You are an expert at summarizing long articles. Proceed to summarize the following text: 
quantum cryptography key distribution ( qckd ) is at the moment the most advanced and challenging application of quantum information . qckd offers the possibility that two remote parties , sender and receiver ( conventionally called alice and bob ) , can exchange a secret random key , called sifted key ( string of qubits ) , to implement a secure encryption / decryption algorithm based on a shared secret key , without the need that the two parties meet .    in practical qckd , alice and bob use a quantum channel , along which sequences of signals are either sent or measured at random between different bases of orthogonal quantum states . alice can play the role of either setting randomly the polarization basis of photons and sending them to bob ( faint laser pulses as photon source ) , or measuring photons randomly in any one of the selected bases ( entangled photon source ) . bob , randomly and independently from alice , measures in one of the bases . the sifted key consists of the subset of measurements performed when alice s and bob s bases are in an agreed configuration according to the protocol used , obtaining at this point a deterministic outcome whose security relies on the laws of quantum physics , for they previously agreed upon the correspondence between counting a photon in a specific state and the bit values 0 or 1 . in contrast , the security of conventional cryptography relies upon the unproven difficulty in factorizing large numbers into prime numbers by a conventional algorithm . we note that there is no guarantee that such an algorithm does not exist .    the underlying feature of qckd , namely the reliance of the security of the distributed secret key on the laws of quantum physics , gives it an advantage over the public key cryptography . in other words , the uncertainty principle prohibits one from gaining information from a quantum channel without disturbing it . basically , qckd is founded on the principle that when a third party ( eve ) performs a measurement on a qubit exchanged , she induces a perturbation , yielding errors in the bit sequence transmitted , revealing her presence . any attempt by eve to obtain information about the key leads to a nonzero error rate in the generated sifted key . nevertheless this last claim must be somewhat softened because of practical realization of quantum channels @xcite . unfortunately , in practical systems , errors also happen because of experimental leakage , like losses in optics , detection , electronics and noise . also , even when no eavesdropper is disturbing the bit exchange , there will be errors in the transmission and alice s and bob s strings will not coincide perfectly . thus in practice there is no way to distinguish an eavesdropper attack from experimental imperfections , making it necessary to establish an upper bound on tolerable experimental imperfections in the realization of the quantum channels to implement an error correction procedure . following the first proposal by bennett and brassard and later the ekert protocol invoking entangled states @xcite , various systems of qckd have been implemented and tested by groups around the world . recently some research groups @xcite performed the first qckd experiments based on polarization - entangled photon pairs , and brassard _ et al_. @xcite proved theoretically that qckd schemes based on spontaneous parametric down - conversion ( spdc ) offer enhanced performance , mostly in terms of security , compared to qckd based on weak coherent pulses . entangled photons , generated by spdc in nonlinear crystals , have proved largely successful for quantum optical communication @xcite and quantum radiometry @xcite . furthermore , basic experimental tests of the foundation of quantum mechanics had been performed by exploiting the entanglement of this source @xcite . however , quantum noise in a spdc quantum state may significantly limit performance of the proposed quantum optical communication and information technologies .    in this paper we provide a general model for an _ a priori _ evaluation of some crucial parameters of a general qckd scheme based on polarization entangled photons . we basically adopt the formalism of quantum operations @xcite to describe the dynamics of an open quantum system subject either to the interactions with the environment or to a quantum device performing a measurement on it . these unwanted or induced interactions show up as noise in quantum - information processing systems , degrading their ideal performance . exploiting the quantum - operation formalism we present a model to quantify precisely both quantum and ultimately statistical noise in quantum - information experiments performed using an entangled photon source .    in section ii we consider quantum noise in a lossless measurement system where noise is due to the coupling between the polarization mode of the source with the polarizing beam splitter ports . in section iii we discuss the case of a lossy system , where noise is induced by detection deficiencies , such as losses of correlated photons from the presence of optical elements , non - ideal detectors , and electronic devices in either channel , and detector dark - counts . the model concludes with the calculation of an overall probability of total coincidence counts , including an imperfect time - correlation measurement , ultimately yielding an estimate of accidental coincidences ( section iv ) .    this result is used in the calculation of the quantum bit error rate ( qber ) for qckd protocols , i.e. , bb84 and the two variants of the ekert s protocol , based on chsh and wigner s inequalities respectively ( section v ) . previsions are also presented about the sifted and the corrected key , the quantum - bit error rate ( qber ) before and after a standard error correction procedure . finally we evaluate the performance of security criteria for ekert s protocols based on both the chsh inequality and wigner s inequality ( section vi ) . in this section we consider a real either non - maximally entangled or partially mixed state resulting from both imperfect entangled state generation by spdc and imperfect polarization state selection by real polarizing beam splitters ( pbss ) .        in fig . 