Richard DoyleJet Propulsion Lab

rdoyle@jpl.nasa.gov

A I I N S P A C E

will have difficulty providing the vastly in-creased computing power the space-explo-ration community will need.

The solution might well come from quan-tum computers, which offer properties ofsize, power, and robustness that are ideallysuited to the space environment.

The potential of quantum technologiesgoes far beyond enhanced computing cap-acity. Future space missions will involvedirect participation of non-NASA scientists.This will necessitate allowing more openaccess to spacecraft systems via free-spacecommunication links. Quantum cryptogra-phy would allow such channels to be madeabsolutely secure and invulnerable to attackby malevolent hackers. To explore these

possibilities, this article describes theprogress to date in understanding howquantum computers and related quantuminformation-processing devices mightadvance space exploration.

Smaller, faster, rad harderComputing capacity conventionally

grows through increased processor speed.Over the past three decades, for instance,the microprocessor industry has shrunkcomputer hardware by a factor of tworoughly every 18 months, while maintain-ing robustness and mass-production capa-bility. Smaller hardware means smallerdistances for signals to travel inside micro-chips, so processor speed has risen dramat-

ically. However, as we enter the 21st cen-tury, chip manufacturers have begun toencounter problems in fabricating smallercomputer hardware. Worse still, they arerealizing that smaller computers don’t obeythe same rules are larger ones. They must,therefore, turn to alternative physical mod-els of computation for designing tomor-row’s computers.

Far from being bad news, the need toquestion computing’s limits provides a newand unexpected opportunity for a quantumleap in computing capacity. By extrapolat-ing the trend in miniaturization, we can con-ceive of computer hardware that uses singleatoms to implement bits—the nuggets ofclassical information—by about 2020. Atsuch scales, the dominant physics is quan-tum physics rather than classical physics.

These quantum rules admit subtle andcounterintuitive physical effects, which canbe harnessed to perform extraordinary opera-tions on data stored in quantum bits, orqubits, that are impossible to realize on anyclassical computer—no matter how advancedit might be. Machines designed to exploitthese extraordinary quantum effects arecalled quantum computers.1,2 (See the “Fun-damentals of quantum computing” sidebarfor a discussion of the physics involved.)

The expansion in the fundamental opera-tions available to quantum computers letsthem achieve an enhanced computing capac-ity, not simply by being smaller, but by run-ning qualitatively new types of algorithmsthat cannot run as efficiently on any classicalcomputer. Indeed, we already know thatquantum computers can break codes using afactoring attack and simulate complex quan-tum mechanical systems exponentially fasterthan their classical counterparts.3,4

In addition to a possible algorithmic

10 IEEE INTELLIGENT SYSTEMS

Quantum computing:The final frontier? Richard J. Hughes, Los Alamos National LaboratoryColin P. Williams, Jet Propulsion Laboratory

As NASA spacecraft explore deeper into the cosmos, speed-of-light-limited signal delays make it increasingly impracticalto command missions from Earth. Future spacecraft will needgreater onboard computing capacity to mimic human-level intel-ligence and autonomy. Unfortunately, computer manufacturers

Quantum computingQuantum computing is an exciting area from a computer science viewpoint. Not only is

there the possibility of exponential speedup on some classes of problems, but quantum comput-ing also offers a fresh take on some fundamental concepts such as the bit and the algorithm.The properties of quantum systems are non-intuitive, but they may be exploitable in ways thattransform looming device physics constraints relating to computation into new opportunities.

NASA’s interest in quantum computing is based in part on potential efficiency gains for thekinds of computational problems associated with onboard autonomy capabilities. But equallyrelevant, quantum computing devices may be energy efficient in unprecedented ways, andquantum information theory may offer new concepts for secure communications.

The authors are engaged in cutting-edge research in quantum communications and quan-tum algorithms, and they offer you their view of the potential of this new field and its rele-vance to NASA.

—Richard Doyle

SEPTEMBER/OCTOBER 2000 11

Fundamentals of quantum computingThe fundamental nugget of classical information is the bit—a 0 or

a 1. To understand a quantum computer, start by thinking about whathappens as the physical structures implementing bits become smaller.Bits nowadays are so commonplace that we no longer give muchthought to the properties that we expect them to possess. But as ourcomputing and information-processing artifacts descend to ever-smallerscales, we must question whether bits behave as expected. For example,we assume that a bit always has some definite value, that this value iseither 0 or 1, that we can make a perfect copy of a bit, that we can read abit without affecting its value, and that reading one bit has no effect onthe value of another, unread, bit. At sufficiently small scales, when usingindividual quantum systems to encode bits, all of these assumptions turnout to be wrong, because, in the words of Richard Feynman, “Natureisn’t classical, dammit!” As we understand the rules for manipulatingquantum bits and can exploit them to conceive of new kinds of algo-rithms, we are creating the new field of quantum computing.

The qubit is the classical bit’s quantum analog. We can use almostany 2-state quantum system, such as an electron’s spin, a photon’spolarization orientation, or an ion’s internal energy levels, to encode aqubit. We can represent the two classical bit values as states labeled |0⟩and |1⟩ . Whereas a classical bit must be either 0 or 1, a qubit can be anarbitrary superposition of |0⟩ and |1⟩ simultaneously—a state such asc0|0⟩ + c1|1⟩ with c0 and c1 complex numbers such that |c0|2 + |c1|2 = 1.We can visualize a qubit as a vector of unit length pointing from theorigin to a point on the surface of a bounding sphere (see Figure A).The classical bit values correspond to the north and south poles, andsuperposition states correspond to the other points on the surface.

