Quantum key distribution with setting-choice-independently correlated light sources

TL;DR

This paper introduces a security framework for quantum key distribution that accounts for source imperfections with arbitrary correlations independent of setting choices, providing a practical security proof for real-world QKD systems.

Contribution

It develops a self-contained security proof for loss-tolerant QKD under the setting-choice-independent correlation framework, addressing source imperfections in practical implementations.

Findings

Security proof applicable in finite-key regime

Feasibility demonstrated with reasonable number of pulses

Addresses source correlations independent of settings

Abstract

Despite the enormous theoretical and experimental progress made so far in quantum key distribution (QKD), the security of most existing QKD implementations is not rigorously established yet. A critical obstacle is that almost all existing security proofs make ideal assumptions on the QKD devices. Problematically, such assumptions are hard to satisfy in the experiments, and therefore it is not obvious how to apply such security proofs to practical QKD systems. Fortunately, any imperfections and security-loopholes in the measurement devices can be perfectly closed by measurement-device-independent QKD (MDI-QKD), and thus we only need to consider how to secure the source devices. Among imperfections in the source devices, correlations between the sending pulses are one of the principal problems. In this paper, we consider a setting-choice-independent correlation (SCIC) framework in which the sending pulses can present arbitrary correlations but they are independent of the previous setting choices such as the bit, the basis and the intensity settings. Within the framework of SCIC, we consider the dominant fluctuations of the sending states, such as the relative phases and the intensities, and provide a self-contained information theoretic security proof for the loss-tolerant QKD protocol in the finite-key regime. We demonstrate the feasibility of secure quantum communication within a reasonable number of pulses sent, and thus we are convinced that our work constitutes a crucial step toward guaranteeing implementation security of QKD.

Figures

Tables

Table 1. Table 1: Random variables and sets used throughout the paper

Random variables and sets	Meaning
${𝑿}^i$	Abbreviation of $X^1,X^2,\dots ,X^i$
	($X^i$ can be $c^i,k^i,{\theta }^i,{\mu }^i,P^i,g^i,n^i,y^i,b^i$)
$𝒞$	Set of bit and basis information: $\{0_Z,1_Z,0_X\}$
$c^i\in 𝒞$	Alice’s $i^{\mathrm{th}}$ choice of bit and basis information
$𝒦$	Set of intensity setting: $\{k_1,k_2,k_3\}$
$k^i\in 𝒦$	Alice’s $i^{\mathrm{th}}$ choice of intensity setting
${\theta }^i\in [0,2\pi )$	$i^{\mathrm{th}}$ relative phase between the signal and reference pulses
${\mu }^i\in [0,\infty )$	$i^{\mathrm{th}}$ total intensity in both the signal and reference pulses
${𝒢}_{\mathrm{unt}}^i$	Untagged set of the $i^{\mathrm{th}}$ internal state of the source device
$g^i\in {𝒢}_{\mathrm{unt}}^i\cup \overline{{𝒢}_{\mathrm{unt}}^i}$	$i^{\mathrm{th}}$ internal state of Alice’s source device
${𝒈}^{\ge i}$	Abbreviation of $g^i,g^{i+1},\dots ,g^{N_{\mathrm{sent}}}$
$t^i\in \{u,t\}$	Indicator of $g^i\in {𝒢}_{\mathrm{unt}}^i$ or $g^i\notin {𝒢}_{\mathrm{unt}}^i$: $t^i=u$ if $g^i\in {𝒢}_{\mathrm{unt}}^i$ and $t^i=t$ if $g^i\notin {𝒢}_{\mathrm{unt}}^i$
$n_{\mathrm{tag}}$	Number of tagged signals: $\left|\left\{i\right|t^i=t\}\right|$
${𝓖}_{\mathrm{good}}^{N_{\mathrm{sent}}}$	Set of ${𝒈}^{N_{\mathrm{sent}}}$ where $n_{\mathrm{tag}}$ is upper bounded by a fixed number
$n^i\in [0,\infty )$	Total number of photons in the $i^{\mathrm{th}}$ signal and reference pulses
$ℬ$	Set of bases: $\{Z,X\}$
$a^i\left(b^i\right)\in ℬ$	Alice’s (Bob’s) $i^{\mathrm{th}}$ basis choice
$y^i\in \{0,1,\varnothing \}$	Bob’s $i^{\mathrm{th}}$ measurement outcome
${𝒮}_{Z,Z,k,\det }$	Set $\left\{i\right|a^i=b^i=Z,k^i=k,y^i\ne \varnothing \}$
${𝒮}_{Z,Z,\det }$	Set $\left\{i\right|a^i=b^i=Z,y^i\ne \varnothing \}$
${𝒮}_{Z,Z,n,u,\det }$	Set $\left\{i\right|a^i=b^i=Z,n^i=n,t^i=u,y^i\ne \varnothing \}$
${𝒮}_{c,k,\det ,y,b}$	Set $\left\{i\right|c^i=c,k^i=k,b^i=b,y^i=y\}$
${𝒮}_{c,n,u,\det ,y,b}$	Set $\left\{i\right|c^i=c,n^i=n,t^i=u,b^i=b,y^i=y\}$
${𝒮}_{\det }$	Set $\left\{i\right|y^i\ne \varnothing \}$
${𝒮}_{Z,Z,1,u,\det }^L$	Lower bound on $\left|{𝒮}_{Z,Z,1,u,\det }\right|$
$N_{\mathrm{ph},Z,Z,1,u,\det }$	Number of phase errors in the set ${𝒮}_{Z,Z,1,u,\det }$
$N_{\mathrm{ph},Z,Z,1,u,\det }^U$	Upper bound on $N_{\mathrm{ph},Z,Z,1,u,\det }$