1 we depict the typical scheme for quantum cryptography key distribution as implemented using entangled photons generated by spdc . because of a nonlinear interaction in a @xmath0 crystal , some pump photons ( angular frequency @xmath1 ) spontaneously split into a lower - frequency pair of photons , historically called signal and idler , perfectly correlated in all aspects of their state ( direction , energy , polarization , under the constraints of conservation of energy and wavevector momentum , otherwise known as phase - matching)@xmath2 these entangled states show perfect correlation for polarization measured along orthogonal but arbitrary axes . the qckd performed by pure entangled states relies on the realization of two quantum correlated optical channels . these channels yield single - photon polarization states , such that whenever alice performs a polarization measurement on a photon of the pair , automatically the other photon is projected in a defined polarization state , i.e. , alice plays the role of triggering bob s measurement . in actuality , the light field emerging from the output of the nonlinear crystal is a polarization - entangled multimode state . however , it can be described as a polarization entangled two - photon state in only two effective modes ( one for channel @xmath3 and the other for channel @xmath4 ) , as signal and idler pairs can be easily emitted non - collinearly with the pump by proper phase - matching rules @xcite . this scheme eventually is exploited in quantum information applications by using one channel as the trigger or reference ( @xmath3 ) and the other channel as the probe ( @xmath4 ) . according to fig . 1 , we denote alice s detector apparatus to be the trigger and bob s to be the probe . alice and bob detection apparatus consist of polarization - analyzer systems ( pas ) for proper single - beam polarization rotation , polarizing beam splitters ( pbs ) , photon detectors ( @xmath5 ) , data storage systems ( computers ) and synchronization systems . let us consider in the following type ii spdc entangled states @xcite , where the output two - photon states are a quantum superposition of orthogonally polarized photons , i.e. the singlet state @xcite : @xmath6    practically , pure entanglement may not be achieved because of imperfect source generation and because of incomplete entangled photon collection . according to refs . @xcite an uncompensated for coherence loss , induced in the state by the coupling between polarization and frequency modes because of a birefringent environment , may produce a partially mixed or non - maximally entangled state . also the collection of the same number of entangled photons on both channels is unlikely , mostly due to the imperfect positioning of the detection systems along the true directions of entangled photons on the spdc cones . two complex variables , @xmath7  ( @xmath8 ) and @xmath9 , characterize the imperfect compensation of dephasing and decoherence in the crystal and the misalignment in collecting entangled photons in the optical paths , respectevely . the net result is a non - maximally entangled , or partially mixed state , written as @xmath10 .\end{aligned}\ ] ] we analyze now the quantum noise introduced via an imperfect polarization state selection by the pbss depicted in fig . 1 . here , the entangled photons are detected accordingly to their polarizations by using imperfect polarizing beam splitters ( pbss ) on both arms and perfect single - photon detectors . the pbss project photons onto a polarization basis @xmath11 while the polarization analyzer systems ( pass ) induce the transformations represented by the unitary operators @xmath12 in each arm ( @xmath13 ) , according to @xmath14    in the case of ideal pbss , channel @xmath15 transmits state @xmath16 ( @xmath17 ) and reflects state @xmath18 ( @xmath19 ) , i.e. , there is a perfect coupling between the output ports of the pbss and the projections of the photon polarization state . in the approach so far adopted in the literature a perfect coupling is always assumed because the measurement process is considered as a projection on polarization states @xmath20 @xmath18,@xmath21 @xmath22 thus assuming detectors @xmath23 are sensitive to polarization@xmath2 here we consider a further noise effect induced by the presence of real pbss , where a small part of the photons projected onto @xmath24 @xmath25 are erroneously transmitted , and some photons projected in the state @xmath26 @xmath27 are erroneously reflected ( generally less than 2 % and 5 % , respectively ) , as shown in fig . 2 . for this purpose , we extend the hilbert space to describe these photon states as @xmath28 where @xmath29 represents the photon crossing the output port of the pbs towards detector @xmath30 and @xmath31 represents the photon crossing the input port of the pbs , with @xmath32 . @xmath33 is the transmittance of photons in the @xmath34 polarization state , and @xmath35  @xmath36 is the corresponding reflectance , whose phase relation is @xmath37 . analogously , @xmath38 and @xmath39 are the transmittance and reflectance of photons in the @xmath40 state . so far , we have considered only lossless pbss . the effect of photon losses due to all optical devices used in the channels are treated in sections iii and iv .     polarized state should be reflected , but some of these are wrongly transmitted . moreover all photons projected in @xmath41 polarized state should be transmitted , but some of these are erroneously reflected . , width=8,height=5 ]    we define the input density matrix for the pbs ports as @xmath42 and the total input density matrix @xmath43 of the photon system as @xmath44    the formalism of quantum operation is the most suitable to describe the evolution of a quantum system coupled with another quantum system or with the environment , as well as the evolution of a quantum system subject to measurement @xcite . in this context , we consider the set of non - trace - preserving quantum operations @xmath45 defined as @xmath46 describing the process of detection of the photon pair by the detectors @xmath47 and @xmath48 ( @xmath49 ) . in this expression , the unitary operator @xmath50 describes the action of the pass and the unitary transformation @xmath51 describes the coupling between the photon pair polarization state and the pbs ports . the explicit form of @xmath51 is deduced by eq.s ( [ eq5 ] ) , and calculations are reported