Numerical simulation of the optimal two-mode attacks for two-way continuous-variable quantum cryptography in reverse reconciliation

TL;DR

This paper derives the secret key rates for two-way continuous-variable quantum key distribution under all accessible two-mode attacks, identifying the optimal attack and demonstrating the protocol's advantage over one-way methods for long-distance secure communication.

Contribution

It provides a comprehensive analysis of the security against all accessible two-mode attacks and identifies the optimal attack model for the two-way protocol.

Findings

Optimal two-mode attack minimizes secret key rates and transmission distances.

Two-way protocol outperforms one-way protocol even under optimal attack.

The analysis demonstrates the potential for long-distance secure quantum communication.

Abstract

We analyze the security of the two-way continuous-variable quantum key distribution protocol in reverse reconciliation against general two-mode attacks, which represent all accessible attacks at fixed channel parameters. Rather than against one specific attack model, the expression of secret key rates of the two-way protocol are derived against all accessible attack models. It is found that there is an optimal two-mode attack to minimize the performance of the protocol in terms of both secret key rates and maximal transmission distances. We identify the optimal two-mode attack, give the specific attack model of the optimal two-mode attack and show the performance of the two-way protocol against the optimal two-mode attack. Even under the optimal two-mode attack, the performances of two-way protocol are still better than the corresponding one-way protocol, which shows the advantage of making a double use of the quantum channel and the potential of long-distance secure communication using two-way protocol.

Equations

$${\gamma_{{E_{1}}{E_{2}}}}=\left({\begin{array}[]{*{20}{c}}{{V_{{E_{1}}}}\cdot{{\rm{I}}_{2}}}&{{C_{{E_{1}}{E_{2}}}}}\\ {{C_{{E_{1}}{E_{2}}}}}&{{V_{{E_{2}}}}\cdot{{\rm{I}}_{2}}}\\ \end{array}}\right),$$

$${\gamma }_{E_1{E}_2}>0,{\nu }_{-}\ge 1,$$

$${\tilde{\nu }}_{-}\ge 1,$$

$$K=\beta I\left(A:B\right)-\chi \left(B:E\right),$$

$$\chi \left(B:E\right)=S\left({\rho }_E\right)-{\sum }_{m_B}p\left(m_B\right)S\left({\rho }_E^{m_B}\right),$$

$${\gamma }_{ij}=\mathrm{Tr}\left[\hat{\rho }\left\{\left({\hat{r}}_i-d_i\right),\left({\hat{r}}_j-d_j\right)\right\}\right],$$

$$\left[{\begin{array}[]{*{20}{c}}{{V_{B}}\cdot{\rm{I}}}&{0\cdot{\rm{I}}}&{0\cdot{\rm{I}}}&{\sqrt{\left({V_{B}^{2}-1}\right)}\cdot{\sigma_{z}}}\\ {0\cdot{\rm{I}}}&{{V_{A}}\cdot{\rm{I}}}&{\sqrt{\left({V_{A}^{2}-1}\right)}\cdot{\sigma_{z}}}&{0\cdot{\rm{I}}}\\ {0\cdot{\rm{I}}}&{\sqrt{\left({V_{A}^{2}-1}\right)}\cdot{\sigma_{z}}}&{{V_{A}}\cdot{\rm{I}}}&{0\cdot{\rm{I}}}\\ {\sqrt{\left({V_{B}^{2}-1}\right)}\cdot{\sigma_{z}}}&{0\cdot{\rm{I}}}&{0\cdot{\rm{I}}}&{{V_{B}}\cdot{\rm{I}}}\\ \end{array}}\right]$$

$$\left\{\begin{array}[]{l}{r_{{A_{in}}}}=\sqrt{{T_{1}}}{r_{{B_{2}}}}+\sqrt{1-{T_{1}}}{r_{{E_{1}}}}\\ {r_{{A_{3}}}}=-\sqrt{1-\eta}{r_{{A_{in}}}}+\sqrt{\eta}{r_{{A_{2}}}}\\ {r_{{A_{out}}}}=\sqrt{\eta}{r_{{A_{in}}}}+\sqrt{1-\eta}{r_{{A_{2}}}}\\ {r_{{B_{3}}}}=\sqrt{{T_{2}}}{r_{{A_{out}}}}+\sqrt{1-{T_{2}}}{r_{{E_{2}}}}\\ \end{array}\right.$$

