†1 + (1 − x)η c a†2 −→ xη c η A1 e iΦ A1 a†1 + (1 − x)η c η B1 e iΦB1 a†2 .
p p
(C.3)
Bob sends the photon to a BS of reflectivity y:

p
xη c η A1 e iΦ A1 a†1 + (1 − x)η c η B1 e iΦB1 a†2
p
p
−→ xη c η A1 e iΦ A1 a†1 + (1 − x) yη c η B1 e iΦB1 a†2
p
(C.4)
+ (1 − x)(1 − y)η c η B1 e iΦB1 a†3 .
p
Bob sends the third mode to the detector D B , inducing another loss. We note η y the
y
transmission, including the detector efficiency, and we have η B = η c η B1 η y (here we
omit the dephasing as no interference will occur in this mode). The second mode
undergoes some loss and dephasing, and we note η B2 and ΦB2 the transmission
and dephasing. There we note η B = η c η B1 η B2 the total loss on Bob’s arm of the
interferometer, and ΦB = ΦB1 + ΦB2 the total dephasing. On Alice’s side, the path
depends on the detection of the third mode that triggers the optical switch. In
absence of dark counts and when Bob is honest, a detection on the third mode
means no detection will occur on Alice’s verification detector, such that Bob is not
sanctioned and wins the coin flip. In other words, Alice trusts Bob’s measurement
150
C.1. PHOTON PROPAGATION IN THE INTERFEROMETER
on the third mode, such that we can omit her verification detector and the optical
switch. In that case she simply sends the first mode to Bob to proceed to verification
of the state. That mode undergoes some loss and dephasing, and we note η A2 and
Φ A2 the transmission and dephasing. There we note η A = η c η A1 η A2 the total loss
on Alice’s arm of the interferometer, and Φ A = Φ A1 + Φ A2 the total dephasing. The
total transformation becomes:
p
xη c η A1 e iΦ A1 a†1 + (1 − x) yη c η B1 e iΦB1 a†2 + (1 − x)(1 − y)η c η B1 e iΦB1 a†3
p p
p
q (C.5)
y
xη A e iΦ A a†1 + (1 − x) yη B e iΦB a†2 + (1 − x)(1 − y)η B e iΦB a†3 .
p
−→
After receiving the first mode, Bob makes it interfere with the second mode on a
BS of reflectivity z, such that we get:
p
q
y
xη A e iΦ A a†1 + (1 − x) yη B e iΦB a†2 + (1 − x)(1 − y)η B e iΦB a†3
p
p
−→ ( xzη A e iΦ A + (1 − x) y(1 − z)η B e iΦB ) a†1
p
(C.6)
− ( x(1 − z)η A e iΦ A − (1 − x) yzη B e iΦB ) a†2
p p
q
y
+ (1 − x)(1 − y)η B e iΦB a†3 .
Bob sends the first and second modes to detectors D V1 and D V2 , with efficiencies
V V V V
η V1 and η V2 , and we note η A1 = η A η V1 , η A2 = η A η V2 , η B1 = η B η V1 , and η B2 = η B η V2 .
Up to an irrelevant global phase e iΦ A , we get:
p
( xzη A e iΦ A + (1 − x) y(1 − z)η B e iΦB ) a†1
p
− ( x(1 − z)η A e iΦ A − (1 − x) yzη B e iΦB ) a†2

p p
q
y
+ (1 − x)(1 − y)η B e iΦB a†3
¡q q (C.7)
xzη A + (1 − x) y(1 − z)ηVB1 e iΔΦ a†1
V1 ¢
−→
¡q q
x(1 − z)η A − (1 − x) yzηVB2 e iΔΦ a†2
V2 ¢
−
q
y
+ (1 − x)(1 − y)η B e iΔΦ a†3 ,
where ΔΦ = ΦB − Φ A is the phase difference. We deduce the detection probabilities

in each detector:
151
PV1 = Ph ( b, v1 , v2 ) = (0, 1, 0) = xzηVA1 + (1 − x) y(1 − z)ηVB1

¡ ¢
q (C.8)
V V
+ 2 cos(ΔΦ) x(1 − x) yz(1 − z)η A1 η B1 ,
PV2 = Ph ( b, v2 ) = (0, 1) = x(1 − z)ηVA2 + (1 − x) yzηVB2

¡ ¢
q (C.9)
V V
− 2 cos(ΔΦ) x(1 − x) yz(1 − z)η A2 η B2 ,
y
P D B = Ph ( b, a) = (1, 0) = (1 − x)(1 − y)η B .
¡ ¢
(C.10)
Fig. C.1: Sketch of the interferometer with most relevant notations.
C.2 Phase Fluctuations

In our experiment, the phase difference ΔΦ evolves through time, because of
thermal fluctuations and diverse vibrations or noise. Slow phase drifts, typically
caused by thermal fluctuations, are generally resolved when counting photons,
provided the photon rate is high enough. Fast phase fluctuations however, typically
caused by noise, are hard to resolve by counting photons, due to low rates and
detector recovery time. Hence, the probabilities PV1 and PV2 are averaged over the
typical temporal resolution τ of our detectors. We distinguish two types of behaviour
in the phase difference ΔΦ( t) = ΔΦ f ( t) + ΔΦs ( t), with ΔΦ f ( t) corresponding to fast
fluctuations of typical period τ f ≪ τ, and ΔΦs ( t) corresponding to slow fluctuations
of typical period τs ≫ τ. For fast fluctuations, the average value 〈cos ΔΦ f 〉τ is
approximately constant. For slow fluctuations, the value of ΔΦs ( t) is approximately
constant over a time lapse of τ. In this way, we get:
152
C.3. PREDICTIONS WITH HONEST PLAYERS
〈cos ΔΦ〉τ ( t) = 〈cos(ΔΦ f + ΔΦs )〉τ ( t)

= 〈cos ΔΦ f cos ΔΦs 〉τ ( t) − 〈sin ΔΦ f sin ΔΦs 〉τ ( t 0 )
(C.11)
= 〈cos ΔΦ f 〉τ cos ΔΦs ( t) − 〈sin ΔΦ f 〉τ sin ΔΦs ( t)
¡ ¢
= v C · cos ΔΦs ( t) − S · sin ΔΦs ( t) ,
q
with v := 〈cos ΔΦ f 〉2τ + 〈sin ΔΦ f 〉2τ , C := 〈cos ΔΦ f 〉τ /v, and S := 〈sin ΔΦ f 〉τ /v. By
definition we have C2 + S2 = 1, so there exists a phase Φeff with C = cos Φeff and
S = sin Φeff . We then get:
¡ ¢
〈cos ΔΦ〉τ ( t) = v cos Φeff cos ΔΦs ( t) − sin Φeff sin ΔΦs ( t)
(C.12)
= v cos(ΔΦs ( t) + Φeff ).
Here Φeff appears as an additional constant dephasing, such that we can include it
inside the slow dephasing ΔΦs ( t 0 ). Effectively, it means taking Φeff = 0, such that
S = 0 and 〈sin ΔΦ f 〉τ = 0. In this way, we have:
〈cos ΔΦ〉τ ( t) = v cos ΔΦs ( t), (C.13)
with v = |〈cos ΔΦ f 〉τ | ∈ [0, 1], that we later interpret as the interference visibility.
Now we average PV1 and PV2 :
V V
〈PV1 〉τ ( t) = xzη A1 + (1 − x) y(1 − z)η B1
¢q (C.14)
V V
+ 2v cos ΔΦs ( t) x(1 − x) yz(1 − z)η A1 η B1 ,
¡
V V
〈PV2 〉τ ( t) = x(1 − z)η A2 + (1 − x) yzη B2
¢q (C.15)
V V
− 2v cos ΔΦs ( t) x(1 − x) yz(1 − z)η A2 η B2 ,
¡
which are the effective expressions of PV1 and PV2 we can use for our estimations
in the following. For this reason, we omit the averaging and time dependence in
the remainder of this thesis.
C.3 Predictions with Honest Players

We now consider a protocol where both parties are honest, and we derive the
parameters x, y and z that maximize the fairness and correctness. The fairness
condition imposes:
153
¡ ¢ ¡ ¢
Ph (b, a) = (1, 0) = Ph (b, v1 , v2 ) = (0, 1, 0) , (C.16)
and the correctness condition imposes:

¡ ¢ ¡ ¢
Ph (b, a) = (1, 1) = Ph (b, v2 ) = (0, 1) = 0. (C.17)
As we neglected dark counts and double-pair emissions, we already have

¡ ¢ ¡ ¢
Ph (b, a) = (1, 1) = 0. However, we have a priori Ph ( b, v2 ) = (0, 1) > 0 for any non-
trivial parameters x, y, z ∉ {0, 1} (these cases do not allow to verify the fairness
condition). It is therefore impossible in principle to verify the correctness condi-
¡ ¢
tion. Still, we minimize Ph ( b, v2 ) = (0, 1) in order to approach the condition. As a
reminder, we have:
Ph (b, v2 ) = (0, 1) = PV2 = x(1 − z)ηVA2 + (1 − x) yzηVB2

¡ ¢
¢q (C.18)
V V
− 2v cos ΔΦs x(1 − x) yz(1 − z)η A2 η B2 .
¡
We first notice that minimizing that expression imposes ΔΦs = 0. Now we recall
that ηVA2 = η A η V2 and ηVB2 = η B η V2 , and define Π A = xη A and ΠB = (1 − x) yη B that we
interpret as the probabilities of measuring the photon in Alice’s side or Bob’s side,
before the last tunable BS. We can then rewrite the probability:
³ p ´
PV2 = η V2 · (1 − z)Π A + zΠB − 2v z(1 − z)Π A ΠB . (C.19)
We can then define a variable ξ := Πtot

A Π
∈ [0, 1] with Πtot = Π A + ΠB , such that:
³ p ´
PV2 = η V2 Πtot (1 − z)ξ + z(1 − ξ) − 2v z(1 − z)ξ(1 − ξ) . (C.20)
PV2 is minimized for ∂PV2 /∂ξ = 0 and ∂PV2 /∂ z = 0. One can easily show that
for v < 1, this system has a single solution ξ = z = 1/2, such that Π A = ΠB . This
drastically simplifies the expressions of the probabilities:
PV1 = xηVA1 (1 + v), (C.21)

PV2 = xηVA2 (1 − v), (C.22)
xηVA1 = (1 − x) yηVB1 . (C.23)
The case v = 1 corresponds to a perfect interference, and implies ∂PV2 /∂ξ = ∂PV2 /∂ z
for any set of parameters ξ and z. This way, an infinite number of ξ and z satisfy
154
C.3. PREDICTIONS WITH HONEST PLAYERS
∂PV2 /∂ξ = 0 and ∂PV2 /∂ z = 0. One can therefore impose another condition, such as
the balance condition introduced in [48], in order to find a unique solution (ξ, z).
This case is not relevant for our study as the interference is imperfect as in all
practical scenarios.
Now we can apply the fairness condition, which in the honest case with no dark
counts and no double-pair emission reduces to PV1 = P D B . This gives the following
equation on the parameters:
y
xηVA1 (1 + v) = (1 − x)(1 − y)η B . (C.24)
Combining eqs. (C.23) and (C.24), we can derive the expressions of the three
parameters x, y and z that optimize both fairness and correctness:
V V
h η A1 η A1 i−1
xh = 1 + + y (1 + v) , (C.25)
V
η B1 ηB
V
h η 1 i−1
yh = 1 + By (1 + v) , (C.26)
ηB
1
zh = . (C.27)
2
Then, the probabilities of the different events are calculated straightforwardly:
Ph Alice wins = Ph Bob wins = PV1 = P D B = xh ηVA1 (1 + v),

¡ ¢ ¡ ¢
(C.28)
¡ ¢
Ph Bob sanctioned = 0, (C.29)
Ph Alice sanctioned = PV2 = xh ηVA2 (1 − v).
¡ ¢
(C.30)
One can notice that the condition Π A = ΠB , which later translates to eq. (C.23),
gives the expected result that we should equalize the power of the two arms of the
interferometer in order to display an optimized interference. This condition is used
in the recipe for tuning the reflectivities with honest players, in paragraph 4.3.1.
Finally, by keeping the same reflectivities, and comparing the values of PV1 and
PV2 when ΔΦs = 0 or ΔΦs = π, we get:
¯ P (ΔΦ = 0) − P (ΔΦ = π) ¯ ¯ P (ΔΦ = 0) − P (ΔΦ = π) ¯
¯ V s V1 s ¯ ¯ V2 s V2 s
v=¯ 1 ¯=¯ ¯, (C.31)
¯
PV1 (ΔΦs = 0) + PV1 (ΔΦs = π) PV2 (ΔΦs = 0) + PV2 (ΔΦs = π)
155
so we can indeed interpret v as the interference visibility, which can be easily

evaluated experimentally. Finally, we mention that each path’s transmission ef-
ficiency can be measured by setting the reflectivities and switch’s state to trivial
values x, y, z, s ∈ {0, 1} given in Table 4.1 of in chapter 4, in which we also give the
experimentally measured values of these efficiencies. From these efficiencies we
can compute the above theoretically predicted reflectivities xh , yh and z h , which
maximize the fairness F and correctness C . The evolution of these values with
the communication distance are shown in Fig. 4.5, together with the reflectivities
measured in our experiments.
C.4 Predictions for a Dishonest Alice