Table 2. Table 2: Quantum systems and symbols used throughout the paper

Quantum systems	Meaning
$C^i$	Quantum system storing $c^i$ possessed by Alice
$K^i$	Quantum system storing $k^i$ possessed by Alice
${\Theta }^i$	Quantum system storing ${\theta }^i$ possessed by Alice
$M^i$	Quantum system storing ${\mu }^i$ possessed by Alice
$G^i$	Quantum system storing $g^i$ possessed by Alice
$N^i$	Quantum system storing $n^i$ possessed by Alice
$B^i$	$i^{\mathrm{th}}$ quantum system sent to Bob
$A^i$	Alice’s $i^{\mathrm{th}}$ quantum system defined iff $t^i=u$ and $n^i=1$
$B^{\prime i}$	Bob’s $i^{\mathrm{th}}$ quantum system after Eve’s intervention
Symbols	Meaning
$N_{\mathrm{sent}}$	Number of pulse pairs (signal and reference pulses) sent by Alice
$R_{\mathrm{ph}}^{c^i}$	$i^{\mathrm{th}}$ interval of the relative phase ${\theta }^i$ for $c^i$
$R_{\mathrm{int}}^{k^i}$	$i^{\mathrm{th}}$ interval of the intensity ${\mu }^i$ for $k^i$
$N_{\mathrm{tag}}$	Predetermined upper bound on $n_{\mathrm{tag}}$
$p_{\mathrm{fail}}$	Upper bound on the probability that ${𝒈}^{N_{\mathrm{sent}}}\notin {𝓖}_{\mathrm{good}}^{N_{\mathrm{sent}}}$ occurs
$N_{\det }$	Predetermined number of detection events $\left|{𝒮}_{\det }\right|$
${𝜿}_{A\left(B\right)}^{\mathrm{sift}}$	Alice’s (Bob’s) sifted key
${𝜿}_B^{\mathrm{cor}}$	Bob’s reconciled key
${𝜿}_{A\left(B\right)}^{\mathrm{fin}}$	Alice’s (Bob’s) final key
${ϵ}_{\sec }$	Security parameter of the protocol
${ϵ}_s$	Secrecy parameter of the protocol
${ϵ}_c$	Correctness parameter of the protocol
${ϵ}_{\mathrm{PA}}$	Error probability of privacy amplification
${ϵ}_Z$	Failure probability of the estimation of ${𝒮}_{Z,Z,1,u,\det }^L$ given that $S_{\det }=N_{\det }$
${ϵ}_{\mathrm{PH}}$	Failure probability of the estimation of $N_{\mathrm{ph},Z,Z,1,u,\det }^U$ given that $n_{\mathrm{tag}}\le N_{\mathrm{tag}}$ and $S_{\det }=N_{\det }$
$\ell$	Length (in bits) of the final key

Equations

$${\hat{\rho }}^i({\theta }^i,{\mu }^i{)}_{B^i}$$

$${\hat{\rho }}^i({\theta }^i,{\mu }^i{)}_{B^i}=\sum _{n^i=0}^{\infty }p(n^i|{\mu }^i)\hat{P}[|{\widehat{{\rm Y}}}^i({\theta }^i,n^i){⟩}_{B^i}],$$

$$\hat{P}[|{\widehat{{\rm Y}}}^i({\theta }^i,n^i){⟩}_{B^i}]:=\frac{{\hat{N}}_{B^i}^{n^i}{\hat{\rho }}^i({\theta }^i,{\mu }^i{)}_{B^i}{\hat{N}}_{B^i}^{n^i}}{\mathrm{tr}[{\hat{N}}_{B^i}^{n^i}{\hat{\rho }}^i({\theta }^i,{\mu }^i{)}_{B^i}]},$$

$$P^i:=({\theta }^i,{\mu }^i,c^i,k^i),$$

$$p(g^i|{\mathbf{g}}^{i-1},{\mathbf{P}}^{i-1})=p(g^i|{\mathbf{g}}^{i-1}).$$

$$p(c^i,k^i|{\mathbf{g}}^i,{\mathbf{P}}^{i-1})=p(c^i)p(k^i).$$

$$p({\theta }^i,{\mu }^i|c^i,k^i,{\mathbf{g}}^i,{\mathbf{P}}^{i-1})=p({\theta }^i|c^i,g^i)p({\mu }^i|k^i,g^i).$$

