Information-theoretic security proof of differential-phase-shift quantum key distribution protocol based on complementarity

TL;DR

This paper presents an information-theoretic security proof for the differential-phase-shift quantum key distribution protocol using the complementarity approach, resulting in improved key rates and broader applicability compared to previous methods.

Contribution

It introduces a security proof based on the complementarity approach that enhances key rate estimation and removes the need for numerical calculations, enabling security evaluation for any block size.

Findings

Achieved slightly better key generation rate than previous proofs.

Eliminated the need for numerical calculations in security estimation.

Enabled security evaluation for any block size.

Abstract

We show the information-theoretic security proof of the differential-phase-shift (DPS) quantum key distribution (QKD) protocol based on the complementarity approach [arXiv:0704.3661 (2007)]. Our security proof provides a slightly better key generation rate compared to the one derived in the previous security proof in [arXiv:1208.1995 (2012)] that is based on the Shor-Preskill approach [Phys. Rev. Lett. ${\bf 85}$, 441 (2000)]. This improvement is obtained because the complementarity approach can employ more detailed information on Alice's sending state in estimating the leaked information to an eavesdropper. Moreover, we remove the necessity of the numerical calculation that was needed in the previous analysis to estimate the leaked information. This leads to an advantage that our security proof enables us to evaluate the security of the DPS protocol with any block size. This paper highlights one of the fundamental differences between the Shor-Preskill and the complementarity approaches.

Figures

Equations

$$\underset{i=1}{\overset{L}{⨂}}|e^{\mathrm{i}\delta }(-1{)}^{s_i}\alpha {⟩}_{S,i},$$

$$Q:=\frac{|{\mathbf{\kappa }}_A|}{N},e^{(\mathrm{b})}:=\frac{\mathrm{wt}({\mathbf{\kappa }}_A-{\mathbf{\kappa }}_B)}{|{\mathbf{\kappa }}_A|},$$

$$G=[Q(1-f_{\mathrm{EC}}(e^{(\mathrm{b})})-f_{\mathrm{PA}})]/L.$$

$$\displaystyle\hat{\Pi}_{j,s}=\hat{P}\Big{(}\frac{\sqrt{\kappa_{j}}|j\rangle_{B}+(-1)^{s}\sqrt{\kappa_{j+1}}|j+1\rangle_{B}}{\sqrt{2}}\Big{)}$$

$${\hat{\Pi }}_{j,s}={\hat{F}}_j^{†}\hat{P}(|s{⟩}_{B_{\mathrm{q}}}){\hat{F}}_j$$

$${\hat{F}}_j=\sqrt{{\kappa }_j}|-{⟩}_{B_{\mathrm{q}}}{}_B⟨j|+\sqrt{{\kappa }_{j+1}}|+{⟩}_{B_{\mathrm{q}}}{}_B⟨j+1|.$$

$$|\Phi {⟩}_{C,A,S}=\sum _{\nu =0}^{\infty }|\nu {⟩}_C{\hat{\pi }}_{\nu }\underset{i=1}{\overset{L}{⨂}}|\varphi {⟩}_{A,S,i}$$

$$|\varphi {⟩}_{A,S,i}=\frac{1}{\sqrt{2}}\sum _{s_i=0}^1\hat{H}|s_i{⟩}_{A,i}|(-1{)}^{s_i}\alpha {⟩}_{S,i}.$$

$${}_{A,j}{⟨\pm |\varphi ⟩}_{A,S,j}=\frac{1}{\sqrt{2}}|\pm \alpha {⟩}_{S,j},$$

$$\sum _{s=0}^1{\hat{\Pi }}_{j,s}={\hat{F}}_j^{†}{\hat{F}}_j.$$

$$|{\psi }_{+}{⟩}_{A,j,j+1}:=|0{⟩}_{A,j}|1{⟩}_{A,j+1}$$

$$|{\psi }_{-}{⟩}_{A,j,j+1}:=|1{⟩}_{A,j}|0{⟩}_{A,j+1},$$

$${\hat{U}}_{\mathrm{CNOT}}^{(j)}|{\psi }_{+}{⟩}_{A,j,j+1}=|0{⟩}_{A,j}|1{⟩}_{A,j+1}$$

$${\hat{U}}_{\mathrm{CNOT}}^{(j)}|{\psi }_{-}{⟩}_{A,j,j+1}=|1{⟩}_{A,j}|1{⟩}_{A,j+1},$$

$$\mathrm{if}{z}_{j+1}=1\to z_j=\{\begin{array}{l}0\mathrm{if}{x}_B=+\\ 1\mathrm{if}{x}_B=-.\end{array}$$

$$||{}_{A,j}⟨z_j|{}_{A,j+1}⟨0|{\hat{U}}_{\mathrm{CNOT}}^{(j)}\underset{k=j,j+1}{⨂}|\varphi {⟩}_{A,S,k}|{|}^2$$

$$\propto \frac{1+⟨-\alpha |\alpha ⟩[⟨-\alpha |\alpha ⟩+(-1{)}^{z_j}2]}{2(1+{⟨-\alpha |\alpha ⟩}^2)}=:p(\alpha ,z_j)$$

$$\mathrm{if}{z}_{j+1}=0\to z_j=0.$$

$$\mathrm{if}{z}_{j+1}=0\to z_j=\{\begin{array}{l}0\mathrm{with}\mathrm{probability}1/2\\ 1\mathrm{with}\mathrm{probability}1/2.\end{array}$$

$$Q{f}_{\mathrm{PA}}=\sum _{\nu =0}^{\infty }{Q}^{(\nu )}{f}_{\mathrm{PA}}^{(\nu )}.$$

$$f_{\mathrm{PA}}^{(\nu )}=h(e^{(\mathrm{ph},\nu )}),$$

$${\hat{e}}_j^{(\mathrm{ph})}=$$

$$+$$

$${\hat{e}}_j^{(\mathrm{b})}=\sum _{s,s^{\prime }}\hat{P}(\hat{H}|s{⟩}_{A,j})\hat{P}(\hat{H}|s^{\prime }{⟩}_{A,j+1}){\hat{\Pi }}_{j,s\oplus s^{\prime }\oplus 1}.$$

$$\hat{U}\underset{i^{\prime }=1}{\overset{L}{⨂}}(\hat{H}|s_{i^{\prime }}{⟩}_{A,i^{\prime }})|i{⟩}_B=(-1{)}^{s_i}\underset{i^{\prime }=1}{\overset{L}{⨂}}(\hat{H}|s_{i^{\prime }}{⟩}_{A,i^{\prime }})|i{⟩}_B$$

$$\hat{U}{\hat{e}}_j^{(\mathrm{ph})}{\hat{U}}^{†}=\sum _{\mathbf{a}}\hat{P}(|\mathbf{a}{⟩}_A)\otimes$$

$$\displaystyle\Big{[}\kappa_{j}\delta_{a_{j+1},1}\hat{P}(|j\rangle_{B})+\kappa_{j+1}\delta_{a_{j},1}\hat{P}(|j+1\rangle_{B})\Big{]},$$

$$\hat{U}{\hat{e}}_j^{(\mathrm{b})}{\hat{U}}^{†}={\hat{\Pi }}_{j,1}.$$

$${\hat{e}}^{(\mathrm{ph})}=\sum _{j=1}^{L-1}{\hat{e}}_j^{(\mathrm{ph})},{\hat{e}}^{(\mathrm{b})}=\sum _{j=1}^{L-1}{\hat{e}}_j^{(\mathrm{b})}.$$

$$\hat{U}{\hat{e}}^{(\mathrm{ph})}{\hat{U}}^{†}=\sum _{\mathbf{a}}\hat{P}(|\mathbf{a}{⟩}_A)\otimes {\hat{\Pi }}_{\mathbf{a}}^{(\mathrm{ph})},$$

$${\hat{\Pi }}_{\mathbf{a}}^{(\mathrm{ph})}=$$

$$+{\delta }_{a_{L-1},1}\hat{P}(|L{⟩}_B),$$

Full text

I Introduction

Quantum key distribution (QKD) holds promise to achieve information-theoretically secure communication between two distant parties (Alice and Bob) against any eavesdropper (Eve). Since the first invention of the BB84 protocol Bennett and Brassard (1984), many QKD protocols have been proposed so far Ekert (1991); Bennett (1992); Bruß (1998); Scarani et al. (2004); Stucki et al. (2005); Inoue et al. (2002, 2003); Grosshans and Grangier (2002). Among them, the differential-phase-shift (DPS) QKD protocol Inoue et al. (2003) has been considered as one of the promising protocols for future implementation since this protocol can be rather simply implemented with a passive detection unit. Recently, a field demonstration of the DPS protocol Sasaki et al. (2011) has already been conducted, and the information-theoretic security proofs of the DPS protocol have been established when Alice employs a single-photon source  Wen et al. (2009) and a block-wise phase-randomized coherent light source Tamaki et al. (2012).

