Refined security proof of the round-robin differential phase shift quantum key distribution and its improved performance in the finite-sized case

TL;DR

This paper refines the security proof of the RRDPS quantum key distribution protocol in finite-sized regimes, leading to improved key rates without altering experimental setups.

Contribution

The authors provide a tighter security proof for RRDPS in finite-sized scenarios, enhancing key rates while maintaining the protocol's original features.

Findings

Achieved a tighter estimation of information leakage.

Improved key rates in asymptotic and finite-sized cases.

Maintained the protocol's original experimental features.

Abstract

Among many quantum key distribution (QKD) protocols, the round-robin differential phase shift (RRDPS) protocol is unique in that it can upper-bound the amount of the information leakage without monitoring the signal disturbance. To expedite implementation of the protocol, however, the number of pulses forming a single block should be kept small, which significantly decreases the key rates in the original security proof. In the present paper, we refine the security proof of the RRDPS protocol in the finite-sized regime and achieve a tighter estimation for the information leakage without changing the original experimental setups. As a consequence, we obtain better key rates in both asymptotic and finite-sized cases while keeping the preferable features of the protocol, such as omission of phase randomization.

Figures

Equations

$$\frac{1}{2}\sum_{N_{\mathrm{fin}}\geq 1}\mathrm{Pr}(N_{\mathrm{fin}})\big{\|}\rho_{AE|N_{\mathrm{fin}}}^{\mathrm{fin}}-\rho_{AE|N_{\mathrm{fin}}}^{\mathrm{ideal}}\big{\|}_{1}\leq\varepsilon_{\mathrm{sec}}.$$

$${\rho }_{AE|N_{\mathrm{fin}}}^{\mathrm{fin}}=\sum _{{\mathbf{z}}_A^{\mathrm{fin}}\in \{0,1{\}}^{N_{\mathrm{fin}}}}\mathrm{Pr}({\mathbf{z}}_A^{\text{fin}})|{\mathbf{z}}_A^{\text{fin}}⟩{⟨{\mathbf{z}}_A^{\text{fin}}|}_A\otimes {\rho }_{E|N_{\mathrm{fin}}}({\mathbf{z}}_A^{\text{fin}}).$$

$${\rho }_{AE|N_{\mathrm{fin}}}^{\mathrm{ideal}}:=\left(\sum _{{\mathbf{z}}_A^{\mathrm{fin}}\in \{0,1{\}}^{N_{\mathrm{fin}}}}\frac{1}{2^{N_{\mathrm{fin}}}}|{\mathbf{z}}_A^{\mathrm{fin}}⟩{⟨{\mathbf{z}}_A^{\mathrm{fin}}|}_A\right)$$

$$\otimes {\mathrm{Tr}}_A\left({\rho }_{AE|N_{\mathrm{fin}}}^{\mathrm{fin}}\right).$$

$$2^{-L/2}\underset{l=1}{\overset{L}{⨂}}\sum _{s^{(l)}=0,1}{|s^{(l)}⟩}_{A^{(l)}}{\mathrm{e}}^{\pi \mathrm{i}{s}^{(l)}{\hat{n}}_l}{|{\Psi }_{\sigma }⟩}_{l{R}^{(l)}},$$

$$\sum _{C:C({\mathbf{I}}_{N_{\mathrm{fin}}}\mathbf{O}{)}^T=C_{PA}}p(C|N,N_{\mathrm{fin}})=p^{\prime }(C_{PA}|N,N_{\mathrm{fin}}).$$

$$\sum _{N_{\mathrm{fin}}\ge 1}\mathrm{Pr}(N_{\mathrm{fin}})\left(1-F\left({\rho }_{A|N_{\mathrm{fin}}}^{\mathrm{virt}},|0_X⟩{⟨0_X|}_A\right)\right)\le {\eta }^{\prime },$$

$$\displaystyle\frac{1}{2}\sum_{N_{\mathrm{fin}}\geq 1}\mathrm{Pr}(N_{\mathrm{fin}})\big{\|}\rho_{AE|N_{\mathrm{fin}}}^{\mathrm{fin}}-\rho_{AE|N_{\mathrm{fin}}}^{\mathrm{ideal}}\big{\|}_{1}$$

$$\le \sqrt{2{\eta }^{\prime }},$$

$$F\left({\rho }_{A|N_{\mathrm{fin}}}^{\mathrm{virt}},|0_X⟩{⟨0_X|}_A\right)=\mathrm{Pr}({\mathbf{x}}_A^{\mathrm{fin}}=0|N_{\mathrm{fin}}).$$

$$x_k$$

$$m_k$$

$$u_k$$

$$a_k$$

$$b_k$$

$$y_k$$

$$\mathrm{Pr}(N_{\mathrm{fin}}\ge 1,{\mathbf{x}}_A^{\mathrm{fin}}\ne 0)\le \mathrm{Pr}(N_{\mathrm{fin}}\ge 1,{\mathbf{x}}_A\ne {\mathbf{x}}^{\ast }).$$

$$\mathrm{Pr}(N_{\mathrm{fin}}\ge 1,{\mathbf{x}}_A\ne {\mathbf{x}}^{\ast })\le {\eta }^{\prime },$$

$$\mathrm{Pr}(N\ge 1,{\mathbf{x}}_A\notin T(N,y^N))\le \eta .$$

$$NH_{PA}(N)\geq{\log\bigl{|}T(N,y^{N})\bigr{|}}\text{ for all }y^{N}$$

$$\forall {\mathbf{x}}_1,{\mathbf{x}}_2\in \{0,1{\}}^N$$

$$\mathrm{Pr}({\mathbf{x}}_1{H}^T={\mathbf{x}}_2{H}^T|N,N_{\mathrm{fin}})\le 2^{-(N-N_{\mathrm{fin}})},$$

$$N_{\mathrm{fin}}(N)=\max \{N(1-H_{PA}(N)-s/N),0\},$$

$$\mathrm{Pr}(N_{\mathrm{fin}}\ge 1,{\mathbf{x}}_A\ne {\mathbf{x}}^{\ast })\le \eta +2^{-s},$$

$$\mathrm{Pr}(N\ge 1,{\mathbf{x}}_A\notin T(N,y^N))\le \eta$$

$$\forall y^{N},\ \ {\log\bigl{|}T(N,y^{N})\bigr{|}}\leq NH_{PA}(N),$$

$$N_{\mathrm{fin}}(N)=\max \{N(1-H_{PA}(N)-s/N),0\},$$

$$P_{\Gamma }(g)=\sum _{w\in \mathcal{W}:f_{\Gamma }(w)=g}P(w)$$

$$\tilde{P}_{\omega^{n}}(\omega)=\frac{1}{n}\bigl{|}\{i\in\{1,...,n\}:\omega_{i}=\omega\}\bigr{|}$$

$$\mathcal{W}=\left\{(M,U,X)\in \mathcal{M}\times \mathcal{U}\times \mathcal{X}:0\le M-U-X\le L-2\right\}.$$

$$f_{\mathcal{Y}}(M,U,X):=(M-U-X,U\oplus X).$$

$$y_k=f_{\mathcal{Y}}(m_k,u_k,x_k),$$

$${\mathfrak{b}}_{L,p}(M):=\left(\genfrac{}{}{0ex}{}{L}{M}\right)p^M(1-p{)}^{L-M}.$$

$$\mathrm{Pr}\{\mathbf{v}\}=\frac{N_{\mathrm{em}}!}{{\prod }_{M=0}^L{v}_M!}\prod _{M=0}^L{\left({\mathfrak{b}}_{L,p_{\mathrm{odd}}}(M)\right)}^{v_M}$$

Full text

I Introduction

One of the most important implications of the quantum information theory is that information-theoretically secure communication is possible by the quantum key distribution (QKD). After the first proposal of the BB84 protocol [1], many researches have been made in the field. In recent years, the real world implementation of the QKD is attracting much attention. For the real world implementation, we need careful consideration about the finite-sized effect of the key and the imperfections of the experimental devices because communications in the real world are often done in limited time and with imperfect devices. The finite-sized key rate of the QKD protocol is especially important when we consider the communication between the ground and the satellite [2, 3] for which the communication time is limited and therefore only a small number of bits can be sent at a time.