$$p({\theta }^i|c^i,g^i)=\delta ({\theta }^i,{\theta }_{c^i,g^i}^i),p({\mu }^i|k^i,g^i)=\delta ({\mu }^i,{\mu }_{k^i,g^i}^i),$$

$${\mathcal{G}}_{\mathrm{unt}}^i=\{g^i|\forall c^i\in \mathcal{C},\forall k^i\in \mathcal{K},{\theta }_{c^i,g^i}^i\in R_{\mathrm{ph}}^{c^i},{\mu }_{k^i,g^i}^i\in R_{\mathrm{int}}^{k^i}\},$$

$$R_{\mathrm{ph}}^{0_Z}=[{\theta }_{0_Z}^{\mathrm{L}},{\theta }_{0_Z}^{\mathrm{U}}],R_{\mathrm{ph}}^{1_Z}=[{\theta }_{1_Z}^{\mathrm{L}},{\theta }_{1_Z}^{\mathrm{U}}],R_{\mathrm{ph}}^{0_X}=[{\theta }_{0_X}^{\mathrm{L}},{\theta }_{0_X}^{\mathrm{U}}]$$

$$R_{\mathrm{int}}^k=[{\mu }_k^{-},{\mu }_k^{+}],$$

$${\mathcal{G}}_{\mathrm{good}}^{N_{\mathrm{sent}}}:=\{{\mathbf{g}}^{N_{\mathrm{sent}}}|n_{\mathrm{tag}}\le N_{\mathrm{tag}}\}.$$

$$\sum _{{\mathbf{g}}^{N_{\mathrm{sent}}}\notin {\mathcal{G}}_{\mathrm{good}}^{N_{\mathrm{sent}}}}p({\mathbf{g}}^{N_{\mathrm{sent}}})\le p_{\mathrm{fail}}.$$

$${\hat{M}}_{\varnothing }:={\hat{M}}_{\varnothing ,Z}={\hat{M}}_{\varnothing ,X}.$$

$$p(b^i|{\mathbf{b}}^{i-1},{\mathbf{y}}^{i-1})=p(b^i).$$

$$\frac{1}{2}||{\hat{\rho }}_{AE}^{\mathrm{fin}}-{\hat{\rho }}_{AE}^{\mathrm{ideal}}||\le {ϵ}_{\mathrm{s}}$$

$$p(S_{Z,Z,1,u,\det }<S_{Z,Z,1,u,\det }^{\mathrm{L}}|S_{\det }=N_{\det })\le {ϵ}_Z,$$

$$p(N_{\mathrm{ph},Z,Z,1,u,\det }>N_{\mathrm{ph},Z,Z,1,u,\det }^{\mathrm{U}}|n_{\mathrm{tag}}\le N_{\mathrm{tag}},S_{\det }=N_{\det })\le {ϵ}_{\mathrm{PH}}$$

$${ϵ}_{\mathrm{s}}=\sqrt{2}\sqrt{{ϵ}_{\mathrm{PA}}+{ϵ}_{\mathrm{PH}}}+{ϵ}_Z,$$

$$\ell \le {\ell }_{\mathrm{SCIC}}:=S_{Z,Z,1,u,\det }^{\mathrm{L}}\left[1-h\left(\frac{N_{\mathrm{ph},Z,Z,1,u,\det }^{\mathrm{U}}}{S_{Z,Z,1,u,\det }^{\mathrm{L}}}\right)\right]-{\log }_2\frac{2}{{ϵ}_{\mathrm{PA}}}-{\lambda }_{\mathrm{EC}}({ϵ}_{\mathrm{c}}),$$

$$S_{Z,Z,1,u,\det }^{\mathrm{L}}$$

$$\displaystyle=\frac{\mu^{-}_{k_{1}}\sum_{k\in\mathcal{K}}p_{k}\mu^{-}_{k}e^{-\mu^{-}_{k}}}{(\mu^{+}_{k_{2}}-\mu^{-}_{k_{3}})(\mu^{-}_{k_{1}}-\mu^{+}_{k_{2}}-\mu^{-}_{k_{3}})}\Big{\{}\frac{e^{\mu^{-}_{k_{2}}}[S^{-}_{Z,Z,k_{2},u,{\rm det}}-g_{{\rm MA}}(\epsilon^{Z,k_{2},u}_{{\rm MA}},p^{B}_{Z},N_{{\rm det}})]}{p_{k_{2}}}-\frac{e^{\mu^{+}_{k_{3}}}[S_{Z,Z,k_{3},{\rm det}}+g_{{\rm MA}}(\epsilon^{Z,k_{3},u}_{{\rm MA}},p^{B}_{Z},N_{{\rm det}})]}{p_{k_{3}}}$$