$$\left[{\begin{array}[]{*{20}{c}}{{V_{B}}{\rm{I}}}&0&{-T^{\prime}{C_{B}}{\sigma_{z}}}&{\sqrt{\eta}T{C_{B}}{\sigma_{z}}}\\ 0&{{V_{A}}{\rm{I}}}&{\sqrt{\eta}{C_{A}}{\sigma_{z}}}&{T^{\prime}{C_{A}}{\sigma_{z}}}\\ {-T^{\prime}{C_{B}}{\sigma_{z}}}&{\sqrt{\eta}{C_{A}}{\sigma_{z}}}&{{V_{{A_{3}}}}}&{{C_{{A_{3}}{B_{3}}}}}\\ {\sqrt{\eta}T{C_{B}}{\sigma_{z}}}&{T^{\prime}{C_{A}}{\sigma_{z}}}&{{C_{{A_{3}}{B_{3}}}}}&{{V_{{B_{3}}}}}\\ \end{array}}\right]$$

$$\left\{{\begin{array}[]{*{20}{c}}{V_{{B_{3}}}^{x}=V^{\prime}+2{C_{x}}\left({1-T}\right)\sqrt{T\eta}}\\ {V_{{B_{3}}}^{p}=V^{\prime}+2{C_{p}}\left({1-T}\right)\sqrt{T\eta}}\\ {C_{{A_{3}}{B_{3}}}^{x}=C^{\prime}-{C_{x}}\left({1-T}\right)\sqrt{1-\eta}}\\ {C_{{A_{3}}{B_{3}}}^{p}=C^{\prime}-{C_{p}}\left({1-T}\right)\sqrt{1-\eta}}\\ \end{array}}\right.$$

$$\begin{array}[]{l}I\left({A:B}\right)={I_{x}}\left({A:B}\right)+{I_{p}}\left({A:B}\right)\\ \quad\quad\quad\;{\rm{=}}\frac{1}{2}\log\frac{{{V_{{A_{1x}}}}}}{{{V_{{A_{1x}}{\rm{|}}{B_{x}}}}}}+\frac{1}{2}\log\frac{{{V_{{A_{1p}}}}}}{{{V_{{A_{1p}}{\rm{|}}{B_{p}}}}}}\\ \end{array},$$

$$\gamma =S{\gamma }^{\oplus }{S}^T,{\gamma }^{\oplus }=\underset{k=1}{\overset{N}{\oplus }}{\lambda }_k\cdot {\mathrm{I}}_2,$$

$$\chi\left({B:E}\right)=\sum\limits_{i=1}^{4}{G\Big{(}\frac{{{\lambda_{i}}-1}}{2}\Big{)}}-\sum\limits_{i=5}^{8}{G\Big{(}\frac{{{\lambda_{i}}-1}}{2}\Big{)}},$$

$${\gamma_{{E_{1}}{E_{2}}}}=\left({\begin{array}[]{*{20}{c}}{{V_{E}}\cdot{{\rm{I}}_{2}}}&{{C_{opt}}\cdot{{\rm{I}}_{2}}}\\ {{C_{opt}}\cdot{{\rm{I}}_{2}}}&{{V_{{E}}}\cdot{{\rm{I}}_{2}}}\\ \end{array}}\right),$$

Full text

1 Introduction

Quantum key distribution (QKD) [1, 2] is one of the most practical applications in the field of quantum information. Its goal is to establish a secure key between two legitimate partners, usually named Alice and Bob. Continuous-variable quantum key distribution (CV-QKD) [3, 4, 5] has attracted much attention in the past few years [5, 6, 7, 8, 9] mainly because it only uses standard telecom components. A CV-QKD protocol based on Gaussian-modulated coherent states [10, 11] has been proved to be secure against arbitrary general attacks [12, 13, 14, 15, 16, 17] and experimentally demonstrated [6, 18, 19, 20, 21].

To enhance the tolerable excess noise of CV-QKD, compared to the typical one-way schemes, the two-way CV-QKD protocol was proposed [22]. Afterward, a more feasible two-way CV-QKD protocol was proposed by replacing Alice’s displacement operation with a beam splitter, which leads to a protocol that is easier to analyze when considering channel estimation [23]. In standard CV-QKD protocols the quantum communication is one way, i.e., quantum systems are sent from Alice to Bob. While in two-way protocols, this process is bidirectional, with the systems transformed by Alice and sent back to Bob. The use of two-way quantum communication can increase the secure key rate, transmission distance, and the robustness to noise [22, 23]. As a result, bosonic channels which are too noisy for one-way protocols may become secure for two-way protocols [5].