The round-robin differential phase shift (RRDPS) protocol [4] is a QKD protocol which has a special property that the required amount of privacy amplification is determined only by the protocol parameters and independent of the bit error rates. Due to this property, the protocol is expected to be able to generate the key even when the number of communication rounds is small, because it does not suffer from the convoluted statistical estimation of the information leakage. The protocol can be implemented with a light source producing a coherent laser pulse train at the sender, and a variable-delay interferometer followed by photon detection at the receiver. A number of experimental demonstrations have already been made [5, 6, 7, 8]. Especially, the apparatus for the sender can be made very simple with only binary phase modulation, and the security can be proved without phase randomization of the optical pulses. Fewer assumptions on the light source in the RRDPS protocol also lead to the robustness against the source imperfection [9].

On the other hand, the RRDPS protocol also has a few undesirable features. The protocol assumes a variable delay interferometer which should be switched among $L$ different delays actively or passively for each pulse block. Implementing such an interferometer is costly especially for large $L$. Furthermore, the asymptotic key rate of the RRDPS protocol even with relatively large block size ($L\sim 128$) is about one-tenth of that of the decoy BB84 protocol [10], which is a widely used and the most studied practical QKD protocol. The key rate gets even worse when we decrease $L$ to simplify the implementation. Therefore, it is desired to improve the key rate of the RRDPS protocol especially for relatively small $L$. There have been intensive researches to mitigate or to get over these problems both in theory [11, 12, 13, 14, 15, 16, 17, 18] and experiment [7, 19].

Very recently, Yin et al. shows that by directly evaluating Eve’s collective attacks, one can improve the key rate of the RRDPS protocol with block-wise phase randomization without any change in the protocol [18]. It also implies that we can decrease $L$ to achieve the same key rate. Unfortunately, the analysis in [18] cannot directly be extended to the finite-sized case, and thus its usage is limited.

In this paper, we refine the security proof of the RRDPS protocol with a different approach and obtain better key rates in both asymptotic and finite-sized case without block-wise phase randomization. The main idea of our analysis is to utilize the information disregarded in the original security proof, which leads to a tighter estimation for the amount of the information leakage without the aid of the block-wise phase randomization. Our analysis developed here is based on the technique used in the security proof of the differential quadrature phase shift protocol [20], and it may be applicable to other high dimensional QKD protocols including other DPS-type protocols. The obtained key rate in the asymptotic limit with our analysis is almost the same as that in [18], but we do not require the block-wise phase randomization, and we can also explicitly give the key rate formula in the finite-sized case. Furthermore, we show that the RRDPS protocol outperforms decoy BB84 protocol when the number of communication rounds is small.

The paper is organized as follows. In Section 2, we develop the refined security proof of the RRDPS protocol, which is the main part of this paper. We give the definition of the protocol and subsequently construct a compatible virtual protocol which includes a crucial difference from the original one. We further introduce another auxiliary protocol which reproduces the statistics of the phase errors in the virtual protocol, and by analyzing it, we derive the main theorem, which gives the required amount of the privacy amplification. In Section 3, we numerically simulate the key rates of the RRDPS protocol with our refined analysis in both asymptotic and finite-sized case, illustrating how we determine the parameters which appear in the key rate formula. Finally, in Section 4, we wrap up our analysis, discuss the comparison between the techniques developed here and the existing ones, and refer to some remaining problems.

II Security proof

In what follows, $h(x):=-x\log x-(1-x)\log(1-x)$ denotes binary entropy function, $H(X|Y)_{P}$ denotes the conditional entropy with the joint probability distribution $P$, and $D(P\|Q)$ denotes the Kullback-Leibler divergence. $\mathbb{E}_{X\sim P}[f(X)]$ denotes the expectation value of $f(X)$ when the random variable $X$ obeys the probability distribution $P$. $\|\rho-\sigma\|_{1}=\mathrm{Tr}|\rho-\sigma|$ is the trace norm distance and $F(\rho,\sigma)=\|\sqrt{\rho}\sqrt{\sigma}\|_{1}^{2}$ is the fidelity between the density matrices $\rho$ and $\sigma$. We call $\{\ket{0},\ket{1}\}$ as the bit basis of the qubit, and $\{\ket{0_{X}}=(\ket{0}+\ket{1})/{\sqrt{2}},\ket{1_{X}}=(\ket{0}-\ket{1})/{\sqrt{2}}\}$ as the phase basis. The controlled-NOT (CNOT) operation between control qubit 1 and target qubit 2 is defined as $\ket{0}\bra{0}_{1}\otimes I_{2}+\ket{1}\bra{1}_{1}\otimes X_{2}=I_{1}\otimes\ket{0_{X}}\bra{0_{X}}_{2}+Z_{1}\otimes\ket{1_{X}}\bra{1_{X}}_{2}$, where $I$ is the identity operator, $X=\ket{0}\bra{1}+\ket{1}\bra{0}$, and $Z=\ket{0_{X}}\bra{1_{X}}+\ket{1_{X}}\bra{0_{X}}$. $\bm{I}_{N}$ denotes $N\times N$ identity matrix, and $\oplus$ denotes the summation modulo $2$. The base of the logarithm is taken to be $2$.

II.1 The definition of the protocol

We first give the actual procedure of the RRDPS protocol [4] and the assumptions for the analysis in this paper.

Setups and assumptions: The sender Alice has a $0/\pi$ phase modulator and an i.i.d. source of weak coherent optical pulses. The quantum state of each optical pulse is represented by a density operator $\sigma$, which has no correlation with any other system. The probability that the source emits odd numbers of photons is upper-bounded by a known parameter $p_{\mathrm{src}}$ (e.g. $p_{\mathrm{src}}=1-\bra{0}\sigma\ket{0}$). Bob has a variable delay interferometer whose delay can be switched according to randomly generated numbers. The photon detector can distinguish zero, one, and two or more photons. The inefficiency and the dark counting of the photon detectors can be included in the channel loss. They share a public channel for announcement as well as a quantum channel. The eavesdropper Eve can perform arbitrary attacks allowed in the law of quantum mechanics on the quantum channel and listen to all the announcements of Alice and Bob made over the public channel.

Protocol 1 (actual protocol):

Before the commencement of the protocol, Alice and Bob agree on constants $L$ and $N_{\mathrm{em}}$ as well as a function $N_{\mathrm{fin}}(N)$ and probabilities $p^{\prime}(C|N,N_{\mathrm{fin}})$ over full-rank $N\times N_{\mathrm{fin}}$ binary matrices $C$.

1. (i)

Alice and Bob repeat the following procedures for $N_{\mathrm{em}}$ rounds.

• •

Alice generates a sequence of random bits $s^{(1)},...,s^{(L)}$, and encode them to $L$ optical pulses by modulating the optical phase of the $l$-th pulse with $\mathrm{e}^{\pi\mathrm{i}s^{(l)}}$ ($l=1,...,L$). She sends Bob the $L$ optical pulses through the quantum channel.