$$\displaystyle-\frac{(\mu^{+}_{k_{2}})^{2}-(\mu^{-}_{k_{3}})^{2}}{(\mu^{-}_{k_{1}})^{2}}\Big{(}\frac{e^{\mu^{+}_{k_{1}}}[S_{Z,Z,k_{1},{\rm det}}+g_{{\rm MA}}(\epsilon^{Z,k_{1},u}_{{\rm MA}},p^{B}_{Z},N_{{\rm det}})]}{p_{k_{1}}}\Big{)}\Big{\}}+g_{{\rm MA}}(\epsilon^{Z,1,u}_{{\rm MA}},p^{B}_{Z},N_{{\rm det}})$$

$$R_{\mathrm{ph}}^{0_Z}=[-\theta ,\theta ],R_{\mathrm{ph}}^{1_Z}=[\pi -\theta ,\pi +\theta ],R_{\mathrm{ph}}^{0_X}=\left[\frac{\pi }{2}-\theta ,\frac{\pi }{2}+\theta \right]\left(\mathrm{with}0\le \theta <\frac{\pi }{6}\right).$$

$$N_{\mathrm{ph},Z,Z,1,u,\det }^{\mathrm{U}}=\frac{p_Z^A{p}_Z^B(1+\sin \theta )}{2}\sum _{y=0}^1\sum _{c\in \mathcal{C}}{\Gamma }_{y,c}^{\mathrm{U}}\frac{S_{c,1,u,\det ,y\oplus 1,X}^{\prime }+\mathrm{sgn}({\Gamma }_{y,c}^{\mathrm{U}})g_{\mathrm{A}}(N_{\det },{ϵ}_{\mathrm{A}}^{c,1,u,y,X})}{p(c)p_X^B}+g_{\mathrm{A}}(N_{\det },{ϵ}_{\mathrm{A}}^{\mathrm{ph},Z,1,u}).$$

$$S_{c,1,u,\det ,y,X}^{\prime }=\{\begin{array}{l}{S}_{c,1,u,\det ,y,X}^{\mathrm{U}}\mathrm{if}{\Gamma }_{y,c}^{\mathrm{U}}>0,\\ S_{c,1,u,\det ,y,X}^{\mathrm{L}}\mathrm{if}{\Gamma }_{y,c}^{\mathrm{U}}\le 0,\end{array}$$

$$S_{c,1,u,\det ,y,X}^{\mathrm{U}}:$$

$$\times \sum _{k\in \mathcal{K}}{p}_k{\mu }_k^{+}{e}^{-{\mu }_k^{+}}+g_{\mathrm{MA}}({ϵ}_{\mathrm{MA}}^{c,1,u,y,X},p_X^B,N_{\det })$$

$$S_{c,1,u,\det ,y,X}^{\mathrm{L}}:$$

$$-\frac{e^{{\mu }_{k_3}^{+}}[S_{c,k_3,\det ,y,X}+g_{\mathrm{MA}}({ϵ}_{\mathrm{MA}}^{c,k_3,u,y,X},p_X^B,N_{\det })]}{p_{k_3}}$$

$$\displaystyle-\frac{(\mu^{+}_{k_{2}})^{2}-(\mu^{-}_{k_{3}})^{2}}{(\mu^{-}_{k_{1}})^{2}}\Big{(}\frac{e^{\mu^{+}_{k_{1}}}[S_{c,k_{1},{\rm det},y,X}+g_{{\rm MA}}(\epsilon^{c,k_{1},u,y,X}_{{\rm MA}},p^{B}_{X},N_{{\rm det}})]}{p_{k_{1}}}\Big{)}\Big{\}}+g_{{\rm MA}}(\epsilon^{c,1,u,y,X}_{{\rm MA}},p^{B}_{X},N_{{\rm det}}),$$

$$\sum _{{\mathbf{g}}^{N_{\mathrm{sent}}}}\sqrt{p({\mathbf{g}}^{N_{\mathrm{sent}}})}|{\mathbf{g}}^{N_{\mathrm{sent}}}{⟩}_{{\mathbf{G}}^{N_{\mathrm{sent}}}}\underset{i=1}{\overset{N_{\mathrm{sent}}}{⨂}}\sum _{c^i,k^i}\sqrt{p(c^i)p(k^i)}|{\hat{\rho }}^i({\theta }_{c^i,g^i}^i,{\mu }_{k^i,g^i}^i){⟩}_{N^i{B}^i}|c^i,k^i{⟩}_{C^i{K}^i}|{\theta }_{c^i,g^i}^i,{\mu }_{k^i,g^i}^i{⟩}_{{\Theta }^i,M^i}$$

$$|{\hat{\rho }}^i({\theta }_{c^i,g^i}^i,{\mu }_{k^i,g^i}^i){⟩}_{N^i{B}^i}=\sum _{n^i}\sqrt{p(n^i|{\mu }_{k^i,g^i}^i)}|n^i{⟩}_{N^i}|{\widehat{{\rm Y}}}^i({\theta }_{c^i,g^i}^i,n^i){⟩}_{B^i}.$$