in appendix a. because the operators @xmath52 and @xmath53 independently act on the corresponding subspaces @xmath3 and @xmath4 of the hilbert space of polarization and induce linear transformation , they are ineffective on the hilbert space of the pbs ports . thus , @xmath54 is subject to a global transformation written as an unitary operator @xmath55 where  @xmath56    @xmath57 is the projector representing the detection process by the two detectors @xmath58 and @xmath59 the probability of detection of the photon pair by the detectors @xmath47 and @xmath48 is    @xmath60 =   \notag \\ & = & \text{tr}\left ( \widehat{p}_{x_{a}y_{b}}\widehat{u}_{\psi \text{-pbs}}% \widehat{s}_{\psi } \widehat{\rho } ^{\text{in}}\widehat{s}_{\psi } ^{\dagger } % \widehat{u}_{\psi \text{-pbs}}^{\dagger } \widehat{p}_{x_{a}y_{b}}^{\dagger } \right ) . \label{eqste}\end{aligned}\ ] ]    @xmath61 is trace - preserving because the probabilities of the distinct outcomes sum to one , i.e. , tr@xmath62 = \sum_{x_{a}y_{b}}p(x_{a},y_{b})=1 $ ] for all possible input @xmath63 in the following we consider the noise contribution to the photon counts because of an imperfect collection of photons and a noisy and lossy detection system . for the experimental setup in fig . 1 , we calculate the total probability @xmath64 of @xmath65 counts by any detector @xmath30 by separately calculating the probabilities of counts associated with correlated photons ( @xmath66 ) , with uncorrelated photons ( @xmath67 ) , and with detector dark counts ( @xmath68 ) .    to describe the counting process we adopt the formalism of quantum operations , where we consider a general density matrix representing photons on a channel @xmath69 in term of number of photons , i.e. @xmath70 as @xmath71 the evolution of the system @xmath72 is evaluated according to the formalism of quantum operations .    in this way , we define the set of non - trace - preserving quantum operations as @xmath73 as @xmath74 which describes the detection of @xmath75 photons by the system @xmath76 . in this expression the unitary operator @xmath77 represents the interaction between the quantum system q@xmath78 of photons in the channel @xmath79 in the initial state @xmath80 and the lossy and noisy environment e@xmath81 in the initial state  @xmath82 . the action of @xmath83 on the state `` number of photons '' is @xmath84 where @xmath85 is the probability of measuring @xmath75 photons out of @xmath65 present in the channel @xmath79 because of losses . @xmath86 are the measurement operators . thus , the probability of measuring @xmath75 counts by the detection system @xmath76 is @xmath87 = \sum_{n = m}^{\infty } \rho _ { \,nn}^{\nu } \left| d^{\mu } ( m , n)\right| ^{2 }   \label{pisp}\ ] ] where @xmath88 is the probability of having @xmath65 photons on the channel @xmath69 .      in the following we concentrate primarily on the measurement of correlated photons by a lossy detector , @xmath30 . we define the density matrix of the number of photon pairs , @xmath89 , as @xmath90 analogous to eq . ( [ rhopi ] ) , we write a density matrix of single photons of the pairs ( sp ) along channel @xmath15 : @xmath91    the counting of correlated photons on channel @xmath15 by the detector @xmath30 is described by mapping @xmath92 on the set of non - trace - preserving quantum operation @xmath93 . the explicit form of @xmath94 is deduced by analogy to eq . ( [ exz ] ) , by replacing the interaction unitary operator with @xmath95 and the measurement operator with @xmath96 , given that q@xmath97 is the quantum system of single photons of the pair on the channel @xmath15 and e@xmath98 is the lossy and noisy environment in the initial state  @xmath99 . the @xmath100 action on the state @xmath101 is completely described by means of coefficients @xmath102 in complete analogy with eq . ( [ uxz ] ) , while we have @xmath103 . the probability of @xmath75 counts by the detector @xmath30 corresponding to correlated photons becomes @xmath104 the probability of @xmath65 pairs is given by @xmath105 @xmath106 being the time of measurement and @xmath107 the mean rate of photon pairs in the alice and bob channels @xcite . the terms @xmath108 ^{m } \\ & & \left [ 1-\xi _ { x_{a}}\sum_{y_{b}}p(x_{a},y_{b})\right ] ^{n - m } , \\ \left| d^{sp , y_{b}}(m , n)\right| ^{2 } & = & \left ( \begin{array}{c } n \\ m \end{array } \right ) \left [ \xi _ { y_{b}}\sum_{x_{a}}p(x_{a},y_{b})\right ] ^{m } \\ & & \left [ 1-\xi _ { y_{b}}\sum_{x_{a}}p(x_{a},y_{b})\right ] ^{n - m}.\end{aligned}\ ] ] are the probabilities that only @xmath75 out of @xmath65 photons in the channel @xmath3 ( @xmath4 ) are counted by the detector @xmath47 ( @xmath48 ) . losses due to electronics ( @xmath109 ) , detection efficiencies ( @xmath110 ) , as well as optical losses ( @xmath111 ) are summed up in the term @xmath112 @xcite@xmath113 while we refer to the appendix b for the analysis of dead time in this context . the term @xmath114 incorporates all losses in the alice and bob optical path , such as from crystals , filters , lenses , pbss , pass and fibers . the terms @xmath115 are the probability that each photon of the pair may be counted randomly by any arbitrary detector ( eq . [ eqste ] ) . probability @xmath116 is derived according to eq . ( [ pisp ] ) , giving @xmath117 with mean count rates given by @xmath118      here we consider counts from any detector @xmath30 from stray light , uncorrelated photons , and dark counts eventually contributing to noise in the distributed key . the density matrix associated with stray light and uncorrelated photons is @xmath119 by pursuing the same formalism as before the detection of uncorrelated photons by the detector @xmath30 is described by means of the set of non - trace - preserving quantum operation @xmath120 the map @xmath121 follows in analogy with eq . ( [ exz ] ) . the unitary operator @xmath122 describes the interaction between the quantum system , q@xmath123 , of uncorrelated photons on the channel @xmath30 and the lossy environment , e@xmath123 , in the initial state  @xmath124 . the measurement operator is @xmath125 the action of @xmath126 on the state @xmath127 follows from eq . ( [ uxz ] ) with the decomposition coefficients , @xmath128 . thus , the probability of measuring @xmath75 counts of uncorrelated photons by the detector @xmath30 is @xmath129 where @xmath130 is the probability of @xmath65 