• •

Bob randomly selects the delay $r\in\{1,...,L-1\}$ and feeds the received $L$ pulses to the delayed interferometer as shown in Figure 1. He detects photons with the two detectors at time bins $1$ through $L+r$.

• –

If Bob detects only one photon from the $(r+1)$-th to the $L$-th time bin, and observes no detection at the other bins, he records a sifted key bit $z_{B}\in\{0,1\}$ according to which photon detector has reported the detection. He also records the unordered pair $(i,j)$, which are the positions of the pulse pair arriving at the detected time bin ($i,j\in\{1,...,L\},\ |i-j|=r$). He announces “success”, and Alice records her random bit sequence $(s^{(1)},...,s^{(L)})$. [Success round]

• –

If the above condition is not satisfied, Bob announces “failure” and Alice discards her random bits. [Failure round] 2. (ii)

Let $N$ be the number of the success rounds. By proper indexing, Alice’s records are represented by $(s^{(1)}_{1},...,s^{(L)}_{1}),...,(s^{(1)}_{N},...,s^{(L)}_{N})$, and Bob’s sifted key by $\bm{z}_{B}=({z_{B}}_{1}\ \cdots\ {z_{B}}_{N})$ and his unordered pairs by $(i_{1},j_{1}),...,(i_{N},j_{N})$. 3. (iii)

Bob announces the sequence of the unordered pairs $(i_{1},j_{1}),...,(i_{N},j_{N})$. 4. (iv)

Alice defines her sifted key $\bm{z}_{A}=({z_{A}}_{1}\ \cdots\ {z_{A}}_{N})$ by ${z_{A}}_{k}:=s^{(i_{k})}_{k}\oplus s^{(j_{k})}_{k}$ for $k=1,...,N$. 5. (v)

(Bit error correction) Alice chooses and announces a bit error correcting code. She calculates the $N_{EC}$-bit syndrome for $\bm{z}_{A}$ and encrypts it by consuming $N_{EC}$ bits of the pre-shared secret key before she sends it to Bob. With the syndrome, Bob performs bit error correction on his sifted key $\bm{z}_{B}$ and obtains the reconciled key $\bm{z}_{B}^{\mathrm{rec}}$ of $N$ bits. 6. (vi)

(Privacy amplification) Let $N_{\mathrm{fin}}:=N_{\mathrm{fin}}(N)$. Alice draws a full-rank $N\times N_{\mathrm{fin}}$ binary matrix $C_{PA}$ with the probability $p^{\prime}(C_{PA}|N,N_{\mathrm{fin}})$ and announces it. Alice and Bob computes the final keys as $\bm{z}_{A}^{\text{fin}}=\bm{z}_{A}C_{PA}$ and $\bm{z}_{B}^{\text{fin}}=\bm{z}_{B}^{\mathrm{rec}}C_{PA}$, respectively.

For simplicity, we omitted the bit error sampling rounds in the above protocol. In order to estimate an upper-bound on the bit error rate $e_{\mathrm{bit}}$, Alice randomly inserts $N_{\mathrm{smp}}$ sampling rounds among $N_{\mathrm{em}}$ rounds, and according to $e_{\mathrm{bit}}$, she decides whether she aborts the protocol or not. Here we assume that $N_{\mathrm{smp}}$ is negligibly small compared to $N_{\mathrm{em}}$. The required amount of the error syndrome Alice sends to Bob in the bit error correction, $N_{EC}$, depends on the error correction method; here we assume $N_{EC}=Nf_{EC}h(e_{\mathrm{bit}})$, where $f_{EC}$ is an error correction efficiency to satisfy the required correctness. The net key gain per pulse of the protocol is therefore given by $(N_{\mathrm{fin}}-N_{EC})/(N_{\mathrm{em}}L)=(N_{\mathrm{fin}}-Nf_{EC}h(e_{\mathrm{bit}}))/(N_{\mathrm{em}}L)$.

We evaluate the secrecy of Protocol 1 by the $\varepsilon_{\mathrm{sec}}$-secrecy condition for Alice’s final key defined as

[TABLE]

Here $\mathrm{Pr}(N_{\mathrm{fin}})$ is the probability of obtaining $N_{\mathrm{fin}}$, where aborting the protocol is interpreted as $N_{\mathrm{fin}}=0$. The density operator $\rho_{AE|N_{\mathrm{fin}}}^{\mathrm{fin}}$ represents the state of Alice’s final key and Eve’s quantum system, which takes the form of

[TABLE]

The ideal state $\rho_{AE|N_{\mathrm{fin}}}^{\mathrm{ideal}}$ is defined as

[TABLE]

II.2 The reduction of the protocol

We prove the secrecy condition (1) of the protocol based on complementarity [21]. In this way of the security proof, we introduce a virtual protocol (Protocol 2) in which Alice’s $N_{\mathrm{fin}}$-bit final key is obtained by a bit basis measurement on $N_{\mathrm{fin}}$ register qubits. Protocol 2 should be related to Protocol 1 such that for every attack on Protocol 1, there exists an attack on Protocol 2 resulting in the same final state ($\mathrm{Pr}(N_{\mathrm{fin}})$ and $\rho_{AE|N_{\mathrm{fin}}}^{\mathrm{fin}}$). While the original proof [4] followed the same technique, our construction of Protocol 2 below (see also Figure 2) includes a modification (shown in bold fonts) which is crucial to an improvement of the key rate.

Protocol 2 (virtual protocol):

Before the commencement of the protocol, Alice and Bob agree on constants $L$ and $N_{\mathrm{em}}$ as well as functions $N_{\mathrm{fin}}(N)$, $\bm{x}^{*}(N,y^{N},N_{\mathrm{fin}},\bm{t})$, and probabilities $p(C|N,N_{\mathrm{fin}})$ over full-rank $N\times N$ binary matrices $C$.

1. (i)

Alice and Bob repeat the following procedures for $N_{\mathrm{em}}$ rounds.

• •

Alice prepares an $L$-qubit register $A^{(1)},...,A^{(L)}$, a reference $R:=R^{(1)},...,R^{(L)}$, and $L$ optical pulses (system $1,...,L$) in the following state:

[TABLE]

where $\mathrm{Tr}_{R}\left(\bigotimes_{l=1}^{L}\ket{\Psi_{\sigma}}\bra{\Psi_{\sigma}}_{lR^{(l)}}\right)=\sigma\otimes\cdots\otimes\sigma$, and $\hat{n}_{l}$ is the photon number operator for the $l$-th pulse. She sends Bob the $L$ optical pulses through the quantum channel.

• •

Bob measures the photon number of each of the received pulses. He also generates a uniformly random binary number $q$.