Full text

I Introduction

Quantum key distribution (QKD) LoNphoto2014 is one of the most promising applications of quantum information processing, and it is now on the verge of global commercialization. Nonetheless, there are still several theoretical and experimental challenges Diamanti16 that need to be addressed before its wide-scale deployment. One such challenge is the lack of practical security proofs that bridge the gap between theory and practice. In the security proof of QKD, one typically assumes some mathematical models for Alice and Bob’s devices. However, if these models do not faithfully capture the physical properties of the actual QKD devices, the security of the systems is no longer guaranteed. In fact, such discrepancies between device models assumed in security proofs and the properties of actual devices could be exploited by Eve to attack both the source PhysRevA.91.032326 ; PhysRevA.92.022304 and the detection apparatuses 2006PhysRevA.74.022313 ; Bing07 ; Lamas-Linares:07 ; 2008PhysRevA.78.019905 ; 2008PhysRevA.78.042333 ; Lydersen2010 ; Gerhardt2011 ; 20111367-2630-13-7-073024 . It is therefore indispensable for realising secure QKD to develop security proof techniques that can be applied to actual devices.

One possible approach to close this gap is to use device-independent QKD  yao1998 ; PhysRevLett.98.230501 ; PhysRevLett.113.140501 ; Rotem16 . Its main drawback is, however, that it delivers a quite low secret key rate with current technology, and it still requires some device characterisations 222 Note that device-independent QKD is known to be vulnerable to memory attacks PhysRevLett.110.010503 . See also curty2017 for a possible countermeasure against this type of attacks. . An alternative solution is to use measurement-device-independent (MDI) QKD PhysRevLett.108.130503 , which guarantees the security of QKD without making any assumption on the measurement device. That is, MDI-QKD completely closes the security loophole in the detection unit. This technique still requires, however, that certain assumptions on the source device are satisfied.

Unfortunately, the status of the security proofs with practical light sources is not fully satisfactory, as so far only a few security proofs accommodate realistic imperfections in the source device. Among the imperfections in the source, one of the crucial problems is the presence of correlations among the sending pulses. We categorize these correlations into two types: the first type is the setting-choice-independent correlation (SCIC) where the correlation is independent of Alice’s choices of settings such as the bit, the basis, and the intensity settings, and the second type is the setting-choice-dependent correlation (SCDC) where the correlation is dependent on Alice’s setting choices. For instance, the former case (SCIC) may arise when the temperature in the laser drifts slowly over time due to thermal effects, where such drift could depend on how long we have operated a device and the ambient temperature of the room. Another example may be found in modulation devices which are operated by power supply fluctuating in time. On the other hand, the latter case (SCDC) occurs when the $i^{{\rm th}}$ sending state could depend on the previous setting choices that Alice has made up to the $(i-1)^{{\rm th}}$ pulse. That is to say, secret information encoded in the previous quantum signals sent by Alice could be leaked to subsequent quantum signals sent by Alice. In other words, subsequent signals could act as side channels for previous signals. Recently, the SCDC between the intensities of different pulses has been observed experimentally qcrypt2017tomita . Also, the authors of qcrypt2017tomita conducted a security analysis which is valid for the restricted scenario where only the nearest neighbour correlation is considered. More in general, however, the $i^{{\rm th}}$ state could be dependent on all the previous setting choices that Alice has made. This general correlation seems to be very hard to deal with theoretically, and even if we would have a theoretical countermeasure against it, the characterisation of the device might be highly non-trivial. Fortunately, it would be reasonable to assume that the SCDC could be eliminated if the modulation devices are initialized each time after Alice emits a pulse. For instance, before Alice sends the $(i+1)^{{\rm th}}$ pulse, she applies a random voltage to the modulation devices several times until the setting-choice information up to the $i^{{\rm th}}$ pulse which is stored in the device is deleted. This potential solution may decrease the repetition rate of the source, however, this could be overcome by multiplexing several sources, for instance by employing integrated silicon photonics Ding2017 ; Sibson:17 ; Ma:16 . With this reasonable solution, we are left with rigorously dealing with the SCIC.

In this paper, we consider the dominant fluctuations of the sending state, such as the relative phase AkihiroNJP2015 ; PhysRevA.93.042325 ; PhysRevA.92.032305 ; PhysRevA.93.042308 and the intensity PhysRevA.77.042311 ; AkihiroNJP2015 ; Hayashi2016Decoy ; qcrypt2017tomita within the framework of SCIC, and we provide an information theoretic security proof in the finite-key regime. In particular, we consider the loss-tolerant QKD protocol PhysRevA.90.052314 that is a BB84 type protocol which, unlike the standard BB84 protocol bb84 , has the advantage of being robust against phase modulation errors. The loss-tolerant protocol is highly practical and has been experimentally demonstrated in both prepare & measure QKD PhysRevA.92.032305 ; Zbinden18 and MDI-QKD PhysRevA.93.042308 . Our main contribution is to explicitly write down all the assumptions that we impose on QKD systems, and by using only these assumptions we give a self-contained security proof. Our numerical simulations of the key generation rate show that provably secure keys can be distributed over long distance within a reasonable number of pulses sent, e.g, $10^{12}$ pulses.