uncorrelated photons in the channel @xmath30 . according to refs . @xcite , we assume that we have @xmath131 where @xmath132 is the mean rate of uncorrelated photons . the term @xmath133 is the probability of @xmath75 out of @xmath65 uncorrelated photons counted by the detector @xmath30 . the @xmath67 derived accordingly from eq . ( [ piu ] ) is @xmath134    the main source of noise in detectors is due to dark counts , whose distribution is regarded merely from a statistical point of view as the probability of @xmath65 dark counts @xmath135 with the mean dark - count rate being @xmath136 . as real counters can not distinguish among counts due to correlated photons , counts due to uncorrelated photons , and dark counts , the total probability of measuring @xmath137 counts by detector @xmath30 is calculated according to @xcite , @xmath138 giving @xmath139 where the mean rate of total counts measured by the detector @xmath30 is @xmath140 we build up a model for the probability @xmath141 of measuring @xmath65 coincidences by a pair of detectors @xmath47 and @xmath142 in order to estimate crucial quantities of a typical qckd experiment , such as the sifted key and the qber before and after the error correction procedure , whenever different protocols are applied . we distinguish between the probability distribution of true coincidences ( @xmath143 due to correlated photons ) and the probability distribution of accidental coincidences ( @xmath144 , because of imperfections in the detection electronics ) . we consider the density matrix in terms of counted pair states ( eq . ( [ rhopi ] ) ) , and we describe its evolution exploiting the formalism of quantum operations as described in section iv by defining another set of non - trace - preserving quantum operations @xmath145    @xmath146 describes the measurement of @xmath75 coincidences originated by the detection of the two photons of a pair by the detectors @xmath47 , @xmath142 . its explicit expression is found from eq . ( [ exz ] ) , except for the interaction between the quantum system q@xmath147 of photon pairs in the initial state @xmath89 and the lossy and noisy environment e@xmath148 in the initial state  @xmath149 represented by the unitary operator @xmath150 and the measurement operator @xmath151    the action of @xmath152 on the state `` number of photon pairs '' is @xmath153    thus , the probability of measuring @xmath75 true coincidences corresponding to photon pairs by the pair of detectors @xmath154 @xmath48 is @xmath155    realizing that a true coincidence may occur only if both photons of the pair are not lost , we emphasize that the terms @xmath156 are the probabilities that only @xmath75 pairs are detected as coincidences by the pair of detectors @xmath47 , @xmath48 when @xmath157 photons are present in the alice s and bob s channels . it is straightforward to deduce the explicit form of @xmath158 as @xmath159 ^{m } \\ & & \left [ 1-\xi _ { x_{a}}\xi _ { y_{b}}p(x_{a},y_{b})\right ] ^{n - m}.\end{aligned}\ ] ] probability @xmath160 is derived according to eq . ( [ pipi ] ) , obtaining @xmath161 where @xmath162 is the mean rate of true coincidences seen by the pair of detectors @xmath47 and @xmath142 . the presence of the temporal coincidence window@xmath163 during which coincidences are measured , modifies the mean total coincidence counts , thus forcing one to distinguish between true and accidental coincidence statistics . we assume that true coincidences occur in the middle of the coincidence temporal window . then we deduce the probability distribution of accidental coincidences and finally the probability distribution of total coincidences@xmath164 accounting for true and accidental coincidences , assuming @xmath165 , where @xmath166is the dead time in the @xmath15 channel according to appendix b.    we regard @xmath167 as the probability distribution of photons counted by the detector @xmath30 that may contribute to accidental coincidences in the time interval @xmath168 . by observing that the probability distributions @xmath64 and @xmath169 are poisson , it is simple to demonstrate that we have @xmath170 where @xmath171 , and @xmath172 are the mean count rates possibly contributing to accidental coincidences from the detectors @xmath47 and @xmath48 , respectively . let us denote by @xmath173 the probability that at least one photon in @xmath48 is counted in the coincidence window @xmath174 @xmath175 because detectors @xmath47 are here considered as triggers . the term in eq . ( [ eqq ] ) is intended to account for the contribution of single detectors @xmath48 . because detectors @xmath48 are statistically independent , the probability that both detectors count a photon producing an accidental coincidence is @xmath176 . the final probability of accidental counts from detector @xmath48 is obtained by subtracting half the probability that both detectors in bob s channel count an accidental photon , in formula @xmath177    according to @xcite , we calculate the probability distribution of accidental coincidences in the time measurement @xmath178 by  applying the discrete convolution between the poisson distribution of `` triggering '' counts and the binomial distribution with parameter @xmath179 @xmath180 with @xmath181@xmath182 giving @xmath183 with @xmath184    lastly the probability distribution of total coincidence counts @xmath185 is obtained by @xmath186 where the mean rate of total coincidence measured by an arbitrary pair of @xmath47 and @xmath142 detectors is @xmath187    to characterize a particular qckd procedure we embody the effect of the transformations @xmath52 and @xmath53 on photon polarization by the rotation matrices @xmath188 we rewrite eq . ( [ lambdac ] ) in terms of the rotation angles @xmath189 induced by transformations @xmath190 and @xmath191 on the polarization state of photons , by replacing @xmath192 with @xmath193 whose complete expression is in appendix a@xmath2 more specifically , the calculated mean coincident counts are made explicit in terms of angular settings @xmath194 and @xmath195 as @xmath196 to characterize a particular qckd procedure and to assess its advantages , we evaluate particular quantities such as the qber and the sifted key for different types of qckd protocols so far experimentally implemented , i.e. bb84 protocol and ekert s protocols based on chsh and wigner s inequalities , respectively . the qber is a parameter for describing the signal quality in the transmission of the sifted key , defined as the relative frequency of errors induced by accidental coincidences , i.e. the number of errors divided by the total size of the cryptographic sifted key ( @xmath197 ) @xcite .    