• –

If Bob detects only one photon in the block and the generated random number $q$ is [math], he announces “success” and Alice keeps her register qubits $(A^{(1)},...,A^{(L)})$. Let $i$ be the position of the pulse with the detection. Bob randomly selects $j\in\{1,...,L\}\setminus\{i\}$ and records the ordered pair $(i\rightarrow j)$. [Success round]

• –

If the above condition is not satisfied, Bob announces “failure” and Alice discards her qubits. [Failure round] 2. (ii)

Let $N$ be the number of the success rounds. By proper indexing, Alice’s qubit registers are represented by $(A_{1}^{(1)},...,A_{1}^{(L)}),...,(A_{N}^{(1)},...,A_{N}^{(L)})$ and Bob’s records of ordered pairs are represented by $(i_{1}\rightarrow j_{1}),...,(i_{N}\rightarrow j_{N})$. 3. (iii)

Bob announces the sequence of unordered pairs $(i_{1},j_{1}),...,(i_{{N}},j_{{N}})$. He additionally announces the ordered pairs $(i_{1}\rightarrow j_{1}),...,(i_{N}\rightarrow j_{N})$. 4. (iv)

According to the ordered pairs $(i_{k}\rightarrow j_{k})$ $(k\in\{1,...,N\})$, Alice applies a CNOT operation between qubits $A_{k}^{(i_{k})}$ and $A_{k}^{(j_{k})}$ with $A_{k}^{(i_{k})}$ being control and $A_{k}^{(j_{k})}$ being target. She stores qubit $A_{k}^{(j_{k})}$ as the $k$th sifted key qubit, which she renames as $A_{k}$. She then measures qubit $A_{k}^{(i_{k})}$ in the phase basis to obtain a binary outcome $b_{k}$. She also performs phase-basis measurement on each of the $L-2$ qubits $A_{k}^{(l)}\ (l\in\{1,...,L\}\setminus\{i_{k},j_{k}\})$ to count the number $a_{k}\in\{0,...,L-2\}$ of the qubits with outcome $1$. Alice records $y_{k}=(a_{k},b_{k})$. At the end, she has $N$ sifted key qubits $A^{\prime}:=A_{1},...,A_{N}$, and the sequence $y^{N}:=y_{1},...,y_{N}$. 5. (v)

Alice chooses and announces a bit error correcting code. 6. (vi)

Let $N_{\mathrm{fin}}:=N_{\mathrm{fin}}(N)$. Alice draws a full-rank $N\times N$ binary matrix $C$ with the probability $p(C|N,N_{\mathrm{fin}})$ and announces $N\times N_{\mathrm{fin}}$ matrix $C_{PA}:=C\left(\bm{I}_{\mathrm{N_{\mathrm{fin}}}}\ \bm{O}\right)^{T}$. She acts a unitary $U(C)=\sum_{\bm{z}\in\{0,1\}^{N}}\ket{\bm{z}C}\bra{\bm{z}}_{A^{\prime}}=\sum_{\bm{x}\in\{0,1\}^{N}}\ket{\bm{x}(C^{-1})^{T}{}_{X}}\bra{\bm{x}_{X}}_{A^{\prime}}$ on her sifted key qubits, and performs phase basis measurement on the subsystem $A_{N_{\mathrm{fin}}+1},...,A_{N}$ to obtain $(N-N_{\mathrm{fin}})$-bit sequence $\bm{t}$. Using $y^{N}$ and $\bm{t}$, Alice computes ${\bm{x}^{*}}:=\bm{x}^{*}(N,y^{N},N_{\mathrm{fin}},\bm{t})$ and acts a unitary $U^{\prime}(\bm{x}^{*})=\sum_{\bm{x}^{\prime}\in\{0,1\}^{N_{\mathrm{fin}}}}\ket{(\bm{x}^{\prime}\oplus\bm{x}^{*}\tilde{H}^{T})_{X}}\bra{\bm{x}^{\prime}_{X}}_{A}$ on the remaining $N_{\mathrm{fin}}$ qubits $A:=A_{1},...,A_{N_{\mathrm{fin}}}$ (final key qubits), where $\tilde{H}$ is the $N_{\mathrm{fin}}\times N$ matrix $\left(\bm{I}_{\mathrm{N_{\mathrm{fin}}}}\ \bm{O}\right)C^{-1}$. 7. (vii)

She performs bit basis measurement on the final key qubits $A$ and obtains the final key $\bm{z}_{A}^{\mathrm{fin}}$.

We choose the parameters in Protocol 2 according to those of Protocol 1 as follows. The constants $L$ and $N_{\mathrm{em}}$ and the function $N_{\mathrm{fin}}(N)$ are the same as those of Protocol 1. The probability $p(C|N,N_{\mathrm{fin}})$ is chosen to satisfy

[TABLE]

If Alice performed bit basis measurement on her register qubits of (4), she obtains the random bit sequence $s^{(1)},...,s^{(L)}$ with the same probability and the $L$ optical pulses in the same state as those in Protocol 1. In addition, all the quantum operations of Alice in Protocol 2, which are composed of permutations of the bit basis, are equivalent to the classical information processing in Protocol 1. (Note that $U^{\prime}(\bm{x}^{*})$ dose not change the bit basis of the qubits.) Furthermore, as shown in the original paper [4], Bob announces unordered pairs $(i_{k},j_{k})$ in Protocol 2 with the same probability as in Protocol 1. Therefore, for every attack of Eve in Protocol 1, we can define a corresponding attack in Protocol 2 by letting Eve ignore the ordered pairs $(i_{k}\rightarrow j_{k})$. Then, by setting the parameters as mentioned above and with the attack by Eve as defined above, we can conclude that the final state of Alice and Eve at the end of (vii) in Protocol 2 is equal to $\rho_{AE|N_{\mathrm{fin}}}^{\mathrm{fin}}$ in Protocol 1.

On the other hand, let $\rho^{\mathrm{virt}}_{AE|N_{\mathrm{fin}}}$ be the quantum state on the Alice’s final key qubits $A$ and Eve’s system $E$ at the end of (vi) in Protocol 2. If $\rho^{\mathrm{virt}}_{AE|N_{\mathrm{fin}}}$ satisfies

[TABLE]

where $\ket{\bm{0}_{X}}:=\ket{0_{X}}^{\otimes N_{\mathrm{fin}}}$ and $\rho_{A|N_{\mathrm{fin}}}^{\mathrm{virt}}:=\mathrm{Tr}_{E}(\rho_{AE|N_{\mathrm{fin}}}^{\mathrm{virt}})$, and Eve performs the attack as defined above, the left-hand side of (1) is proved to satisfy

[TABLE]

and thus Protocol 1 is $\sqrt{2\eta^{\prime}}$-secret [21, 22].

The fidelity in the left-hand side of (6) is equal to the probability that Alice obtains $N_{\mathrm{fin}}$-bit sequence $\bm{0}:=(0\cdots 0)$ when she measures $\rho^{\mathrm{virt}}_{AE|N_{\mathrm{fin}}}$ in the phase basis. We therefore consider the alternative procedure (vii)’ after (vi) in Protocol 2 as follows:

1. (vii)’

She performs phase basis measurement on the final key qubits $A$ and obtains the final-phase key $\bm{x}_{A}^{\mathrm{fin}}$.

Using $\bm{x}_{A}^{\mathrm{fin}}$, the fidelity in (6) is given by

[TABLE]

In order to evaluate the right-hand side, we introduce a third protocol which faithfully simulates the statistics of $\bm{x}_{A}^{\mathrm{fin}}$ as follows.

Protocol 3 (estimation protocol):

• (i)

Alice and Bob follow the step (i) of Protocol 2 except that Alice measures the $L$ qubits in the phase basis immediately after its preparation, and obtains a bit sequence $\mathfrak{s}^{(1)},...,\mathfrak{s}^{(L)}$. She records $m=\sum_{l=1}^{L}\mathfrak{s}^{(l)}\ (\in\{0,...,L\})$ for every round. In the success rounds, Alice records the sequence $(\mathfrak{s}_{k}^{(1)},...,\mathfrak{s}_{k}^{(L)})$. Let $v_{M}$ be the number of rounds with $m=M$, where $\sum_{M}v_{M}=N_{\mathrm{em}}$.

• (ii)

By proper indexing, Alice has the bit sequences $(\mathfrak{s}^{(1)}_{1},...,\mathfrak{s}^{(L)}_{1}),...,(\mathfrak{s}^{(1)}_{N},...,\mathfrak{s}^{(L)}_{N})$. Bob has the sequence of ordered pairs, $(i_{1}\rightarrow j_{1}),...,(i_{N}\rightarrow j_{N})$.