The previous security proof Tamaki et al. (2012) with coherent light source is based on the Shor-Preskill approach  Shor and Preskill (2000) in which Alice and Bob virtually extract a maximally-entangled state (MES) to show that they share a monogamy correlation. In order to extract an MES, Alice and Bob use some estimated information about the correlation between them. Specifically, this information consists of the bit and phase error rates, where the phase error is defined by fictitious erroneous outcomes when Alice and Bob would have measured their virtual qubits in a basis conjugate to the basis for generating the key. Since the phase error rate cannot be directly obtained in the experiment, the estimation of this quantity is a central issue in the security proof, and some security proofs have been conducted along this approach  Koashi and Preskill (2003); Tamaki et al. (2003); Koashi (2004); Boileau et al. (2005); Tamaki and Lo (2006); Wen et al. (2009).

Another approach for the security proof is the complementarity approach Koashi (2007). In this approach, a complementary control of the actual protocol and a virtual protocol are considered, which Alice and Bob choose to execute, but cannot execute simultaneously. The goal of the actual protocol is to agree on the bit values along the key generation basis, say the $X$ basis, while in the virtual protocol, Alice and Bob collaborate to create an eigenstate of the $Z$ basis (a complementary basis to the $X$ basis) in Alice’s side. With these protocols, Koashi proved in Koashi (2007) that the necessary and sufficient condition for the secure key distillation is to be able to execute whichever task was chosen. On one hand, once an MES is shared between Alice and Bob, they also accomplish the complementary task, which implies that the Shor-Preskill approach is included in the complementarity one. On the other hand, the purpose of the complementarity approach is to create an eigenstate of the $Z$ basis at Alice’s side, and therefore, we can employ some additional information, such as the one on Alice’s sending state, which may provide an advantage over the Shor-Preskill approach.

In this paper, we show that these two approaches indeed give a different resulting secret key rate of the DPS QKD protocol by exploiting a property of pulses emitted by Alice. More specifically, we adopt the complementarity approach for the security proof where we accommodate the intuition that it is difficult to extract information from a train of weak coherent pulses employed in the DPS protocol. As a result, we show that the secure key rate based on the complementarity approach is 1.22 times as high as the one based on the Shor-Preskill approach when the bit error rate is 2%. Moreover, we remove the necessity of the numerical calculation that was needed to evaluate the leaked information to Eve in the previous analysis Tamaki et al. (2012), and we provide the closed formulas for the upper bounds on the leaked information. This leads to an advantage that our security proof enables us to evaluate the security of the DPS protocol with any block size.

This paper is organized as follows. In Sec. II, we introduce the DPS protocol including the assumptions on Alice and Bob’s devices. In Sec. III, we explain our security proof based on the complementarity approach. In our security proof, we estimate the leaked information for each photon number emission separately, and in Sec. IV, we show the resulting upper bounds on the estimated leaked information up to the two-photon emission events. In Sec. V, we compare the resulting secret key rates based on the Shor-Preskill and the complementarity approaches, and finally, we conclude our paper in Sec. VI.

II DPS QKD

We first describe the setup of the DPS protocol (see Fig. 1), and list up the assumptions we make on Alice and Bob’s devices. Note that the setup and the assumptions are exactly the same as those in Tamaki et al. (2012).

II.1 Setup and assumptions

Alice uses a laser source emitting coherent pulses and a phase modulator, and a train of $L$ $(L\geq 3)$ pulses forms a block. Bob uses a one-bit delay interferometer with two 50:50 beam splitters and with its delay being equal to the interval of the neighboring sending pulses. After the interferometer, the pulses are detected by two photon detectors corresponding to bit values of 0 and 1. The $j^{{\rm th}}$ ($1\leq j\leq L-1$) time slot is defined as an expected detection time at Bob’s detectors from the superposition of the $j^{{\rm th}}$ and $(j+1)^{{\rm th}}$ incoming pulses. Also, the $0^{{\rm th}}$ ($L^{{\rm th}}$) time slot is defined as an expected detection time at Bob’s detectors from the superposition of the $1^{{\rm st}}$ ($L^{{\rm th}}$) incoming pulse and the $L^{{\rm th}}$ incoming pulse in the previous block ($1^{{\rm st}}$ incoming pulse in the next block).

As for the assumptions on Alice’s device, we assume that (A 1) the phase modulator randomly modulates each relative phase between adjacent sending pulses by 0 or $\pi$. Moreover, (A 2) the randomization of overall optical phase $\delta$ is done for each block of $L$ pulses. This means that the quantum state of the $L$ pulses is written as a classical mixture of the total photon number contained in the $L$ pulses. Besides, (A 3) we do not consider any side-channel in Alice’s site.

Regarding the assumptions on Bob’s device, we suppose that (B 1) Bob uses two photon-number-resolving (PNR) detectors, which can discriminate among the vacuum, a single-photon and multiphoton. Also, we assume that (B 2) the detection efficiency is the same for both detectors. Finally, (B 3) we do not consider any side-channel in Bob’s site.

II.2 Actual protocol

The actual protocol proceeds as follows. In its description, $|\bm{\kappa}|$ denotes the length of a bit string $\bm{\kappa}$.

(a 1) Alice generates a random $L$-bit sequence $s_{1}s_{2}...s_{L}$ and a random common phase shift $\delta\in[0,2\pi)$. For a random $L$-bit sequence $s_{1}s_{2}...s_{L}$, she sends the following coherent state (system $\mathcal{H}_{S}$) to Bob through a quantum channel

[TABLE]

where $|\alpha\rangle_{S,i}$ represents the coherent state $\sum_{n}e^{-|\alpha|^{2}/2}\alpha^{n}|n\rangle_{S,i}/\sqrt{n!}$ of the $i^{{\rm th}}$ pulse mode.

(a 2) Bob performs the interference measurement with two PNR detectors, and we call the successful detection event if Bob detects one-photon in the $j^{{\rm th}}$ time slot (with $1\leq j\leq L-1$), and detects the vacuum in all the other time slots including the $0^{{\rm th}}$ and $L^{{\rm th}}$ time slots. If the successful detection occurs, the variable $j$ is set to the time slot, otherwise Bob sets $j=0$. If $j\neq 0$, he obtains his raw bit $s\in\{0,1\}$ depending on which detector has reported a detection at the $j^{{\rm th}}$ time slot. Bob announces $j$ over an authenticated public channel.

(a 3) If $j\neq 0$, Alice calculates her raw key bit as $s_{j}\oplus s_{j+1}\in\{0,1\}$.

(a 4) Alice and Bob repeat steps (a 1)-(a 3) $N$ times.

(a 5) Alice defines a sifted key $\bm{\kappa}_{A}$ by concatenating the successful detection events (i.e., $j\neq 0$).

(a 6) Bob defines a sifted key $\bm{\kappa}_{B}$ by concatenating the successful detection events (i.e., $j\neq 0$).

(a 7) Bob corrects the errors in his sifted key $\bm{\kappa}_{B}$ to make it coincide with $\bm{\kappa}_{A}$ by sacrificing $|\bm{\kappa}_{A}|f_{{\rm EC}}$ bits of encrypted public communication from Alice by consuming the same length of the pre-shared secret key.

(a 8) Alice and Bob conduct privacy amplification by shortening their keys by $|\bm{\kappa}_{A}|f_{{\rm PA}}$ to obtain the final keys.

In this paper, we consider the asymptotic limit of the sifted key length ($N\rightarrow\infty$). In the experiments, the following parameters are observed:

[TABLE]

where the minus sign is a bit-by-bit modulo-2 subtraction and ${\rm wt}(\bm{\kappa})$ denotes the weight (the number of 1’s) in a bit string $\bm{\kappa}$. In the asymptotic limit, $f_{{\rm EC}}$ is given by a function of the bit error rate $e^{({\rm b})}$. The asymptotic key generation rate per sending pulse is given by Gottesman et al. (2004); Koashi (2009)

[TABLE]

In this key generation formula, we omit for simplicity the random sampling procedure to estimate the bit error rate $e^{({\rm b})}$ because its cost is negligible in the asymptotic limit.