When measuring a superposition state c0|0⟩ + c1|1⟩ , it is generallyimpossible to predict with absolute certainty the bit value that the mea-surement will obtain. We only know that the probability of finding thequbit to be 0 is |c0|2 and that of finding it to be 1 is |c1|2. Moreover, theact of making the measurement appears to project the qubit into state|0⟩ or state |1⟩ consistent with the measurement outcome.

Any nontrivial computation requires a quantum memory register of nqubits. Fortunately, n need only be around 50 before we can imagine aquantum computer that can perform specialized computations thatoutstrip the capabilities of any classical rival. The state of n qubits liesin a 2n-dimensional space spanned by the vectors

If we measure the bit value of all n qubits, the possible states in whichthe complete memory register can be found correspond to the 2n classi-cally allowed bit strings that n bits can represent—that is, “00…0,”“00…1,” …, or “11…1”. However, between measurements, the n qubitscan exist in superposition of all the 2n classical states. Quantum comput-ers thus have tremendous capacity to work on several different computa-tions at once. Alas, quantum mechanics forbids us from reading theanswer to each of these superposed computations individually. We canonly make some measurement that reveals a collective property of allthe answers, which is often good enough to perform useful computation.

Quantum memory registers can exhibit quintessentially quantumbehaviors that have no classical analogs. For example, suppose we had a2-qubit quantum memory register in the state (|00⟩ + |11⟩)/√2. Thisquantum state is rather strange: initially neither qubit is in a definitestate, each could be found to be 0 or 1 with equal probability. But assoon as we measure one of the qubits, the bit value of the other (unmea-sured) qubit will become definite. We say such a state is entangled,because we cannot think of the register’s state as being composed of adefinite state for each qubit it contains. Instead, measurements made onone set of qubits have a side effect on another set of unmeasured qubits.The correlations between the bit values or entangled qubits can be muchgreater than anything classical bits can achieve. It is these excess corre-lations that ultimately account for much of quantum computing’s power.

So much for quantum memory registers and readout. How do wecompute? That is, how do we make the qubits perform a purposefulcomputation? Surprisingly, the answer was discovered in 1926, longbefore quantum computers were invented! That’s because a quantumcomputer is first and foremost a quantum mechanical system, andErwin Schrödinger discovered a formula that describes how all isolatedquantum systems evolve in time. If the quantum computer’s memoryregister is described at time t by the state |ψ(t)⟩ , it must evolve in accor-dance with Schrödinger’s equation:

where H is an operator, called the Hamiltonian, related to the totalenergy of the system. This equation’s solution is

|ψ(t)⟩ = exp(–i H t/η) |ψ(0)⟩ = U|ψ(0)⟩

where U is some unitary operator. (An operator is unitary if its inverseequals its conjugate transpose. Unitary operators are linear: given aninput state we can compute a unique output state and vice versa. Theunitarity property turns out to have an important physical implication.It means that a perfect quantum computer is necessarily a reversiblecomputer.) This means that the computer’s final state comes from act-ing on the initial state with some unitary evolution operator U.

To interpret this physical evolution as a computation, we make thefollowing correspondences. At time t, the state |ψ(t)⟩ represents thememory register’s content; the algorithm that the quantum computer isexecuting is the unitary operator U; the initial data on which the com-puter will act is encoded in the initial state |ψ(0)⟩ . The outcome fromthe quantum computation results from a measurement made on some orall of the qubits in state |ψ(t)⟩ . Thus, quantum algorithms are, in reality,just unitary transformations of some initial state vector |ψ(0)⟩ intosome final state vector |ψ(t)⟩ followed by a measurement.

Once we know a unitary operator that implements a desired quantumcomputation, to make a practical quantum computer for performingthis computation, we must break down this operator into a sequence ofquantum logic gates that act on single qubits or pairs of qubits at a time.This defines a quantum circuit that performs the computation.

Quantum algorithms are now available for such problems as factor-ing large composite integers; computing discrete logarithms; estimat-ing eigenvalues; determining means, medians, and maxima of func-tions; simulating stochastic processes; evaluating high-dimensionalintegrals; and finding collisions in functions. A few quantum algo-rithms are exponentially faster, but the majority are polynomiallyfaster, than their classical counterparts.

it

tH tη

ψψ

∂

∂=

( )( )

00 0 00 1 11 1K124 34

K K

n

, ,...,

c 0 | 0> + c1 |1 >

Figure A. Picture a qubit as a vector contained in a sphere.

advantage, quantum computers might alsobe more robust in the space environmentthan classical computing devices of compa-rable complexity. Quantum computers storeinformation in exceedingly small physicalstructures, such as in the orientation ofnuclear spins. These objects present farsmaller cross sections to incoming radiationthan conventional computer circuitry, mak-ing it less likely for radiation to damage acomparably powerful quantum device.

Furthermore, in principle, quantum com-puters are reversible: they can recover all of

the energy expended during computation.The only time energy must truly dissipateis when information is erased, so quantumcomputers could be more energy efficientthan today’s classical irreversible comput-ers of comparable computing capacity.

Quantum algorithms for NASAapplications

In certain mission-critical applications,computational processing speed is of para-mount importance. For example, a remotespacecraft might be about to encounter a rare

astronomical body or perform a part of themission for which there is only one opportu-nity for success, such as insertion into orbitor landing on a planetary surface. There willoften be the need for onboard capability toprocess information, make decisions, andsometimes, replan elements of the mission inreal time (see Figure 1). Unfortunately, plan-ning is an NP-Hard problem, so fine-grainedreplanning quickly consumes available com-putational resources.