• (iii)

Bob announces the sequence of unordered pairs $(i_{1},j_{1}),...,(i_{{N}},j_{{N}})$. He additionally announces the ordered pairs $(i_{1}\rightarrow j_{1}),...,(i_{N}\rightarrow j_{N})$.

• (iv)

With the ordered pairs $(i_{k}\rightarrow j_{k})$ $(k\in\{1,...,N\})$, Alice computes the following variables for $k\in\{1,...,N\}$.

[TABLE]

At the end, she has a sifted-phase key $\bm{x}_{A}:=(x_{1}\cdots x_{N})(=x^{N})$ and the sequence $y^{N}:=y_{1},...,y_{N}$ as well as the sequences $m^{N}:=m_{1},...,m_{N}$ and $u^{N}:=u_{1},...,u_{N}$.

• (vi)

She draws a full-rank $N\times N$ binary matrix $C$ with probability $p(C|N,N_{\mathrm{fin}})$. She computes $H:=(\bm{O}\ \bm{I}_{N-N_{\mathrm{fin}}})C^{-1}$, $\tilde{H}:=(\bm{I}_{N_{\mathrm{fin}}}\ \bm{O})C^{-1}$, and $\bm{t}:=\bm{x}_{A}H^{T}$. Using $y^{N}$ and $\bm{t}$, she computes $\bm{x}^{*}:=\bm{x}^{*}(N,y^{N},N_{\mathrm{fin}},\bm{t})$ and obtains the final-phase key $\bm{x}_{A}^{\mathrm{fin}}=(\bm{x}_{A}\oplus\bm{x}^{*})\tilde{H}^{T}$.

Since all the quantum operations of Alice in Protocol 2 are composed of permutations of the phase basis states, Alice’s procedures of determining $\bm{x}_{A}^{\mathrm{fin}}$ in Protocol 2 with (vii)’ and those in Protocol 3 are equivalent. (We used the property of CNOT operation to derive (9) and (13).) It is clear in Protocol 3 that the following inequality always holds:

[TABLE]

With (8), the left-hand side of the above inequality is identified as the left-hand side of (6). Therefore, if we can ensure

[TABLE]

the condition (6) is satisfied. The parameter $\eta^{\prime}$ in (16) can be regarded as an upper-bound on the probability that Alice misidentifies the sequence $\bm{x}_{A}$ (phase error patterns) and computes the wrong sequence $\bm{x}^{*}$ when given the sequence $y^{N}$ and the syndrome $\bm{t}$.

The bound $\eta^{\prime}$ can be further related to the number of candidates of $\bm{x}_{A}$, given $N$ and $y^{N}$. Suppose that a family of sets $T(N,y^{N})$ satisfies

[TABLE]

Suppose further that for a function $H_{PA}(N)$ which depends only on $N$,

[TABLE]

holds, where \bigl{|}T(N,y^{N})\bigr{|} is the cardinality of $T(N,y^{N})$. We assume that the selection of $H^{T}$ with probability $p(C|N,N_{\mathrm{fin}})$ in Protocol 3 is equivalent to $\text{universal}_{2}$ hashing, i.e.

[TABLE]

which amounts to require $p^{\prime}(C|N,N_{\mathrm{fin}})$ in Protocol 1 to be dual $\text{universal}_{2}$ hashing [23]. Then, by setting

[TABLE]

we obtain, from the union bound,

[TABLE]

because learning $\bm{t}=\bm{x}_{A}H^{T}$ eliminates all the wrong candidates in $T(N,y^{N})$ except probability no more than $2^{-s}$. Then, from (6), (7), (21), and by identifying $\eta^{\prime}=\eta+2^{-s}$, Protocol 1 is $\sqrt{2(\eta+2^{-s})}$-secret.

The conclusion of this subsection is as follows. If we can define $T(N,y^{N})$ which satisfies

[TABLE]

in Protocol 3 and

[TABLE]

for a function $H_{PA}(N)$ which depends only on $N$, then by setting

[TABLE]

Protocol 1 can be made $\sqrt{2(\eta+2^{-s})}$-secret.

II.3 The origin of the improvement

Here we give a crude explanation of why we expect an improvement of the key rate from the introduction of additional information $y_{k}=(a_{k},b_{k})$ collected by Alice in Protocol 2. In the asymptotic limit, the ratio $N_{\mathrm{fin}}/N$ is given by $N_{\mathrm{fin}}/N=1-H_{PA}$, where $H_{PA}$ is the fraction for the shortening in privacy amplification, representing an upper-bound on the amount of leaked information. In the original security proof, for the implementation without phase randomization, it is simply given by $H_{PA}=\max h(e_{\mathrm{ph}})$, where $e_{\mathrm{ph}}$ is the average phase error probability of a sifted key qubit. In this framework, the best strategy by Eve is to make $e_{\mathrm{ph}}$ as high as possible. It is simply achieved by her measuring all the photon number parities $\mathfrak{s}^{(1)},...,\mathfrak{s}^{(L)}$, followed by choosing the index $i$ such that $\mathfrak{s}^{(i)}=0$, as illustrated in Figure 3, (i) and (ii). Since the index $j$ is chosen randomly, phase error occurs (like (i)) with probability $m/(L-1)$ for a round, resulting in $e_{\mathrm{ph}}=\sum_{k}m_{k}/N(L-1)$. Hence, Eve will only have to choose $N$ rounds with higher values of $m=\sum_{l}\mathfrak{s}^{(l)}$.

The introduction of $y_{k}=(a_{k},b_{k})$ drastically changes Eve’s strategy. In this case, the asymptotic fraction will be given by a conditional entropy as $H_{PA}=\max\sum_{y}p(y)h(e_{\mathrm{ph}}(y))$, where $e_{\mathrm{ph}}(y)$ is the phase error probability conditioned on $y=(a,b)$. As seen in Figure 3, case (i) and case (ii) have distinct values of $y$, and thus no longer contributes to $H_{PA}$. In order to increase the conditional entropy, Eve must mix the case with the same values of $y$, such as cases (iii) and (iv). Due to the randomness of index $j$, these inevitably lead to occurrence of other cases like (v) and (vi), and this continues. Notice that these cases involve different values of $m=\sum_{l}\mathfrak{s}^{(l)}$. Hence simply choosing higher values of $m$ no longer works for Eve, and she must find an appropriate balance over the values of $m$ to make the conditional entropy higher.

We emphasize here that the above constraint for Eve is quite natural once we notice that her true objective is not to increase the phase error probability but to learn the optical phase difference ${s}^{(i)}\oplus{s}^{(j)}$ between the pair of pulses. The value of ${s}^{(i)}\oplus{s}^{(j)}$ is encoded on the relative phase of superposition states of (i) and (iii), and on that of (ii) and (iv), for example. In this sense, the introduction of $y_{k}=(a_{k},b_{k})$ can be interpreted as providing more precise evaluation of Eve’s ability to learn Alice’s sifted key bits. The reduction to Protocol 3 in the previous subsection is essentially regarded as reducing that evaluation to a problem on classical random variables possessed by Alice alone. It is nonetheless convoluted and involves many variables and constraints, but it will be efficiently solved by introducing Lagrange multipliers in the next subsection.

II.4 The estimation of the number of phase error patterns

In this subsection, we give an explicit construction of $T(N,y^{N})$, the set of likely phase error patterns. The construction has free parameters $\bm{\nu}$ and $\bm{\xi}$ served as Lagrange multipliers, which will be defined later. While any proper choice of the parameters makes Protocol 1 secure, the key length will depend on the choice.