In step (a 2), when the successful detection event ($j\neq 0$) occurs, the state of the incoming $L$ pulses is expressed by the Hilbert space $\mathcal{H}_{B}$ spanned by $L$ states, and we denote its orthonormal basis by $\{|i\rangle_{B}\}^{L}_{i=1}$, with $i$ representing the position of the single-photon before the first beam splitter. Determination of the detected time slot $j$ and the bit value $s\in\{0,1\}$ is represented by a generalized measurement on the system $\mathcal{H}_{B}$. Let $\hat{\Pi}_{j,s}$ be the POVM elements for the bit value $s$ detected at the $j^{{\rm th}}$ time slot (with $1\leq j\leq L-1$). Considering the action of the beam splitters, they are written as

[TABLE]

with $\kappa_{1}=\kappa_{L}=1$ and $\kappa_{i}=1/2$ (for $2\leq i\leq L-1$). Here we define $\hat{P}(|\cdot\rangle)=|\cdot\rangle\langle\cdot|$. For later discussions, we decompose $\hat{\Pi}_{j,s}$ into two consecutive measurements. The first one is a filter operation $\hat{F}_{j}:\mathcal{H}_{B}\to\mathcal{H}_{B_{{\rm q}}}$ with $1\leq j\leq L-1$, which gives the outcome $j$ and leaves a qubit system $\mathcal{H}_{B_{{\rm q}}}$. The second one measures the qubit in the $Z$ basis $\{|0\rangle_{B_{{\rm q}}},|1\rangle_{B_{{\rm q}}}\}$. By using the filter operation and the qubit measurement, $\hat{\Pi}_{j,s}$ can be decomposed as

[TABLE]

if we choose $\hat{F}_{j}$ as

[TABLE]

Here, we define the $X$ basis state as $|\pm\rangle=(|0\rangle\pm|1\rangle)/\sqrt{2}$.

III Security proof

In this section, we prove the security of the protocol described in Sec. II.2, and determine the amount of privacy amplification $f_{{\rm PA}}$ in the asymptotic limit.

III.1 Alternative protocol

To explain our security proof, we introduce an alternative protocol equivalent to the actual one, which is designated to fulfill the following conditions.

(i) The state of the optical pulses emitted by Alice and the data processing for generating the final key are identical to the ones of the actual protocol.

*(ii) Bob’s measurement on receiving the $L$ pulses and his announcement of $j$ over an authenticated public channel are identical to the actual protocol. *

These two conditions ensure that Eve cannot change her attack depending on which of the actual and the alternative protocols is conducted, resulting in the identical correlation between the final key and Eve’s quantum system. Hence, the final key in the actual protocol is secure in terms of the composable security Canetti (2001) if the alternative protocol is secure against Eve’s general attack.

As an alternative protocol, we consider an entanglement-based protocol in which Alice prepares $L$ auxiliary qubits of system $\mathcal{H}_{A}$ located in Alice’s site and $L$ coherent pulses of system $\mathcal{H}_{S}$ in state

[TABLE]

with

[TABLE]

Here, $\hat{\pi}_{\nu}$ denotes the projection of the $L$ pulses onto the subspace where $\nu$ photons are contained in the $L$ pulses, $\mathcal{H}_{C}$ is a system storing the information of the outcome of the projection, and also we define the Hadamard operation as $\hat{H}=1/\sqrt{2}\sum_{x,y=0,1}(-1)^{xy}|x\rangle\langle y|$. To generate a raw key bit, Alice measures her auxiliary qubit in the $X$ basis.

Now, we introduce an alternative entanglement-based protocol that satisfies the above conditions (i) and (ii). A controlled-NOT (C-NOT) gate $\hat{U}^{(j)}_{{\rm CNOT}}$ appearing in the protocol is defined on the $Z$ basis $\{|0\rangle,|1\rangle\}$ by $\hat{U}^{(j)}_{{\rm CNOT}}|x\rangle_{A,j}|y\rangle_{A,j+1}=|x\rangle_{A,j}|x\oplus y\rangle_{A,j+1}$ (with $x,y\in\{0,1\}$).

The protocol proceeds as follows.

(al 1) Alice prepares the state $|\Phi\rangle_{C,A,S}$, measures the system $\mathcal{H}_{C}$ to learn the total photon number $\nu$ in the $L$ pulses, and sends the $L$ pulses to Bob through a quantum channel.

(al 2) Bob receives the $L$ pulses and carries out the quantum nondemolition (QND) measurement to test if there is exactly one photon in total from the $j=1^{{\rm th}}$ to $j=(L-1)^{{\rm th}}$ time slots and the vacuum in the $j=0^{{\rm th}}$ and $L^{{\rm th}}$ time slots. If this test is passed, Bob performs the filter operation $\{\hat{F}_{j}\}^{L-1}_{j=1}$ in Eq. (6) to know in which time slot he detects a single-photon, and the variable $j$ is set to the time slot. Otherwise Bob sets $j=0$. Bob announces $j$ over an authenticated public channel. If $j=0$, Alice and Bob skip steps (al 3) and (al 4) below.

(al 3) Bob measures his qubit $B_{{\rm q}}$ in the $Z$ basis $\{|0\rangle_{B_{{\rm q}}},|1\rangle_{B_{{\rm q}}}\}$ and obtains his raw key bit $s$.

(al 4-1) Alice applies the C-NOT gate on the $j^{{\rm th}}$ qubit (control) and $(j+1)^{{\rm th}}$ qubit (target) [see Fig. 2 (a)].

(al 4-2) Alice measures the $(j+1)^{{\rm th}}$ qubit in the $Z$ basis $\{|0\rangle_{A,j+1},|1\rangle_{A,j+1}\}$ to obtain the outcome $z_{j+1}\in\{0,1\}$.

(al 4-3) Alice measures the $j^{{\rm th}}$ qubit in the $X$ basis $\{|+\rangle_{A,j},|-\rangle_{A,j}\}$ and determines a raw key bit.

(al 5) Alice and Bob repeat steps (al 1)-(al 4) $N$ times.

(al 6)[=(a 5)] Alice defines a sifted key $\bm{\kappa}_{A}$ by concatenating the successful detection events (i.e., $j\neq 0$).

(al 7)[=(a 6)] Bob defines a sifted key $\bm{\kappa}_{B}$ by concatenating the successful detection events (i.e., $j\neq 0$).

(al 8)[=(a 7)] Bob corrects the errors in his sifted key $\bm{\kappa}_{B}$ to make it coincide with $\bm{\kappa}_{A}$ by sacrificing $|\bm{\kappa}_{A}|f_{{\rm EC}}$ bits of encrypted public communication from Alice by consuming the same length of the pre-shared secret key.

This alternative protocol satisfies the above conditions (i) and (ii) because of the following reasons. First, as for (i), we show that Alice’s procedure dictated in (i) is the same between both actual and alternative protocols by modifying Alice’s procedure in the alternative protocol. For this, since the outcome $z_{j+1}$ obtained in step (al 4-2) is neither announced nor used in determining the final key, we can omit this step. Next, steps (al 4-1) and (al 4-3) are equivalently done by measuring all the $L$ qubits in the $X$ basis to obtain an $L$-bit sequence $s_{1}s_{2}...s_{L}$ as the outcome, and then setting $s_{j}\oplus s_{j+1}$. Since the $X$-basis measurement on all the qubits does not require the knowledge of $j$ announced in step (al 2), we can consider that it is done in step (al 1). Then, using the relation

[TABLE]

we see that the random $L$-bit sequence $s_{1}s_{2}...s_{L}$ is obtained, and we thus conclude that Alice’s sending state is equivalent to Eq. (1). Note that the total photon number measurement to obtain $\nu$ in step (al 1) makes the pulse train diagonalized in the Fock basis, and with this measurement, the assumption (A 2) introduced in Sec. II.1 is satisfied. Hence, the state of the optical pulses emitted by Alice and the data processing for generating the final key are identical to the ones of the actual protocol.