in other words , the qber is given by total coincidence provided by those detectors `` wrongly '' firing in coincidence according to the chosen protocol . in fact the protocol establishes which pair of detectors should fire to contribute to the key . here we examine the bb84 protocol variant proposed for entangled states in ref . recall that alice and bob measure photons randomly and independently between two bases of orthogonal quantum states . one basis corresponds to horizontal and vertical linear polarization ( @xmath198 ) , while the other to linear polarizations rotated by 45@xmath199 ( @xmath200 ) . only half of the photon pairs can contribute to the sifted key , as only the subset of measurements performed with the two analyzers in the same basis contributes . the sifted key is given by @xmath201 t ,   \notag\end{aligned}\ ] ] where @xmath202 is the probability to measure in the right basis ( @xmath203 and @xmath204 ) , while @xmath205 is the probability to measure in a particular analyzer setting ( @xmath206 or @xmath207 ) . all detectors contribute to the sifted key @xmath197 , but only coincidences between @xmath208 and @xmath209 correspond to the expected anticorrelation when measurements are performed in the same basis ( @xmath210 ) , while qber contributions come from the coincidences between detectors @xmath211 and @xmath212 ( as it is clear from eq.s ( [ a1 ] ) in appendix a ) . therefore the qber@xmath213 explicit formula is @xmath214 t}{4 k_{\text{bb84}}(\theta _ { a})}.   \label{qber1}\ ] ]    to test the behavior of qber , we simulate a realistic experiment with parameters @xmath215 ( quantum efficiency of the four detectors)@xmath216 @xmath217 ( transmittance of the four channels)@xmath216 @xmath218 s@xmath219 ( dark count rate of the four detectors ) , @xmath220 ns ( total dead time of the alice s and bob s detection systems ) , @xmath221 and @xmath222 ns . the entanglement parameters are @xmath223 and @xmath224 the correlation level in the alice channel is @xmath225 ( @xmath226 ) , and the correlated photon rate is @xmath227khz .     and @xmath228,width=8,height=5 ]    in fig . 3 we show the dependence of qber versus the optical properties of real pbs , i.e. the transmittance @xmath229 and @xmath230 ( @xmath13 ) for the states @xmath231 and @xmath232 respectively . results show how strongly the qber can be affected by the optical properties of pbss , whose influence has been neglected so far .     and the correlated photon rate @xmath233 for two noise levels in the channels ( @xmath234 and @xmath235 , where @xmath236 and @xmath237).,width=8,height=5 ]    in fig . 4 the behavior of the qber is presented versus the level of correlation , @xmath238 , in the alice channel and the rate , @xmath107 , of the correlated photon pairs for two different noise levels , i.e. , the ratio between the mean rate of photons in the two channels . far from ideal conditions , the presence of uncorrelated events in the two channels induces a non - linear increase of the qber . the other parameters are set as in fig . 3 for realistic pbss parameters , @xmath239 and @xmath240 . ekert s protocol has the peculiarity of relying on the completeness of quantum mechanics for security . therefore , the possible combined choices between alice and bob for analyzer settings split into three groups : the first for key distribution , the second containing the security proof , and the third garnering the discarded measurements .    here we consider two possible variants of ekert s protocol : the variant based on the clauser - horne - shimony - holt inequality ( chsh ) , similar to the one proposed in ref . @xcite , and the variant based on wigner s inequality @xcite .      to increase the number of measurements devoted to the key distribution we consider the case where alice and bob measure randomly among four analyzer settings and use the chsh inequality to test eavesdropping . in this scheme , alice s choices for the analyzer settings are @xmath241 and bob s are @xmath242 . the key distribution is performed when alice and bob s settings are the same or orthogonal , so that the sifted key is @xmath243 t,\end{aligned}\ ] ] where ( @xmath244 are angular settings generating the key and @xmath245    in a maximally entangled state configuration , the detectors contributing to the key should be @xmath211 and @xmath246 for the orthogonal analyzer settings and @xmath208 and @xmath247 for the parallel settings .  thus the qber is calculated according to    @xmath248 t\right\ } , \ ] ]    where the intuitive notation @xmath249 indicates the sum over @xmath208 and @xmath247 detectors and @xmath250 indicates the sum over @xmath211 and @xmath251      as in ref . @xcite , we consider the case of the ekert s variant where the security of the quantum channels follows from wigner s inequality . in this case , alice and bob measure randomly among four analyzers settings whose choices are @xmath252 for alice and @xmath253 for bob . the key distribution is performed when alice s and bob s settings are the same so that the sifted key is @xmath254 with @xmath255    the qber is calculated according to @xmath256 t}{k_{\text{wi}}(\theta _ { a})},\ ] ] by taking the detectors contributing to the wrong bits as @xmath211 and @xmath257     and the entanglement parameter @xmath258 . the parameters settings are @xmath259 @xmath260 s@xmath261@xmath262 @xmath263 @xmath264 @xmath265 @xmath266 s@xmath219 , @xmath220 ns , @xmath222 ns and @xmath267 , taken from typical and experimental realistic values so far implemented . pbss are considered real with @xmath268 and @xmath240 ( @xmath269).,width=8,height=5 ]    in fig . 5 we present a comparison of qber levels for the bb84 protocol and the ekert protocols considering both chsh and wigner s inequality versus the analyzers angular setting @xmath270 and the entanglement parameter @xmath9 . experimental conditions are the same ( low noise ) as for figs . 