Now we derive results for the case when Alice is dishonest and Bob is honest. In
general, Alice might be able to perform more sophisticated strategies, involving
more complex quantum states, such as those mentioned in [48]. Yet, finding optimal
cheating strategies for Alice remains an open question. To illustrate the cheat
sensitivity of our protocol, we consider a naive strategy, by simply setting up a
reflectivity x > xh , which a priori favors Alice (such a strategy is optimal in the case
of a lossless protocol [48]). As Bob is honest, we still keep y = yh and z = z h = 1/2
from eqs. (4.6) and (4.7), and Alice’s verification setup is not required. In that case
we can derive the expressions for the probabilities of the different events:
1 ³ V1
q ´
P(A. wins) = 〈PV1 〉 = xη A + (1 − x) yh ηVB1 + 2v x(1 − x) yh ηVA1 ηVB1 , (C.32)
2
1³
q ´
P(A. sanctioned) = 〈PV2 〉 = xηVA2 + (1 − x) yh ηVB2 − 2v x(1 − x) yh ηVA2 ηVB2 , (C.33)
2
P(B. wins) = P D B = (1 − x)(1 − yh )η By . (C.34)
These come straightforwardly from equations (C.10), (C.14) and (C.15), by not-
ing that a dishonest Alice would still set ΔΦs = 0, which maximizes her winning
probability and minimizes her sanction probability. This gives the curves plotted
in Fig. 4.9 from chapter 4.
156
APPENDIX
D
S ECURITY FOR Q UANTUM C HANNEL C ERTIFICATION
he security of our protocols for certified transmission through untrusted
T quantum channels relies on some certification bounds, given in equation

(6.27) in the 1sDI protocol, and equation (6.31) in the full-DI protocol. The
first section is dedicated to deriving the certification bounds for the 1sDI and
full-DI protocols. The fair-sampling assumption also plays a significant role in the
security of these protocols, so we clarify the assumptions made on the detection
apparatus in the second section.
D.1 Bounding the Transmission Fidelity

In the following, we give the full proof for the certification bounds used to secure
our protocols for quantum transmission through an untrusted quantum channel.
We first give some further intuition on the average channel over the protocol and
the expected output state. We then show the certification bound (6.16), which relies
on the evaluation of the fidelity of a probe state to a maximally-entangled state,
and the fidelity of the corresponding output state after the channel to the same
maximally-entangled state. This bounds the fidelity between any state that outputs
a quantum channel and the corresponding unknown input state. In the next para-
157
APPENDIX D. SECURITY FOR QUANTUM CHANNEL CERTIFICATION
graph, we show how to evaluate the two probe states’ fidelities up to isometries,
even when no IID assumption is made and the state source might be untrusted.
This method relies on self-testing of steering inequalities in a semi-device inde-
pendent scenario, where Alice’s measurement setup is trusted. Still, this method
requires the measurement of a large sample of close-to-maximally-entangled states,
going through a channel that might evolve through time. In particular, the chan-
nel might not have the same action on the probe states than on the transmitted
state. Therefore, we then give some important statistical development in the next
paragraph, in order to bound the errors made on the different evaluated fidelities,
due to finite state sample in a non-IID setting, as well as losses in the untrusted
channel. Finally, we tie up the security proof, combining the previous parts’ results
in order to provide a bound on the expected fidelity of the transmitted output state
to the input state. We also give some way to generalize that security proof to a
fully-device independent setting. Note that we extensively use our new results
from chapter 5 in order to derive the following proofs.
D.1.1 Average Channel and Expected States

We first recall most important notations for the understanding of the proof. When
the protocol does not abort, Alice and Bob wish to bound the probability that it
successfully implements the channel E 0 ⊗ 1 i on the input state ρ i . During the
protocol Alice sends N + 1 states through the channel, including N states Φ i , and
one copy of ρ i . On the k−th state, the channel takes the expression E k|[k−1] . The
average channel reads:
1 NX +1
Ē = E k|[k−1] . (D.1)
N + 1 k=1
This defines a physical channel, which would randomly apply any of the E k|[k−1] .
Similarly as we did in (6.11), we call Ē i,o the average channel when the isometries
Γ i and Γo are applied. From these two definitions follow the ouput states when
sending the probe state Φ i or the input state ρ i :
Φ̄ o = (Ē ⊗ 1)[Φ i ]/t(Ē |Φ i ), (D.2)

ρ̄ o = (Ē i,o ⊗ 1)[ρ i ]/t(Ē i,o |ρ i ). (D.3)
158
D.1. BOUNDING THE TRANSMISSION FIDELITY
Only one copy of the state ρ i is sent through the channel during the protocol, at
a random position r . Assuming the channel’s operator has no way of guessing
that position, that state has the same probability of going through any one of the
channels E k|[k−1] , such that it is expected to undergo the operation Ē i,o . Therefore,
ρ̄ o is the expected output state, and the fidelity F ρ̄ o , (E 0 ⊗ 1)[ρ i ] can be interpreted
¡ ¢
as the average probability of successfully implementing the channel E 0 on ρ i , up

to isometry [26]. In the following, we show how to bound that fidelity using only
the measurements performed during the protocol when sending the probe states
Φ i through the channel.
D.1.2 Bounding Channel Fidelity with State Fidelities

We now prove the key theoretical result of this chapter (6.16), which allows one to
bound the quality of a channel with probe states fidelities to a maximally-entangled
state, up to isometries. More precisely, we show the following lemma:
Lemma D.1 (Probabilistic Channel Certification). Let us consider a de-

terministic channel E 0 from L (H i ) to L (H o ), a probabilistic channel E
from L (H A 1 ) to L (H B ), and a secondary space L (H A 2 ). For any isometries
Γ A 1 /A 2 : H A 1 /A 2 −→ H A 1 /A 2 ⊗ H i and ΓB : H B −→ H B ⊗ H o we define the cor-
responding fidelities of a state Φ i ∈ L (H A 1 ⊗ H A 2 ) to a maximally-entangled
state Φ+ ∈ L (H i⊗2 ), before and after application of the channels:
F i = F ((Λ A 1 ⊗ Λ A 2 )[Φ i ], Φ+ ),
(D.4)
F o = F ((ΛB ⊗ Λ A 2 )[(E ⊗ 1)[Φ i ]]/t(E |Φ i ), (E 0 ⊗ 1)[Φ+ ]),
where ΛP [·] = TrP (ΓP [·]) for P = A 1 , A 2 or B. Then there exist two isometries Γ i
and Γ o , built from Γ A 1 , Γ A 2 and ΓB , such that the diamond fidelity between
E and E 0 is bounded, up to isometries:
q ³ ¡ i ´
o
¢
1 − F ⋄ (E i,o , E 0 ) ≤ d · sin arcsin C /t(E |Φ i ) + arcsin C , (D.5)
where d = dim H i , E i,o = Tr ext (Γ o ◦ E ◦ Γ i )[ρ A 1 ⊗ • ] , ρ A 1 an ancillary state in

¡ ¢
p p
L (H A 1 ), and C i = 1 − F i and C o = 1 − F o .
159
Proof. This theorem is a generalization of the result from [25] to trace-decreasing

channels. We follow the same guidelines for our proof. In order to forget about the
injection map on Alice’s second subsystem that leaves channel E unaffected, we first
we define Φ′i = (1 ⊗ Λ A 2 )[Φ i ]. Then, we note that according to Proposition 2 from [25],
if one is given a target pure state ρ 0 ∈ L (H s ys ) and any state Γ[ρ ] ∈ L (H ext ⊗H s ys )
with Λ[ρ ] = Tr ext (Γ[ρ ]) ∈ L (H s ys ), then the following relation holds
F (Λ[ρ ], ρ 0 ) = F (Γ[ρ ], ρ ext ⊗ ρ 0 ), (D.6)
Trs ys (Γ[ρ ]ρ 0 ⊗ 1)
where ρ ext = . We start by applying this proposition to F i , with
Tr(Γ[ρ ]ρ 0 ⊗ 1)
Hilbert spaces H s ys = H i⊗2 and H ext = H A 1 , so that fidelity reads:
F i = F (Γ A 1 ⊗ 1)[Φ′i ], ρ A 1 ⊗ Φ+ ,
¡ ¢
(D.7)
TrH i ⊗ H i (Γ A 1 ⊗ 1)[Φ′i ]|Φ+ 〉〈Φ+ |1

¡ ¢
where ρ A 1 = ¡ A ′
¢ . The isometry Γ A 1 can be written
Tr (Γ ⊗ 1)[Φ i ]|Φ+ 〉〈Φ+ |1
1
as a unitary, applied on a Hilbert state of larger dimension, so that
(Γ A 1 ⊗ 1)[Φ′i ] = (U i ⊗ 1)[σ ext ⊗ Φ′i ], (D.8)
where σ ext is an ancillary pure state and U i a unitary operation applied on that
state and H A 1 . This way we get:
F i = F (U i ⊗ 1)[σ ext ⊗ Φ′i ], ρ A 1 ⊗ Φ+

¡ ¢
†
= F σ ext ⊗ Φ′i , (U i ⊗ 1)[ρ A 1 ⊗ Φ+ ]
¡ ¢
(D.9)
†
≤ F Φ′i , Tr ext,i (U i ⊗ 1)[ρ A 1 ⊗ Φ+ ] ,
¡ ¢
where we use the fidelity invariance under unitary operation, and the fact that it
can only increase upon tracing out, here of the Hilbert space of σ ext . This allows us
†
to define the input isometry Γ i = (U i ⊗ 1)[ • ] so we have:
F i ≤ F Φ′i , Tr ext,i (Γ i [ρ A 1 ⊗ Φ+ ]) .
¡ ¢
(D.10)
Now by defining the output isometry Γ o = ΓB , we can apply the map Γ o ◦ Ē ⊗ 1 to

both states on the right-hand side of the inequality, and our new extended process
160
inequality from chapter 5 (see theorem 5.2), and once again fidelity monotonicity
when tracing out subsystems:
p
Ci = 1 − F i
≥ C Φ′i , Tr ext,i (Γ i [ρ A 1 ⊗ Φ+ ])
¡ ¢
¢ (D.11)
≥ t(Ē |Φ′i ) · C (Γ o ◦ Ē ⊗ 1)[Φ′i ]/t(Ē |Φ′i ), Tr ext,i ((Γ o ◦ Ē ◦ Γ i ⊗ 1)[ρ A 1 ⊗ Φ+ ])/ t̃
¡
≥ t(Ē |Φ′i ) · C (ΛB ◦ Ē ⊗ 1)[Φ′i ]/t(Ē |Φ′i ), Tr ext ((Γ o ◦ Ē ◦ Γ i ⊗ 1)[ρ A 1 ⊗ Φ+ ])/ t̃ .
¡ ¢
Here in order to apply the theorem 5.2, we noted that t(Ē |Φ′i ) = Tr((Ē ⊗ 1)[Φ′i ])
is the transmissivity of the first state, which does not vary under application of
isometry Γ o . Also t̃ is the transmissivity of the second state, i.e. t̃ = t(Ē i,o |Φ+ ) as
we define Ē i,o = Tr ext ((Γ o ◦ Ē ◦ Γ i )[ρ A 1 ⊗ • ]). The last partial trace in the inequality
is carried out over all subsystems except L (H o ⊗ H i ), so the distance can only
decrease. Noting (ΛB ◦ Ē ⊗ 1)[Φ′i ]/t(Ē |Φ′i ) = (ΛB ⊗ Λ A 2 ) ◦ (Ē ⊗ 1)[Φ i ]/t(Ē |Φ i ) we get:
C i /t(Ē |Φ′i ) ≥ C (ΛB ⊗ Λ A 2 )[Φ̄ o ], (Ē i,o ⊗ 1)[Φ+ ]/t(Ē i,o |Φ+ ) .
¡ ¢
(D.12)
Finally, we can apply an equivalent of triangular inequality to Ulhmann’s fidelity:

p
arccos F (ρ 1 , ρ 3 ) = arcsin C (ρ 1 , ρ 3 )
p p
≤ arccos F (ρ 1 , ρ 2 ) + arccos F (ρ 2 , ρ 3 ) (D.13)
= arcsin C (ρ 1 , ρ 2 ) + arcsin C (ρ 2 , ρ 3 ),
with the following states
ρ 1 = (Ē i,o ⊗ 1)[Φ+ ]/t(Ē i,o |Φ+ ), (D.14)