Currently, no known algorithm (classicalor quantum) can solve NP-Hard problems inbetter than exponential time in the worstcase. But it appears that quantum algorithmscan be faster than classical ones by a signifi-cant factor. Consider solving the planningproblem by reducing it to the k-SAT, orpropositional satisfiability, problem, whichis the canonical NP-Hard problem. The bestclassical tree-search algorithm for solving k-SAT is ResolveSAT.5 Other types of classi-cal algorithms—local search algorithmssuch as Walk-SAT and Simulated Anneal-ing—do better at solving k-SAT in practice,but their complexity is harder to pin down.Certain randomized algorithms do reason-ably well, but invariably at the price oftrading correctness for efficiency: some areguaranteed to terminate with correct resultsbut have uncertain running times, whereasothers have certain running times but are notguaranteed to terminate with correctsolutions.

The state of the art in quantum algorithmsfor NP-Hard problems is a nested quantumtree-search algorithm invented by NicolasCerf, Lov Grover, and Colin Williams.6 Thisalgorithm builds upon another quantumalgorithm, called Grover’s algorithm, forperforming unstructured quantum search.7

Unstructured quantum search. We canintuitively interpret the unstructured searchproblem as follows. Suppose we have atelephone directory and must find the nameof the person who has a particular telephonenumber. Because the telephone directory issorted by name, rather than by number, wecan do no better than to pick a random start-ing point and examine one entry afteranother. If the directory contains N entries,in the worst case we must look at N itemsbefore finding the desired name. Conse-quently, unstructured classical search’scomplexity would appear to be (O(N)) andthere would seem to be no way of improv-ing on it.

12 IEEE INTELLIGENT SYSTEMS

No!No!

Yes!No!

No!Yes!

No!No

No!No!

No!

No!No

No!No!

No!

π N repetitions

Q • Q ... Q

Figure 2. Unstructured quantum search.

Figure 1. A spacecraft might have to replan its actions under extreme constraints on power, maneuverability, time, andcomputational resources.

SEPTEMBER/OCTOBER 2000 13

However, a quantum computer has newoperations on data that lets it solve unstruc-tured quantum search more efficiently. Theidea behind the unstructured quantumsearch algorithm is to begin with an equallyweighted superposition of all possible can-didate telephone numbers (see Figure 2).Suppose there is an oracle (implemented assome secret quantum circuit) that, if giventhe index of a telephone directory entry, willtell us whether the index is or is not that ofthe sought-after item. Because the oracle is“quantum,” we can hand it a superpositionof indices, rather than just a single index,and the oracle will respond with a superpo-sition of replies indicating which indices door do not correspond to solutions.

We can use the oracle to build an ampli-tude-amplification operator whoserepeated application tends to pump proba-bility amplitude from the nonsolution statesinto the solution ones. The quantum com-puter does not read the contents of its mem-ory register during this amplitude-amplifica-tion process, which allows it to remain in aquantum superposition state. The quantumcomputer makes only a single final mea-surement after a prescribed number of amp-litude-amplification applications—justenough, in fact, to boost the probability of ameasurement yielding the solution to closeto 1. By amplitude amplifying (π/4)√—

Ntimes, the true solution will bubble to thesurface and hence be detected.

Thus, for a task requiring O(N) opera-tions on a classical computer and thatseems to be impossible to speed up, we cansolve it in just O{(π/4)√—

N} steps on aquantum computer.

Quantum algorithms for NP-Hard prob-lems. In principle, we could use Grover’sunstructured quantum search algorithm tosolve an NP-Hard problem such as con-

straint satisfaction, planning, scheduling,combinatorial optimization, propositionalsatisfiability, or diagnosis. For example,consider a constraint-satisfaction problem(CSP) consisting of µ variables that eachcan take on b possible values, together witha set of constraints that restrict the valuesthat tuples of variables can assume simulta-neously (see Figure 3).

Currently, the best known tree-searchalgorithm for solving the kind of CSP des-cribed above is ResolveSAT.5 ResolveSAT’scomplexity is O(b0.446µ) (for a problem hav-ing µ variables and b values per variable). Inprinciple, we could use a slightly modifiedversion of Grover’s unstructured searchalgorithm to solve an NP-Hard problem byreplacing the oracle with a quantum circuitthat can decide whether a candidate solutionis in fact a solution in polynomial time, thensearching among the N = bµ assignments ofvalues to variables in a time complexity ofroughly O(b0.5µ). However, this is less effi-cient than ResolveSAT, so the naïve use ofGrover’s algorithm does not offer anyadvantage.

However, as NP-Hard problems haveinternal structure, a quantum computercould do better than to run Grover’s algo-rithm. Our structured quantum search usesa Grover-like quantum search at an inter-mediate level of the search tree to conditiona subsequent quantum search in the leaves,which produces a nested quantum-searchalgorithm overall (see Figure 4).

Whereas ResolveSAT’s complexity isO(b0.446µ), the nested quantum-search algo-rithm has a complexity of O(b0.333µ) withone cut level, improving with more cuts.This is an exciting development for com-puter science because the recent improve-ments in SAT-solver algorithms, such asResolveSAT, have only nibbled away at theexponent in the exponential cost function.

Quantum computing promises to take a bigbite out of the exponent.

Could quantum computers do even bet-ter? Unfortunately, we now know that noquantum algorithm can do better than asquare root speedup on unstructured quan-tum-search problems.8 Minor improvementsbeyond this are possible on average usingparallel, punctuated, quantum searches.9

Because there is some probability of obtain-ing the correct answer before amplitudeamplification completes, a society of k inde-pendent quantum searches performing par-tial amplitude amplification followed bypremature measurement might find a solu-tion earlier than expected. For a singlesearch agent, this strategy results in 13%additional speedup on average for unstruc-tured quantum search. However, the ulti-mate speedup attainable for structured quan-tum-search problems, such as NP-Hardproblems, remains an open question.