In what follows, we adopt the following notations. For a finite set ${\cal W}$, we define ${\cal P}_{\cal W}$ as the set of all the probability mass functions on ${\cal W}$. When a set $\Gamma$ is associated with ${\cal W}$ uniquely by a function $f_{\Gamma}:{\cal W}\rightarrow\Gamma$, we denote the distribution on $\Gamma$ induced from $P\in{\cal P}_{\cal W}$ by ${P}_{\Gamma}$, which satisfies

[TABLE]

for $g\in\Gamma$. For a finite set $\Omega$, the type $\tilde{P}_{\omega^{n}}\in{\cal P}_{\Omega}$ for $\omega^{n}=(\omega_{1},...,\omega_{n})\in\Omega^{n}$ is defined by

[TABLE]

for $\omega\in\Omega$.

Let ${\cal M}=\{0,...,L\},\ {\cal U}={\cal X}=\{0,1\}$ and ${\cal Y}=\{(a,b)|a\in\{0,...,L-2\},\ b\in\{0,1\}\}$ be the set of all the possible values of $m_{k},u_{k},x_{k},$ and $y_{k}$ in Protocol 3, respectively. Let ${\cal W}$ be the finite set defined as follows:

[TABLE]

Let $f_{\cal M}:{\cal W}\rightarrow{\cal M}$, $f_{\cal M\times U}:{\cal W}\rightarrow{\cal M\times U}$, and $f_{\cal X}:{\cal W}\rightarrow{\cal X}$ be the projections from the Cartesian product ${\cal M\times U\times X}$ restricted on ${\cal W}$. Let $f_{{\cal Y}}:{\cal W}\rightarrow{\cal Y}$ be the function defined by

[TABLE]

In Protocol 3, $x_{k},u_{k},$ and $m_{k}$ are related to $y_{k}$ by

[TABLE]

and hence $y^{N}$ is uniquely determined once sequences $x^{N}$, $m^{N}$, and $u^{N}$ are given. We denote the binomial distribution with $L$ trials by $\mathfrak{b}_{L,p}\in{\cal P}_{\cal M}$, where

[TABLE]

When Eve’s attack is fixed in Protocol 3, the joint probability distribution of $\bm{v}:=(v_{0},...,v_{L}),N,x^{N},m^{N},$ and $u^{N}$, denoted by $\mathfrak{P}$, is determined. In what follows, $\mathrm{Pr}\{\cdot\}$ denotes the probability under $\mathfrak{P}$. Regardless of Eve’s attacks, the following three conditions hold for $\mathfrak{P}$.

The variable $\bm{v}=(v_{0},...,v_{L})$ obeys multinomial distribution

[TABLE]

with $p_{\mathrm{odd}}$ satisfying

[TABLE]

This property can be confirmed if we rewrite the initial state of Protocol 3, given by (4), as

[TABLE]

where $\Pi_{l}^{\mathrm{even(odd)}}$ is the projection operator onto the even (odd) photon number states. The probability of obtaining $\mathfrak{s}^{(l)}=1$ when measuring the $l$-th qubit of (33) in phase basis, denoted by $p_{\mathrm{odd}}$, is given by

[TABLE]

Hence the number $M=\sum_{l}\mathfrak{s^{(l)}}$ follows the probability $\mathfrak{b}_{L,p_{\mathrm{odd}}}(M)$. Since $p_{\mathrm{odd}}$ is equal to the probability of emitting odd number of photons in a pulse, (32) holds by definition. 2. 2.

For the type $\tilde{P}_{m^{N}}$ of the random variable $m^{N}$,

[TABLE]

holds, which is obvious from the definition of the type. 3. 3.

Since Bob randomly chooses $j_{k}$ out of $\{1,...,L\}\setminus\{i_{k}\}$ in each success round, the probability of obtaining $x_{k}=1$ in the $k$th success round given $m_{k}$ and $u_{k}$ is $(m_{k}-u_{k})/(L-1)$. Therefore,

[TABLE]

holds for $N\geq 1$, where

[TABLE]

Let $\bm{\nu}=\{\nu_{0},...,\nu_{L}\}$ be the set of real non-negative constants which satisfy $\nu_{M}=0$ for all $M<Lp_{\mathrm{src}}$. Let ${\cal P}^{N,\bm{\nu},\delta_{1}}\subseteq{\cal P}_{{\cal W}}$ be the set of the probability mass functions defined by

[TABLE]

From the conditions 1 and 2 of $\mathfrak{P}$, the type $\tilde{P}_{m^{N},u^{N},x^{N}}\in{\cal P}_{{\cal W}}$ in Protocol 3 belongs to ${\cal P}^{N,\bm{\nu},\delta_{1}}$ with a high probability. More precisely, we have the following proposition with its proof given in Appendix A.

Proposition 1**.**

Let $\bm{\nu}=\{\nu_{0},...,\nu_{L}\}$ be the set of non-negative constants which satisfy $\nu_{M}=0$ for all $M<Lp_{\mathrm{src}}$. Suppose that $\eta_{1}$ and $\delta_{1}$ satisfy

[TABLE]

where the convex set ${\cal Q}$ is defined as

[TABLE]

When the random variables $(\bm{v},N,m^{N},u^{N},x^{N})$ satisfy (31) and (35), the following inequality holds:

[TABLE]

Let $\bm{\xi}=\{\xi_{M,U}:(M,U)\in{\cal M}\times{\cal U},\ 0\leq c(M,U)\leq 1\}$ be the set of real constants satisfying \bigl{|}\xi_{M,U}\bigr{|}\leq 1. Let ${\cal P}^{\bm{\xi},\delta_{2}}\subseteq{\cal P}_{{\cal W}}$ be the set of the probability mass functions defined as

[TABLE]

Since the right-hand side of the inequality is a concave function with respect to $P$, ${\cal P}^{\bm{\xi},\delta_{2}}$ is a convex subset of ${\cal P}_{{\cal W}}$. From the condition 3 of $\mathfrak{P}$, the type $\tilde{P}_{m^{N},u^{N},x^{N}}\in{\cal P}_{{\cal W}}$ in Protocol 3 belongs to ${\cal P}^{\bm{\xi},\delta_{2}(N)}$ with a high probability. More precisely, we have the following proposition with its proof given in Appendix B.

Proposition 2**.**

Let $\bm{\xi}=\{\xi_{M,U}:(M,U)\in{\cal M}\times{\cal U},\ 0\leq c(M,U)\leq 1\}$ be the set of real constants which satisfy \bigl{|}\xi_{M,U}\bigr{|}\leq 1. Suppose that $\eta_{2}$ and $\{\delta_{2}(N)\}_{N=1,2,...}$ satisfy

[TABLE]

When the random variables $(N,m^{N},u^{N},x^{N})$ satisfy the condition (36), the following inequality holds:

[TABLE]

We define the following convex set of probability mass functions over ${\cal W}$,

[TABLE]

which satisfies

[TABLE]

if $(\eta_{1},\delta_{1})$ and $(\eta_{2},\{\delta_{2}(N)\}_{N=1,...})$ satisfy (39) and (43), respectively (union bound). With ${\cal E}\subseteq{\cal P}_{{\cal W}}$, we define the set of likely phase error patterns $T(N,y^{N})$ as follows:

[TABLE]

If $\tilde{P}_{m^{N},u^{N},x^{N}}\in{\cal E}$, by setting $P=\tilde{P}_{m^{N},u^{N},x^{N}}$, we have $P_{{\cal X}\times{\cal Y}}=\tilde{P}_{x^{N},y^{N}}$, and thus $x^{N}\in T(N,y^{N})$. Therefore, from (46), we also have

[TABLE]

Here, the upper-bound of \bigl{|}T(N,y^{N})\bigr{|} is obtained by using the following lemma.