ρ 2 = (ΛB ⊗ Λ A 2 )[Φ̄ o ], (D.15)
ρ 3 = (E 0 ⊗ 1)[Φ+ ]. (D.16)
ρ 1 is the output state of the real channel when sending a perfect maximally entan-
gled state, ρ 2 the average output state we effectively measure after application
of the real channel on a close-to-maximally-entangled state, and ρ 3 the output
state of the target channel when sending a perfectq
maximally entangled state. This
way we have C (ρ 2 , ρ 3 ) = C o and C (ρ 1 , ρ 3 ) = arccos F J (Ē i,o , E 0 ) by definition, and
i
C (ρ 1 , ρ 2 ) ≤ C /t(Ē |Φ i ) via inequality (D.12). This gives the result:
q
arccos F J (Ē i,o , E 0 ) = arcsin C J (Ē i,o , E 0 ) ≤ arcsin C i /t(Ē |Φ i ) + arcsin(C o ). (D.17)
¡ ¢
161
From here, one just has to use the comparison between Choi-Jamiołkowski and
diamond distances, as we showed in chapter 5 (see theorem 5.3), in order to get
the bound (D.5) and lemma D.1. ■
The isometries mentioned in the proof are fundamental in a device-independent

study, in order to extract ideal qubit spaces to real-world infinite-dimension phys-
ical Hilbert spaces. Γ A 1 , Γ A 2 and ΓB are the same type of isometries as in all
standard self-testing results [158], and they extract a qubit state from the full
state of a physical system, which encompasses all other degrees of freedom. The
unused degrees of freedom are then thrown away. The channel isometries Γ i and
Γo were introduced more recently [25] and together extract a qubit channel from a
physical channel acting on all degrees of freedom of a physical system. The output
isometry Γ o performs the same operation as ΓB , extracting a qubit out of a physical
system. The isometry Γ i however, performs the inverse operation than the other
isometries, encoding the qubit state into a physical system, such that it can be fed
into the physical channel. We give a schematic view of these channels in Figure
6.3. In Protocol 6.1, the input state Φ i is assumed to be fully characterized, so we
can ignore the input isometry and Γ i = Γ A 1 = 1. Yet, we must include that isometry
when building the fully device-independent Protocol 6.2.
The result we just showed allows us to deduce the protocol’s success probability,
by evaluating the fidelities F i and F o to a Bell state, as well as the transmissivity
t(Ē |Φ i ). The two following paragraphs are dedicated to evaluating F o and t(Ē |Φ i ),
using data received by Alice and Bob only. In order to tie up the security of Protocol
2, we tackle the certification of F i in a later paragraph.
D.1.3 Certifying the average Bell output state

In order to certify the average output state Φ̄ o = (Ē ⊗ 1)[Φ i ]/t(Ē |Φ i ), we use self-
testing results from previous works [162] that consider steering-based certification
of the Bell pair in a finite number of measurement rounds, without making the
common IID assumption. In a non-IID scenario the channel may change its be-
haviour throughout the protocol, such that we define E k|[k−1] the expression of
the channel when Alice sends the k−th state. Then, we call the output state
162
Φk = (E k|[k−1] ⊗ 1)[Φ i ]/t k when Alice sends the state Φ i , with t k = t(E k|[k−1] |Φ i ) being
the transmissivity of the state Φ i through the channel E k|[k−1] . Using this notation,
we can define the following state:
¡ NX
+1 ¢
Φ̄ t = T k Φk /(K + 1), (D.18)
k=1
where T k = 1 when a state is detected by Bob, and T k = 0 otherwise, such that

P N +1
k=1
T k = K +1. We take T r = 1, in order to include the state Φr = (E r|[r−1] ⊗1)[Φ i ]/t r
in the sum. Φ̄ t is the average output state of the protocol, in the particular case
ρ i = Φ i and when the protocol did not abort. Therefore, we expect Φ̄ t to be a good
approximation for Φ̄ o , the expected output state when sending Φ i through the
average channel Ē i,o . However, we leave that consideration for the next paragraph,
and now show certification results for Φ̄ t in place of Φ̄ o .
When ρ i = Φ i , we can see our protocol as an attempt to authenticate an un-

measured Bell pair, emerging from an untrusted source. The latter is made of
Alice’s trusted source, sending copies of Φ i in the untrusted quantum channel. The
state emerging from the E r is the unmeasured pair, and the K other output states
are measured by Alice and Bob in order to perform a Bell test. In that case, our
protocol corresponds to that described in [26, 162], such that we can apply the
self-testing-based security results from that work, in a non-IID and 1sDI setting,
to our protocol:
Proposition D.1. Let us consider our protocol where ρ i = Φ i , Alice and Bob measure
K states and witness an average violation of either steering inequality of 2 − ϵ. We
can bound the fidelity of the average state Φ̄ t to a maximally-entangled state Φ+ ,
up to isometry. More precisely, there exist isometries Γ A 2 and ΓB acting respectively
on L (H A 2 ) and L (H B ), such that by defining the local maps Λ A 2 [·] = Tr A 2 (Γ A 2 [·])
and ΛB [·] = TrB (ΓB [·]), for any x > 0 we have with probability at least (1 − e− x ):
F ((ΛB ⊗ Λ A 2 )[Φ̄ t ], Φ+ ) ≥ 1 − α · f x (ϵ, K ) −→ 1 − αϵ, (D.19)

K →+∞
where α is a constant and f is a function which both depend on the inequality used:
ϵ ϵ + 8/K
r
x
f x (ϵ , K ) = 8 + + , (D.20)
K 2 2 + 1/K
and α = 1.26.
163
It is worth noting that as the r -th state is left unmeasured in this protocol, and
we assume the channel’s operator has no way of guessing r , then the measurements
performed on the test EPR pairs follow the same statistics in the general case as
in the special case ρ i = Φ i . We can therefore use the correlations witnessed in our
protocol in Proposition D.1, even when sending any ρ i in r -th position, in order to
certify the hypothetical state Φ̄ t up to isometry.
Fig. D.1: Minimum fidelity of the average output state to a Bell state, up to
isometries, as a function of the deviation to maximum violation. As we make no
IID assumption, we give the evolution for different numbers K of states measured.
We set a confidence level 1 − e− x ≈ 0.999.
Finally, we give some insight on the behaviour of those bounds with the para-
meters of the problem (see Fig. D.1). First, we can take x = 7 in order to get a
bound with almost absolute certainty, as (1 − e− x ) ≈ 0.999. The corresponding term
p
in x/K can be made arbitrarily small by measuring a large number K of states.
Similarly, when measuring a reasonable amount of states K > 108 , we reach the
asymptotic regime where the fidelity is simply bounded by 1 − αϵ.
D.1.4 Errors due to Post-Selection and Finite Statistics

We now show the validity of approximating the state Φ̄ o (D.2) with Φ̄ t (D.18), as
well as the following approximation:
K +1
t(Ē |Φ i ) ≈ R = , (D.21)
N +1
164
where K + 1 = |SP | is the number of states that Bob is able to measure after they
are sent through the channel. Alice and Bob have direct access to the value R in
the end of the protocol, as the fraction of states that successfully pass through the
channel, which we identify as the heralding efficiency η s in experiments. Therefore,
they can easily evaluate t(Ē |Φ i ) by using (D.21).
Proposition D.2. In our protocol, provided that Bob measured a large enough
number K + 1 of states, the transmissivity t(Ē |Φ i ) of Φ i through the average channel
Ē can be approximated by the proportion R of states which were successfully detected
by Bob, and the state Φ̄ o can be approximated by Φ̄ t . More precisely, for any x > 0
we have with probability at least (1 − 2 e− x )2 :
q
arccos F (Φ̄ t , Φ̄ o ) ≤ Δ x (R, K ), (D.22)
t(Ē |Φ i ) ≥ τ x (R, K ), (D.23)
where
Δx (R, K ) = arccos 11−−3δδxx(R,K)

(R,K)
, (D.24)
τ x (R, K ) = R (1 − δ x (R, K )), (D.25)
q
1 2x
δ x (R, K ) = K +1 + R(K +1) . (D.26)
In particular, this proposition gives the error terms mentioned given in equa-
tions (6.26) and (6.27) from chapter 6.
Proof. First let us rewrite the transmissivity through the average channel using
the expressions at each rounds:
³ 1 NX +1 ´ 1 NX +1
t(Ē |Φ i ) = Tr E k [Φ i ] = tk. (D.27)
N + 1 k=1 N + 1 k=1
Alice and Bob do not have direct access to that quantity, as they cannot measure
t k individually. However, they have access to the random variables {T k }1≤k≤ N +1
defined in the previous subsection, the sum of which gives the number of states
that were measured by Bob during the protocol:
NX
+1
K + 1 = |SP | = T k. (D.28)
k=1
165
As no IID assumption is made, the variables T k may differ from one another and
depend on the experiment’s history. Taking the difference with transmissivities,
we define a new random variable, for j ̸= k :
j j
(T k − E[T k ]) =
X X
Dj = (T k − t k ), (D.29)
k=1 k=1
k̸= r k̸= r
and D r = D r−1 . The expectation value of D j is finite for any j , as it is zero, and
we have E[D j+1 |H j ] = D j , where H j is the history of the experiment after the j -th
state is sent through the channel. This makes D j a martingale. We also note that
|D j+1 − D j | ≤ 1 for any j , such that we can apply the Azuma-Hoeffding inequality:
³ γ2 ´
P (|D j | ≥ γ) ≤ 2 exp − . (D.30)
2j
Note that D N +1 = ( N + 1) · (R − t(Ē |Φ i )) − 1 + t r , such that by taking j = N + 1 we get:
¡ −γ+1− t γ+1− t ¢
³ γ2 ´
P N +1 r ≤ R − t(Ē |Φ i ) ≤ N +1 r ≥ 1 − 2 exp − . (D.31)
2( N + 1)
Now considering 0 ≤ 1 − t r ≤ 1, and taking the relative difference we get:
γ+1 ¢
³ γ2 ´
P |R −t(RĒ |Φi )| ≤ K +1 ≥ 1 − 2 exp −
¡
, (D.32)
2( N + 1)
γ2
such that by taking x = 2(N +1) > 0 we get the following bound with probability at
least (1 − 2 e− x ):
|R − t(Ē |Φ i )|
|Δ1 | = ≤ δ x (R, K ), (D.33)
R
q
1 2x
where δ x (R, K ) = K +1 + R(K +1) . This straightly gives the inequality in (D.23):
t(Ē |Φ i ) ≥ τ x (R, K ), (D.34)
where τ x (R, K ) = R (1 − δ x (R, K )). Note that as the value of x can be chosen arbi-
trarily, we can take the same value as in Proposition D.1, which will simplify the
notation. To show the bound (D.22), we now assume bound (D.33) stands, such that
|Δ1 | ≤ δ x (R, K ). We then re-write Φ̄ o using the states Φk and transmissivities t k :
Φ̄ o = (Ē ⊗ 1)[Φ i ]/t(Ē |Φ i )
¡ 1 NX +1 ¢
= (E k ⊗ 1)[Φ i ] /t(Ē |Φ i )
N + 1 k=1 (D.35)
¡ 1 NX +1 ¢
= t k Φk /t(Ē |Φ i ).
N + 1 k=1
166
We pick a projector P̂ that allows to express the trace distance between Φ̄ o and Φ̄ t :
D (Φ̄ t , Φ̄ o ) = Tr(P̂ (Φ̄ t − Φ̄ o ))

NX
+1¡
Tk t ¢
= K +1 − (N +1)t(k Ē |Φ ) Tr(P̂ Φk )
k=1
i (D.36)
³¯ NX
+1¡ ¯ ¯ NX+1 ¯´
t(Ē |Φ i ) T k −t k
− N1+1 T k Tr(P̂ Φk )¯ + ¯
¢
≤ ¯ Tr( P̂ k ¯ /t(Ē |Φ i ).
)
¯ ¯ ¯ ¯
K +1 N +1 Φ
k=1 k=1
Let us call the second term in parenthesis |Δ2 | and bound the first term:
¯ NX
+1³ ´ ¯ NX+1 ¯ ¯
t(Ē |Φ i ) 1 ¯ t(Ē |Φ i ) 1 ¯
K +1 − N +1 T k Tr(P̂ Φ k )¯ = T k Tr(P̂ Φk )¯ K +1 − N +1 ¯
¯ ¯
¯
k=1 k=1
¯ ¯
¯ t(Ē |Φ )
≤ (K + 1)¯ K +1i − N1+1 ¯
¯
(D.37)
¯ ¯
= ¯ t(Ē |Φ i ) − R ¯
¯ ¯
≤ R δ x (R, K ).
In order to bound |Δ2 |, we make the exact same proof as for |Δ1 |, taking
Tr(P̂ Φk ) · T k in place of T k and Tr(P̂ Φk ) · t k in place of t k , when defining D j in
equation (D.29). This new sum of variables D̃ j is still a martingale such that
|D̃ j+1 − D̃ j | ≤ 1. Therefore it still verifies equation (D.30), and we have
D̃ N +1 = ( N + 1)Δ2 − Tr(P̂ Φr )(1 − t r ), (D.38)
such that:
¡ −γ+Tr(P̂ Φr )(1− t r ) γ+Tr(P̂ Φr )(1− t r ) ¢
³ γ̃2 ´
P N +1 ≤ Δ2 ≤ N +1 ≥ 1 − 2 exp − . (D.39)
2( N + 1)
As 0 ≤ Tr(P̂ Φr )(1 − t r ) ≤ 1 we can simplify:
³
γ̃+1
´ ³ γ̃2 ´
Pr |Δ2 | ≤ N +1 ≥ 1 − 2 exp − , (D.40)
2( N + 1)
γ̃2
such that by taking 2(N +1) = x we get the following bound with probability at least
−x
(1 − 2 e ):
|Δ2 | ≤ R δ x (R, K ). (D.41)
This way, coming back to (D.37) we get:

2R δ x (R, K ) 2 δ x (R, K )
D (Φ̄ t , Φ̄ o ) ≤ ≤ . (D.42)
t(Ē |Φ i ) 1 − δ x (R, K )
167
p
Now we use a comparison between fidelity and trace distance 1 − F ≤ D in order
to bound the angle distance between Φ̄ t and Φ̄ o :
q
A (Φ̄ t , Φ̄ o ) = arccos F (Φ̄ t , Φ̄ o ) ≤ Δ x (R, K ),
1 − 3 δ x (R, K ) (D.43)
where Δ x (R, K ) = arccos .
1 − δ x (R, K )
Finally, we point out that this bound is true with probability (1 − 2 e− x ) and
at the condition that bound (D.33) holds, which also happens with probability
(1 − 2 e− x ), such that both bounds hold with probability (1 − 2 e− x )2 . This ties up the
proof of Proposition D.2. ■
This proposition highlights the purely statistics-induced error on states and

transmissivities. It is mostly due to the fact that Alice and Bob only have access to
a finite number of states, in a non-IID setting. Most importantly, as the channel is
allowed to be lossy, these states only give information on a sample of the different
expressions E k|[k−1] that it might take during the protocol, causing more uncer-
tainty than when certifying a source of state without channel. This error must
be included in the bounds in order to derive the protocol’s security. Also note that
we can use this theorem when applying the injection map ΛB ⊗ Λ A 2 defined in the
previous subsection to both states, as we always have:
F (ΛB ⊗ Λ A 2 )[Φ̄ t ], (ΛB ⊗ Λ A 2 )[Φ̄ o ] ≥ F (Φ̄ t , Φ̄ o ).

¡ ¢
(D.44)
This is fundamental to derive the final security bound for our protocol. Finally, we
give some insight on the dependence of this error on the different parameters of the
problem. First we notice that this error can be made arbitrarily small by measuring
a large enough number K of states, which still needs to be limited for practical
applications. The error tends to increase with the confidence level, such that we
need more states K in order to ensure a smaller error with reasonable certainty.
Similarly, the more lossy the channel is, i.e. the smaller R , the bigger the error.
Therefore having a lossy channel also imposes to measure more states in order
to accurately certify the protocol. We give an idea of the evolution of that error
in Fig. D.2, for different confidence levels and different channel’s transmission
ratios R . We see that with a transmission ratio R = 50%, corresponding to telecom
168
light propagating in a 15km-long optical fiber or ideal quantum teleportation, we

can ensure an error Δ x (R, K ) ≤ 0.015 with a confidence level of 99.5%, by measuring
a reachable number of states K ≈ 1010 .
(a) For different minimum confidence levels, (b) With a minimum confidence level 99.5%,
with a transmission ratio R = 50%. with different transmission ratios.
Fig. D.2: Minimum statistics-induced error Δ x (R, K ), as a function of the number

of states measured K .
D.1.5 Certifying the Output State of the Protocol
Combining the last three paragraphs allows us to extract a bound for the fidelity
of the expected output state ρ̄ o to the input state ρ i up to isometry. We assume
that Alice prepared N states with fidelity F i to a Bell state, that Bob received K of
those states during the protocol, and that they measured an ϵ-close to maximum
violation of the steering inequality. First, they can use Lemma D.1, implying that
there exist isometries Γ i , Γ o , Γ A 1 , Γ A 2 , and ΓB , giving the result from (6.16):
q q
B A2
)[ρ̄ o ], ρ i ≤
¡ ¢
1 − F (Λ ⊗ Λ 1 − F ⋄ (Ē i,o , E 0 )
= C ⋄ (Ē i,o , E 0 )
(D.45)
≤ 2 C J (Ē i,o , E 0 )
≤ 2 sin arcsin C i /t(Ē |Φ i ) + arcsin(C o ) .
¡ ¡ ¢ ¢
169
Now we fix x > 0 in order to apply Proposition D.2, such that we have both:
t(Ē |Φ i ) ≥ τ x (R, K ), (D.46)

p ¡ B p
arccos F (Λ ⊗ Λ A 2 )[Φ̄ t ], (ΛB ⊗ Λ A 2 )[Φ̄ o ] ≤ arccos F (Φ̄ t , Φ̄ o )
¢
(D.47)
≤ Δ x (R, K ).
with probability at least (1 − 2 e− x )2 , where τ x and Δ x are functions detailed in

paragraph D.1.4. In that case, we can apply the triangular inequality to arcsin(C o ):
arcsin(C o ) ≤ arcsin C (ΛB ⊗ Λ A 2 )[Φ̄ t ], Φ+ + Δ x (R, K ),

¡ ¢
(D.48)
and bound t(Ē |Φ i ) in order to get:
arcsin C i /t(Ē |Φ i ) ≤ arcsin C i /τ x (R, K ) .

¡ ¢ ¡ ¢
(D.49)
We can then bound C ((ΛB ⊗ Λ A 2 )[Φ̄ t ], Φ+ ) using Proposition D.1, with a confi-
dence level (1 − e− x ):
arcsin C ((ΛB ⊗ Λ A 2 )[Φ̄ t ], Φ+ ) ≤ arcsin α f x (ϵ, K ) .

¡ ¢ p
(D.50)
Combining (D.45), (D.48), (D.49), and (D.50) we can bound the input-output
fidelity up to isometries:
³ ´
1 − F (ρ̄ o , ρ i ) ≤ 2 · sin arcsin C i /τ x (R, K ) + arcsin α f x (ϵ, K ) + Δ x (R, K ) , (D.51)
p ¡ ¢ p
where α and f are given in Proposition D.1. This way, for any x > 0 we can bound the
output state fidelity to the input state with probability at least (1 − e− x ) · (1 − 2 e− x )2 :
³ ´
F (ρ̄ o , ρ i ) ≥ 1 − 4 · sin2 arcsin C i /τ x + arcsin α f x (ϵ, K ) + Δ x .
¡ ¢ p
(D.52)
D.1.6 Full-Device Independence: Probe State Certification

In protocol 2 Alice does not trust her measurement setup anymore, nor the source
of input state Φ i . However we still make the IID assumption on that source. In
that case we deduce the following theorem from a previous work [162]:
170
Proposition D.3. When Alice measures an average violation of Bell inequality

p
2 2 − η on M identical copies of Φ i with untrusted measurement apparatus, then
for any x > 0 we can bound the fidelity of Φ i to Φ+ up to isometries, with probability
(1 − e− x ), meaning that there exists two isometries Γ A 1 and Γ A 2 on L (H A 1 ) and
L (H A 2 ) such that:
F (Λ A 1 ⊗ Λ A 2 )[Φ i ], Φ+ ≥ 1 − α · g x (η, M ) −→ 1 − α · η,
¡ ¢
(D.53)
M →+∞
p
with Λ A 1 [·] = Tr A 1 (Γ A 1 [·]), Λ A 2 [·] = Tr A 1 (Γ A 2 [·]), α = 1.19, and g x (η, M ) = 8 2 x/M + η.
Then, if Alice and Bob measure K states at the output of the channel with
untrusted measurement apparatus, and witness an average violation of CHSH in-
p
equality of 2 2 − ϵ, we can bound the fidelity of the average state Φ̄ t to a maximally-
entangled state Φ+ , up to isometries, with probability at least (1 − e− x ), meaning
that there exist isometries Γ A 2 and ΓB on L(H A 2 ) and L(H B ), such that:
F ((ΛB ⊗ Λ A 2 )[Φ̄ t ], Φ+ ) ≥ 1 − α · f x (ϵ, K ) −→ 1 − α · ϵ, (D.54)

K →+∞
with Λ A 2 [·] = Tr A 2 (Γ A 2 [·]), ΛB [·] = TrB (ΓB [·]), α = 1.19 and

q p
f x (ϵ, K ) = 16 2x
K + 34ϵ + ϵ+(44++24/K2 )/K . (D.55)
Thanks to the IID assumption made on the probe-state source, we still consider
all input probe states to be equal to Φ i , so the first part of Proposition D.3 enables
Alice and Bob to certify the quantity F i once, for the whole protocol. This way,
compared to Proposition D.1 for protocol 1, we bound C i ≤ α g x (η, M ) , and replace
p
the expression of f x and α. We also multiply the confidence level by (1 − e− x ) to

account for the confidence on the input bound, due to the finite number M of input
state tested. This straightly gives the bound:
³ ´
2
¡p p
F (ρ̄ o , ρ i ) ≥ 1 − 4 · sin arcsin α g x (η, M ) /τ x + arcsin α f x (ϵ, K ) + Δ x ,
¢
(D.56)
with confidence level at least (1 − e− x )2 · (1 − 2 e− x )2 for any x > 0, therefore showing

the security bound for protocol 2. We show the corresponding certified fidelity with
examples of experimental parameters in Fig. D.3.
171
(a) R = 50% (b) R = 70%
(c) R = 90% (d) R = 100%
Fig. D.3: Minimum certified fidelity of the output state of Protocol 2, to the state
sent through the channel, as a function of the deviations η, ϵ from maximum
violation of CHSH inequality. We set x = 7 for a confidence level > 99.4%, a number
of probe states M = K = 1010 , and different ratios of transmission R = K/N .
172
D.2. DETECTORS MODEL IN EXPERIMENT
D.2 Detectors Model in Experiment

We now detail the assumptions made on the players’ detection systems, in order to
perform our proof-of-principle experimental protocol, as well as the consequences
on the protocol’s results. We focus on the detectors used in order to certify the
output probe state in the one-sided device-independent protocol, and therefore omit
the system that Alice uses in order to certify the input state Φ i . Both Alice and Bob
each possess a local measurement apparatus, ideally made of 2-outcomes POVMs
A
{ M̂ l | q2 }l=0,1 and { M̂ lB| q }l=0,1 , for q = 0, 1. In reality, these detectors have non-unit
efficiency, meaning they only return a result with a certain probability which may
depend on the parameter q, the outcome l , or even the quantum state ρ . This way
we adopt a similar description as that of [185], such that we get the probabilities of
returning outcome l , when measuring ρ with measurement parameter q:
P A (l | q, ρ ) = Tr(ρ M̂ lA| q2 ) · η A (l, q, ρ ), (D.57)
PB (l | q, ρ ) = Tr(ρ M̂ lB| q ) · ηB (l, q, ρ ), (D.58)
where η A and ηB are the efficiencies. For a bipartite state, the probability of getting
outcomes ( l A , l B ) with parameters ( q A , q B ) becomes:
P(l A , l B | q A , q B , ρ ) = Tr ρ · M̂ lA 2| q ⊗ M̂ lBB | qB · η A (l A , q A , ρ A ) · ηB (l B , q B , ρ B ), (D.59)

¡ ¢
A A
where ρ A = TrB (ρ ) and ρ B = Tr A (ρ ) are the local states, such that the efficiencies
are local. In the following we focus on the assumptions made on these efficiencies
in our protocol, and the consequences on the results. First, in a one-sided device-
independent scenario, we assume that Alice fully characterizes her measurement
apparatus, and proves her efficiency to be independent of the state ρ and the
measurement parameter q, such that:
η A 2 ( l, q, ρ ) = η A 2 ( l ). (D.60)
The values of η A 2 ( l ) are accessible to Alice, as part of her detectors’ characterization.