3 and 4 . results highlight that the qber is sensitive to the angle @xmath271 when the ideal entanglement is not achieved for both variants of ekert s protocols . in the wigner s case , the sensitivity is so remarkable that this protocol has to be considered less robust than bb84 and the chsh based ekert s protocol . the security of the bb84 variant protocol is based on a public comparison between alice and  bob s measurements on a sufficiently large random subset of the sifted key , e.g. more than half is recommended in @xcite .    the security proof for the chsh - inequality - based ekert s protocol is evaluated with the specific choices of settings by the chsh inequality , @xmath272 where we have @xmath273 here @xmath274 is the normalized coincidence rate as a function of the analyzer settings and detector choices . the terms @xmath275 are commonly stored when experiments are performed .    for maximally entangled states we have @xmath276 , while for any realistic local theory we have @xmath277 it is expected that the presence of an eavesdropper will reduce the observed value of @xmath278 giving @xmath279 when the eavesdropper measures photons over either one or both ( total eavesdropping ) of alice s and bob s channels @xcite .    in the case of wigners - inequality - based ekert s protocol , the wigner s inequality result has @xmath280 giving for the maximally entangled states , @xmath281 and @xmath282 for any local realistic theory . as for the chsh inequality , it can be proved that the limit becomes @xmath283 for eve detecting only one photon of the pair , while in the case of total eavesdropping there is no boundary condition @xcite .     and w@xmath284 versus the coincidence window @xmath285 and the correlation level in the alice channel @xmath286 . in the case of maximally entangled states we have w@xmath287s@xmath2871 , while the lower cut is defined by the eavesdropping limit w@xmath288 and s@xmath288 . the choice of parameter values are the same of fig . 4 except for @xmath289 and @xmath290 . the lower two surfaces represented correspond to w@xmath284 and s@xmath284 in the case of real pbss , with parameters @xmath291 and @xmath292 the higher surface represents s@xmath293=w@xmath284 in the case of ideal pbss.,width=8,height=5 ]    in fig . 6 we compare the behaviors of the chsh and wigner s inequality parameters , @xmath294 = @xmath295 and @xmath296 versus the coincidence window @xmath285 and the correlation level in alice s channel , @xmath297 the lower surfaces represent the case of real pbss , where @xmath298 @xmath299 , while the upper surface corresponds to  ideal pbss , where @xmath300 @xmath301 . we observe that , given the same noise level in the system and real pbss , wigner s parameter reaches the eavesdropping limit faster than the chsh one does , revealing the intrinsic weakness of wigner s test against experimental parameters . furthermore , the wigner s security test guarantees against eavesdropping strategies only for the detection of one photon of the pair , while the chsh security is independent on the adopted strategy ( see refs . @xcite ) . a satisfactory protocol must be able to recover from noise as well as from partial leakage , allowing alice and bob to reconcile the two strings of bits measured and distill from the sifted key a corrected key . a strong need for the application of any error - correction method is an _ a priori _ knowledge of the qber , which provides information regarding how many times the error - correction procedure must be applied to reduce the qber to a certain agreed level , commonly 1 % . here , we show an example of error correction on an _ a priori _ evaluated qber according to a common approach reported in ref . @xcite , to show that our model allows for prediction of the corrected key length .    in general , alice and bob can not distinguish between errors caused either by an eavesdropper or by the environment . thus , they must assume that all errors are due to an eavesdropper and evaluate the leaked information from the qber . also , even though by the error - correction procedure one can disregard incorrect bits by simply dropping them off in building the distilled key , the residual knowledge of an eavesdropper may still not be faithfully quantified by the reduced qber obtained after the correction . the effects of eve s strategy is in fact equivalent to quantum noise yielding eventually accidental coincidences , these last contributing to both incorrect and correct bits transmitted , as it is clear from eqs . ( [ k1 ] , [ qber1 ] ) . hence the error - correction procedure is not sufficient to cancel a potential eve s knowledge of part of the key due to accidental coincidence .    to prove this last assertion we introduce the quantum accidental bit rate ( qabr ) , a quantity related to accidental coincidences and , in this sense , analogous to the qber however , the error - correction procedure can not reduce the qabr at the qber level . as an example , we give the qabr in the case of ekert s protocol based on wigner s inequality , @xmath302     and the correlation parameter in the alice channel @xmath303 : the sawtooth shape is due to the application of the error correction procedure . the parameters are set as in figure 6 except that , in this case , ideal pbss are considered . , width=8,height=5 ]    figure 7 shows the qber with and without the application of the error - correction procedure together with the 1/2 qabr vs the coincidence window and the correlation parameter in alice s channel . the error - correction procedure is very ineffective at reducing the qabr and consequently the possible effect of eve s knowledge on the corrected key . this paper is concerned with an _ a priori _ evaluation of qckd crucial parameters when entangled photons produced by spdc are exploited . the basic experimental feature consists in the detection of coincident photons . toward this aim , we developed a statistical model to calculate the probability of accidental coincidences contributing to errors in the sifted key , not completely accounted for by simple experimental means . we investigated the noise contribution due to imperfect source generation and selection , imperfect polarizing beam splitters performing polarization states analysis , and noisy and lossy measurement system for photon - number detection . we emphasized some basic system imperfections such as uncorrelated photons collection , detection system deficiencies , detection system noise due to detector dark counts , and electronic system imperfections associated with non - ideal - time - correlation measurements . we discussed how this model can be adopted for the evaluation of the qber and the sifted key for different well - known protocols , i.e. , bb84 and ekert s protocols based on both chsh and wigner s inequality , and compared them to expected results .    