However, when comparing the performance of two-way CV-QKD protocol with one-way protocol in numerical simulations, all of the works assumed the eavesdropper performs two independent attacks [22, 23, 27] or give a specific attack model [25, 26]. It makes us to wander does the outperformance of two-way protocol against a specific attack mean two-way protocol really have advantages than one-way protocol? Do we make a fair comparison? Or it is just because the chosen attack model is powerless?

Recently, it is very interesting to see that the security of the original two-way CV-QKD protocol against two-mode attacks has been studied assuming direct reconciliation [28], and the general immunity and superadditivity of the original protocol has also been studied [29]. Inspired by the method of [28], in this paper, we analyze the security of the modified two-way CV-QKD protocol in reverse reconciliation against general two-mode attacks, including two independent attacks, all separable attacks and all entangled attacks. Normally, reverse reconciliation is more useful than direct reconciliation in practice [5]. Against all accessible two-mode attacks, the expression of secret key rates of two-way CV-QKD protocol using coherent states are derived under reverse reconciliation. Then we evaluate and compare the performance of the two-way protocol against different attacks and identify the optimal attack model, resulting the lowest secret key rate, for the eavesdropper at different transmission distance. We also show the performance of the two-way CV-QKD protocol against the optimal two-mode attack. Finally, the performances of the two-way CV-QKD protocol against the optimal attack are compared with the performances of the one-way version of the scheme and show that the two-way CV-QKD protocol still achieves higher secret key rate than one-way protocol. Thus, the two-way protocol is still able to distribute secret keys in communication lines which are too noisy for the corresponding one-way protocol.

The paper is organized as follows. In Sec. 2, we review the basic notions of the entanglement-based scheme of the two-way CV-QKD protocol and the general two-mode attacks and identify different type of attacks. In Sec. 3, we derive the expression of secret key rates of the coherent-state based two-way CV-QKD protocol. In Sec. 4, the simulation results against different attacks are provided and the performances of the two-way protocol against the optimal attack are compared with one-way protocol to show the advantage of two-way scheme. Our conclusions are drawn in Sec. 5.

2 Entanglement-based model of two-way CV-QKD protocols against two-mode attacks

In this section, we first present basic notions of the entanglement-based scheme of the two-way CV-QKD protocol using coherent states. Then we describe the general two-mode attacks and identify different type of attacks.

2.1 Entanglement-based model of two-way CV-QKD protocols

The entanglement-based scheme of the two-way CV-QKD protocol using coherent states is illustrated in Fig. 1 and can be described as follows:

Step 1: Bob initially prepares an EPR pair (EPR1 with variance $V_{B}$, where the shot noise variance is normalized to $1$), keeps the mode $B_{1}$ and sends the other mode $B_{2}$ to Alice through the channel where Eve may perform her attack.

Step 2: Alice prepares another EPR pair (EPR2 with variance $V_{A}$). She keeps the mode $A_{1}$ and measures it using heterodyne detection to get the variables $x_{A_{1}}$ and $p_{A_{1}}$. She then couples mode $A_{2}$ and the received mode $A_{in}$ from Bob with a beam splitter (transmittance: $T_{A}\in[0,1]$). Alice then sends mode $A_{out}$ back to Bob where Eve may perform her attack again. Alice measures another mode $A_{3}$ with homodyne detection for parameter estimation [23].

Step 3: Bob measures his original mode $B_{1}$ using heterodyne detection to get the variables $x_{B_{1}}$ and $p_{B_{1}}$. He also measures the received mode $B_{3}$ with heterodyne detection to get $x_{B_{3}}$ and $p_{B_{3}}$.

Step 4: Bob uses ${x_{B_{x}}}={x_{B_{3}}}-{k}x_{B_{1}}$ and ${p_{B_{p}}}={p_{B_{3}}}-{k}p_{B_{1}}$ to construct the estimator to Alice’s corresponding variable $x_{{A_{1}}}$ and $p_{{A_{1}}}$, where ${k}$ is the parameter used to optimize Bob’s estimator of Alice s corresponding value. Then Alice and Bob proceed with classical data postprocessing including reconciliation and privacy amplification. Here we use reverse reconciliation [18].