Distributed quantum algorithms. Somefuture space missions will involve constel-lations of spacecraft acting in unison (seeFigure 5). Such constellations permitsimultaneous monitoring of an entireplanet, rather than the periodic monitoringallowed by individual orbiting spacecraft.However, managing constellations ofspacecraft presents new computationalchallenges. How can we fuse the data fromdifferent spacecraft to create a snapshot ofthe entire planet at a given instant? Howmuch communication must take place be-tween spacecraft to perform some collec-tive task? These questions naturally lead usinto thinking about whether we can com-bine quantum communications and quan-tum-computing techniques to provide newsolutions to these kinds of problems.

For the simplest example of a NASA-relevant distributed computation, consider

Q̂

Figure 3. A simple constraint-satisfaction problem. A seven-node graph is to be colored using at most three colors suchthat no two nodes connected directly by an edge have the same color. On the left is the graph and on the right a satisfying coloring of the graph. Graph coloring is an NP-Hard problem.

Amplify “goods”at level i

Figure 4. Nested quantum-search embeds one quantumsearch algorithm within another. There are N candidatesolutions in the fringe, but only those that are extensionsof a “good” at level i need be examined.

synchronizing a pair of clocks on two dif-ferent spacecraft. For fusion of time-dependent data to be possible, two space-craft must agree on the time. Generallyspeaking, the more accurately clocks can besynchronized the better the resolutionattainable from distributed sensors. Con-ventionally, synchronization occurs throughan operational line-of-sight exchange oflight pulses between two observers, sayAlice and Bob, who are co-located withtheir clocks. While such a scheme is practi-cal, it is not immune to errors. In the GPSsatellite constellation, for example, the abil-ity of the spaceborne atomic clocks to syn-chronize with a ground-based masteratomic clock is limited by the fluctuatingrefractive index of the atmosphere, whichcauses the speed of light to vary randomly,limiting our ability to establish absolutedistance and the resultant timing informa-tion with high accuracy.

Could quantum communications and dis-tributed quantum computation help? Wemight think so because entangled particleshave some very peculiar properties that let usavoid sending timing information through theatmosphere. For example, if Alice and Bobeach hold one member of a pair of entangledparticles in the state (|01⟩ – |10⟩)/√2, whenAlice measures her particle, she will instanta-

neously cause the state of Bob’s particle tobecome definite as well, regardless of thedistance between them and the nature of theintervening medium. Similarly, if Alice andBob start out by sharing pairs of entangledparticles, certain distributed quantum compu-tations, such a joint appointment scheduling,can be performed using less communicationoverhead than ought to be necessary classic-ally.10 Likewise, if Alice and Bob shareentangled particles, Alice can send Bob twobits of classical information by sending onlyone qubit between them.11 So, it appears thatshared prior entanglement is a powerfulcomputational and communications resource.

Assuming such shared prior entangle-ment, it appears possible to synchronize apair of clocks without sending timinginformation through the atmosphere.12

Alice and Bob start out having correspond-ing members of entangled pairs of atoms,each in the state (|01⟩ – |10⟩)/√2. Theatoms are indexed so Alice and Bob knowwhich atom in Alice’s ensemble corres-ponds to which (entangled) atom in Bob’sensemble. This shared ensemble is effec-tively a pre-clock from which Alice andBob will later distill a pair of synchronizedclocks. The pre-clock is idling becauseeach atom in it is in the (|01⟩ – |10⟩)/√2state that does not evolve in time under any

symmetric operations by Alice and Bob. To make a clock, Alice simultaneously

measures each particle in her ensemble in the

basis. For each atom, Alice will either findit in the state (|0⟩ + |1⟩)/√2 state (Type I) orthe (|0⟩ – |1⟩)/√2 state (Type II). Alice’smeasurement does two things: it starts bothAlice’s atoms and Bob’s atom “ticking”and tells Alice the indices of the atoms inboth her Type I and Type II subensembles.Alice can choose to use either Type I orType II atoms to make a clock. Bob’s clockhas complementary Type I and Type IIsubensembles of ticking atoms, but cannotyet tell which is which. Instead he mustwait for a classical communication fromAlice telling him the indices of the atomsthat Alice used to make her clock. If Bobselects atoms with the complementary setof indices, he will have a clock that is tick-ing in synchrony with Alice’s.

Thus Alice and Bob are left with syn-chronized clocks without any timing infor-mation having been transmitted through theatmosphere between them. This is reallyjust a thought experiment at this stage,predicated on the assumption of sharedprior entanglement between Alice and Bob.If this can be made to work, Alice and Bobwill be able to synchronize their clocks to agreater precision than possible with line-of-sight optical light pulses. This, in turn,would let us improve the resolution attain-able with distributed sensors—such as verylong baseline interferometers—for imagingplanets orbiting distant stars (see Figure 6).

It is not yet clear whether establishingshared prior entanglement is really anydifferent from distributing a pair of clocksthat start at a common location. Neverthe-less, thinking about distributed quantumcomputations in space has stimulated newand exciting questions relating to relativis-tic quantum information theory.

See the “Solid-state quantum computinghardware” sidebar for a discussion of thehardware side of the equation.

Secure Earth-to-space quantumcommunications

On 27 April 1986, a hacker known asCaptain Midnight briefly took over a satel-lite television broadcast to the US’s EastCoast. This celebrated incident highlighted

1

20 1

1

20 1+( ) −( )

,

14 IEEE INTELLIGENT SYSTEMS

Figure 5. A constellation of spacecraft must be synchronized to perform data fusion tasks.