given that this model predicts precisely the qber and the sifted key , it ultimately guarantees a method to compare different security criteria of the hitherto proposed qckd protocols and provides an objective assessment of performances and advantages of different systems . thus , it yields a method for an _ a priori _ evaluation of the tolerable experimental imperfections in a practically implemented quantum system to establish the degree of security and competitiveness of qckd systems .    finally , we used the model in a standard error - correction procedure , observing that this does not completely cancel the possible residual eavesdropping knowledge on the corrected key . we emphasize that this model yields also the degree of security of the corrected key , if a precise modelling of system imperfections is provided .    acknowledgment . this work was developed in collaboration with elsag s.p.a . , genova ( italy ) , within a project entitled  quantum cryptographic key distribution " co - funded by the italian ministry of education , university and research ( miur ) - grant n. 67679/ l. 488 . in addition stefania castelletto acknowledges the partial support of the darpa quist program . we explicitly calculate the unitary transformation @xmath305 according to eq.s ( [ eq5 ] ) obtaining a 16@xmath30616 matrix @xmath307 where we indicate    @xmath308 ; \;\;\;\;\;u_{2}=\left [ \begin{array}{cccc } { \cal t}_{a}{\cal r}_{b } & 0 & 0 & 0 \\ 0 & { \cal t}_{a}{\cal r}_{b}^{\perp } & 0 & 0 \\ 0 & 0 & { \cal t}_{a}^{\perp } { \cal r}_{b } & 0 \\ 0 & 0 & 0 & { \cal t}_{a}^{\perp } { \cal r}_{b}^{\perp } \end{array } \right ] \\ u_{3 } & = & \left [ \begin{array}{cccc } { \cal r}_{a}{\cal t}_{b } & 0 & 0 & 0 \\ 0 & { \cal r}_{a}{\cal t}_{b}^{\perp } & 0 & 0 \\ 0 & 0 & { \cal r}_{a}^{\perp } { \cal t}_{b } & 0 \\ 0 & 0 & 0 & { \cal r}_{a}^{\perp } { \cal t}_{b}^{\perp } \end{array } \right ] ; \;\;\;\;\;\;\;\;u_{4}=\left [ \begin{array}{cccc } { \cal r}_{a}{\cal r}_{b } & 0 & 0 & 0 \\ 0 & { \cal r}_{a}{\cal r}_{b}^{\perp } & 0 & 0 \\ 0 & 0 & { \cal r}_{a}^{\perp } { \cal r}_{b } & 0 \\ 0 & 0 & 0 & { \cal r}_{a}^{\perp } { \cal r}_{b}^{\perp } \end{array } \right]\end{aligned}\ ] ]    and @xmath309 , @xmath310 @xmath311 analogously for @xmath312 and @xmath313    according to eq.s ( [ eqste ] ) and ( [ ti2 ] ) we obtain for @xmath314  the following :    @xmath315 + \\ \sin ^{2}(\theta _ { b})\left [ \begin{array}{c } \cos ^{2}(\theta _ { a})\left ( \left| \mathcal{t}_{a}\mathcal{t}_{b}\right| ^{2}+\left| \mathcal{t}_{a}^{\perp } \mathcal{t}_{b}^{\perp } \epsilon \right| ^{2}\right ) + \sin ^{2}(\theta _ { a})\left ( \left| \mathcal{t}_{a}^{\perp } \mathcal{t}% _ { b}\right| ^{2}+\left| \mathcal{t}_{a}\mathcal{t}_{b}^{\perp } \epsilon \right| ^{2}\right ) \end{array } \right ] + \\ \sin ( 2\theta _ { a})\cos ( 2\theta _ { b})\mathrm{re}(\epsilon \zeta /2)\left ( \begin{array}{c } -\left| \mathcal{t}_{a}\mathcal{t}_{b}\right| ^{2}+\left| \mathcal{t}% _ { a}^{\perp } \mathcal{t}_{b}\right| ^{2}+ \left| \mathcal{t}_{a}\mathcal{t}_{b}^{\perp } \right| ^{2}-\left| \mathcal{t}% _ { a}^{\perp } \mathcal{t}_{b}^{\perp } \right| ^{2 } \end{array } \right ) \end{array } \right\ } , \ ] ] @xmath316 + \\ \sin ^{2}(\theta _ { b})\left [ \begin{array}{c } \cos ^{2}(\theta _ { a})\left ( \left| \mathcal{t}_{a}\mathcal{r}_{b}\right| ^{2}+\left| \mathcal{t}_{a}^{\perp } \mathcal{r}_{b}^{\perp } \epsilon \right| ^{2}\right ) + \sin ^{2}(\theta _ { a})\left ( \left| \mathcal{t}_{a}^{\perp } \mathcal{r}% _ { b}\right| ^{2}+\left| \mathcal{t}_{a}\mathcal{r}_{b}^{\perp } \epsilon \right| ^{2}\right ) \end{array } \right ] + \\ \sin ( 2\theta _ { a})\cos ( 2\theta _ { b})\mathrm{re}(\epsilon \zeta /2)\left ( \begin{array}{c } -\left| \mathcal{t}_{a}\mathcal{r}_{b}\right| ^{2}+\left| \mathcal{t}% _ { a}^{\perp } \mathcal{r}_{b}\right| ^{2}+ \left| \mathcal{t}_{a}\mathcal{r}_{b}^{\perp } \right| ^{2}-\left| \mathcal{t}% _ { a}^{\perp } \mathcal{r}_{b}^{\perp } \right| ^{2 } \end{array } \right ) \end{array } \right\ } , \ ] ] @xmath317 + \\ \sin ^{2}(\theta _ { b})\left [ \begin{array}{c } \cos ^{2}(\theta _ { a})\left ( \left| \mathcal{r}_{a}\mathcal{t}_{b}\right| ^{2}+\left| \mathcal{r}_{a}^{\perp } \mathcal{t}_{b}^{\perp } \epsilon \right| ^{2}\right ) + \sin ^{2}(\theta _ { a})\left ( \left| \mathcal{r}_{a}^{\perp } \mathcal{t}% _ { b}\right| ^{2}+\left| \mathcal{r}_{a}\mathcal{t}_{b}^{\perp } \epsilon \right| ^{2}\right ) \end{array } \right ] + \\ \sin ( 2\theta _ { a})\cos ( 2\theta _ { b})\mathrm{re}(\epsilon \zeta /2)\left ( \begin{array}{c } -\left| \mathcal{r}_{a}\mathcal{t}_{b}\right| ^{2}+\left| \mathcal{r}% _ { a}^{\perp } \mathcal{t}_{b}\right| ^{2}+ \left| \mathcal{r}_{a}\mathcal{t}_{b}^{\perp } \right| ^{2}-\left| \mathcal{r}% _ { a}^{\perp } \mathcal{t}_{b}^{\perp } \right| ^{2 } \end{array } \right ) \end{array } \right\ } , \ ] ] @xmath318 + \\ \sin ^{2}(\theta _ { b})\left [ \begin{array}{c } \cos ^{2}(\theta _ { a})\left ( \left| \mathcal{r}_{a}\mathcal{r}_{b}\right| ^{2}+\left| \mathcal{r}_{a}^{\perp } \mathcal{r}_{b}^{\perp } \epsilon \right| ^{2}\right ) + \sin ^{2}(\theta _ { a})\left ( \left| \mathcal{r}_{a}^{\perp } \mathcal{r}% _ { b}\right| ^{2}+\left| \mathcal{r}_{a}\mathcal{r}_{b}^{\perp } \epsilon \right| ^{2}\right ) \end{array } \right ] + \\ \sin ( 2\theta _ { a})\cos ( 2\theta _ { b})\mathrm{re}(\epsilon \zeta /2)\left ( \begin{array}{c } -\left| \mathcal{r}_{a}\mathcal{r}_{b}\right| ^{2}+\left| \mathcal{r}% _ { a}^{\perp } \mathcal{r}_{b}\right| ^{2}+ \left| \mathcal{r}_{a}\mathcal{r}_{b}^{\perp } \right| ^{2}-\left| \mathcal{r}% _ { a}^{\perp } \mathcal{r}_{b}^{\perp } \right| ^{2 } \end{array } \right ) \end{array } \right\ } .