Next, we see that the alternative protocol satisfies the condition (ii). In step (al 2), the QND measurement over the $j=0^{{\rm th}}$ to $j=L^{{\rm th}}$ time slots informs Bob if the successful detection occurs or not (namely, $j=0$ or $j\neq 0$). The probability of resulting $j\neq 0$ is the same as the one in the actual protocol. Moreover, if $j\neq 0$, the probability of announcing $j$ (with $1\leq j\leq L-1$) is the same between both protocols since the following equation is satisfied from Eq. (5),

[TABLE]

Hence, the information of $j$ announced by Bob in the alternative protocol is equivalent to the actual protocol.

Therefore, the alternative protocol satisfies the conditions (i) and (ii), which means that the security of the alternative protocol guarantees the security of the actual protocol.

III.2 Complementary task

The next step is to determine the amount of privacy amplification $f_{{\rm PA}}$, where we employ the argument of complementarity Koashi (2007). In this approach, we consider a virtual measurement that is complementary to the one to determine the sifted key $\bm{\kappa}_{A}$. Recall that the measurement to obtain the sifted key is performed in step (al 4-3), and the complementary measurement means that the measurement basis ($X$ basis) in step (al 4-3) is replaced with the complementary basis (here we consider the $Z$ basis). In other words, the virtual measurement is described as the following step (al 4-3*∗*).

(al 4-3∗) Alice measures the $j^{{\rm th}}$ qubit in the $Z$ basis $\{|0\rangle_{A,j},|1\rangle_{A,j}\}$ and determines the outcome $z_{j}\in\{0,1\}$.

While Bob, instead of aiming at learning $\bm{\kappa}_{A}$, tries to guess the value of the complementary observable $z_{j}$. This suggests that step (al 3) is replaced with the following step (al 3∗).

(al 3∗) Bob measures his qubit $B_{{\rm q}}$ in the $X$ basis $\{|+\rangle_{B_{{\rm q}}},|-\rangle_{B_{{\rm q}}}\}$ and obtains its outcome $x_{B}\in\{+,-\}$.

In the complementarity argument Koashi (2007), we need to quantify how well Alice successfully predicts the outcome $z_{j}$ of the measurement defined in step (al 4-3∗) with a help of Bob through quantum communication (see Fig. 2 (b) for Alice’s procedure to estimate $z_{j}$). For the quantification, we employ the phase error rate. Here, the phase error rate $e^{({\rm ph})}$ is defined as the probability that Alice fails her prediction on $z_{j}$, where the phase error rate is related to the amount of privacy amplification $Qf_{{\rm PA}}$ Koashi (2009).

To accomplish the prediction on $z_{j}$, Alice employs three information that could help her prediction, which are listed below.

• •

(I-1) $x_{B}$ obtained in step (al 3∗).

• •

(I-2) $z_{j+1}\in\{0,1\}$ obtained in step (al 4-2).

• •

(I-3) The intensity of Alice’s sending state is weak.

The information (I-1) informs Alice of which of the $j^{{\rm th}}$ or $(j+1)^{{\rm th}}$ original pulse contains a single-photon, which corresponds to $x_{B}=-$ or $x_{B}=+$, respectively. The failure probability for this prediction, which we call the phase error rate, is related to the amount of privacy amplification (see Eq. (20) for the explicit formula).

As an introduction, we first consider the simplest case where Eve is absent in the quantum channel (we call this case the normal operation). In this case, if Bob successfully detects a single-photon at the $j^{{\rm th}}$ time slot, and depending on his $X$ basis measurement outcome $x_{B}=+$ or $x_{B}=-$ from the information (I-1), the state of the $j^{{\rm th}}$ and $(j+1)^{{\rm th}}$ Alice’s systems is written as

[TABLE]

and

[TABLE]

respectively. After Alice performs the C-NOT gate in step (al 4-1), $|\psi_{+}\rangle_{A,j,j+1}$ and $|\psi_{-}\rangle_{A,j,j+1}$ are transformed to

[TABLE]

and

[TABLE]

respectively. In this case, $z_{j+1}$ obtained in step (al 4-2) is always 1, and Alice can predict $z_{j}$ as 0 or 1 without causing any error depending on Bob’s outcome $x_{B}=+$ or $-$, respectively.

Moreover, by following the same arguments above, if the quantum channel is a linear lossy channel $\mathcal{N}_{\eta}:\mathcal{N}_{\eta}|\alpha\rangle=|\eta\alpha\rangle$, $z_{j+1}=0$ never occurs, and for $z_{j+1}=1$, Alice can also perfectly predict the outcome $z_{j}$. Summarizing two examples of the normal operation and the linear lossy channel case, if $z_{j+1}=1$ as (I-2), the following Alice’s prediction succeeds with unit probability,

[TABLE]

Therefore, in general case (without assuming any channel model), if $z_{j+1}=1$, we suppose that Alice takes the above strategy on her prediction.

As we discussed above, the successful detection events never occur with $z_{j+1}=0$ in the normal operation and the linear lossy channel case. Hence, if the successful detection occurs with $z_{j+1}=0$, we consider that Alice always predicts $z_{j}$ as 0 because before Alice sends the system $\mathcal{H}_{S}$ to Bob, $z_{j}=0$ is more likely to occur. This tendency is rather remarkable as the intensity of the sending state becomes weaker. Mathematically, this is confirmed as

[TABLE]

and $p(\alpha,0)/p(\alpha,1)=(\coth\alpha^{2})^{2}\geq 1$. Here, $||\cdot||$ denotes the trace norm.

From this consideration and (I-3), in any channel model, we suppose that Alice takes the following strategy as

[TABLE]

It is notable that if $z_{j+1}=0$, Alice does not use Bob’s information $x_{B}$ [namely, (I-1)] to estimate the outcome $z_{j}$, and her prediction is wrong when $z_{j}=1$.

This prediction strategy highlights the difference between the complementarity approach and Shor-Preskill approach. Recall that in the Shor-Preskill approach Tamaki et al. (2012), the goal of Alice and Bob in an alternative protocol is to generate the maximally entangled state (MES) of the two qubit systems $\mathcal{H}_{A,j}$ and $\mathcal{H}_{B_{{\rm q}}}$. To generate the MES, the bit and phase error rates are needed, where the phase errors are defined as the instances where Alice’s $Z$ basis measurement outcome in step (al 4-3∗) and Bob’s $X$ basis measurement outcome in step (al 3∗) are different. Hence, the phase error is defined as the relation between $z_{j}$ and $x_{B}$, which means that it cannot be defined as an instance only by focusing on Alice’s specific measurement outcome, such as $z_{j}=1$. In fact, if we translate the construction of the phase error POVM in Tamaki et al. (2012) to the complementarity argument, Alice’s prediction for $z_{j+1}=0$ in Tamaki et al. (2012) can be interpreted as follows:

[TABLE]

This means that if $z_{j+1}=0$, Alice randomly selects $z_{j}$, which implies that the knowledge on Alice’s sending states [namely, (I-3)] is not used.

Therefore, the prediction in Eq. (17) that uses a property of Alice’s sending state highlights one of the unique features in the complementarity approach, and this difference of the prediction leads to a tighter upper bound on the phase error rate, which we show in Sec. IV. Specifically, this difference will be reflected by all the differences in two curves in Figs. 3, 4 and 5.

Our goal is to obtain the amount of $Qf_{{\rm PA}}$ in Eq. (3). For this, recall that the photon number measurement is conducted on the $L$ pulses in step (al 1), and therefore, $Qf_{{\rm PA}}$ in Eq. (3) can be expressed as a classical mixture of Fock state, that is,

[TABLE]

Here, $Q^{(\nu)}$ is defined as $Q^{(\nu)}=\frac{|\bm{\kappa}^{(\nu)}_{A}|}{N}$ with $\bm{\kappa}^{(\nu)}_{A}$ denoting the sifted key originating from the $\nu$-photon emission events, and $f^{(\nu)}_{{\rm PA}}$ is the amount of privacy amplification for $\bm{\kappa}^{(\nu)}_{A}$. From Gottesman et al. (2004); Koashi (2009), in the asymptotic limit, the amount of privacy amplification for $\bm{\kappa}^{(\nu)}_{A}$ is given by

[TABLE]

where $h(x):=-x\log_{2}x-(1-x)\log_{2}(1-x)$ represents the binary entropy function, and $e^{({\rm ph},\nu)}$ is a phase error rate for the $\nu$-photon emission events.