SEPTEMBER/OCTOBER 2000 15

the importance of controlling and avoidingdenial-of-service attacks on orbital assets.In addition to maintaining the security ofuplinked command paths, ensuring thesecurity of downlinked data—which issusceptible to passive eavesdropping—-canbe equally important. Quantum key distrib-ution (QKD) is an emerging technologybased on single photon communicationsthat will provide satellite communicationswith greater security and convenience thanpresent-day methods.

How cryptographic methods work.Cryptographic methods can assure thesecurity of data and command paths toorbital assets as follows. We can encryptmessage (“plaintext”) P according to somealgorithm E before transmission to producea “ciphertext,” C = EK(P), where K is asecret parameter known as a cryptographickey (a random binary number sequence,typically a few hundred bits in length). Onreceiving the ciphertext, the intended recip-ient can invert the encryption process usingthe decryption algorithm D to recover theoriginal message P = DK(C), provided thesecret key K is known. Conversely,although the encryption and decryption

algorithms E and D might be publiclyknown, an eavesdropper passively monitor-ing the transmission C could not discernthe underlying message P because of the

randomization the encryption processintroduced, provided the key K remainssecret. Secret key material therefore is avery valuable resource that must be avail-

Figure 6. Very long baseline interferometers can be used for imaging of planets orbiting distant stars.

Solid-state quantum computing hardwareMuch progress has been made in designing quantum computer hard-

ware. The early work on ion traps, cavity quantum electrodynamics,and nuclear magnetic resonance has inspired several schemes forimplementing quantum computer hardware in solid-state quantumelectronics. The move to solid-state quantum electronics is appealingbecause it builds upon decades of experience in microprocessor fabri-cation technology. These schemes use electric charge, magnetic flux,superconducting phase, electron spin, or nuclear spin as the informationbearing degree of freedom.1–5 Although each scheme has variousadvantages and disadvantages, the approach based on harnessing quan-tized charge is especially appealing because we can fabricate the neces-sary superconducting circuitry for such a qubit using present-day e-beam lithography equipment. Also, quantum coherence, essential forcreating superposed and entangled states, has been demonstrated exper-imentally.6 These qualities make the quantized charge-based qubit astrong contender for the basic element of a proof-of-concept quantumcomputer. Figure B shows a schematic diagram for a charge-basedqubit with ancillary readout circuitry.

The basic idea is that in a superconductor the electrons team up inpairs, called Cooper pairs. By varying voltages and magnetic fluxes,we can make several Cooper pairs hop onto an island in a superconduc-tor. If there are N Cooper pairs, we say the island is in state |0⟩ . If thereare N + 1 Cooper pairs, the island is in state |1⟩ As Cooper pairs arequantum objects, we can create superpositions of N and N + 1 Cooperpairs on the island simultaneously, thereby creating arbitrary superpo-sition states of the form c0|0⟩ + c1|0⟩ . This is a qubit, the elementalbuilding block of a quantum memory register.

So how do we act on such qubits to make them change their state? Tomake a practical design for a quantum computer, we must specify howto decompose any valid quantum computation into a sequence of ele-mentary 1- and 2-qubit quantum gates which can be realized in physi-

cal hardware that is feasible to fabricate. The set of these 1- and 2-qubitgates is arbitrary provided it is universal—capable of achieving anyvalid quantum computation from a quantum circuit comprising onlygates from this set. Traditionally, we have taken the set of universalgates to be the set of all 1-qubit quantum gates in conjunction with asingle 2-qubit gate called controlled-NOT. However, many equallygood universal gate sets exist,7 and there might be an advantage inusing a nonstandard universal gate set if certain gate designs happen tobe easier to realize in one hardware context than another. Certainly, wehave known for some time that the square root of the 2-qubit exchange-interaction (the SWAP gate) is as powerful as the better-known con-trolled-NOT gate (CNOT) as far as computational universality is con-cerned. It makes sense, therefore, to see what gates are easy to makeand then extend them into a universal set. We pursued this strategy atthe Jet Propulsion Lab. In particular, we showed, in the context of

Single Cooperpair box

RFSET

V9

Figure B. Schematic diagram of a single charge-based qubit with an adjoining RFSET readout.

able on the satellite and at the ground sta-tion. Moreover, frequent key changes arenecessary to ensure security. So, if the keymaterial supplied at launch should be usedup during normal operations, methods forsecure key distribution to satellites on-orbitare of paramount importance to ensure thatthird parties cannot acquire even partialknowledge of the new key.

It is obviously impractical to send acourier to a satellite, and key transmissionsthemselves must be assumed susceptible topassive eavesdropping. Public-key encryp-tion methods, which derive their securityfrom the perceived difficulty of certainmathematical problems such as factoringlarge integers, can be conveniently used tosecurely distribute new keys by broadcast,but are subject to increasing challenges,including unanticipated advances in compu-tational techniques, technology, and algo-rithms. For example, there have recentlybeen rapid advances in the size of integersthat have been factored with Internet collab-

orations,13 and new proposals for specialpurpose, high-speed factoring hardwarehave emerged.14 Furthermore, because it isnotoriously difficult to assess an adversary’sfuture computational capabilities accurately,today’s passively monitored public-keytransmissions could become retroactivelyvulnerable well before their intended secu-rity lifetime elapses.15 If large-scale quan-tum computation becomes feasible, essen-tially all public-key methods will becomevulnerable.3,16

QKD is unconditionally secure, no mat-ter what present or future technology anadversary might possess; its security is as-sured by laws of Nature.17 A QKD proce-dure starts with the sender Alice generatinga secret random binary number sequenceRA. For each bit in the sequence, Alice pre-pares and transmits a single photon over aquantum channel (a low-loss, faithfultransmission medium) to the recipient Bob(see Figure 7). He measures each arrivingphoton and attempts to identify the bit

value Alice has transmitted. Alice’s photonstate preparations and Bob’s measurementsare chosen from sets of nonorthogonal pos-sibilities. For example, using the so-calledB92 protocol18 Alice agrees with Bob(through public discussion) that she willtransmit a vertically polarized single-pho-ton state for each 0 in her sequence, and a45 degree-polarized single-photon state foreach 1 in her sequence.