\ ] ]    in the case of maximally entangled states , i.e. @xmath319 and @xmath320 , and ideal pbss , i.e. , @xmath321 and@xmath322 the @xmath51 is simply given by    @xmath323 ; \;\;\;\;\;\ ; u_{2}=\left [ \begin{array}{cccc } 0 & 0 & 0 & 0 \\ 0 & i & 0 & 0 \\ 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 \end{array } \right ] ; \;\;\;\;\;\ ; u_{3}=\left [ \begin{array}{cccc } 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 \\ 0 & 0 & i & 0 \\ 0 & 0 & 0 & 0 \end{array } \right ] ; \;\;\;\;\;\ ; u_{4}=\left [ \begin{array}{cccc } 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 1 \end{array } \right]\end{aligned}\ ] ]    and @xmath324 according to refs . @xcite , in the case of non - extending dead time , the correction is @xmath325 where @xmath326 are the mean number of photons counted in the @xmath15 channel , i.e. @xmath327 with @xmath328 calculated in the absence of dead time @xmath329 , and @xmath330 . we can therefore write down the dead time correction in this case as @xmath331 \,\,d_{a}\right\ } ^{-1}\ ] ] and @xmath332 \,\,d_{b}\right\ } ^{-1}\ ] ] by noting that , when several devices are used in series , a good approximation considers the whole apparatus to be a black box , with a non - extending dead time equal to the largest of dead times of the single component @xcite . we showed in ref . @xcite that @xmath333provides a satisfactory approximation for @xmath334 . 99 c. bennett and g. brassard , in _ proceedings of the ieee international conference on computers , systems and signal processing , bangalore _ , ( ieee , new york 1984 ) , p. 175 . a. k. ekert , phys . rev . lett . * 67 * , 661 ( 1991 ) . c. h. bennett , g. brassard , and n. d. mermin , phys . lett . * 68 * , 557 ( 1992 ) . g. brassard , n. lutkenhaus , t. mor , and b. c. sanders , phys . * 85 * , 1330 ( 2000 ) . a. k. ekert , j. g. rarity , p. r. tapster , and g. m. palma , phys . . lett . * 69 * , 1293 ( 1992 ) . a. v. sergienko , m. atature , z. walton , g. jaeger , b. e. a. saleh , and m. c. teich , phys . a * 60 * , 2622 ( 1999 ) . t. jennewein , c. simon , g. weihs , h. weinfurter , and a. zeilinger , phys . * 84 * , 4729 ( 2000 ) . d. s. naik , c. g. peterson , a. g. white , a. j. berglund , and p. g. kwiat , phys . lett . * 84 * , 4733 ( 2000 ) . w. tittel , j. brendel , h. zbinden , and n. gisin , phys . lett . * 84 * , 4737 ( 2000 ) . l. mandel , j. opt . b * 1 * , 108 ( 1984 ) . e. jakeman and j. g. rarity , opt . commun . * 59 * , 219 ( 1986 ) . j. g. rarity , p. r. tapster , and e. jakeman , opt . commun . * 62 * , 201 ( 1987 ) . j. g. rarity and p. r. tapster , appl . b * 55 * , 298 ( 1992 ) . d. c. burnham and d. l. weinberg , phys . lett . * 25 * , 84 ( 1970 ) . d. n. klyshko , _ photons and nonlinear optics _ , ( gordon and breach science publishers , new york , amsterdam , 1988 ) . j. g. rarity , k. d. ridley , and p. r. tapster , appl . opt . * 26 , * 4616 ( 1987 ) . a. n. penin and a. v. sergienko , appl . opt . * 30 * , 3582 ( 1991 ) . p. g. kwiat , a. m. steinberg , r. y. chiao , p. h. eberhard , and m. d. petroff , appl . opt . * 33 * , 1844 ( 1994 ) . a. l. migdall , r. u. datla , a. v. sergienko , j. s. orszak , and y. h. shih , metrologia * 32 * , 479 ( 1996 ) . s. castelletto , a. godone , c. novero , and m. l. rastello , metrologia * 32 * , 501 ( 1996 ) . m. m. hayat , a. joobeur , and b. e. a. saleh , j. opt . a * 16 * , 348 ( 1999 ) . g. brida , s. castelletto , c. novero , and m. l. rastello , j. opt . b * 16 * , 1623 ( 1999 ) . g. brida , s. castelletto , i. p. degiovanni , c. novero , and m. l. rastello , metrologia * 37 * , 625 ( 2000 ) . p. r. tapster , j. g. rarity , and p. c. m. owens , phys . lett . * 73 * , 1923 ( 1994 ) . w. tittel , j. brendel , h. zbinden , and n. gisin , phys . * 81 * , 3563 ( 1998 ) . g. weihs , t. jennewein , c. simon , h. weinfurter , and a. zeilinger , phys . lett . * 81 * , 5039 ( 1998 ) . m. nielsen and i. chuang , _ quantum computation and quantum information _ , ( cambridge university press , new york , 2000 ) . n. boeuf , d. branning , i. chaperot , e. dauler , s. guerin , g. jaeger , a. muller , and a. migdall , opt . eng . * 39 * , 1016 ( 2000 ) . p. g. kwiat , k. mattle , h. weinfurter , a. zeilinger , a. v. sergienko , and y. shih , phys . lett . * 75 * , 4337 ( 1995 ) . entangled states may be successfully generated for this purpose by two type i nonlinear crystals , according to p. g. kwiat , e. waks , a. g. white , i. appelbaum , and p.h . eberhard , phys . a * 60 * , r773 ( 1999 ) , so that the general state is @xmath335\,\left| v_{a}\right\rangle \left| v_{b}\right\rangle .$ ]    p. g. kwiat , a. j. berglund , j. b. altepeter , and a. g. white , science * 290 * , 498 ( 2000 ) . a. j. berglund , arxiv : quantph/0010001 v2 ( 2000 ) . s. castelletto , i. p. degiovanni , and m. l. rastello , in _ quantum communication , computing , and measurement 3 , _ proceedings of the fifth international conference on quantum communication , measurement and computing , capri , italy , edited by p. tombesi and o. hirota , ( kluwer academic , new york , 2001 ) , p. 131 . j. perina jr . , o. haderka , and j. soubusta , phys . a * 64 * , 052305 ( 2001 ) . s. castelletto , i. p. degiovanni , and m. l. rastello , j. opt . b * 19 * , 1247 ( 2002 ) . s. castelletto , i. p. degiovanni , and m. l. rastello , metrologia * 37 * , 613 ( 2000 ) . s. castelletto and i. p. degiovanni , _ private communication . _ s. castelletto , i. p. degiovanni , and m. l. rastello , in _ advanced mathematical and computational tools in metrology v _ , edited by p. ciarlini , m. cox , e. filipe , f. pavese , and d. richter , ( world scientific company , singapore , 2001 ) , p. 41 .
quantum - cryptography key distribution ( qckd ) experiments have been recently reported using polarization - entangled photons . however , in any practical realization , quantum systems suffer from either unwanted or induced interactions with the environment and the quantum measurement system , showing up as quantum and , ultimately , statistical noise . in this paper , we investigate how ideal polarization entanglement in spontaneous parametric downconversion ( spdc ) suffers quantum noise in its practical implementation as a secure quantum system , yielding errors in the transmitted bit sequence . because all spdc - based qckd schemes rely on the measurement of coincidence to assert the bit transmission between the two parties , we bundle up the overall quantum and statistical noise in an exhaustive model to calculate the accidental coincidences . 
 this model predicts the quantum - bit error rate and the sifted key and allows comparisons between different security criteria of the hitherto proposed qckd protocols , resulting in an objective assessment of performances and advantages of different systems .