The most general eavesdropping strategy of two-way CV-QKD protocol is coherent attacks, which involve a unitary applied to all modes over all uses of the protocol. However, this could be reduced to collective attacks by assuming that Alice and Bob perform random permutations on their data [15]. When the eavesdropper perform collective attacks, she interacts independently and identically with each quantum signal over every uses. In the entanglement-based representation of two-way CV-QKD protocol, this means that the joint state ${\rho_{{A^{n}}{B^{n}}}}$ has an identical and independently distributed (i.i.d.) structure ${\rho_{{A^{n}}{B^{n}}}}=\rho_{AB}^{\otimes n}$, where n amounts the number of the uses of the protocol.

What’s more, the most general collective attack against two-way CV-QKD protocol is a joint attack involving two channels, the forward and backward channels. In each use of the protocol, Eve could intercept the two modes, one is the output of Bob side in the forward channel (mode $B_{2}$ in Fig. 1) and the other is the output of Alice side in the backward channel (mode $A_{out}$ in Fig. 1), and make them intercept with an ensemble of ancillary vacuum modes via a general unitary $U$. The remaining modes are stored in a quantum memory which will be measured at the end of the protocol.

The description of this attack can be further simplified. Since the protocol is based on the Gaussian modulation, its optimal eavesdropping attack is based on a Gaussian unitary $U$. Thus, the security of the protocol can be reduced to studying a two-mode Gaussian attack against two channels, which is depicted in Fig. 1.

2.2 Two-mode attack strategy

In this two-mode Gaussian attack, the two output modes, $B_{2}$ and $A_{out}$, are mixed with two ancillary modes, $E_{1}$ and $E_{2}$, by two beam splitters with transmissivities $T_{1}$ and $T_{2}$, respectively. These ancillary modes belong to a reservoir of ancillas ($E_{1}$, $E_{2}$ and an extra set $e$) which is globally described by a pure Gaussian state. The reduced state $\rho_{E_{1}E_{2}}$ of the injected ancillas is a correlated thermal state with zero mean and covariance matrix in the normal form

[TABLE]

where ${V_{E_{1}}}$ and ${V_{E_{2}}}$ are the variances of the thermal noise affecting each channel, ${C_{{E_{1}}{E_{2}}}}=diag\left(C_{x},C_{p}\right)$ is the correlation parameters between two ancillas. The various parameters ${V_{E_{1}}}$, ${V_{E_{2}}}$, $C_{x}$ and $C_{p}$ must satisfy the physical constraints [9, 30, 31, 32]:

[TABLE]

where the positivity ${\gamma_{{E_{1}}{E_{2}}}}>0$ is equivalent to the positivity of the principal minors of the matrix of Eq. 1, ${\nu_{-}}=\sqrt{0.5\left({\Delta\left({{\gamma_{{E_{1}}{E_{2}}}}}\right)-\sqrt{\Delta{{\left({{\gamma_{{E_{1}}{E_{2}}}}}\right)}^{2}}-4\det{\gamma_{{E_{1}}{E_{2}}}}}}\right)}$, and $\Delta\left({{\gamma_{{E_{1}}{E_{2}}}}}\right):=V_{{E_{1}}}^{2}+V_{{E_{2}}}^{2}+2{C_{x}}{C_{p}}$.

In the two-way CV-QKD protocols, normally the excess noises of two channels are fixed, which means the variances, ${V_{E_{1}}}$ and ${V_{E_{2}}}$, are fixed for every transmissivity $T_{1}$ and $T_{2}$. Thus, the remaining degrees of freedom in the two-mode Gaussian attack are the correlation parameters $C_{x}$ and $C_{p}$, which can be represented as a point on a correlation plane. Each point of this plane describes an attack. Among all these accessible attacks, those satisfying the further condition