Bob agrees with Alice to test the polariza-tion of each arriving photon for horizontalpolarization to reveal 1s, or negative 45-degree polarization to reveal 0s. Bob’schoices of polarization are set by random bitvalues from a secret random binary se-quence RB, which he generates and proceedsthrough in synchronization with Alice. Inthis scheme, Bob will never detect a photonfor which he and Alice have used a prepara-tion and measurement pair that correspondsto different bit values, such as horizontal andvertical polarizers, which happens for 50%of the bits in Alice’s sequence.

16 IEEE INTELLIGENT SYSTEMS

charge-based qubits, that any 1-qubit operation and a 2-qubit operationcalled the square root of complex SWAP (or ) is universal forquantum computation.8 Such a quantum gate has been designed andfabricated at JPL. Figure C shows a photograph of the qubit with asso-ciated connections needed for performing gate operations.

It is not yet clear which approach to quantum computing hardwarewill prove to be the most feasible or cost effective. Moreover, deploy-ing quantum computer hardware in space poses unique challenges forquantum hardware designers. Power supplies must be of limited dura-tion and be nonrenewable, and radiation levels can be significantlyhigher than on Earth.

Quantum computers might help to overcome these problems. Aswe’ve noted, quantum computers are naturally reversible computers—the energy expended during computation is, in principle, recoverable.Though possibly surprising, that’s a well-known thermodynamicresult.9 In practice, quantum computers are unlikely to realize thisreversible thermodynamic ideal. Nevertheless, it is sensible to startwith a computer that is reversible, in principle, if we are to conserveprecious energy resources. Moreover, if quantum computers can

answer certain computational questions by running a quantum algo-rithm that requires fewer steps than any classical algorithm for thesame problem, this too could result in a net energy saving.

Quantum computers might also be better suited for operation in aradiation environment. Quantum-scale structures present smaller crosssections to incoming radiation than do conventional computer memorycomponents. In addition, certain quantum systems, such as nuclearspins, are relatively immune to ionizing radiation that might damageconventional computer hardware.

References1. D. V. Averin, “Adiabatic Quantum Computation with Cooper

Pairs,” Solid State Communications, Vol. 105, 1998, pp. 659–664.

2. L. Tian et al., “Decoherence of the Superconducting PersistentCurrent Qubit,” 1999; preprint available at http://xxx.lanl.gov/abs/cond-mat/9910062.

3. G. Blatter, V. Geshkenbein, and L. Ioffe, “Engineering Supercon-ducting Phase Qubits,” 1999; http://xxx.lanl.gov/abs/cond-mat/9912163.

4. R. Vrijen et al., “Electron Spin Resonance Transistors for Quan-tum Computing in Silicon-Germanium Heterostructures,” 1999;http://xxx.lanl.gov/abs/quant-ph/9905096.

5. B. Kane, “Silicon-Based Quantum Computation,” 2000; http://xxx.lanl.gov/abs/quant-ph/0003031, submitted to Fortschritte derPhysik Special Issue on Experimental Proposals for QuantumComputation.

6. Y. Nakamura, A. Pashkin, and J. S. Tsai, “Coherent Control ofMacroscopic Quantum States in a Single-Cooper-Pair Box,”Nature, Vol. 398, 1999, pp. 785–787.

7. D. Di Vincenzo, “Two Bit Gates are Universal for Quantum Compu-tation,” Physical Review A, Vol. 51, No. 2, Feb. 1995, pp. 1015–1022.

8. P. Echternach et al., “Universal Quantum Gates for Single CooperPair Box Based Quantum Computing,” Proc. Progress in Electro-magnetics Research Symp., Session on Solid-State Quantum Com-puting Hardware, PIERS, Washington, D.C., 2000.

9. C. H. Bennett, “Logical Reversibility of Computation,” IBM J.Research and Development, Vol. 17 (1973) pp. 525-532.

iSWAP

Figure C. A single qubit, implemented as a quantized charge device fabricated inaluminum using e-beam lithography. In a superconductor, electrons pair up asCooper pairs. If there are N Cooper pairs on the center island, the island contains a|0>qubit. If there are N+1 Cooper pairs on the island, the island contains a |1>qubit. As electrons are quantum, we can have a superposition of N and N+1 Cooperpairs on the island simultaneously.

SEPTEMBER/OCTOBER 2000 17

However, for the other 50% of Alice’sbits, the preparations and measurements usenonorthogonal polarizations, such as verticaland negative 45 degrees, resulting in a quan-tum-mechanically random 50% detectionprobability for Bob on this portion. Thus, bydetecting single photons, Bob identifies arandom 25% portion of the bits in Alice’srandom sequence, assuming she transmitsexactly one photon for each bit and there areno bit losses in transmission or detection.This 25% efficiency factor is the price thatAlice and Bob must pay for secrecy. (Inpractice there will be additional losses, butphotons that fail to reach the receiver merelyreduce the key rate without leaking anyinformation to adversaries.) Bob and Alicereconcile their common bits through discus-sion over a public channel with Bob reveal-ing the locations, but not the bit values, in thesequence where he detected photons; Aliceretains only those detected bits from her ini-tial sequence.