Having finished the explanation of the prediction on $z_{j}$, next we give an overview of the proof conducted in the following sections (from Sec. III.3 to Sec. IV.3). The goal of our discussion is to obtain the upper bound on the amount of privacy amplification $f^{(\nu)}_{{\rm PA}}=h(e^{({\rm ph},\nu)})$ in Eq. (20) with the bit error rate $e^{({\rm b},\nu)}$. To achieve this goal, in Sec. III.3, we first formulate the POVM elements for the bit and phase error events. In Sec. III.4, to discuss the security for each photon number emission event separately, we introduce the projection operator $\hat{P}^{(\nu)}$ representing that the state of $L$ pulses is contained in the $\nu$-photon subspace. In Sec. III.5, we relate $e^{({\rm ph},\nu)}$ and $e^{({\rm b},\nu)}$, and we show that it suffices to calculate the quantity $\Omega^{(\nu)}(\lambda)$ in Eq. (37) to upper-bound the phase error rate $e^{({\rm ph},\nu)}$. Then, in Sec. IV, we explicitly derive the quantity $\Omega^{(\nu)}(\lambda)$ for $\nu=0,1,2$, and obtain the upper bound on $e^{({\rm ph},\nu)}$ with the bit error rate $e^{({\rm b},\nu)}$ and $\Omega^{(\nu)}(\lambda)$.

III.3 Bit and phase error POVMs

In this subsection, we construct the POVMs for the phase and bit errors. The POVM elements for the phase error when the successful detection occurs at the $j^{{\rm th}}$ (with $1\leq j\leq L-1$) time slot, which act on the systems $\mathcal{H}_{A,j}$, $\mathcal{H}_{A,j+1}$ (just before the C-NOT gate in Fig. 2) and $\mathcal{H}_{B}$, are given by

[TABLE]

where we define $\bar{s}=s\oplus 1$. Here, the first and second terms correspond to the failure prediction on $z_{j}$ for $z_{j+1}=1$ [whose prediction strategy is given in Eq. (15)] and $z_{j+1}=0$ [whose prediction strategy is given in Eq. (17)], respectively. Next, we construct the POVM element for the bit error. A bit error is the instance where Alice’s $X$ basis measurement on her $j^{{\rm th}}$ auxiliary qubit in step (al 4-3) and the outcome of Bob’s interference measurement defined in Eq. (4) are different. From this definition, the POVM elements for the bit error for the $j^{{\rm th}}$ time slot, which act on the systems $\mathcal{H}_{A,j}$, $\mathcal{H}_{A,j+1}$ and $\mathcal{H}_{B}$, are given by

[TABLE]

For simplicity of analysis, we introduce the unitary operator $\hat{U}$ defined by

[TABLE]

for $1\leq i\leq L$. By applying $\hat{U}$ to $\hat{e}^{({\rm ph})}_{j}$ in Eq. (21), we obtain the following equation (see Appendix A for the derivation)

[TABLE]

where we denote Alice’s $Z$ basis states as $|\bm{a}\rangle_{A}:=|a_{1}\rangle_{A,1}|a_{2}\rangle_{A,2}...|a_{L}\rangle_{A,L}$ with $\bm{a}:=a_{1}a_{2}...a_{L}$ ($a_{i}\in\{0,1\}$). Also, by applying unitary $\hat{U}$ to Eq. (22), we have Tamaki et al. (2012)

[TABLE]

Then, by taking a sum over all the time slots, we obtain the operators for the phase and bit errors as

[TABLE]

When the state of Alice and Bob’s quantum systems $\mathcal{H}_{A}$ and $\mathcal{H}_{B}$ just after the successful QND measurement ($j\neq 0$) at step (al 2) is $\hat{\rho}_{AB}$, the probability of having a bit error in the extracted qubit pair of systems $\mathcal{H}_{A_{j}}$ and $\mathcal{H}_{B_{{\rm q}}}$ is given by ${\rm tr}(\hat{\rho}_{AB}\hat{e}^{({\rm b})})$, and the probability of having a phase error is given by ${\rm tr}(\hat{\rho}_{AB}\hat{e}^{({\rm ph})})$.

By appling $\hat{U}$ to $\hat{e}^{({\rm ph})}$ and $\hat{e}^{({\rm b})}$, these error operators are concisely written as follows.

[TABLE]

where we define $\hat{\Pi}^{{\rm(ph)}}_{{\bm{a}}}$ as

[TABLE]

and

[TABLE]

with

[TABLE]

Here, $\hat{\Pi}$ is a tridiagonal symmetric matrix, and the matrix elements are given by

[TABLE]

III.4 Constraints on Alice’s auxiliary qubit system $\mathcal{H}_{A}$

Here, we constrain Alice’s auxiliary qubit system $\mathcal{H}_{A}$ by using the knowledge of the total photon number $\nu$ contained in the $L$ pulses. For this, we first rewrite Eq. (7) as

[TABLE]

and from this equation, we see that if the total photon number is $\nu$, ${\rm wt}({\bm{a}})\leq\nu$ is satisfied since $|\alpha\rangle-|-\alpha\rangle$ contains at least one photon. Also, since $|\alpha\rangle+(-)|-\alpha\rangle$ contains even (odd) number of photons, we also have that the parity of $\nu$ and ${\rm wt}({\bm{a}})$ are the same, that is, $(-1)^{\nu}=(-1)^{{\rm wt}({\bm{a}})}$. Therefore, after the successful detection event ($j\neq 0$) occurs and the system $\mathcal{H}_{C}$ reveals a photon number $\nu$, the state of Alice and Bob’s systems are contained in the range projection operator $\hat{P}^{(\nu)}$ with

[TABLE]

Through the unitary $\hat{U}$ in Eq. (23), we have Tamaki et al. (2012)

[TABLE]

with

[TABLE]

Note that Eq. (34) can be derived by using Eq. (54) in Appendix A.

III.5 Relation between the bit and phase errors

In this subsection, we derive the upper bound on the phase error rate for $e^{({\rm ph},\nu)}$ for the $\nu$-photon emission events by using the bit error rate $e^{({\rm b},\nu)}$ originating from the $\nu$-photon emission events. To obtain this, we consider deriving the largest eigenvalue $\Omega^{(\nu)}(\lambda)$ of the operator

[TABLE]

with $0<\lambda<\infty$. Here, we define the POVM elements regarding the phase and bit errors for the $\nu$-photon emission events as $\hat{e}^{({\rm ph},\nu)}:=\hat{P}^{(\nu)}\hat{e}^{({\rm ph})}\hat{P}^{(\nu)}$ and $\hat{e}^{({\rm b},\nu)}:=\hat{P}^{(\nu)}\hat{e}^{({\rm b})}\hat{P}^{(\nu)}$, respectively. Once we obtain $\Omega^{(\nu)}(\lambda)$, we can bound the phase error rate for the $\nu$-photon emission events as

[TABLE]

and hence to derive $\Omega^{(\nu)}(\lambda)$ is vital for determining the key rate. Since the unitary operator does not change the eigenvalues, $\Omega^{(\nu)}(\lambda)$ is also the largest eigenvalue of the operator Tamaki et al. (2012).

[TABLE]

where Eqs. (27), (29) and (34) are used. To obtain an upper bound on Eq. (38), we use a fact that Eq. (38) is a direct sum of $\hat{\Pi}^{{\rm(ph)}}_{{\bm{a}}}-\lambda\hat{\Pi}$ with different ${\bm{a}}$ of ${\rm wt}({\bm{a}})=\nu-1,\nu-3...$ and $\hat{P}_{\bm{a}}(\hat{\Pi}^{{\rm(ph)}}_{{\bm{a}}}-\lambda\hat{\Pi})\hat{P}_{\bm{a}}$ with ${\bm{a}}$ of ${\rm wt}({\bm{a}})=\nu+1$. Since $\max_{\bm{a}}(\hat{\Pi}^{{\rm(ph)}}_{{\bm{a}}}-\lambda\hat{\Pi})\geq\max_{\bm{a^{\prime}}}(\hat{\Pi}^{{\rm(ph)}}_{{\bm{a^{\prime}}}}-\lambda\hat{\Pi})$ holds for any ${\bm{a}}$ and ${\bm{a^{\prime}}}$ with ${\rm wt}({\bm{a}})\geq{\rm wt}({\bm{a^{\prime}}})$, we only need to consider $\hat{\Pi}^{{\rm(ph)}}_{\bm{a}}-\lambda\hat{\Pi}$ with ${\rm wt}({\bm{a}})=\nu-1$. We thus conclude that $\Omega^{(\nu)}(\lambda)$ is the larger of the two numbers $\Omega^{(\nu)}_{-}(\lambda)$ and $\Omega^{(\nu)}_{+}(\lambda)$ defined as follows; $\Omega^{(\nu)}_{-}(\lambda)$ is the largest eigenvalue of the operator

[TABLE]

and $\Omega^{(\nu)}_{+}(\lambda)$, which is the largest eigenvalue of the operator

[TABLE]

Recall that $\hat{P}_{\bm{a}}$ is defined in Eq. (35), and $\hat{P}_{\bm{a}}(\hat{\Pi}^{{\rm(ph)}}_{\bm{a}}-\lambda\hat{\Pi})\hat{P}_{\bm{a}}$ is contained in the subspace $\{|i\rangle_{B}\}$ with $a_{i}=1$.