The paper is organised as follows. In section II, we describe the assumptions that we make on Alice and Bob’s devices and we introduce the protocol considered. In section III, we present a formula for the key generation length of the protocol. This formula depends on certain parameters that need to be estimated; the estimation results for these parameters are shown in section IV. Then in section V, we present our numerical simulation results for the key generation rate. Here, we assume realistic intervals for the actual phases and intensities under the framework of SCIC, and we show that secure communication is possible within a reasonable time frame of signal transmission, say $10^{12}$ signals. Finally, section VI summarises the paper. There are also various appendixes describing all the detailed derivations of the parameters in the key rate.

II Assumptions and protocol description

Here, we introduce the assumptions on Alice and Bob’s devices and the protocol we consider throughout this paper. To describe the assumptions, we use a shorthand notation $\bm{X}^{i}:=X^{i},X^{i-1},...,X^{1}$ for a sequence of random variables $\{X^{j}\}^{i}_{j=1}$ and $X^{0}:=0$. In what follows, we first summarise the assumptions we make on the sending devices as well as those on the measurement devices, and then we move on to the description of the protocol.

II.1 Assumptions on Alice’s transmitter

(A-1) Assumption on the sending state $\hat{\rho}^{i}(\theta^{i},\mu^{i})_{B^{i}}$

We assume that Alice employs a coherent light source with a Poissonian photon number distribution in any basis, bit and intensity setting. Here we denote by $c^{i}\in\mathcal{C}:=\{0_{Z},1_{Z},0_{X}\}$ Alice’s bit and basis choice for the $i^{{\rm th}}$ pulse, and $k^{i}\in\mathcal{K}:=\{k_{1},k_{2},k_{3}\}$ Alice’s intensity setting choice for the $i^{{\rm th}}$ pulse 333The method introduced in this paper is general and can be applied to many different protocols. To simplify the discussion, however, we consider the loss-tolerant three-state protocol PhysRevA.90.052314 with two decoy states.. Moreover, we consider that the $i^{{\rm th}}$ signals are in a single-mode 444The single-mode condition means that each $i^{{\rm th}}$ emitted signal can be mathematically characterised by a single creation operator. This creation operator can, however, be different for different pulses.. Also, we assume that she uses phase encoding, i.e., she encodes the $i^{{\rm th}}$ bit and basis information into the relative phase $\theta^{i}$ between two pulses, a signal and a reference pulse, whose common phase $\delta\in[0,2\pi)$ is perfectly randomized. We denote by $\mu^{i}$ the $i^{{\rm th}}$ actual value of the intensity generated by Alice’s source. Mathematically, given the phase and the intensity, the $i^{{\rm th}}$ sending state $\hat{\rho}^{i}(\theta^{i},\mu^{i})_{B^{i}}$ to Bob in the system $B^{i}$ can be described as

[TABLE]

Here, we assume that the intensities of the signal and the reference pulses are the same and equal to $\mu^{i}/2$ 555This assumption is not mandatory. Even if the intensities of the $i^{{\rm th}}$ signal and reference pulses differ, the security proof can be established by introducing an additional filter operation in the security proof as explained in PhysRevA.90.052314 . . In Eq. (1), we define $\hat{P}[|\cdot\rangle]:=|\cdot\rangle\langle\cdot|$, the subscripts $S^{i}$ and $R^{i}$ respectively represent the optical modes of the $i^{{\rm th}}$ signal and reference pulse, and $|e^{{\rm i}\theta}\sqrt{\mu}\rangle_{S^{i}(R^{i})}$ denotes a coherent state in mode $S^{i}(R^{i})$, i.e., $|e^{{\rm i}\theta}\sqrt{\mu}\rangle_{S^{i}(R^{i})}=e^{-\mu/2}\sum^{\infty}_{n=0}(e^{{\rm i}\theta}\sqrt{\mu})^{n}|n\rangle_{S^{i}(R^{i})}/\sqrt{n!}$ with $|n\rangle_{S^{i}(R^{i})}$ being a Fock state with $n$ photons in mode $S^{i}(R^{i})$. Eq. (1) can be rewritten as

[TABLE]

where $p(n^{i}|\mu^{i}):=e^{-\mu^{i}}(\mu^{i})^{n^{i}}/n^{i}!$ and the $n^{i}$-photon state $\hat{P}[|\hat{\Upsilon}^{i}(\theta^{i},n^{i})\rangle_{B^{i}}]$ is defined as

[TABLE]

where $\hat{N}^{n^{i}}_{B^{i}}:=\sum^{n^{i}}_{k=0}\hat{P}[|n^{i}-k\rangle_{S^{i}}|k\rangle_{R^{i}}]$.