The resulting detected bit sequences com-prise the raw key material from which a purekey is distilled using classical error detec-tion techniques. Because the key does notexist until after the quantum transmissionsare complete there is no prior record of a keythat could be compromised by insiders.

Because a photon is an indivisible elemen-tary particle, the QKD transmissions cannotbe passively tapped in the conventional sense,so adversaries would need to undertake farmore risky active attacks. However, Heisen-berg’s Uncertainty Principle ensures that anyactive attack will not permit an adversary tofaithfully read the key transmissions. More-over, such an attempt will inevitably disturbthe transmissions, letting the intended usersdetect the attempted eavesdropping, as wellas put a rigorous upper bound on the informa-tion that might have been leaked. With thisbound, Alice and Bob can apply the tech-nique of privacy amplification in which theyagree (by public discussion) to produce a newbit sequence formed from the parities of suit-ably chosen random subsets of their recon-ciled bit sequences, which ensures that anyadversary could do no better than guess theresulting bit sequence. The keys produced atthe end of this procedure will be secret. Theycould be used to initialize conventional cryp-tographic hardware, typically requiring a fewhundred bits.

Transmitting secure signals. For success-ful ground-to-satellite key generation with

QKD, we will need reliable single-photontransmission and detection through a turbu-lent atmosphere against a high background.For good atmospheric transmission, free-space QKD can operate at a wavelengthnear 770 nm where the transmission fromsurface to space can be as high as 80%, andthe polarized QKD photons will faithfullytransmit because the depolarizing effects ofFaraday rotation in the ionosphere and ofatmospheric turbulence are negligible. Wecan readily produce photons at this wave-length with rugged, low-power semicon-ductor lasers, control their properties, anddetect them with efficiencies as high as65% with off-the-shelf components.

Atmospheric turbulence will cause beamwander, which we can overcome using theoptical beam-control techniques developedin free-space laser communications forhigh-bandwidth terrestrial, surface-to-satellite, satellite-to-satellite, and (poten-tially) deep-space communications. QKDis compatible with and can take advantageof the optical techniques developed for thisnew communications infrastructure.

At Los Alamos, ground-based experi-ments have shown that the single opticalphotons of QKD can faithfully transmitthrough a turbulent atmosphere and be reli-ably detected even against a daylight back-ground over a point-to-point 1.6-km path.20

This distance was limited only by the lengthsof the available ranges. Because most of theoptical effects of atmospheric turbulence ona surface-to-space path occur within 2 km ofthe ground, these results demonstrate that

QKD could effectively serve to securelyrekey a satellite on-orbit from a ground sta-tion (or for satellite-to-satellite key genera-tion).21 For illustration, we can estimate thekey generation capability of QKD between aground station and a low Earth orbit (LEO)satellite (~600 km altitude) in one overheadpass. We will assume that the QKD transmit-ter (Alice) is at the ground station and thereceiver (Bob) is on the satellite.

To estimate the key generation rate, wecan assume 20-cm diameter optics at boththe transmitter and satellite receiver. Beam-wander from atmospheric turbulence atnight at a typical optical communicationsground station can be 1 to 5 arc seconds, butfor this analysis we assume a worst case“seeing” of ~10 times the diffraction limit(10 arc seconds of wander). With a laserpulse rate of 10 MHz, one photon-per-pulseon average, and atmospheric transmissionand detector efficiencies as above, a keygeneration rate of ~500 Hz should be feasi-ble. Higher key rates would be possibleunder more typical seeing conditions. Also,with a beam fine-pointing control system,as used in laser communications systems,the beam could be locked onto the satellite,increasing the key rate to ~40 kHz.

It would also be possible to place theQKD transmitter on the satellite and thereceiver on the ground. Because most ofthe optical influence of atmospheric turbu-lence would occur in the final ~2 km of thebeam path, a higher key rate would be pos-sible. In either case, the bit error rate(BER) from background photons would be

Prepare Measure

0 1

Quantum channel:allows secret comparison

of RA and RB

Authentic public channel:for reconcilliation &

error correction

Secretrandom bit

sequence, RA

Secretrandom bit

sequence, RB

Alice

0 1

Bob

Distilled secretkey sequence

Distilled secretkey sequence

Alice Bob

Figure 7. The B92 quantum-key distribution protocol.

no worse than the few percent level seen inthe Los Alamos ground-based experi-ments.20 Although such BERs are verymuch larger than those acceptable in con-ventional communications, they are toler-ated in QKD because of the ensuredsecrecy of the transmitted bits. Interactiveerror-correction methods for removing allsuch errors are available for use in QKD.

From these simple analyses, we see thatduring the several minutes that a satellitewould be in view of the ground station,there would be adequate time to acquire thesatellite, perform the QKD transmissionsfor ~1 minute, and produce a minimum of~10,000 raw bits, from which a shortererror-free key stream of several thousandbits would be produced after error correc-tion and privacy amplification. Under moretypical seeing conditions or with beam finepointing implemented, we could produceup to 105 secret key bits in a 1-minuteQKD transmission. So, multiple new cryp-tographic keys could be generated betweena ground station and a LEO satellite in oneoverhead pass using available technology.Satellite QKD could also serve to providesecure key distribution to two ground-based users (Alice and Bob): they couldeach generate independent quantum keyswith the same satellite, which would thentransmit the XOR of the two keys to Bob.Bob would then XOR this bit string withhis key to produce a key that agrees withAlice’s. Alice and Bob could then use theirshared key for encrypted communicationsover any convenient channel.

Based on these feasibility arguments,QKD will be capable of providing the ulti-

mate level of security for future genera-tions of satellites.