This way, for l + and l − such that η A 2 ( l + ) > η A 2 ( l − ), Alice can ignore the outcomes l +
with probability 1 − η A 2 ( l − )/η A 2 ( l + ) in order to effectively equalize the efficiencies
of the two outcomes. In that case the efficiency on Alice’s side is a constant η A 2 ,
such that
η A 2 ( l, q, ρ ) = η A 2 . (D.61)
173
On Bob’s side, we first make the weak fair sampling assumption [185], stating
that we can factorize the efficiencies due to classical parameters from those due to
quantum states:
ηB ( l, q, ρ ) = ηB B
C ( l, q) · η Q (ρ ). (D.62)
We then make a form of strong fair-sampling assumption, stating the efficiency

does not depend on q, such that:
ηB ( l, q, ρ ) = ηB B
C ( l ) · η Q (ρ ). (D.63)
Now we could assume the state-dependent efficiency to be unit, which leads to

an unbalanced-outcomes homogeneous fair-sampling assumption, and leaves the
protocol more vulnerable to attacks. Another solution is to consider ηB
Q
(ρ ) as a
part of the quantum channel being tested, as shown in Fig. D.4. In that case our
protocol is more secure but certifies a different channel, the output of which is
necessarily measured by Bob measurement apparatus. This would require further
investigation if the quantum communication is followed by another protocol which
does not involve Bob’s measurement apparatus. In both cases, we can neglect the
state-dependent efficiency, such that
ηB ( l, q, ρ ) = ηB
C ( l ), (D.64)
is an efficiency which a priori depends on the result l . The detection probability

then becomes
PB (l | q, ρ ) = Tr(ρ M̂ lB| q ) · ηB (l ). (D.65)
Fig. D.4: Schematic representation of Bob’s measurement apparatus, taking our

assumptions into account. The apparatus first displays some state-dependent
transmissivity ηQ , that we can include inside the channel E . Bob then measures
the observable B̂ q , the result l ∈ {0, 1} of which is filtered with efficiency η( l ).
174
D.2. DETECTORS MODEL IN EXPERIMENT
Similarly to [185], we now show that even though the efficiency ηB slightly
varies with the outcome l , we can still use the measured outcome without any
correction on Bob’s side, and still get a good evaluation of I = |〈 Â 0 B̂0 〉 + 〈 Â 1 B̂1 〉|. By
definition we have:
A A A A
〈 Â q B̂ q 〉 = 〈 M̂0| 2q M̂0B| q 〉 + 〈 M̂1| 2q M̂1B| q 〉 − 〈 M̂0| 2q M̂1B| q 〉 + 〈 M̂1| 2q M̂0B| q 〉. (D.66)
With their imperfect detectors, Alice and Bob approximate that quantity by mea-
suring the following:
n 0,0| q + n 1,1| q − n 0,1| q − n 1,0| q
Â q B̂ q = , (D.67)
n 0,0| q + n 1,1| q + n 0,1| q + n 1,0| q
where n l A ,l B | q is the number of times the measurement of a pair gave the outcome
( l A , l B ), when Alice and Bob both measured with parameter q. When measuring a
big number of state N we approximate
n l A ,l B | q = N · P( l A , l B | q A , q B , ρ ) = N · Tr(ρ · M̂ lA 2| q ⊗ M̂ lBB | q ) · η A · ηB ( l B ), (D.68)

A
so we rewrite the evaluation of 〈 Â q B̂ q 〉, symplifying the constant terms N and η A :
Tr ρ · ( M̂0A| 2q ⊗ M̂0B| q − M̂1A| 2q ⊗ M̂0B| q ) · ηB (0) + Tr ρ · ( M̂1A| 2q ⊗ M̂1B| q − M̂0A| 2q ⊗ M̂1B| q ) · ηB (1)
£ ¤ £ ¤
Â q B̂ q = £
Tr ρ · ( M̂0A| 2q ⊗ M̂0B| q + M̂1A| 2q ⊗ M̂0B| q ) · ηB (0) + Tr ρ · ( M̂1A| 2q ⊗ M̂1B| q + M̂0A| 2q ⊗ M̂1B| q ) · ηB (1)
¤ £ ¤
h ¢i
Tr ρ · Â q ⊗ M̂0B| q · ηB (0) − M̂1B| q · ηB (1)
¡
= h ¡ ¢i .
Tr ρ · M̂0B| q · ηB (0) + M̂1B| q · ηB (1)
(D.69)
Then we take ξ such that ηB (1)/ηB (0) = 1 + ξ, and we get
h ¢i
Tr ρ · Â q ⊗ M̂0B| q − M̂1B| q · ηB (1)/ηB (0)
¡
Â q B̂ q = h ¡ ¢i
Tr ρ · M̂0B| q + M̂1B| q · ηB (1)/ηB (0)
(D.70)
〈 Â q B̂ q 〉 − Tr ρ · Â q ⊗ M̂1B| q · ξ
£ ¤
= .
1 + Tr ρ · M̂1B| q · ξ
£ ¤
Considering ηB (1) ≈ ηB (0), such that |ξ| ≪ 1, we approximate the difference between
the expected and measured correlations 〈 Â q B̂ q 〉 and Â q B̂ q , at first order:
Â q B̂ q − 〈 Â q B̂ q 〉 ≈ − Tr ρ · Â q ⊗ M̂1B| q · ξ − 〈 Â q B̂ q 〉 · Tr ρ · M̂1B| q · ξ
£ ¤ £ ¤
= (1 − 〈 Â q B̂ q 〉) · Tr ρ · M̂1A| 2q ⊗ M̂1B| q · ξ
£ ¤
(D.71)
A
− (1 + 〈 Â q B̂ q 〉) · Tr ρ · M̂0| 2q ⊗ M̂1B| q · ξ.
£ ¤
175
Provided Alice and Bob witness a close-to-maximum violation of steering inequality,

we also have (1 − 〈 Â q B̂ q 〉) ≪ 1 and Tr ρ · M̂0A| 2q ⊗ M̂1B| q ≪ 1. This way, that difference
£ ¤
is doubly negligible, such that even noticeable unbalance between the detectors
efficiencies should not significantly deviate the measured correlation from the
expected correlation. We therefore assume Â q B̂ q ≈ 〈 Â q B̂ q 〉, such that the value of
I can be accurately measured even without correction for the detectors efficiency.
In our experiment, we measure the relative efficiency between Bob’s detectors,
for each protocol iteration. This way we get ξ ≲ 0.03, while witnessing a close-
to-maximum violation of steering inequality, legitimizing the approximation. We
still compute the violation that would be measured if detectors were perfectly
balanced, and ηB (1) = ηB (0), by correcting the data with the relative efficiencies.
The difference between the corrected and uncorrected data is included in the error
bars displayed in Fig. 6.7.
176
B IBLIOGRAPHY
[1] R. L. Rivest, A. Shamir, and L. Adleman, “A method for obtaining digital

signatures and public-key cryptosystems,” Communications of the ACM,
vol. 21, no. 2, pp. 120–126, 1978.
[2] P. Richard, “Simulating physics with computers,” International journal of

theoretical physics, vol. 21, no. 6-7, pp. 467–488, 1982.
[3] D. Deutsch, “Quantum theory, the church–turing principle and the univer-
sal quantum computer,” Proceedings of the Royal Society of London. A.
Mathematical and Physical Sciences, vol. 400, no. 1818, pp. 97–117, 1985.
[4] P. W. Shor, “Algorithms for quantum computation: discrete logarithms and

factoring,” in Proceedings 35th annual symposium on foundations of
computer science, pp. 124–134, Ieee, 1994.
[5] C. Bennett and G. Brassard, “Quantum cryptography: Public key cryptogra-

phy and coin tossing,” in Proceedings of the International Conference on
Computers, Systems and Signal processing, vol. 175, pp. 175–179, 1984.
[6] A. K. Ekert, “Quantum cryptography based on bell’s theorem,” Physical

Review Letters, vol. 67, pp. 661–663, aug 1991.
[7] G. Vernam, “Cipher printing telegraph systems for secret wire and radio
telegraphic communications,” Transactions of the American Institute of
Electrical Engineers, vol. XIV, pp. 295–301, 1926.
[8] C. E. Shannon, “Communication theory of secrecy systems,” The Bell system

technical journal, vol. 28, no. 4, pp. 656–715, 1949.
177
BIBLIOGRAPHY
[9] J. S. Bell, “On the einstein podolsky rosen paradox,” Physics, vol. 1, no. 3,
pp. 195–200, 1964.
[10] W. K. Wootters and W. H. Zurek, “A single quantum cannot be cloned,” Nature,

vol. 299, no. 5886, pp. 802–803, 1982.
[11] D. Dieks, “Communication by epr devices,” Physics Letters A, vol. 92, no. 6,
pp. 271–272, 1982.
[12] M. Hillery, V. Bužek, and A. Berthiaume, “Quantum secret sharing,” Physical

Review A, vol. 59, no. 3, p. 1829, 1999.
[13] R. Cleve, D. Gottesman, and H.-K. Lo, “How to share a quantum secret,”
Physical review letters, vol. 83, no. 3, p. 648, 1999.
[14] D. Markham and B. C. Sanders, “Graph states for quantum secret sharing,”
Physical Review A, vol. 78, no. 4, p. 042309, 2008.
[15] A. Kent, “Unconditionally secure bit commitment by transmitting measure-

ment outcomes,” Physical review letters, vol. 109, no. 13, p. 130501, 2012.
[16] A. Cabello, “Multiparty key distribution and secret sharing based on entan-
glement swapping,” arXiv preprint quant-ph/0009025, 2000.
[17] M. Christandl and S. Wehner, “Quantum anonymous transmissions,” in

International conference on the theory and application of cryptology and
information security, pp. 217–235, Springer, 2005.
[18] H. J. Kimble, “The quantum internet,” Nature, vol. 453, pp. 1023–1030, June
2008.
[19] S. Wehner, D. Elkouss, and R. Hanson, “Quantum internet: A vision for the
road ahead,” Science, vol. 362, no. 6412, p. eaam9288, 2018.
[20] R. W. Spekkens and T. Rudolph, “Quantum protocol for cheat-sensitive weak

coin flipping,” Physical Review Letters, vol. 89, no. 22, p. 227901, 2002.
178
BIBLIOGRAPHY
[21] A. Gočanin, I. Šupić, and B. Dakić, “Sample-efficient device-independent

quantum state verification and certification,” PRX Quantum, vol. 3, feb
2022.
[22] J.-D. Bancal, K. Redeker, P. Sekatski, W. Rosenfeld, and N. Sangouard,

“Self-testing with finite statistics enabling the certification of a quantum
network link,” arXiv:1812.09117 [quant-ph], July 2020.
[23] J.-D. Bancal, N. Sangouard, and P. Sekatski, “Noise-Resistant Device-

Independent Certification of Bell State Measurements,” Physical Review
Letters, vol. 121, p. 250506, Dec. 2018.
[24] M. O. Renou, J. Kaniewski, and N. Brunner, “Self-Testing Entangled Mea-

surements in Quantum Networks,” Physical Review Letters, vol. 121,
p. 250507, Dec. 2018.
[25] P. Sekatski, J.-D. Bancal, S. Wagner, and N. Sangouard, “Certifying the

Building Blocks of Quantum Computers from Bell’s Theorem,” Physical
Review Letters, vol. 121, p. 180505, Nov. 2018.
[26] A. Unnikrishnan and D. Markham, “Authenticated teleportation with one-

sided trust,” Physical Review A, vol. 100, p. 032314, Sept. 2019.
[27] F. Monteiro, V. C. Vivoli, T. Guerreiro, A. Martin, J.-D. Bancal, H. Zbinden,

R. T. Thew, and N. Sangouard, “Revealing genuine optical-path entangle-
ment,” Physical review letters, vol. 114, no. 17, p. 170504, 2015.
[28] A. Suprano, D. Zia, E. Polino, T. Giordani, L. Innocenti, M. Paternostro,

A. Ferraro, N. Spagnolo, and F. Sciarrino, “Enhanced detection tech-
niques of orbital angular momentum states in the classical and quantum
regimes,” New Journal of Physics, vol. 23, no. 7, p. 073014, 2021.
[29] F. Graffitti, A. Pickston, P. Barrow, M. Proietti, D. Kundys, D. Rosset, M. Ring-

bauer, and A. Fedrizzi, “Measurement Device Independent Verification of
Quantum Channels,” Physical Review Letters, vol. 124, p. 010503, Jan.
2020.
179
BIBLIOGRAPHY
[30] P. Lefebvre, R. Valivarthi, Q. Zhou, L. Oesterling, D. Oblak, and W. Tittel,

“Compact energy–time entanglement source using cascaded nonlinear
interactions,” JOSA B, vol. 38, no. 4, pp. 1380–1385, 2021.
[31] A. Aspect, P. Grangier, and G. Roger, “Experimental tests of realistic local

theories via bell’s theorem,” Physical Review Letters, vol. 47, no. 7, p. 460,
1981.
[32] C.-Z. Peng, J. Zhang, D. Yang, W.-B. Gao, H.-X. Ma, H. Yin, H.-P. Zeng,
T. Yang, X.-B. Wang, and J.-W. Pan, “Experimental long-distance decoy-
state quantum key distribution based on polarization encoding,” Physical
review letters, vol. 98, no. 1, p. 010505, 2007.
[33] D. Rosenberg, J. W. Harrington, P. R. Rice, P. A. Hiskett, C. G. Peterson,

R. J. Hughes, A. E. Lita, S. W. Nam, and J. E. Nordholt, “Long-distance
decoy-state quantum key distribution in optical fiber,” Physical review
letters, vol. 98, no. 1, p. 010503, 2007.
[34] T. Schmitt-Manderbach, H. Weier, M. Fürst, R. Ursin, F. Tiefenbacher,