Furthermore, we suppose that there are no side-channels in Alice’s source and Eve can only manipulate Bob’s system $B$ with her arbitrary prepared ancilla.

In the following, we first explain our correlation model for the source device, and we make assumptions on how the phases $\{\theta^{i}\}^{N_{{\rm sent}}}_{i=1}$ and the intensities $\{\mu^{i}\}^{N_{{\rm sent}}}_{i=1}$ are determined in the source device, where $N_{{\rm sent}}$ denotes the number of pulse pairs (signal and reference pulses) sent by Alice. See Fig. 1 for a schematic explanation of our correlation model of the source device. For illustration purposes, we exemplify in Fig. 2 the setting-choice-dependent correlation (SCDC) that is not taken into account in our security analysis.

(A-2) Assumption on the correlation: Setting-choice-independent correlation (SCIC)

The correlation model we consider is the setting-choice-independent correlation (SCIC), which means that the internal state of the source device which determines the $i^{{\rm th}}$ sending state is arbitrarily correlated with the previous internal states of the source device but it does not depend on the previous setting choices made by Alice. We denote by $g^{i}$ the classical random variable representing the $i^{{\rm th}}$ internal state of the source device; it determines the correspondence between the setting choices ($c^{i}$ and $k^{i}$) and the output parameters from the source device ($\theta^{i}$ and $\mu^{i}$). We suppose that $g^{i}$ depends on the past internal state of the source device $\bm{g}^{i-1}$ and is independent of the past setting choices and output parameters 666 Note that since the output parameters ($\theta^{i}$ and $\mu^{i}$) have the information of the setting choices ($c^{i}$ and $k^{i}$), we also need to impose the independence of $g^{i}$ from $\bm{\theta}^{i-1}$ and $\bm{\mu}^{i-1}$. . Hence, if we denote the $i^{{\rm th}}$ setting choices and output parameters by

[TABLE]

the SCIC model can be mathematically expressed in terms of a probability distribution satisfying for any $\bm{P}^{i-1}$ and $\bm{g}^{i-1}$ the following

[TABLE]

(A-3) Assumption on the random choice of $c^{i}$ and $k^{i}$

We assume that conditioned on the past realisation $\bm{P}^{i-1}$ and $\bm{g}^{i}$, then $c^{i}$ and $k^{i}$ are independent of each other and also independent of $\bm{P}^{i-1}$ and of $\bm{g}^{i}$, which is expressed by the following condition

[TABLE]

(A-4) Assumption on the independence of $\theta^{i}$ and $\mu^{i}$

We suppose that the phase $\theta^{i}$ (intensity $\mu^{i}$) only depends on the setting choice $c^{i}$ ($k^{i}$) and on $g^{i}$. Mathematically, this means that the probability distributions satisfy

[TABLE]

(A-5) Assumption on unique determination of $\theta^{i}$ and $\mu^{i}$

The phase $\theta^{i}$ (intensity $\mu^{i}$) is uniquely determined given $g^{i}$ and the setting choice $c^{i}$ ($k^{i}$) as $\theta^{i}_{c^{i},g^{i}}$ ($\mu^{i}_{k^{i},g^{i}}$), that is, $\theta^{i}$ ($\mu^{i}$) is a function of $c^{i}$ ($k^{i}$) and $g^{i}$. This is expressed as

[TABLE]

where $\delta(x,y)$ denotes the Kronecker delta. Note that Eq. (8) does not impose any restriction on $\{g^{i}\}^{N_{{\rm sent}}}_{i=1}$ since there exists the information of $\theta^{i}$ and $\mu^{i}$ somewhere in the source device, and we can take the parameters $\{g^{i}\}^{N_{{\rm sent}}}_{i=1}$ such that $\{g^{i}\}^{N_{{\rm sent}}}_{i=1}$ uniquely determine the correspondence between $\{c^{i}\}_{c^{i}\in\mathcal{C}}$ and $\{\theta^{i}_{c^{i},g^{i}}\}_{c^{i}\in\mathcal{C}}$, and $\{k^{i}\}_{k^{i}\in\mathcal{K}}$ and $\{\mu^{i}_{k^{i},g^{i}}\}_{k^{i}\in\mathcal{K}}$.

For the security analysis, we define the random variable associated to tagged events as follows.

(D-1) Definition of tagged random variable

For the internal state of the source device $g^{i}$, we define the untagged set $\mathcal{G}^{i}_{{\rm unt}}$ as

[TABLE]

and if $g^{i}\in(\notin)\mathcal{G}^{i}_{{\rm unt}}$, we call the $i^{{\rm th}}$ pulse the untagged (tagged) signal, which we denote by $t^{i}=u~{}(t)$. In the above definition of the untagged set, $R^{c^{i}}_{{\rm ph}}$ and $R^{k^{i}}_{{\rm int}}$ respectively denote the interval of the phase for $c^{i}$ and the interval of the intensity for $k^{i}$.