[TABLE]

are separable attacks (${\gamma_{{E_{1}}{E_{2}}}}$ seperable), while those violating the condition of Eq. 3 are entangled attacks (${\gamma_{{E_{1}}{E_{2}}}}$ entangled), where ${{\tilde{\nu}}_{-}}=\sqrt{0.5\left({\tilde{\Delta}\left({{\gamma_{{E_{1}}{E_{2}}}}}\right)-\sqrt{\tilde{\Delta}{{\left({{\gamma_{{E_{1}}{E_{2}}}}}\right)}^{2}}-4\det{\gamma_{{E_{1}}{E_{2}}}}}}\right)}$, and $\tilde{\Delta}\left({{\gamma_{{E_{1}}{E_{2}}}}}\right):=V_{{E_{1}}}^{2}+V_{{E_{2}}}^{2}-2{C_{x}}{C_{p}}$. Fig. 2 are a numerical representation of the correlation plane under fixed variances: ${V_{E_{1}}}=3$ and ${V_{E_{2}}}=3$. Then we can identify the following attacks: Separable Attack, Independent Attack and Entangled Attack, which is detailed describe in Ref. [9, 32]. Here we just give the some basic knowledge which will be used in the following analysis. As illustrated in Fig. 2, the point (1) represents the independent attack; the point (2), (3), (4) and (5) represent four specific separable attacks; the point (6) and (7) represent two specific entangled attacks.

2.3 Security analysis of two-way CV-QKD protocol against two-mode attacks

In this subsection, we will derive the secure bound of the two-way protocol using coherent states against two-mode Gaussian attacks.

From the information-theoretic perspective, the asymptotic secret key rate ${K}$ against two-mode Gaussian attacks in reverse reconciliation is given by [33]

[TABLE]

where $\beta$ is the reconciliation efficiency, $I(A:B)$ is the classical mutual information between Alice and Bob, $\chi(B:E)$ is the the Holevo bound between Eve and Bob [34]

[TABLE]

where $S(\rho)$ is the von Neumann entropy of the quantum state $\rho$, $m_{B}$ is Bob’s measurement result, and it can take the form $m_{B}=x_{B}$ for homodyne detection or the form $m_{B}=x_{B},p_{B}$ for heterodyne detection. $p\left(m_{B}\right)$ is the probability density of the measurement result, $\rho_{E}^{m_{B}}$ is the corresponding state of Eve’s ancillary conditioned on Bob’s measurement result.

The overall state can be described by the covariance matrix, which is defined by

[TABLE]

where ${{\hat{r}}_{2i-1}}={{\hat{x}}_{i}}$, ${{\hat{r}}_{2i}}={{\hat{p}}_{i}}$, ${d_{i}}=\left\langle{{{\hat{r}}_{i}}}\right\rangle={\rm{Tr}}\left[{\hat{\rho}{{\hat{r}}_{i}}}\right]$, $\hat{\rho}$ is the density matrix, and denotes the anticommutator. Before channel transmission, the covariance matrix ${\gamma_{{B_{1}}{A_{1}}{A_{2}}{B_{2}}}}$ is

[TABLE]

where $V_{B}$ is the variance of EPR1 and $V_{A}$ is the variance of EPR2. The channel transmission relationship are as follow,

[TABLE]

After two-mode Gaussian attacks, the covariance matrix ${\gamma_{{B_{1}}{A_{1}}{A_{2}}{B_{2}}}}$ is changed into ${\gamma_{{B_{1}}{A_{1}}{A_{3}}{B_{3}}}}$, which is given by

[TABLE]

where the forward and backward channel are assumed to have identical transmissitivity $T_{1}=T_{2}=T$ and same excess noise $V_{E_{1}}=V_{E_{2}}=V_{E}$. The parameters $T^{\prime}=\sqrt{T\left({1-\eta}\right)}$, ${C_{A}}=\sqrt{\left({V_{A}^{2}-1}\right)}$, ${C_{B}}=\sqrt{\left({V_{B}^{2}-1}\right)}$. The matrices ${V_{{A_{3}}}}=\left[{\eta{V_{A}}+\left({1-\eta}\right)\left({T{V_{B}}+\left({1-T}\right){V_{E}}}\right)}\right]{\rm{I}}$, ${V_{{B_{3}}}}=diag\left({V_{{B_{3}}}^{x}},{V_{{B_{3}}}^{p}}\right)$ and ${C_{{A_{3}}{B_{3}}}}=diag\left({C_{{A_{3}}{B_{3}}}^{x}},{C_{{A_{3}}{B_{3}}}^{p}}\right)$, which is given by

[TABLE]

where $V^{\prime}=T\left({1-\eta}\right){V_{A}}+{T^{2}}\eta{V_{B}}+\left\{{1-T\left[{1-\eta\left({1-T}\right)}\right]}\right\}{V_{E}}$ and $C^{\prime}=\sqrt{T\eta\left({1-\eta}\right)}{V_{A}}-T\sqrt{T\eta\left({1-\eta}\right)}{V_{B}}-\left({1-T}\right)\sqrt{T\eta\left({1-\eta}\right)}{V_{E}}$