IV Explicit relations between the bit and phase error rates

Here, we derive the explicit relations between $e^{({\rm b},\nu)}$ and $e^{({\rm ph},\nu)}$ by evaluating $\Omega^{(\nu)}(\lambda)$. For simplicity, we consider extracting the secret key up to the two-photon emission events ($\nu=0,1$ and 2), and for more than two-photon emission events, we pessimistically assume that Eve has perfect knowledge on the sifted keys. Therefore, it is sufficient to provide the relationship for $\nu=0,1$, and 2.

IV.1 Zero-photon part

First, we discuss the case for $\nu=0$ when Alice emits zero-photon. Since $\Omega^{(0)}_{-}(\lambda)$ has no candidates for $\nu=0$, $\Omega^{(0)}(\lambda)=\Omega^{(0)}_{+}(\lambda)$. For $\Omega^{(0)}_{+}(\lambda)$, regardless of $i$ such that $a_{i}=1$, we have

[TABLE]

which corresponds to the single fixed point $(e^{({\rm b},0)},e^{({\rm ph},0)})=(1/2,0)$.

IV.2 Single-photon part

Next, we derive a relation between $e^{({\rm b},1)}$ and $e^{({\rm ph},1)}$. First, as for $\Omega^{(1)}_{-}(\lambda)$, since $\hat{\Pi}^{{\rm(ph)}}_{\bm{a}}=0$ from Eq. (39), $\Omega^{(1)}_{-}(\lambda)$ is a largest eigenvalue of $-\lambda\hat{\Pi}$, which is zero 222Note that ${}_{B}\langle\psi|\hat{\Pi}|\psi\rangle_{B}=0$ is achieved only for the state $|\psi\rangle_{B}=[\sum^{L-1}_{i=2}|i\rangle_{B}+(|1\rangle_{B}+|L\rangle_{B})/\sqrt{2}]/\sqrt{L-1}$.. Next, for the derivation of $\Omega^{(1)}_{+}(\lambda)$, since ${\rm wt}({\bm{a}})=2$ from its definition in Eq. (40), there are $\binom{L}{2}$ patterns to choose $i$ and $j$ such that $a_{i}=a_{j}=1$ holds. In order to find the pair $(i,j)$ to achieve the largest eigenvalue of Eq. (40), we use the following fact (see Hatakeyama et al. (2017) for its proof).

Fact 1

Given two $n\times n$ real matrices $A=(A_{i,j})_{i,j}$ and $\tilde{A}=(\tilde{A}_{i,j})_{i,j}$, whose off-diagonal elements are non-negative, their largest eigenvalues (respectively denoted by $\Lambda_{A}$ and $\Lambda_{\tilde{A}}$) have a relation

[TABLE]

if $A_{i,j}\geq\tilde{A}_{i,j}$ holds for any $i$ and $j$ $(1\leq i,j\leq n$).

Thanks to this fact and Eqs. (28) and (30), we find that the largest eigenvalue $\Omega^{(1)}_{+}(\lambda)$ is achieved on the subspace $\{|1\rangle_{B},|2\rangle_{B}\}$ [namely, $(i,j)=(1,2)$], and by calculating the largest eigenvalue of $\hat{P}_{\bm{a}}(\hat{\Pi}^{{\rm(ph)}}_{\bm{a}}-\lambda\hat{\Pi})\hat{P}_{\bm{a}}$ with $a_{1}=a_{2}=1$, we have $\Omega^{(1)}_{+}(\lambda)$ in Lemma 1.

Lemma 1

$\Omega^{(1)}_{+}(\lambda)$* is given by*

[TABLE]

which is non-negative if $\lambda\leq(3+\sqrt{5})$.

Then, by combining the results of $\Omega^{(1)}_{\pm}(\lambda)$, $\Omega^{(1)}(\lambda)=\max\{\Omega^{(1)}_{+}(\lambda),\Omega^{(1)}_{-}(\lambda)\}$ is given by

[TABLE]

Then, from Eq. (44), an upper bound on the phase error rate for the single-photon emission events is given in the Theorem 1 (see Appendix B for its proof).

Theorem 1

The upper bound on $e^{({\rm ph},1)}$ is given by

[TABLE]

if $0\leq e^{({\rm b},1)}\leq(10-3\sqrt{5})/22$ and

[TABLE]

if $(10-3\sqrt{5})/22<e^{({\rm b},1)}$.

In Fig. 3, we plot the resulting relation on ($e^{({\rm b},1)},e^{({\rm ph},1)})$ (see the blue curve). For comparison, we compare our result and the previous work Tamaki et al. (2012) (see the red curve), and we find that our security proof gives a tighter bound on $e^{({\rm ph},1)}$.

IV.3 Two-photon part

Here, we derive an upper bound on $e^{({\rm ph},2)}$. The evaluation of $\Omega^{(2)}(\lambda)=\max\{\Omega^{(2)}_{+}(\lambda),\Omega^{(2)}_{-}(\lambda)\}$ involves the calculation of the largest eigenvalues $\Omega_{+}^{(2)}(\lambda)$ and $\Omega_{-}^{(2)}(\lambda)$. As for $\Omega_{+}^{(2)}(\lambda)$, since ${\rm wt}({\bm{a}})=\nu+1=3$ from Eq. (40), we need to choose three indexes $1\leq i<j<k\leq L$ such that $a_{i}=a_{j}=a_{k}=1$ holds. There are $\binom{L}{3}$ patterns for the choices, and we need to find out the pair ($i,j,k$) that achieves the largest eigenvalue of Eq. (40). In so doing, the previous analysis Tamaki et al. (2012) relies on a numerical method that compares each of all the largest eigenvalues of Eq. (40) with different ($i,j,k$), which becomes complicated as $L$ becomes larger. On the other hand, we do not rely on a numerical method and derive $\Omega_{+}^{(2)}(\lambda)$ in a closed form as will be shown in Theorem 2, which holds for any $L$ of $L\geq 3$. This can be accomplished by using the fact 1, and as a result, we find that the largest eigenvalue $\Omega^{(2)}_{+}(\lambda)$ is obtained on the subspace $\{|1\rangle_{B},|2\rangle_{B},|3\rangle_{B}\}$ [namely, $(i,j,k)=(1,2,3)$]. By calculating the largest eigenvalue of $\hat{P}_{\bm{a}}(\hat{\Pi}^{{\rm(ph)}}_{\bm{a}}-\lambda\hat{\Pi})\hat{P}_{\bm{a}}$ with $a_{1}=a_{2}=a_{3}=1$, the largest eigenvalue $\Omega_{+}^{(2)}(\lambda)$ of Eq. (40) is given in Theorem 2.

Theorem 2

$\Omega_{+}^{(2)}(\lambda)$* is given by $x/4$, where $x$ is the maximum solution of the following equality for $x$,*

[TABLE]

Next, we derive $\Omega_{-}^{(2)}(\lambda)$ that is the largest eigenvalue of the operator defined in Eq. (39). In this case, since ${\rm wt}({\bm{a}})=\nu-1=1$, we need to find $\bm{a}$ with ${\rm wt}(\bm{a})=1$ that achieves the largest eigenvalue of the operator $\hat{\Pi}^{{\rm(ph)}}_{\bm{a}}-\lambda\hat{\Pi}$. For this, we again note that the previous analysis Tamaki et al. (2012) relies on a numerical method that compares each of all the largest eigenvalues of Eq. (39) with different $\bm{a}$ of ${\rm wt}(\bm{a})=1$. On the other hand, we do not rely on such a numerical method and derive $\Omega_{-}^{(2)}(\lambda)$ in a closed form as shown in Theorem 3 that can be applied for any $L$ of $L\geq 3$ (see Appendix C for the proof).