Lemma 1** (The upper bound on the number of distinct patterns compatible to a joint probability distribution).**

Let ${\cal W}$ be a finite set, and ${\cal E}$ be a closed convex subset of ${\cal P}_{\cal W}$. Let ${\cal X}$ and ${\cal Y}$ be sets associated with ${\cal W}$ by functions $f_{\cal X}:{\cal W\rightarrow X}$ and $f_{\cal Y}:{\cal W\rightarrow Y}$. For $y^{N}\in{{\cal Y}}^{N}$, define the set

[TABLE]

Then the cardinality of the set $T(y^{N})$ satisfies

[TABLE]

Although we have assumed specific choices of ${\cal W},f_{\cal X},f_{\cal Y},$ and ${\cal E}$, we can generally prove Lemma 1 without such specification, as shown in Appendix C. Since what we need is a bound on \bigl{|}T(N,y^{N})\bigr{|} independent of $y^{N}$ as in (23), we use Lemma 1 with $T(y^{N})=T(N,y^{N})$ and take the maximum with all the possible sequence $y^{N}$ as follows:

[TABLE]

Combining Proposition 1 and 2, (45), (47), (48), and (51), we arrive at the following theorem.

Theorem 1** (The main result).**

Let $\bm{\nu}=\{\nu_{M}:M\in{{\cal M}}\}$ be the set of non-negative constants which satisfy $\nu_{M}=0\text{ for all }M<Lp_{\mathrm{src}}$. Let $\bm{\xi}=\{\xi_{M,U}:(M,U)\in{\cal M}\times{\cal U},\ 0\leq c(M,U)\leq 1\}$ be the set of real constants which satisfy \bigl{|}\xi_{M,U}\bigr{|}\leq 1. Let $\eta_{1}$ and $\delta_{1}$ be non-negative numbers which satisfy

[TABLE]

where $\mathfrak{b}:=\mathfrak{b}_{L,p_{\mathrm{src}}}$. Let $\eta_{2}$ and $\{\delta_{2}(N)\}_{N=1,...}$ be non-negative numbers which satisfy

[TABLE]

Let $H_{PA}(N)$ be a function of $N$ which satisfies

[TABLE]

where ${\cal E}$ is given in (45). Then, if the three conditions (31), (35), and (36) are satisfied, there exists $T(N,y^{N})$ which satisfies

[TABLE]

in Protocol 3, and

[TABLE]

Combining this and the conclusion of the section II.2, we conclude that Protocol 1 can be made $\sqrt{2(\eta_{1}+\eta_{2}+2^{-s})}$-secret by setting $N_{\mathrm{fin}}(N)$ as in (24).

III Numerical simulations

We numerically simulate the net key gain per pulse $(N_{\mathrm{fin}}-N_{EC})/{N_{\mathrm{em}}L}=N(1-H_{PA}(N)-s/N-f_{EC}h(e_{\mathrm{bit}}))/{N_{\mathrm{em}}L}$ of the RRDPS protocol using Theorem 1. We set

[TABLE]

where $\lceil\cdot\rceil$ denotes the ceiling function. Since the conditional entropy function is concave with respect to the joint probability distribution $P$, what we need is to solve the following constrained convex optimization problem:

[TABLE]

with a proper choice of the constants $\bm{\nu}$ and $\bm{\xi}$.

First, we consider the asymptotic limit $N_{\mathrm{em}},N\rightarrow\infty$ while the block detection rate $R:=N/N_{\mathrm{em}}$ remains constant. In this case, we can neglect $\delta_{1}$ and $\delta_{2}(N)$, and the optimization problem (58) is reduced to the following simple form:

[TABLE]

Here the equality of the second constraint comes from the fact that $\xi_{M,U}$ can be both positive and negative. Finding the best bound on $H(X|Y)_{P_{{\cal X}\times{\cal Y}}}$ by adjusting $\bm{\nu}$ and $\bm{\xi}$ is equivalent to solving the following convex optimization problem with the affine constraints:

[TABLE]

Since the problem is convex, if we can find $P^{*}(M,U,X)>0,\bm{\nu}^{*},\bm{\xi}^{*},$ and $\lambda^{*}$ that satisfy the following Karush-Kuhn-Tucker (KKT) condition, the maximum of $H(X|Y)_{P_{{\cal X}\times{\cal Y}}}$ in the problem (60) is achieved at $P=P^{*}$.

[TABLE]

The asymptotic limit $H_{PA}$ of the amount of privacy amplification $H_{PA}(N)$ is then given by

[TABLE]

For the numerical simulation of the key rate, we assume that the block detection rate $R$ is given by

[TABLE]

where $\eta$ is an overall transmission rate of the channel and $\mu$ is the mean photon number of each pulse from the source. (This rate is equal to the probability of detecting single photon in a block with efficiency $1/2$ [4].) We neglect the dark count rate. In addition, we assume that the photon number distribution of each pulse is Poissonian with mean $\mu$. From (34), $p_{\mathrm{odd}}$ in this case is given by

[TABLE]

We set $p_{\mathrm{src}}=p_{\mathrm{odd}}=\mathrm{e}^{-\mu}\sinh\mu$. The error correction efficiency $f_{EC}$ is set to $1$. We numerically solved (61) and always found solution. Figure 4 shows the key rates vs. transmission rates by our new analysis and by the original analysis with the key rate of the decoy BB84 protocol with time-bin implementation when $e_{\mathrm{bit}}=3\%$. One can see that our new analysis improves the key rates of the RRDPS protocol for all $L$ compared to the original one. Moreover, we obtain an improvement of more than one order of magnitude in the key rate with relatively small $L$, which may improve the practicality of the protocol. The improved key rates with our analysis are comparable to that obtained in [18], but our analysis does not require the optical phase randomization.

Next we simulated the key rates in the finite-sized case by solving (58) with a heuristic choice of $\bm{\nu}$ and $\bm{\xi}$. Regardless of $N_{\mathrm{em}}$, we used $\{\nu_{M}^{*}:M\in{{\cal M}}\}$ and $\{\xi_{M,U}^{*}:(M,U)\in{\cal M}\times{\cal U},\ 0\leq c(M,U)\leq 1\}$, which are obtained as the solutions of (61), to define

[TABLE]

where $\xi_{\mathrm{max}}$ is defined as

[TABLE]

This heuristic choice of $\bm{\nu}$ and $\bm{\xi}$ becomes optimal when $N_{\mathrm{em}},N\rightarrow\infty$, i.e. in the asymptotic limit. We set the required correctness $\varepsilon_{\mathrm{cor}}$ and the required secrecy $\varepsilon_{\mathrm{sec}}$ to $\varepsilon_{\mathrm{cor}}=\varepsilon_{\mathrm{sec}}=10^{-15}$. We assumed that the bit error correction efficiency $f_{EC}=1.2$. Furthermore, for simplicity, we set

[TABLE]

in order to satisfy $\varepsilon_{\mathrm{sec}}=\sqrt{2(\eta_{1}+\eta_{2}+2^{-s})}$. We determined the values of $\delta_{1}$ and $\{\delta_{2}(N)\}_{N=1,...}$ by numerically solving

[TABLE]

where $\mathfrak{b}:=\mathfrak{b}_{L,p_{\mathrm{src}}}$. When we solved the optimization problem, we used the “minimize” function of the scipy library in Python with the “SLSQP” method. Figure 5 shows the key rates vs. the total emitted pulses of the RRDPS protocol with our analysis and with the original analysis, and of the decoy BB84 protocol. (The number of total emitted pulses is given by $N_{\mathrm{em}}L$ in the case of the RRDPS protocol.) Since the sampling cost $N_{\mathrm{smp}}$ is negligible only when we allow a margin for the estimation of $e_{\mathrm{bit}}$, we expect that the actual bit error rate should be lower than $3\%$. For this reason, we have also plotted the rate with $e_{\mathrm{bit}}=1.5\%$ for the decoy BB84 protocol. Comparison of these rates shows that the improvement of the key rates over the original proof survives up to fairly small number of total emitted pulses at which the decoy BB84 protocol fails to produce a key.