For two-way CV-QKD protocol using coherent states, Alice measures mode $A_{1}$ to get the variables $x_{A_{1}}$, $p_{A_{1}}$ using heterodyne detectors. While Bob measures modes $B_{1}$ and $B_{3}$ to get the variables $x_{B_{1}}$, $p_{B_{1}}$ and $x_{B_{3}}$, $p_{B_{3}}$ using heterodyne detectors. Then he uses the estimators ${x_{B_{x}}}={x_{B_{3}}}-{k}x_{B_{1}}$, ${p_{B_{p}}}={p_{B_{3}}}-{k}p_{B_{1}}$ to construct $x_{{A_{1}}}$, $p_{{A_{1}}}$ at the same time.

The classical mutual information between Alice and Bob becomes

[TABLE]

where $V_{A_{1x}}=V_{A_{1p}}=\frac{1}{2}\left(V_{A_{1}}+1\right)$, $V_{A_{1x}|x_{B_{x}}}=\frac{1}{2}\left(V_{A_{1}|x_{B_{x}}}+1\right)$ and $V_{A_{1p}|p_{B_{p}}}=\frac{1}{2}\left(V_{A_{1}|p_{B_{p}}}+1\right)$.

The calculation of $\chi\left({B:E}\right)$ is more complex. For heterodyne detection, we have $\chi_{x}\left({B:E}\right)=S\left(E\right)-S\left(E|x_{B_{x}},p_{B_{p}}\right)$. Assuming Eve is able to purify Alice and Bob’s system, we have $S\left(E\right)=S\left(B_{1}A_{1}A_{3}B_{3}\right)$ and $S\left(E|x_{B_{x}},p_{B_{p}}\right)=S\left(B_{1}A_{1}A_{3}B_{3}|x_{B_{x}},p_{B_{p}}\right)$. The $S\left(B_{1}A_{1}A_{3}B_{3}\right)$ and $S\left(B_{1}A_{1}A_{3}B_{3}|x_{B_{x}},p_{B_{p}}\right)$ can be calculated by the symplectic eigenvalues of the covariance matrices $\gamma_{B_{1}A_{1}A_{3}B_{3}}$ and $\gamma_{B_{1}A_{1}A_{3}B_{3}|x_{B_{x}},p_{B_{p}}}$, which is derived from the following method.

Given an arbitrary $N$-mode covariance matrix $\gamma$, there exists a symplectic matrix $S$ such that

[TABLE]

where the diagonal matrix ${\gamma^{\oplus}}$ is called the Williamson form of $\gamma$, and the $N$ positive quantities $\lambda_{k}$ are called the symplectic eigenvalues of $\gamma$ [5]. Here the symplectic spectrum $\left\{{{\lambda_{k}}}\right\}_{k=1}^{N}$ can be easily computed as the standard eigenspectrum of the matrix $\left|{i\Omega\gamma}\right|$ [5], where the modulus must be understood in the operational sense. Here $\Omega$ is the symplectic form \Omega=\mathop{\oplus}\limits_{k=1}^{N}{\kern 1.0pt}{\kern 1.0pt}\left[{\begin{array}[]{*{20}{c}}0&1\\ {-1}&0\\ \end{array}}\right].

The covariance matrix $\gamma_{B_{1}A_{1}A_{3}B_{3}}$ is given by Eq. 9, while the derivation of $\gamma_{B_{1}A_{1}A_{3}B_{3}|x_{B_{x}},p_{B_{p}}}$ need to concern Bob’s post-processing strategy. In coherent-state based protocol, Bob uses ${x_{B_{x}}}={x_{B_{3}}}-{k}x_{B_{1}}$ and ${p_{B_{p}}}={p_{B_{3}}}-{k}p_{B_{1}}$ to construct $x_{{A_{1}}}$ and $p_{{A_{1}}}$ at the same time, where ${k}=\sqrt{0.5{T^{2}}\eta\frac{{{V_{B}}-1}}{{{V_{B}}+1}}}$. Thus, we are not able to derive $\gamma_{B_{1}A_{1}A_{3}B_{3}|x_{B_{x}}}$ directly. As developed in [25], we transform modes $B_{3x}$ and $B_{1x}$ into modes $B_{x}$ and $B_{4}$ with a CNOT gate $\Gamma_{x}$, and transform modes $B_{3p}$ and $B_{1p}$ into modes $B_{p}$ and $B_{5}$ with a CNOT gate $\Gamma_{p}$. We should emphasize that this is a virtual operation in the entanglement-based scheme, while in its corresponding Prepare & Measurement scheme Bob does not perform such operations.