Theorem 3

Among various $\bm{a}$ with ${\rm wt}({\bm{a}})=1$, the largest eigenvalue of $\hat{\Pi}^{{\rm(ph)}}_{\bm{a}}-\lambda\hat{\Pi}$ realizes when $\bm{a}=0100...0$.

Thanks to this Theorem, we have that $\Omega_{-}^{(2)}(\lambda)$ is the largest eigenvalue of the operator $\hat{\Pi}^{{\rm(ph)}}_{\bm{a}:\bm{a}=0100...0}-\lambda\hat{\Pi}$.

Whether $\Omega_{+}^{(2)}(\lambda)$ is larger than $\Omega_{-}^{(2)}(\lambda)$ or not depends on $\lambda$. With a constant $\tilde{\lambda}$, which is solely dependent on $L$, $\Omega_{+}^{(2)}(\lambda)\leq\Omega_{-}^{(2)}(\lambda)$ for $\lambda\geq\tilde{\lambda}$ and $\Omega_{+}^{(2)}(\lambda)>\Omega_{-}^{(2)}(\lambda)$ for $\lambda<\tilde{\lambda}$. As a result, the boundary of $(e^{({\rm b},2)},e^{({\rm ph},2)})$ consists of two convex curves determined from $\Omega_{\pm}^{(2)}(\lambda)$ and a straight line with the slope $\tilde{\lambda}$ connecting them, which is shown in Fig. 4 (see the blue curve). We also show the previous result of the relation $(e^{({\rm b},2)},e^{({\rm ph},2)})$ in Tamaki et al. (2012) (see the red curve), and we find that the resulting relation is almost the same.

Recall that the secret keys are generated from the $\nu=$0, 1 and 2-photon emission events, and we take a worst case scenario that if Alice emits more than two photons, Eve has perfect knowledge on the sifted keys. From this consideration, the amount of privacy amplification in Eq. (19) is upper bounded by

[TABLE]

where in the first inequality, we bound the convex regions of ($e^{({\rm b},\nu)},h(e^{({\rm ph},\nu)}$)) specified by a set of linear inequalities with $0<\gamma<\infty$,

[TABLE]

Here, $\Omega^{(\nu)}_{h}(\gamma)$ is the quantity depending on $\gamma$ and $\Omega^{(\nu)}(\gamma)$. Also, in the second inequality of Eq. (48), we use the definition of the bit error rate $e^{({\rm b})}=\sum_{\nu}Q^{(\nu)}e^{{\rm({\rm b},\nu)}}$. Since we can choose arbitrary $\gamma$ to lower-bound the amount of privacy amplification, the lower bound on the asymptotic key generation rate in Eq. (3) is written as

[TABLE]

Here, $Q^{(\nu)}$ is chosen to maximize Eq. (48) as Tamaki et al. (2012)

[TABLE]

where $\{p_{\nu}\}$ is the Poisson distribution with mean $L\alpha^{2}$

[TABLE]

and $\nu_{\min}$ is the integer satisfying

[TABLE]

V Key generation rates

Here, we show the key generation rates of the DPS protocol based on our analysis and the previous analysis in Tamaki et al. (2012). For both cases, we suppose that the total detection probability is assumed to be given by $Q=(L-1)\eta\alpha^{2}e^{-(L+1)\eta\alpha^{2}}$, where we assume that the transmittance of the channel including the detection probability is given by $\eta=0.1\times 10^{-0.2l/10}$, and for simplicity we adopt $f_{{\rm EC}}(e^{({\rm b})})=h(e^{({\rm b})})$. In Fig. 5, we show the key rates for the case of $e^{({\rm b})}=2\%$ and $L=10$ by optimizing the mean photon number $\alpha^{2}$. As a result, we find that the secure key rate of the DPS protocol based on our analysis is 1.22 times as high as the previous one.

We note that the two key generation rates in Fig. 5 do not decrease drastically after a certain distance. This is so because we consider the constant bit error rate, which is independent of the distance.

VI conclusion

In conclusion, we have proven the information-theoretic security proof for the DPS QKD protocol based on the complementarity approach. As a result, we found that our security proof provides a slightly better key generation rate compared to the previous security proof based on the Shor-Preskill approach Tamaki et al. (2012). This improvement is obtained since the complementarity approach can incorporate more detailed information on Alice’s sending state to estimate the leaked information to Eve. In particular, we have employed the information that the intensity of Alice’s sending states is weak, and thanks to this additional information we have obtained tighter upper bounds on the leaked information to Eve compared to those in the previous proof Tamaki et al. (2012). Moreover, we have removed the necessity of the numerical calculation, which was needed in Tamaki et al. (2012) to derive the leaked information on the two-photon emission events. This leads to an advantage that our security proof enables us to evaluate the security of the DPS protocol with any block size $L$ of $L\geq 3$.

Acknowledgments

G. K. and K. T. acknowledge support from CREST, JST. Y. T. acknowledges support from Grant-in-Aid for JSPS Fellows (KAKENHI Grant No. JP17J03503) and the support from the Program for Leading Graduate Schools: Interactive Materials Science Cadet Program. T. S. acknowledges the support from the ImPACT Program of Council for Science, Technology and Innovation (Cabinet Office, Government of Japan). AM acknowledges support from Grant-in-Aid for JSPS Fellows (KAKENHI Grant No. JP17J04177).

Appendix A Proof of Eq. (24)

Here, we prove Eq. (24). First, from the definition of $\hat{U}$ in Eq. (23), we have

[TABLE]

By using Eqs. (21) and (54), a direct calculation leads to the following equation

[TABLE]

which concludes Eq. (24). Note that in the final equation, we use the property of the Kronecker delta $\delta_{a_{j},0}+\delta_{a_{j},1}=1$.

Appendix B Proof of Theorem 1

In this appendix, we prove Theorem 1. For this, we consider bounding the convex achievable reagion ($e^{({\rm b},1)},e^{({\rm ph},1)}$) by a straight line with the slope either $\lambda=3+\sqrt{5}=:\lambda_{0}$ or $\lambda=\lambda^{\prime}(<\lambda_{0})$. Here, from Eq. (44), $\lambda>\lambda_{0}$ never appears in the discussion since it is trivially understood from Eqs. (37) and (44) that $\lambda=\lambda_{0}$ gives a tighter bound on $e^{({\rm ph},1)}$ than $\lambda>\lambda_{0}$. In a lower bit error rate regime, the convex achievable region is tightly bounded with $\lambda=\lambda_{0}$. On the other hand, in a higher bit error rate regime, $\lambda^{\prime}$ gives a tighter bound. Hence, we derive the threshold bit error rate $e^{*({\rm b},1)}$ that for $e^{({\rm b},1)}\leq(>)e^{*({\rm b},1)}$, the convex achievable region is tightly bounded with the slope $\lambda=\lambda_{0}~{}(\lambda^{\prime})$. This threshold can be derived by solving the following equation:

[TABLE]

By using Lemma 1, Eq. (56) leads to

[TABLE]

By taking a limit of $\lambda^{\prime}\rightarrow\lambda_{0}$, we can derive the threshold bit error rate as $e^{*({\rm b},1)}=\lim_{\lambda^{\prime}\rightarrow\lambda_{0}}f(\lambda^{\prime})=(10-3\sqrt{5})/22$. This means that for $0\leq e^{({\rm b},1)}\leq e^{*({\rm b},1)}$, $\lambda=\lambda_{0}$ is the optimal slope to bound $e^{({\rm ph},1)}$, and for $e^{({\rm b},1)}>e^{*({\rm b},1)}$, the optimal slope $\lambda$ (with $0<\lambda<\lambda_{0}$) changes according to the bit error rate as shown in Eq. (46).

Appendix C Proof of Theorem 3

In this appendix, we prove Theorem 3 in the main text. We first prove the Theorem for the case of $L=3$ and 4, and after that we prove it for the case of $L\geq 5$.