T. Scheidl, J. Perdigues, Z. Sodnik, C. Kurtsiefer, J. G. Rarity, et al.,
“Experimental demonstration of free-space decoy-state quantum key dis-
tribution over 144 km,” Physical Review Letters, vol. 98, no. 1, p. 010504,
2007.
[35] H.-L. Yin, T.-Y. Chen, Z.-W. Yu, H. Liu, L.-X. You, Y.-H. Zhou, S.-J.
Chen, Y. Mao, M.-Q. Huang, W.-J. Zhang, et al., “Measurement-device-
independent quantum key distribution over a 404 km optical fiber,” Phys-
ical review letters, vol. 117, no. 19, p. 190501, 2016.
[36] M. Bozzio, A. Orieux, L. T. Vidarte, I. Zaquine, I. Kerenidis, and E. Diamanti,

“Experimental demonstration of practical unforgeable quantum money,”
Preprint at: http://arxiv. org/abs/1705.01428, 2017.
[37] M. Bozzio, A. Orieux, L. Trigo Vidarte, I. Zaquine, I. Kerenidis, and E. Dia-

manti, “Experimental investigation of practical unforgeable quantum
money,” npj Quantum Information, vol. 4, no. 1, pp. 1–8, 2018.
180
BIBLIOGRAPHY
[38] M. Bozzio, E. Diamanti, and F. Grosshans, “Semi-device-independent quan-

tum money with coherent states,” Physical Review A, vol. 99, no. 2,
p. 022336, 2019.
[39] B. Bell, D. Markham, D. Herrera-Martí, A. Marin, W. Wadsworth, J. Rarity,

and M. Tame, “Experimental demonstration of graph-state quantum
secret sharing,” Nature communications, vol. 5, no. 1, pp. 1–12, 2014.
[40] M. Proietti, J. Ho, F. Grasselli, P. Barrow, M. Malik, and A. Fedrizzi, “Exper-

imental quantum conference key agreement,” Science advances, vol. 7,
no. 23, p. eabe0395, 2021.
[41] L. Rückle, J. Budde, J. de Jong, F. Hahn, A. Pappa, and S. Barz, “Experi-

mental anonymous conference key agreement using linear cluster states,”
arXiv preprint arXiv:2207.09487, 2022.
[42] A. Fedrizzi, T. Herbst, A. Poppe, T. Jennewein, and A. Zeilinger, “A

wavelength-tunable fiber-coupled source of narrowband entangled pho-
tons,” Optics Express, vol. 15, no. 23, p. 15377, 2007.
[43] S. Krapick, H. Herrmann, V. Quiring, B. Brecht, H. Suche, and C. Silberhorn,

“An efficient integrated two-color source for heralded single photons,” New
Journal of Physics, vol. 15, no. 3, p. 033010, 2013.
[44] S. Fasel, O. Alibart, S. Tanzilli, P. Baldi, A. Beveratos, N. Gisin, and

H. Zbinden, “High-quality asynchronous heralded single-photon source
at telecom wavelength,” New Journal of Physics, vol. 6, no. 1, p. 163,
2004.
[45] T. Guerreiro, A. Martin, B. Sanguinetti, N. Bruno, H. Zbinden, and R. Thew,

“High efficiency coupling of photon pairs in practice,” Optics express,
vol. 21, no. 23, pp. 27641–27651, 2013.
[46] J.-W. Pan, D. Bouwmeester, H. Weinfurter, and A. Zeilinger, “Experimental

entanglement swapping: Entangling photons that never interacted,” Phys.
Rev. Lett., vol. 80, pp. 3891–3894, 1998.
181
BIBLIOGRAPHY
[47] H.-S. Zhong, Y. Li, W. Li, L.-C. Peng, Z.-E. Su, Y. Hu, Y.-M. He, X. Ding,
W. Zhang, H. Li, et al., “12-photon entanglement and scalable scattershot
boson sampling with optimal entangled-photon pairs from parametric
down-conversion,” Physical review letters, vol. 121, no. 25, p. 250505,
2018.
[48] M. Bozzio, U. Chabaud, I. Kerenidis, and E. Diamanti, “Quantum weak coin

flipping with a single photon,” Phys. Rev. A, vol. 102, p. 022414, Aug 2020.
[49] S. Neves, V. Yacoub, U. Chabaud, M. Bozzio, I. Kerenidis, and E. Dia-

manti, “Experimental cheat-sensitive quantum weak coin flipping,” arXiv
preprint arXiv:2211.03472, 2022.
[50] R. Yehia, S. Neves, E. Diamanti, and I. Kerenidis, “Quantum city: simulation

of a practical near-term metropolitan quantum network,” arXiv preprint
arXiv:2211.01190, 2022.
[51] D. F. James, P. G. Kwiat, W. J. Munro, and A. G. White, “Measurement of

qubits,” Physical Review A, vol. 64, no. 5, p. 052312, 2001.
[52] J. B. Altepeter, E. R. Jeffrey, and P. G. Kwiat, “Photonic state tomography,”

Advances in Atomic, Molecular, and Optical Physics, vol. 52, pp. 105–159,
2005.
[53] E. Schrödinger, “Die gegenwärtige situation in der quantenmechanik,” Natur-

wissenschaften, vol. 23, no. 49, pp. 823–828, 1935.
[54] A. Einstein, B. Podolsky, and N. Rosen, “Can quantum-mechanical descrip-

tion of physical reality be considered complete?,” Physical review, vol. 47,
no. 10, p. 777, 1935.
[55] J. F. Clauser, M. A. Horne, A. Shimony, and R. A. Holt, “Proposed experiment

to test local hidden-variable theories,” Physical review letters, vol. 23,
no. 15, p. 880, 1969.
[56] B. S. Cirel’son, “Quantum generalizations of bell’s inequality,” Letters in

Mathematical Physics, vol. 4, no. 2, pp. 93–100, 1980.
182
BIBLIOGRAPHY
[57] N. Brunner, D. Cavalcanti, S. Pironio, V. Scarani, and S. Wehner, “Bell

nonlocality,” Reviews of Modern Physics, vol. 86, no. 2, p. 419, 2014.
[58] C. H. Bennett, G. Brassard, et al., “Teleporting an unknown quantum state

via dual classical and einstein-podolsky-rosen channels,” Phys. Rev. Lett.,
vol. 70, pp. 1895–1899, 1993.
[59] D. M. Greenberger, M. A. Horne, and A. Zeilinger, “Going beyond bell’s theo-

rem,” in Bell’s theorem, quantum theory and conceptions of the universe,
pp. 69–72, Springer, 1989.
[60] D. M. Greenberger, M. A. Horne, A. Shimony, and A. Zeilinger, “Bell’s theo-

rem without inequalities,” American Journal of Physics, vol. 58, no. 12,
pp. 1131–1143, 1990.
[61] G. Murta, F. Grasselli, H. Kampermann, and D. Bruß, “Quantum conference

key agreement: A review,” Advanced Quantum Technologies, vol. 3, no. 11,
p. 2000025, 2020.
[62] M. Christandl and S. Wehner, “Quantum anonymous transmissions,” Ad-

vances in Cryptology, ASIACRYPT, pp. 217–235, 2005.
[63] R. Jozsa, “Fidelity for mixed quantum states,” Journal of modern optics,
vol. 41, no. 12, pp. 2315–2323, 1994.
[64] A. Gilchrist, N. K. Langford, and M. A. Nielsen, “Distance measures to

compare real and ideal quantum processes,” Physical Review A, vol. 71,
no. 6, p. 062310, 2005.
[65] A. E. Rastegin, “Sine distance for quantum states,” arXiv:quant-ph/0602112,

Feb. 2006.
[66] B. E. Saleh and M. C. Teich, Fundamentals of photonics.

john Wiley & sons, 2019.
[67] J. Armstrong, N. Bloembergen, J. Ducuing, and P. S. Pershan, “Interactions

between light waves in a nonlinear dielectric,” Physical review, vol. 127,
no. 6, p. 1918, 1962.
183
BIBLIOGRAPHY
[68] P. Franken and J. Ward, “Optical harmonics and nonlinear phenomena,”

Reviews of Modern Physics, vol. 35, no. 1, p. 23, 1963.
[69] A. Yariv, “Coupled-mode theory for guided-wave optics,” IEEE Journal of

Quantum Electronics, vol. 9, no. 9, pp. 919–933, 1973.
[70] J. Kerr, “Xl. a new relation between electricity and light: Dielectrified me-
dia birefringent,” The London, Edinburgh, and Dublin Philosophical
Magazine and Journal of Science, vol. 50, no. 332, pp. 337–348, 1875.
[71] J. Kerr, “Liv. a new relation between electricity and light: Dielectrified media
birefringent (second paper),” The London, Edinburgh, and Dublin Philo-
sophical Magazine and Journal of Science, vol. 50, no. 333, pp. 446–458,
1875.
[72] M. Planck and M. Masius, The Theory of Heat Radiation.

Blakiston, 1914.
[73] A. Einstein, “Uber einen die erzeugung und verwandlung des lichtes be-
treffenden heurischen gesichtpunkt,” Ann. Phys, vol. 17, pp. 132–148,
1905.
[74] W. Louisell, A. Yariv, and A. Siegman, “Quantum fluctuations and noise in

parametric processes. i.,” Physical Review, vol. 124, no. 6, p. 1646, 1961.
[75] D. C. Burnham and D. L. Weinberg, “Observation of simultaneity in paramet-

ric production of optical photon pairs,” Physical Review Letters, vol. 25,
no. 2, p. 84, 1970.
[76] C. Fabre and N. Treps, “Modes and states in quantum optics,” Reviews of
Modern Physics, vol. 92, no. 3, p. 035005, 2020.
[77] J. W. Fleming and D. L. Wood, “Refractive index dispersion and related prop-
erties in fluorine doped silica,” Applied optics, vol. 22, no. 19, pp. 3102–
3104, 1983.
[78] L. Mach, “Ueber einen interferenzrefraktor,” Zeitschrift für Instru-

mentenkunde, vol. 12, no. 3, p. 89, 1892.
184
BIBLIOGRAPHY
[79] L. Zehnder, “Ein neuer interferenzrefraktor,” 1891.
[80] C. K. Hong, Z. Y. Ou, and L. Mandel, “Measurement of subpicosecond time

intervals between two photons by interference,” Phys. Rev. Lett., vol. 59,
pp. 2044–2046, 1987.
[81] D. Bouwmeester and A. Zeilinger, “The physics of quantum information: basic

concepts,” in The physics of quantum information, pp. 1–14, Springer,
2000.
[82] S. S. Gill, A. Kumar, H. Singh, M. Singh, K. Kaur, M. Usman, and R. Buyya,

“Quantum computing: A taxonomy, systematic review and future direc-
tions,” Software: Practice and Experience, vol. 52, no. 1, pp. 66–114, 2022.
[83] C. Peikert et al., “A decade of lattice cryptography,” Foundations and trends®

in theoretical computer science, vol. 10, no. 4, pp. 283–424, 2016.
[84] S. Wiesner, “Conjugate coding,” ACM Sigact News, vol. 15, no. 1, pp. 78–88,
1983.
[85] S.-K. Liao, W.-Q. Cai, J. Handsteiner, B. Liu, J. Yin, L. Zhang, D. Rauch,
M. Fink, J.-G. Ren, W.-Y. Liu, et al., “Satellite-relayed intercontinental
quantum network,” Physical review letters, vol. 120, no. 3, p. 030501,
2018.
[86] G. Ribordy, J. Brendel, J.-D. Gautier, N. Gisin, and H. Zbinden, “Long-

distance entanglement-based quantum key distribution,” Physical Review
A, vol. 63, no. 1, p. 012309, 2000.
[87] R. Ursin, F. Tiefenbacher, T. Schmitt-Manderbach, H. Weier, T. Scheidl,

M. Lindenthal, B. Blauensteiner, T. Jennewein, J. Perdigues, P. Trojek,
et al., “Entanglement-based quantum communication over 144 km,” Na-
ture physics, vol. 3, no. 7, pp. 481–486, 2007.
[88] X. Ma, C.-H. F. Fung, and H.-K. Lo, “Quantum key distribution with en-
tangled photon sources,” Physical Review A, vol. 76, no. 1, p. 012307,
2007.
185
BIBLIOGRAPHY
[89] T. Honjo, S. W. Nam, H. Takesue, Q. Zhang, H. Kamada, Y. Nishida,

O. Tadanaga, M. Asobe, B. Baek, R. Hadfield, et al., “Long-distance
entanglement-based quantum key distribution over optical fiber,” Optics
Express, vol. 16, no. 23, pp. 19118–19126, 2008.
[90] J. Yin, Y.-H. Li, S.-K. Liao, M. Yang, Y. Cao, L. Zhang, J.-G. Ren, W.-Q. Cai, W.-
Y. Liu, S.-L. Li, et al., “Entanglement-based secure quantum cryptography
over 1,120 kilometres,” Nature, vol. 582, no. 7813, pp. 501–505, 2020.
[91] M. Bozzio, U. Chabaud, I. Kerenidis, and E. Diamanti, “Quantum weak

coin flipping with a single photon,” Physical Review A, vol. 102, no. 2,
p. 022414, 2020.
[92] J.-L. Smirr, M. Deconinck, R. Frey, I. Agha, E. Diamanti, and I. Zaquine,

“Optimal photon-pair single-mode coupling in narrow-band spontaneous
parametric downconversion with arbitrary pump profile,” Journal of the
Optical Society of America B, vol. 30, p. 288, jan 2013.
[93] J.-L. Smirr, Towards a narrow-band source of polarisation entangled entan-

gled photon at 1550 nm.
Phd thesis, Université Paris Sud - Paris XI, Nov. 2010.
[94] N. Bruno, Single photon entanglement: from foundations to applications.