Since we have the covariance matrices $\gamma_{B_{1}A_{1}A_{3}B_{3}}$ and $\gamma_{B_{1}A_{1}A_{3}B_{3}|x_{B_{x}},p_{B_{p}}}$, we could calculate the symplectic eigenvalues of them by the method mentioned before. Thus, the expression for Eq. 5 can be further simplified as follows:

[TABLE]

where $G(x)=(x+1)\log_{2}(x+1)-x\log_{2}x$, ${\lambda_{1-4}}$ are the symplectic eigenvalues of the covariance matrix $\gamma_{B_{1}A_{1}A_{3}B_{3}}$ and ${\lambda_{5-8}}$ are the symplectic eigenvalues of the covariance matrix $\gamma_{B_{1}A_{1}A_{3}B_{3}|x_{B_{x}},p_{B_{p}}}$.

3 Optimal two-mode attack strategy

In this section, to find the optimal two-mode attack strategy against two-way CV-QKD protocols, the performance of two-way CV-QKD protocols are compared under different types two-mode attack strategy.

We first analyze the secret key rates of the protocol against all accessible attacks at fixed transmission distance $d=10km,20km,30km$, where we only put the result at $d=10km$ here and put the results at $d=20km,30km$ in the appendix. The parameters affecting the value of the secret key rate are the reconciliation efficiency $\beta$, the variance of Alice’s and Bob’s modulation: $(V_{A}-1)$ and $(V_{B}-1)$, the transmittance of the beam splitter at Alice’s side $\eta$ and the transmission efficiency $T$. The parameters ${V_{A}}$, ${V_{B}}$, $\beta$, $\eta$ and ${\upsilon_{el}}$ are fixed in all simulations. Here, we choose the variance $V_{A}=V_{B}=20$, $\beta=1$, $\eta=0.75$ as the value of the beam splitter transmittance at Alice’s side and channel noise $\varepsilon=0.2$. As illustrated in Fig. 3 (a), different colors correspond to different values of the secret key rate, where color red corresponds to higher value of the rate, while color blue corresponds to lower value of the rate. It is found that the secret key rate is symmetric with respect to the bisector $C_{x}=C_{p}$, which is coincident with the security analysis in Sec.2.3. What’s more, in order to be more clear, we plot the specific cases where $C_{x}=-C_{p}$ and $C_{x}=C_{p}$ in Fig. 3 (b) and (c), respectively. The minimum key rate associated with the optimal attack correspond to the two-mode symmetric separable attack with $C_{x}=C_{p}=C_{opt}^{10km}=0.0078$ when we fix the channel excess noise $\varepsilon=0.2$. The situation at distance $d=20km,30km$ is illustrated in the appendix. The optimal attack is the two-mode symmetric separable attack $C_{x}=C_{p}=C_{opt}^{20km}=0.0073$ at $d=20km$, and is the two-mode symmetric separable attack with $C_{x}=C_{p}=C_{opt}^{30km}=0.0039$ at $d=30km$

Depends on the results of each distance, we plot the normalized correlation parameters of the optimal two-mode attack as a function of the distance under different channel excess noise $\varepsilon=0.2,0.15,0.1,0.05,0.02$ in Fig. 4. The optimal two-mode attack always occurs at the case where the correlation parameter $C_{x}$ is equal to $C_{p}$. The normalized correlation parameters ${{C^{\prime}}_{x}}$ is defined as ${{C^{\prime}}_{x}}={{{C_{x}}}\mathord{\left/{\vphantom{{{C_{x}}}{C_{sep}^{\max}}}}\right.\kern-1.2pt}{C_{sep}^{\max}}}$, where ${{C^{\prime}}_{x}}=-1,0,1$ correspond the case of points (5), (1), (4) in Fig. 2. Thus, depending on Eq. 1, the covariance matrix of the injected ancillas of the optimal two-mode attack becomes

[TABLE]

where ${V_{E}}=1+\frac{{T\varepsilon}}{{1-T}}$.