For the cases of $L=3$ and 4, through a direct comparison of the largest eigenvalues of the operator $\hat{\Pi}^{{\rm(ph)}}_{\bm{a}}-\lambda\hat{\Pi}$ among various $\bm{a}$ with ${\rm wt}(\bm{a})=1$, it is easy to confirm that the operator gives the largest eigenvalues when $a_{2}=1$.

Next, from now on, we move on to the general case of $L\geq 5$. We first introduce two functions $F(L,x,w,y)$ and $g_{s}(L,x,w,m)$ and investigate their properties, which we use in the main part of the proof in Appendix C.3. Throughout the discussion below, we assume $L\geq 5$, $0\leq x$, $-1\leq y\leq 1$ and $0<w<\infty$.

C.1 Function $F(L,x,w,y)$

First, we introduce $F(L,x,w,y)$, which is defined as

[TABLE]

From this definition, it is easy to confirm that

[TABLE]

and for $0\leq w\leq 1/2$,

[TABLE]

Here, $w=\frac{\cosh{2x}}{2\cosh{x}}$ is a monotonically increasing and one-to-one function from the domain $\mathbb{R}_{\geq 0}$ to $\mathbb{R}_{\geq 1/2}$. Hence, an inverse function $f(w)$ can be defined from $\mathbb{R}_{\geq 1/2}$ to $\mathbb{R}_{\geq 0}$ as

[TABLE]

With this notation and Eqs. (59) and (60), we have that

[TABLE]

Also, we have a property

[TABLE]

From Eqs. (62)-(64) and the continuity of $F(L,x,w,y)$, we obtain

[TABLE]

From this equation, we can define the following function

[TABLE]

In the case of $L>5~{}{\rm and}~{}w\neq\frac{1}{2}$, we can confirm from (62) that $x_{\max}(L,w,y)$ is strictly larger than $x_{w}$:

[TABLE]

Also, Eq. (67) holds in the case of $w=\frac{1}{2}$ or $L=5$. For $w=\frac{1}{2}$ and $L\geq 5$, Eq. (67) is satisfied since

[TABLE]

Also, for $L=5$ and $w\neq 1/2$, Eq. (67) is satisfied since

[TABLE]

holds.

Next, since

[TABLE]

holds, we have the following relation if $0\leq y\leq 1$

[TABLE]

From this equation and Eq. (67), we obtain

[TABLE]

which leads to the inequality

[TABLE]

if $0\leq y\leq 1$. As for $-1\leq y\leq 0$, from the definitions of the function $F(L,x,w,y)$ and $x_{\max}$, we find that these are even functions of $y$. Therefore, for $-1\leq y\leq 1$,

[TABLE]

is satisfied.

C.2 Property of the function $g_{s}(L,x,w,m)$

Next, we introduce the function $g_{s}(L,x,w,m)$ for $s\in\{-1,1\}$, which is given by

[TABLE]

This function has a following property that we use in Appendix C.3.

Property 1

For $|m|\leq\frac{L-5}{2}$,

[TABLE]

and for $|m|=\frac{L-3}{2}$,

[TABLE]

Proof of Property 1

First, we prove Eq. (76). Since $g_{s}(L,x,w,m)$ is a monotonically-decreasing function for $w$, we have

[TABLE]

where we use the fact $x>x_{w}\Rightarrow\frac{\cosh{2x}}{2\cosh{x}}>w$. By combining Eqs. (78) and (67), we obtain

[TABLE]

for $|m|\leq\frac{L-5}{2}$, which concludes Eq. (76).

As for the proof of Eq. (77), we use

[TABLE]

for $x>0$ and since $\cosh(L-3)x>0$, we can conclude Eq. (77).

C.3 Calculation of $\hat{\Pi}^{({\rm ph})}_{{\bm{a}}}-\lambda\hat{\Pi}$

Next, we calculate the matrix elements of $\hat{\Pi}^{({\rm ph})}_{{\bm{a}}}-\lambda\hat{\Pi}=(\hat{\Pi}^{({\rm ph})}_{{\bm{a}}}-\lambda\hat{\Pi}|_{j,k})_{j,k}$, which is a tridiagonal symmetric matrix. For convenience of notation, we denote the index of low and column of the matrix by $j,k\in\{-\frac{L-1}{2},-\frac{L-3}{2},...,\frac{L-3}{2},\frac{L-1}{2}\}$ (not by $\{1,2,...,L-1,L\}$). The diagonal elements are given by

[TABLE]

and the off-diagonal elements are given by

[TABLE]

Since we now consider ${\rm wt}(\bm{a})=\nu-1=1$, we need to choose only one $j$ such that $a_{j}=1$. If we define $m$ that satisfies $a_{m}=1$, $\hat{\Pi}^{({\rm ph})}_{{\bm{a}}}-\lambda\hat{\Pi}$ is characterized by $m$, and we define $\hat{A}^{(m)}:=\hat{\Pi}^{({\rm ph})}_{{\bm{a}}:a_{m}=1}-\lambda\hat{\Pi}$. Below, we classify $m$ into three cases, and for each of all the cases we calculate the matrix elements of $\hat{A}^{(m)}=(\hat{A}^{(m)}|_{j,k})_{j,k}$.

(I) For $|m|=\frac{L-1}{2}$,

[TABLE]

where $s\in\{-1,1\}$.

(II) For $|m|=\frac{L-3}{2}$,

[TABLE]

(III) For $|m|\leq\frac{L-5}{2}$,

[TABLE]

Now, we prove Theorem 3 that the largest eigenvalue of $\hat{A}^{(m)}$ realizes when $|m|=\frac{L-3}{2}$ for $L\geq 5$ and $0<\lambda<\infty$. First, from the above expressions in Eqs. (83) and (85), $\hat{A}^{(\pm\frac{L-1}{2})}\leq\hat{A}^{(\pm\frac{L-5}{2})}$ are obtained, and hence we need not to consider the case (I) for deriving the largest eigenvalue of $\hat{A}^{(m)}$.

Next, we compare the eigenvalues of the cases (II) and (III). For this, we prepare the vector $v^{(m)}=(v^{(m)}|_{j})_{j}$ that has $L$ elements. As well as the matrix representation, we denote the index of column of the vector by $j\in\{-\frac{L-1}{2},-\frac{L-3}{2},...,\frac{L-3}{2},\frac{L-1}{2}\}$. For $s\in\{-1,1\}$, $j_{-}\in\{-\frac{L-3}{2},-\frac{L-5}{2},...,m-2,m-1\}$ and $j_{+}\in\{m+1,m+2,...,\frac{L-5}{2}\frac{L-3}{2}\}$, we define $v^{(m)}$ as

[TABLE]

where $x\in\mathbb{R}$ is a free parameter. In this case, the following equation holds.

[TABLE]

Here we recall that $g_{s}(L,x,\lambda^{-1},m)$ and $F(L,x,\lambda^{-1},\frac{2m}{L-3})$ are defined in Eqs. (75) and (58), respectively. In the following, we set $x=x_{\max}(L,\lambda^{-1},\frac{2m}{L-3})$. From its definition in Eq. (66), we have that the rhs of Eq. (90) is zero, which leads to

[TABLE]

Moreover, thanks to Property 1, we find that all the elements of $v^{(m)}$ never become zero simultaneously, and therefore we conclude that $v^{(m)}$ and $\frac{\lambda}{2}(\cosh x_{\max}(L,\lambda^{-1},\frac{2m}{L-3})-1)$ represent the eigenvector and the eigenvalue of $\hat{A}^{(m)}$, respectively. In particular, if $|m|\leq\frac{L-5}{2}$, all the elements of $v^{(m)}$ are guaranteed to be positive due to Eq. (76) in Property 1. By combining this fact and the fact that $\hat{A}^{(m)}$ is an Hermite operator with non-negarive off-diagonal elements, we conclude that the eigenvalue $\frac{\lambda}{2}(\cosh x_{\max}(L,\lambda^{-1},\frac{2m}{L-3})-1)$ is the largest eigenvalue of $\hat{A}^{(m)}$ if $|m|\leq\frac{L-5}{2}$. Finally, from Eq. (73), we have that

[TABLE]

Since the rhs represents the eigenvalue of $\hat{A}^{(\frac{L-3}{2})}$, we conclude that $\hat{A}^{(\frac{L-3}{2})}$ has an eigenvalue that is no smaller than the largest eigenvalue of $\hat{A}^{(m)}$ with $|m|\leq\frac{L-5}{2}$.