PhD thesis, Université de Genève, Mar. 2015.
[95] N. Bruno et al., “Pulsed source of spectrally uncorrelated and indistinguish-

able photons at telecom wavelengths,” Optics Express, vol. 22, p. 17246,
jul 2014.
[96] R. S. Bennink, “Optimal collinear gaussian beams for spontaneous paramet-

ric down-conversion,” Physical Review A, vol. 81, may 2010.
[97] Z. Y. Ou and L. Mandel, “Violation of bell’s inequality and classical probability

in a two-photon correlation experiment,” Physical Review Letters, vol. 61,
pp. 50–53, jul 1988.
[98] P. G. Kwiat et al., “New high-intensity source of polarization-entangled

photon pairs,” Physical Review Letters, vol. 75, pp. 4337–4341, dec 1995.
186
BIBLIOGRAPHY
[99] P. G. Kwiat, E. Waks, A. G. White, I. Appelbaum, and P. H. Eberhard, “Ultra-

bright source of polarization-entangled photons,” Physical Review A,
vol. 60, pp. 773–776, aug 1999.
[100] R. Rangarajan, M. Goggin, and P. Kwiat, “Optimizing type-i polarization-

entangled photons,” Opt. Express, vol. 17, p. 18920, 2009.
[101] G. Sagnac, “L’éther lumineux démontré par l’effet du vent relatif d’éther
dans un interféromètre en rotation uniforme,” CR Acad. Sci., vol. 157,
pp. 708–710, 1913.
[102] J. Brendel, N. Gisin, W. Tittel, and H. Zbinden, “Pulsed energy-time entan-

gled twin-photon source for quantum communication,” Physical Review
Letters, vol. 82, no. 12, p. 2594, 1999.
[103] S. Tanzilli, W. Tittel, H. De Riedmatten, H. Zbinden, P. Baldi, M. DeMicheli,

D. B. Ostrowsky, and N. Gisin, “Ppln waveguide for quantum communica-
tion,” The European Physical Journal D-Atomic, Molecular, Optical and
Plasma Physics, vol. 18, no. 2, pp. 155–160, 2002.
[104] A. Martin, A. Issautier, H. Herrmann, W. Sohler, D. B. Ostrowsky, O. Alibart,

and S. Tanzilli, “A polarization entangled photon-pair source based on a
type-ii ppln waveguide emitting at a telecom wavelength,” New Journal
of Physics, vol. 12, no. 10, p. 103005, 2010.
[105] F. Kaiser, A. Issautier, O. Alibart, A. Martin, and S. Tanzilli, “Guided-wave

photonics for narrowband polarization entanglement,” arXiv preprint
arXiv:1111.5683, 2011.
[106] T. E. Stuart, J. A. Slater, F. Bussières, and W. Tittel, “Flexible source of

nondegenerate entangled photons based on a two-crystal sagnac interfer-
ometer,” Physical Review A, vol. 88, no. 1, p. 012301, 2013.
[107] S. Tanzilli, A. Martin, F. Kaiser, M. P. De Micheli, O. Alibart, and D. B.

Ostrowsky, “On the genesis and evolution of integrated quantum optics,”
Laser & Photonics Reviews, vol. 6, no. 1, pp. 115–143, 2012.
187
BIBLIOGRAPHY
[108] B.-S. Shi and A. Tomita, “Generation of a pulsed polarization entangled

photon pair using a sagnac interferometer,” Physical Review A, vol. 69,
jan 2004.
[109] T. Kim, M. Fiorentino, and F. N. C. Wong, “Phase-stable source of polarization-

entangled photons using a polarization sagnac interferometer,” Physical
Review A, vol. 73, jan 2006.
[110] R. S. Bennink, “Optimal collinear gaussian beams for spontaneous para-

metric down-conversion,” Physical Review A, vol. 81, no. 5, p. 053805,
2010.
[111] R.-B. Jin, R. Shimizu, K. Wakui, H. Benichi, and M. Sasaki, “Widely tunable
single photon source with high purity at telecom wavelength,” Optics
Express, vol. 21, p. 10659, apr 2013.
[112] C. Chen et al., “Efficient generation and characterization of spectrally fac-

torable biphotons,” Optics Express, vol. 25, p. 7300, mar 2017.
[113] F. Graffitti, P. Barrow, M. Proietti, D. Kundys, and A. Fedrizzi, “Indepen-

dent high-purity photons created in domain-engineered crystals,” Optica,
vol. 5, pp. 514–517, May 2018.
[114] J. Yin et al., “Satellite-based entanglement distribution over 1200 kilometers,”

Science, vol. 356, no. 6343, pp. 1140–1144, 2017.
[115] D. H. Smith, “An ultrafast source of polarization entangled photon pairs

based on a sagnac interferometer,” Master’s thesis, University of Waterloo,
2009.
[116] M. A. Broome, M. P. Almeida, A. Fedrizzi, and A. G. White, “Reducing multi-

photon rates in pulsed down-conversion by temporal multiplexing,” Optics
express, vol. 19, no. 23, pp. 22698–22708, 2011.
[117] C. Greganti et al., “Tuning single-photon sources for telecom multi-photon

experiments,” Optics Express, vol. 26, p. 3286, jan 2018.
188
BIBLIOGRAPHY
[118] S. Pancharatnam, “Achromatic combinations of birefringent plates,” in Pro-

ceedings of the Indian Academy of Sciences-Section A, vol. 41, pp. 137–144,
Springer, 1955.
[119] K. Fradkin et al., “Tunable midinfrared source by difference frequency gener-

ation in bulk periodically poled ktiopo4,” Applied Physics Letters, vol. 74,
no. 7, pp. 914–916, 1999.
[120] F. König and F. N. C. Wong, “Extended phase matching of second-harmonic

generation in periodically poled ktiopo4 with zero group-velocity mis-
match,” Applied Physics Letters, vol. 84, no. 10, pp. 1644–1646, 2004.
[121] R. Yehia, E. Diamanti, and I. Kerenidis, “Composable security for multi-

partite entanglement verification,” Physical Review A, vol. 103, no. 5,
p. 052609, 2021.
[122] A. Unnikrishnan, I. J. MacFarlane, R. Yi, E. Diamanti, D. Markham, and

I. Kerenidis, “Anonymity for practical quantum networks,” Physical re-
view letters, vol. 122, no. 24, p. 240501, 2019.
[123] A. Zeilinger, M. A. Horne, H. Weinfurter, and M. Żukowski, “Three-particle

entanglements from two entangled pairs,” Phys. Rev. Lett., vol. 78,
pp. 3031–3034, 1997.
[124] F. Bouchard, A. Sit, Y. Zhang, R. Fickler, F. M. Miatto, Y. Yao, F. Sciarrino,

and E. Karimi, “Two-photon interference: the hong–ou–mandel effect,”
Reports on Progress in Physics, vol. 84, no. 1, p. 012402, 2020.
[125] H. E. Guilbert, Y.-P. Wong, and D. J. Gauthier, “Observation of elliptical

rings in type-i spontaneous parametric down-conversion,” Journal of the
Optical Society of America B, vol. 32, p. 2096, oct 2015.
[126] M. Smania, Photonic multipartite entanglement : Generation, measurement

and applications.
PhD thesis, Stockholm University, Department of Physics, 2020.
189
BIBLIOGRAPHY
[127] H. Anwer, Photonic Multipartite Communication: Complexity, measurements

and Bell inequalities.
PhD thesis, Department of Physics, Stockholm University, 2021.
[128] R.-B. Jin, M. Takeoka, U. Takagi, R. Shimizu, and M. Sasaki, “Highly effi-
cient entanglement swapping and teleportation at telecom wavelength,”
Scientific Reports, vol. 5, mar 2015.
[129] A. Broadbent and C. Schaffner, “Quantum cryptography beyond quantum

key distribution,” Designs, Codes and Cryptography, vol. 78, pp. 351–382,
2016.
[130] M. Blum, “Coin flipping by telephone a protocol for solving impossible prob-
lems,” SIGACT News, vol. 15, p. 23–27, jan 1983.
[131] O. Goldreich, S. Micali, and A. Wigderson, “How to play any mental game,”
Proceedings of the Nineteenth Annual ACM Symposium on Theory of
Computing, p. 218–229, 1987.
[132] D. Alistarh, J. Aspnes, V. King, and J. Saia, “Communication-efficient ran-

domized consensus,” Distrib. Comput., vol. 31, no. 6, pp. 489–501, 2018.
[133] R. Cleve, “Limits on the security of coin flips when half the processors are
faulty,” Proceedings of the Eighteenth Annual ACM Symposium on Theory
of Computing, p. 364–369, 1986.
[134] A. Ambainis, “A new protocol and lower bounds for quantum coin flipping,”
Journal of Computer and System Sciences, vol. 68, no. 2, pp. 398–416,
2004.
[135] G. Berlin, G. Brassard, F. Bussieres, and N. Godbout, “Fair loss-tolerant

quantum coin flipping,” Phys. Rev. A, vol. 80, p. 062321, 2009.
[136] A. Kitaev, “Quantum coin flipping,” 6th Workshop on Quantum Information

Processing, 2003.
[137] C. Mochon, “Quantum weak coin flipping with arbitrarily small bias,” arXiv,
vol. 0711.4114, 2007.
190
BIBLIOGRAPHY
[138] D. Aharonov, A. Chailloux, M. Ganz, I. Kerenidis, and L. Magnin, “A simpler

proof of the existence of quantum weak coin flipping with arbitrarily
small bias,” SIAM J. Comput., vol. 45, no. 3, pp. 633–679, 2016.
[139] A. Chailloux and I. Kerenidis, “Optimal quantum strong coin flipping,” Pro-
ceedings of the 2009 50th Annual IEEE Symposium on Foundations of
Computer Science, p. 527–533, 2009.
[140] A. Chailloux and I. Kerenidis, “Optimal bounds for quantum bit commitment,”
Proceedings of the 2011 IEEE 52nd Annual Symposium on Foundations
of Computer Science, p. 354–362, 2011.
[141] G. Molina-Terriza, A. Vaziri, R. Ursin, and A. Zeilinger, “Experimental quan-

tum coin tossing,” Phys. Rev. Lett., vol. 94, p. 040501, Jan 2005.
[142] G. Berlín, G. Brassard, F. Bussières, N. Godbout, J. A. Slater, and W. Tittel,

“Experimental loss-tolerant quantum coin flipping,” Nat. Commun., vol. 2,
p. 561, 2011.
[143] A. Pappa, P. Jouguet, T. Lawson, A. Chailloux, M. Legré, P. Trinkler, I. Kereni-

dis, and E. Diamanti, “Experimental plug and play quantum coin flipping,”
Nat. Commun., vol. 5, p. 3717, 2014.
[144] L. Hardy and A. Kent, “Cheat sensitive quantum bit commitment,” Phys.
Rev. Lett., vol. 92, p. 157901, Apr 2004.
[145] R. W. Spekkens and T. Rudolph, “Quantum protocol for cheat-sensitive weak

coin flipping,” Phys. Rev. Lett., vol. 89, p. 227901, Nov 2002.
[146] L. You, “Superconducting nanowire single-photon detectors for quantum

information,” Nanophotonics, vol. 9, no. 9, pp. 2673–2692, 2020.
[147] S. Steinhauer, S. Gyger, and V. Zwiller, “Progress on large-scale superconduct-

ing nanowire single-photon detectors,” Applied Physics Letters, vol. 118,
no. 10, p. 100501, 2021.
191
BIBLIOGRAPHY
[148] A. Pickston, F. Graffitti, P. Barrow, C. L. Morrison, J. Ho, A. M. Brańczyk,

and A. Fedrizzi, “Optimised domain-engineered crystals for pure telecom
photon sources,” Optics Express, vol. 29, no. 5, pp. 6991–7002, 2021.
[149] L. Stasi, P. Caspar, T. Brydges, H. Zbinden, F. Bussières, and R. Thew,

“Enhanced heralded single-photon source with a photon-number-resolving
parallel superconducting nanowire single-photon detector,” arXiv preprint
arXiv:2210.16005, 2022.
[150] L. K. Shalm, Y. Zhang, J. C. Bienfang, C. Schlager, M. J. Stevens, M. D.