This covariance matrix represents a specific two-mode attack model, which is illustrated in Fig. 5. Eve initially prepares two EPR pairs (EPR1 with variance $V_{1}=V_{E}+C_{opt}$ and EPR2 with variance $V_{2}=V_{E}-C_{opt}$), keeps one mode of each EPR pairs and then she couples the other mode of the two EPR pairs with a $50:50$ beam splitter. The output modes of the beam splitter, mode $E_{1}$ and $E_{2}$, are two ancillary injected modes of two-mode attack. Finally, Eve mixes modes $E_{1}$ and $E_{2}$ with the modes in the forward and backward channels, by two beam splitters with transmissivity $T$, respectively. The remaining modes are stored in the quantum memory which will be measured at the end of the protocol. We note that, no matter what specific model of Eve is, the optimal two-mode attack has the feature that $V_{E_{1}}=V_{E_{2}}$, $C_{x}=C_{p}$, which is symmetric for x-quadrature and p-quadrature.

4 Outperfomance of two-way CV-QKD protocols

In the following, we compare the two-way CV-QKD protocol with their one-way counterpart to examine whether two-way protocol remains advantageous when the optimal two-mode attack strategy is used against the two-way protocol.

To reveal the advantage of two-way CV-QKD protocol more explicitly, the relationship between the tolerable excess noise and the transmission distance are shown in Fig. 6. When using ideal reconciliation efficiency $\beta=1$, the upper limit of the tolerable excess noise of two-way CV-QKD protocol is almost the double of the upper limit of the one-way protocol at short transmission distance. As the transmission distance increases, this advantage would be reduced. But the tolerable excess noise of the two-way protocol is still higher than that of the one-way protocol. As the reconciliation efficiency decreases from an ideal value to a more practical one [6], the advantage of two-way protocols still holds and becomes more obvious. The results in Fig. 6 (b) show that the two-way CV-QKD could tolerate more channel excess noise than the one-way protocol.

Thus, from the above discussion, it is found that even under the optimal two-mode attacks, which cause lower secret key rate and shorter transmission distance, the performances of the two-way protocol are still better than the one-way protocol. The two-way protocol is able to distribute secret keys in communication lines which are too noisy for the one-way protocol.

5 CONCLUSION

In this paper, we analyze the security of two-way CV-QKD protocol against general two-mode attacks, including two independent attacks, all separable attacks and all entangled attacks. Against all accessible two-mode attacks, the expression of secret key rates of the two-way CV-QKD protocol is derived under the reverse reconciliation. Then we evaluate and compare the performance of the two-way protocol against different attacks and it is found that there is an optimal two-mode attack to minimize the performance of the protocol in terms of both key rates and maximal transmission distances. We identify the optimal two-mode attack, give the specific attack model of the optimal two-mode attack and show the performance of the two-way protocol against the optimal two-mode attack.

The performance of the two-way CV-QKD protocol against the optimal attack are compared with the performances of the one-way version of the scheme and show that the two-way CV-QKD protocols still achieve higher secret key rate and tolerate more excess noise than one-way protocol, which shows the advantage of making a double use of the quantum channel and addressing the question - whether the two-way protocol really have advantages than one-way protocol?

Acknowledgments

This work was supported in part by the National Basic Research Program of China (973 Pro-gram) under Grant 2014CB340102, in part by the National Natural Science Foundation under Grants 61225003, 61531003, 61427813, 61401036, 61471051, in part by BUPT Excellent Ph.D. Students Foundation (CX2015205) and in part by Youth research and innovation program of BUPT(2015RC12).

Appendix A Optimal two-mode attack strategy at different distance

In this appendix, we show the secret key rates of the two-way CV-QKD protocol against all accessible attacks at fixed transmission distance $d=20km,30km$. The parameters we use here keep the same with Sec. 3. As illustrated in Fig. 7 (a) and Fig. 8 (a), different colors correspond to different values of the secret key rate, where color red regions correspond to higher values of the rate, while color blue regions correspond to lower values of the rate. What’s more, we also plot the specific cases where $C_{x}=-C_{p}$ and $C_{x}=C_{p}$ in Fig. 7 (b), (c), and Fig. 8 (b), (c), respectively. The minimal key rate associated with the optimal attack correspond to the two-mode symmetric separable attack $C_{x}=C_{p}=C_{opt}^{20km}=0.0073$ at $d=20km$ and correspond to the two-mode symmetric separable attack $C_{x}=C_{p}=C_{opt}^{30km}=0.0039$ at $d=30km$.