(A-6) Assumption on the intervals for the phase and intensity

The $i^{{\rm th}}$ interval of the phase $R^{c^{i}}_{{\rm{\rm ph}}}$ is assumed to be given by

[TABLE]

for all instances $i$, where $R^{0_{Z}}_{{\rm{\rm ph}}}$, $R^{1_{Z}}_{{\rm{\rm ph}}}$ and $R^{0_{X}}_{{\rm{\rm ph}}}$ do not overlap each other and the parameters $\{\theta^{{\rm L}}_{c}\}_{c\in\mathcal{C}}$ and $\{\theta^{{\rm U}}_{c}\}_{c\in\mathcal{C}}$ must satisfy $-\frac{\pi}{6}<\theta^{{\rm L}}_{0_{Z}}\leq 0$, $0\leq\theta^{{\rm U}}_{0_{Z}}<\frac{\pi}{6}$, $\frac{5\pi}{6}<\theta^{{\rm L}}_{1_{Z}}\leq\pi$, $\pi\leq\theta^{{\rm U}}_{1_{Z}}<\frac{7\pi}{6}$, $\frac{\pi}{3}<\theta^{{\rm L}}_{0_{X}}\leq\frac{\pi}{2}$, and $\frac{\pi}{2}\leq\theta^{{\rm U}}_{0_{X}}<\frac{2\pi}{3}$. Also, the $i^{{\rm th}}$ interval of the intensity $R^{k^{i}}_{{\rm{\rm int}}}$ has the form

[TABLE]

for all instances $i$, and we suppose that the following three conditions are satisfied 777These conditions are needed in the decoy-state method that is used for the parameter estimation (see Appendix D for details). : $\mu^{+}_{k_{3}}<\mu^{-}_{k_{2}}$, $\mu^{+}_{k_{2}}+\mu^{+}_{k_{3}}<\mu^{-}_{k_{1}}$ and $\mu^{+}_{k_{1}}\leq 1$.

(A-7) Assumption on the number of tagged signals

We define the good set $\bm{\mathcal{G}}^{N_{{\rm sent}}}_{{\rm good}}$ of $\bm{g}^{N_{{\rm sent}}}$ as that whose number of tagged events $n_{{\rm tag}}:=|\{i|g^{i}\notin\mathcal{G}^{i}_{{\rm unt}}\}|$ is upper bounded by a constant number $N_{{\rm tag}}$ as

[TABLE]

We suppose that the probability of $\bm{g}^{N_{{\rm sent}}}$ not being an element of $\bm{\mathcal{G}}^{N_{{\rm sent}}}_{{\rm good}}$ is upper bounded by $p_{{\rm fail}}$, which is expressed as

[TABLE]

II.2 Assumptions on Bob’s measurement unit

(B-1) Assumption on basis-independent detection efficiency

We denote by $\{\hat{M}_{y^{i},b^{i}}\}_{y^{i}\in\{0,1,\emptyset\}}$ the $i^{{\rm th}}$ POVM (positive operator-valued measure) for Bob’s measurement in the basis $b^{i}\in\mathcal{B}:=\{Z,X\}$, where $\hat{M}_{0,b^{i}}$ ($\hat{M}_{1,b^{i}}$) represents the POVM element associated to the detection of the bit value $y^{i}=0~{}(1)$ in the basis $b^{i}$, and the element $\hat{M}_{\emptyset,b^{i}}$ represents the failure of outputting a bit value. We suppose that whether a detection occurs or not for each pulse pairs does not depend on the chosen measurement basis $b^{i}$; this condition is represented as

[TABLE]

(B-2) Assumption on random choice of the measurement basis

We assume that Bob measures each incoming signal in a basis $b^{i}\in\mathcal{B}$ chosen independently of the previous basis choices and measurement outcomes. This condition is expressed in terms of the probability distribution as

[TABLE]

Furthermore, we suppose that there are no side-channels in Bob’s measurement device. Let us remark that our security model allows the use of threshold detectors; this simply implies that Bob’s $Z$ and $X$ basis measurements are not necessarily measurements on a qubit space. Note also that any error in the detection apparatus (say, for example, modulation errors) can be accommodated in our security proof as long as the assumptions stated in (B-1) and (B-2) are satisfied.

II.3 Protocol description

In this section, we describe the protocol of which we prove the security. See Fig. 3 for a typical setup of the actual protocol. In particular, we consider the loss-tolerant protocol PhysRevA.90.052314 . Also, we suppose that Alice uses the decoy-state method PhysRevLett.91.057901 ; PhysRevLett.94.230504 ; PhysRevLett.94.230503 with one signal and two decoys, and we consider asymmetric coding, i.e., the $Z$ and $X$ bases are chosen with probabilities $p^{A}_{Z}:=\sum_{c^{i}=0_{Z},1_{Z}}p(c^{i})$ and $p^{A}_{X}:=p(c^{i}=0_{X})$