QUANTUM COMPUTING ANDquantum communications are two aspectsof the new field of quantum informationtheory. This field is still in its infancy but isalready promising to have a major impacton space exploration. Quantum computingoffers an alternative and relatively unex-plored route to increased computing capac-ity for onboard autonomy and machineintelligence. Quantum algorithms let ussolve old problems in new ways, sometimesexponentially faster than possible with con-ventional computers. Quantum communica-tions could enable unconditionally securecommunications with manned spacecraftand let us encrypt sensitive data en route toand from satellites. New and unforeseenapplications of quantum technologies arebeing discovered every year.

References1. C.P. Williams and S. Clearwater, Ultimate

Zero & One: Computing at the QuantumFrontier, Copernicus Books, New York, 1999.

2. C.P. Williams and S. Clearwater, Explo-rations in Quantum Computing, Springer-Verlag, New York, 1998.

3. P.W. Shor, “Polynomial-Time Algorithmsfor Prime Factorization and Discrete Algo-rithms on a Quantum Computer,” SIAM J.Computing, Vol. 26, No. 1484–1509, 1997.

4. D.S. Abrams and S. Lloyd, “A QuantumAlgorithm Providing Exponential SpeedIncrease for Finding Eigenvalues andEigenvectors,” Physical Review Letters,Vol. 83, 1999, pp. 5162–5165.

5. R. Paturi et al. “An Improved Exponential-Time Algorithm for k-SAT,” Proc. IEEE39th Symp. Foundations of Computer Sci-ence, IEEE Computer Soc. Press, LosAlamitos, Calif., 1998, pp. 628–637.

6. N.J. Cerf, L.K. Grover, and C.P. Williams“Nested Quantum Search and StructuredProblems,” Physical Rev. A, Vol. 61, 2000.

7. L.K. Grover, “A Fast Quantum MechanicalAlgorithm for Database Search,” Proc. 28thACM Ann. Symp. Theory of Computing,ACM Press, New York, 1996, pp. 212–219.

8. C. Zalka, “Grover’s Quantum SearchingAlgorithm is Optimal,” Physical Rev. A,Vol. 60, 1999, pp. 2746–2751.

9. R. Gingrich, C.P. Williams, and N.J. Cerf,“Generalized Quantum Search with Paral-lelism,” Physical Review A, Feb. 2000.

10. H. Buhrman et al., “Multiparty QuantumCommunication Complexity,” 1997;http://xxx.lanl.gov/abs/quant-ph/9710054.

11. C.H. Bennett and S.J. Wiesner, PhysicalRev. Letters, Vol. 69, 1992, p. 2881.

12. R. Jozsa et al., “Quantum Clock Synchro-nization Based on Shared Prior Entangle-ment,” Physical Review Letters, Vol. 85, No.9, 2000.

13. S. Cavallar et al., “Factorization of a 512–BitsRSA Modulus,” LNCS, Vol. 1807, 1999, p. 1.

14. A. K. Lenstra and A. Shamir, “Analysis andOptimization of the TwinkleFactoringDevice,” LNCS, Vol. 1807, 1999, p. 35.

15. D. Atkins et al., “The Magic Words areSqueamish Ossifrage” LNCS, Vol. 917,1994, p. 265.

16. R.J. Hughes, “Cryptography, QuantumComputation and Trapped Ions,” Philosoph-ical Trans. Royal Soc., Vol. A356, p. 1853,1998.

17. R.J. Hughes et al., “Quantum Cryptography,”Contemporary Physics, Vol. 36, 1995, p. 149.

18. R. J. Hughes and J. E. Nordholt, “QuantumCryptography Takes to the Air,” PhysicsWorld, May 1999, p. 31.

19. W.T. Buttler et al., “Daylight Quantum KeyDistribution Over 16 km,” Physical Rev.Letters, Vol. 84, 2000, p. 5652.

20. R.J. Hughes et al., “Free-Space QuantumKey Distribution in Daylight,” J. ModernOptics, Vol. 47, 2000, p. 549.

18 IEEE INTELLIGENT SYSTEMS

Richard Hughes is a Laboratory Fellow and Quantum Information Scienceteam leader in the Physics Division at Los Alamos National Laboratory. He isprincipal investigator of several projects in quantum computation and quantumcryptography. Richard obtained his PhD in theoretical elementary particlephysics from the University of Liverpool, England, and has held research posi-tions at Oxford University and The Queen’s College, Oxford; the CaliforniaInstitute of Technology; and CERN, Geneva, Switzerland. In 1996 and 1998he was awarded Los Alamos Distinguished Performance Awards for his quan-tum cryptography research, and in 1997 he was awarded the Los Alamos Fel-lows’Prize for his work on quantum information science. He became a Fellowof the American Physical Society in 1999. In his spare time he competes inultra running events in excess of 100km. Contact him at hughes@lanl.gov.

Colin P. Williams is a principal scientist at the Jet Propulsion Laboratory andan acting associate professor of computer science at Stanford University. He isalso chief scientific officer of Quantum Confidential Inc., a company commer-cializing quantum technologies. His current research interests include quantumcomputing, quantum cryptography, quantum lithography, computational phasetransitions, and AI. He holds a PhD in artificial intelligence from the Universityof Edinburgh, an MSc in atmospheric physics from Imperial College, Univer-sity of London, and a BSc in mathematical physics from the University of Not-tingham. He was a former research assistant to Stephen Hawking and researchscientist at Xerox PARC. Contact him at the Jet Propulsion Lab., CaliforniaInst. of Technology, Pasadena, CA 91109; colin.p.williams@jpl.nasa.gov.