Mazurek, C. Abellán, W. Amaya, M. W. Mitchell, M. A. Alhejji, et al.,
“Device-independent randomness expansion with entangled photons,”
Nature Physics, vol. 17, no. 4, pp. 452–456, 2021.
[151] C. Clivati, A. Meda, S. Donadello, S. Virzì, M. Genovese, F. Levi, A. Mura,

M. Pittaluga, Z. Yuan, A. J. Shields, M. Lucamarini, I. P. Degiovanni, and
D. Calonico, “Coherent phase transfer for real-world twin-field quantum
key distribution,” Nat. Commun., vol. 13, jan 2022.
[152] J.-P. Chen, C. Zhang, Y. Liu, C. Jiang, W. Zhang, X.-L. Hu, J.-Y. Guan, Z.-
W. Yu, H. Xu, J. Lin, M.-J. Li, H. Chen, H. Li, L. You, Z. Wang, X.-B.
Wang, Q. Zhang, and J.-W. Pan, “Sending-or-not-sending with indepen-
dent lasers: Secure twin-field quantum key distribution over 509 km,”
Phys. Rev. Lett., vol. 124, p. 070501, Feb 2020.
[153] C. A. Miller, “The impossibility of efficient quantum weak coin flipping,” in

Proceedings of the 52nd Annual ACM SIGACT Symposium on Theory of
Computing, pp. 916–929, 2020.
[154] M. Nielsen and I. Chuang, Quantum Computation and Quantum Informa-

tion.
Cambridge University Press, 2000.
[155] N. Lütkenhaus, J. Calsamiglia, and K.-A. Suominen, “Bell measurements for

teleportation,” Physical Review A, vol. 59, pp. 3295–3300, May 1999.
192
BIBLIOGRAPHY
[156] A. Jamiołkowski, “Linear transformations which preserve trace and positive

semidefiniteness of operators,” Reports on Mathematical Physics, vol. 3,
pp. 275–278, Dec. 1972.
[157] M.-D. Choi, “Completely positive linear maps on complex matrices,” Linear
Algebra and its Applications, vol. 10, pp. 285–290, June 1975.
[158] I. Šupić and J. Bowles, “Self-testing of quantum systems: a review,” Quantum,

vol. 4, p. 337, Sept. 2020.
[159] A. Acín, N. Brunner, N. Gisin, S. Massar, S. Pironio, and V. Scarani, “Device-

Independent Security of Quantum Cryptography against Collective At-
tacks,” Physical Review Letters, vol. 98, p. 230501, June 2007.
[160] R. Colbeck, “Quantum And Relativistic Protocols For Secure Multi-Party

Computation,” arXiv:0911.3814 [quant-ph], Feb. 2011.
[161] D. Mayers and A. Yao, “Quantum cryptography with imperfect apparatus,”

in Proceedings 39th Annual Symposium on Foundations of Computer
Science (Cat. No.98CB36280), pp. 503–509, Nov. 1998.
[162] A. Unnikrishnan, Enforcing trust in quantum networks.

PhD thesis, University of Oxford, University of Oxford, 2019.
[163] J. Calsamiglia and N. Lütkenhaus, “Maximum efficiency of a linear-optical

bell-state analyzer,” Applied Physics B, vol. 72, no. 1, pp. 67–71, 2001.
[164] D. Mayers and A. Yao, “Self testing quantum apparatus,” QIC, vol. 4, pp. 273–
286, jul 2004.
[165] S. J. Summers and R. Werner, “Maximal violation of bell’s inequalities

is generic in quantum field theory,” Communications in Mathematical
Physics, vol. 110, no. 2, pp. 247–259, 1987.
[166] S. L. Braunstein, A. Mann, and M. Revzen, “Maximal violation of bell inequal-

ities for mixed states,” Physical Review Letters, vol. 68, no. 22, p. 3259,
1992.
193
BIBLIOGRAPHY
[167] B. S. Tsirelson, “Some results and problems on quantum bell-type inequali-

ties,” Hadronic Journal Supplement, vol. 8, no. 4, pp. 329–345, 1993.
[168] S. Popescu, “Bell’s inequalities and density matrices: revealing “hidden”

nonlocality,” Physical Review Letters, vol. 74, no. 14, p. 2619, 1995.
[169] M. McKague, “Self-testing graph states,” in Conference on Quantum Compu-

tation, Communication, and Cryptography, pp. 104–120, Springer, 2011.
[170] M. McKague, T. H. Yang, and V. Scarani, “Robust self-testing of the singlet,”

Journal of Physics A: Mathematical and Theoretical, vol. 45, no. 45,
p. 455304, 2012.
[171] X. Wu, Y. Cai, T. H. Yang, H. N. Le, J.-D. Bancal, and V. Scarani, “Robust
self-testing of the three-qubit w state,” Physical Review A, vol. 90, no. 4,
p. 042339, 2014.
[172] C. Bamps and S. Pironio, “Sum-of-squares decompositions for a family of

clauser-horne-shimony-holt-like inequalities and their application to self-
testing,” Physical Review A, vol. 91, no. 5, p. 052111, 2015.
[173] I. Šupić, R. Augusiak, A. Salavrakos, and A. Acín, “Self-testing protocols

based on the chained bell inequalities,” New Journal of Physics, vol. 18,
no. 3, p. 035013, 2016.
[174] I. Šupić and M. J. Hoban, “Self-testing through epr-steering,” New Journal

of Physics, vol. 18, no. 7, p. 075006, 2016.
[175] E. G. Cavalcanti, S. J. Jones, H. M. Wiseman, and M. D. Reid, “Experimental

criteria for steering and the einstein-podolsky-rosen paradox,” Physical
Review A, vol. 80, no. 3, p. 032112, 2009.
[176] T. H. Yang and M. Navascués, “Robust self-testing of unknown quantum

systems into any entangled two-qubit states,” Physical Review A, vol. 87,
no. 5, p. 050102, 2013.
194
BIBLIOGRAPHY
[177] A. Coladangelo, K. T. Goh, and V. Scarani, “All pure bipartite entangled

states can be self-tested,” Nature communications, vol. 8, no. 1, pp. 1–5,
2017.
[178] I. Šupić, A. Coladangelo, R. Augusiak, and A. Acín, “Self-testing multipartite

entangled states through projections onto two systems,” New journal of
Physics, vol. 20, no. 8, p. 083041, 2018.
[179] I. Bongioanni, L. Sansoni, F. Sciarrino, G. Vallone, and P. Mataloni, “Ex-

perimental quantum process tomography of non-trace-preserving maps,”
Physical Review A, vol. 82, no. 4, p. 042307, 2010.
[180] S. Thomas, M. Billard, N. Coste, S. Wein, H. Ollivier, O. Krebs, L. Tazaïrt,

A. Harouri, A. Lemaitre, I. Sagnes, et al., “Bright polarized single-photon
source based on a linear dipole,” Physical review letters, vol. 126, no. 23,
p. 233601, 2021.
[181] A. Auffèves, “Quantum technologies need a quantum energy initiative,” PRX

Quantum, vol. 3, no. 2, p. 020101, 2022.
[182] A. Dimić, I. Šupić, and B. Dakić, “Sample-efficient device-independent quan-

tum state verification and certification,” arXiv preprint arXiv:2105.05832,
2021.
[183] J. A. Smolin, J. M. Gambetta, and G. Smith, “Efficient method for comput-

ing the maximum-likelihood quantum state from measurements with
additive gaussian noise,” Physical Review Letters, vol. 108, feb 2012.
[184] B. Qi, Z. Hou, L. Li, D. Dong, G. Xiang, and G. Guo, “Quantum state tomog-
raphy via linear regression estimation,” Scientific Reports, vol. 3, dec
2013.
[185] D. Orsucci, J.-D. Bancal, N. Sangouard, and P. Sekatski, “How post-selection

affects device-independent claims under the fair sampling assumption,”
Quantum, vol. 4, p. 238, Mar. 2020.
195
Network Protocols
he security of modern communication networks can be
T enhanced thanks to the laws of quantum mechanics. In

this way, important tasks such as encryption key distri-
bution, anonymous transmissions or electronic voting can be
made secure without computational assumptions. In this thesis,
we developed a source of photonic quantum states which we use
Doctoral Thesis
to demonstrate important cryptographic primitives, namely
quantum weak coin flipping, and the certified transmission of
quantum information through an untrusted and lossy quan-
tum channel. Our source produces photon-pairs at telecom
wavelengths, with high heralding efficiency and closeness to a
maximally-entangled state. Pairs are used as heralded single-
photons to perform the first implementation of a quantum weak
coin flipping protocol, allowing two distant players to decide of
a random winner. Using quantum resources allows to enforce
information-theoretic security and cheat-sensitivity. Cheating
players are detected in a verification step, which involves a care-
fully optimized linear optical interferometer including beam
splitters with variable reflectivities and a fast optical switch.
We demonstrate high values of our protocol benchmarks for
attenuations corresponding to several kilometers of telecom
optical fiber. Alternatively, photon-pairs are used as maximally-
entangled qubits to certify the transmission of a single qubit
through an untrusted and lossy quantum channel. We provide
a whole new protocol, based on the already-known self-testing
technique and new fundamental results on lossy quantum
channels. We demonstrate that protocol using photon-pairs
entangled in polarization to probe the channel. We show it
allows the certification of quantum communication for a large
amount of losses induced by the channel. Finally, we provide
a novel design in order to adapt this source to multipartite
entanglement generation, enabling the implementation of new
protocols involving more than two players.
Thèse défendue le 2 décembre 2022 à Sorbonne Université, Paris, France.

Simon Neves - Thesis

Uploaded by

Copyright:

Available Formats

Simon Neves - Thesis

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Simon Neves - Thesis

Uploaded by

Copyright:

Available Formats

Photonic Resources for the Implementation of Quantum

To cite this version:

HAL Id: tel-04026239

HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est

Thèse de Doctorat de Sorbonne Université.

Thèse présentée et soutenue à Paris le 2 décembre 2022,

M. Nicolas Brunner: Rapporteur, M. Jean-Marc Merolla: Examinateur,

Formerly scientist at the French national research agency (CNRS) and

Previously shaping the laser light to investigate how it interacts with

Imprimé à Sorbonne Université, Paris, France.

he security of modern communication networks can be enhanced thanks

T to the laws of quantum mechanics. In this way, important tasks such as

Our source produces photon-pairs via spontaneous parametric down-conversion

Finally, we provide a new protocol for certifying the transmission of an unmea-

a sécurité des réseaux modernes de communication peut être renforcée grâce

L aux lois de la mécanique quantique, permettant d’effectuer sans hypothèse

L soutien de nombreuses personnes. Je m’appliquerai ici à les mentionner

Tout d’abord, j’aimerais exprimer ma plus sincère gratitude à ma directrice

J’aimerais ensuite remercier toutes les personnes que j’ai eu l’honneur de

APD Avalanche photo-diode

|ψ〉 State vector, or ket

3 Source of Entangled-Photon Pairs 37

3.2 State of the Art . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

4 Quantum Weak Coin Flipping with a Single Photon 69

5 Theory of Probabilistic Quantum Channels 91

5.1 Preliminary Notions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92

6 Certified Quantum Transmission via Bell Theorem 105

A Quantum State Tomography 139

B Sagnac Source Alignment 143

C Quantum Weak Coin Flipping: Predictions 149

C.1 Photon Propagation in the Interferometer . . . . . . . . . . . . . . . 149

D Security for Quantum Channel Certification 157

— An Pierlé, Certain Days.

he ongoing development of modern communication technologies allows

The security of current cryptographic primitives generally relies on so-called

If the existence of quantum systems has threatened the security of classical

improvement of these photonic resources, together with the rising enthusiasm

1.1 Thesis Outline

Chapter 4 presents the first implementation of a cheat-sensitive weak coin flip-

Chapter 5 develops some important fundamental results of quantum channels.

Chapter 6 builds a protocol for certified quantum communication through an

• [49] Experimental cheat-sensitive quantum weak coin flipping,

• Experimental Certification of Quantum Transmissions via Bell Theorem,

• [50] Quantum City: a Realistic Metropolitan Quantum Network Architecture,

W First we go through the basic mathematical framework of quantum

2.1 Mathematical Framework

2.1.1 Quantum State

P(ψ → φ) = |〈φ|ψ〉|2 . (2.1)

The specific case φ = ψ imposes any quantum state to be normalized, 〈ψ|ψ〉 = 1.

In general, a density operator is a Hermitian, nonnegative and normalized operator

In particular, P (ρ ) = 1 when ρ 2 = ρ = |ψ〉〈ψ| such that the system is in a pure state

2.1.2 Quantum Measurements

Â ∈ L (H ), the eigenvalues {a m } of which give the possible outcomes when measur-

P(a m |ψ) = 〈ψ|P̂ m |ψ〉 for a pure state, (2.6)

The expectation value of observable A therefore reads:

〈A 〉ψ = 〈ψ| Â |ψ〉 for a pure state, (2.8)

General Measurements - Although projective measurements are the most intu-

Such a set is known as a Positive Operator-Valued Measurement (POVM). In that

2.1.3 The Quantum Bit