IV Discussion

In this paper, we proposed a refined security proof of the RRDPS protocol, which improves the key generation rate without any change in the protocol itself. The crux of the improvement is an observation that the estimation of the phase error pattern in the virtual protocol can be aided by additional information $y^{N}$, which was ignored in the original security analysis. The pair of parameters $y_{k}=(a_{k},b_{k})$ are related to the parity of the number of emitted photons in each of the $L$ pulses forming the $k$-th block (see (9)-(14)). The parameter $b_{k}$ is associated with the pulse pair from which the sifted key bit is extracted, while the parameter $a_{k}$ is with the rest of $L-2$ pulses. It is interesting that not only $b_{k}$ but also $a_{k}$ contributes to the improvement of the key rate.

The use of additional information related to the emitted numbers may look similar to the tagging technique [25] used for the (decoy) BB84 protocols with a practical source, where the latter uses the information whether the each pulse contains multiple photons (tagged) or not (untagged). There are, however, a couple of differences. One is the conceptual difference arising from the timing at which the tag is defined. In the case of the BB84 protocols, a tag is defined when the optical phase randomization is applied to the pulse before it leaves the sender. As a result, we can easily analyze the statistical properties of the tags without regard to the Eve’s attack. In contrast, $y_{k}=(a_{k},b_{k})$ in our case should be dubbed an ex post facto tag, because it is defined only after the positions of the pair of pulses are announced by Bob. The analysis on the statistical properties of the ex post facto tags are not straightforward and often requires special techniques to extract a property that is independent of Eve’s attack [20]. In our case, it is solved by introducing a third protocol (Protocol 3) solely for this purpose. From the viewpoint of implementation, the ex post facto tag has an advantage that it does not require optical phase randomization.

Another difference is a rather technical one that becomes significant in analyzing the finite-sized case. In contrast to the tag for the BB84 protocols which takes two values (multiple photons or not) or three values (multiple photons, single photons, or vacuum), our tag $y_{k}$ takes \bigl{|}{\cal Y}\bigr{|}=2(L-1) values. As a result, the number of rounds with a specific value $y\in{\cal Y}$ of tag, $N\tilde{P}_{y^{N}}(y)$, is much smaller than $N$. In addition, the constraint (36) essentially dictates connection between the events whose tags take different values. In such a case, it is not wise to derive a statistical bound separately for each value of $y\in{\cal Y}$ and then to combine those bounds by using the union bound. Instead, here we introduced Lagrange multipliers and derived an inequality for a combined property directly, as in Proposition 1 and 2. For counting the number of phase error patterns, the bound in Lemma 1 that is independent of the size \bigl{|}{\cal Y}\bigr{|} will be quite useful for mitigating finite-sized effects.

Although the above strategy succeeded in showing that the improvement persists up to a relatively small total number of emitted pulses, we see in Figure 5 that the rate is eventually surpassed by the original analysis when the total number is further decreased. We may ascribe it to either or both of the following two reasons. One is the fact that we did not optimized the values of the Lagrange multipliers and substituted the values in the asymptotic limit instead. The other is the use of a Bernstein’s inequality in the proof of Proposition 2, which affects the key rate through the definition of ${\cal P}^{\bm{\xi},\delta_{2}}$ in (42). It remains to be open whether we can replace it with a tighter bound while keeping the convexity of ${\cal P}^{\bm{\xi},\delta_{2}}$.

We emphasize here that our focus in the present paper was on the simplest implementation of the sender’s apparatus, namely, the use of the protocol without block-wise phase randomization in the original proposal, as it is. A natural question is that how the situation changes if we combine block-wise phase randomization with our analysis. On one hand, the aid of block-wise phase randomization does not seem to change the key rate so much considering that the key rate with our analysis is comparable to that with [18] in which the block-wise phase randomization is used. On the other hand, ${\cal P}^{N,\bm{\nu},\delta_{1}}$ may be significantly narrowed by the additional photon number constraint which is the consequence of the block-wise phase randomization. We leave it for the future research.

Acknowledgements.

This work was funded in part by ImPACT Program of Council for Science, Technology and Innovation (Cabinet Office, Government of Japan), Photon Frontier Network Program (Ministry of Education, Culture, Sports, Science and Technology), CREST (Japan Science and Technology Agency), and JSPS KAKENHI Grant Number JP18K13469.

Appendix A Proof of Proposition 1

Let $P_{\bm{v}}\in{\cal P}_{\cal M}$ be defined as $P_{\bm{v}}(M):=v_{M}/N_{\mathrm{em}}$. From the condition (31) and the fact that ${\cal Q}$ is a convex set, we can apply the special case of the Sanov’s theorem [26, 27] to $P_{\bm{v}}$ as follows:

[TABLE]

Let $b_{\mathrm{norm}}$ be the constant given by

[TABLE]

Let $q\in{\cal P}_{\cal M}$ be the probability mass function which is defined as

[TABLE]

which is well-defined since $\mathfrak{b}_{L,p_{\mathrm{src}}}(M)\geq\mathfrak{b}_{L,p_{\mathrm{odd}}}(M)$ holds for all $M\geq Lp_{\mathrm{src}}$, and $\sum_{M\in{\cal M}}q(M)=1$. We define the stochastic map $S:{\cal P}_{\cal M}\rightarrow{\cal P}_{\cal M}$ as follows:

[TABLE]

where

[TABLE]

It is easy to observe that

[TABLE]

Furthermore, since (i) $S(P)(M)\geq P(M)$ and $\nu_{M}\geq 0$ for all $M\geq Lp_{\mathrm{src}}$, and (ii) $\nu_{M}=0$ for all $M<Lp_{\mathrm{src}}$, we have

[TABLE]

Therefore, from the definition of ${\cal Q}$ in (40), we have

[TABLE]

Combining (75) and (77) with the monotonicity property of the Kullback-Leibler divergence under the stochastic map [28], we have

[TABLE]

From (70) and (78), we have

[TABLE]

On the other hand, since the random variables $(\bm{v},N,m^{N})$ obey (35) and $\nu_{M}\ (M\in{\cal M})$ are non-negative, we have

[TABLE]

and hence

[TABLE]

Combining (81) with the definition of ${\cal Q}$, we have

[TABLE]

where the first inequality follows from (81). Combining this with (79), we have

[TABLE]

Then (39) implies (41).

Appendix B Proof of Proposition 2

We use one of the Bernstein’s inequalities [29], which is stated as follows. Let $X_{1},...,X_{N}$ be independent zero-mean random variables. Suppose that \bigl{|}X_{k}\bigr{|}\leq 1 for all $k$. Then, for all non-negative $t$,

[TABLE]

holds.

For fixed values of $N(\geq 1),m^{N},u^{N}$, the condition (36) determines the conditional statistics of $N$ variables $\{X_{k}:=\left(x_{k}-c(m_{k},u_{k})\right)\xi(m_{k},u_{k})\}_{k=1,...,N}$, where $\xi(M,U):=\xi_{M,U}$. They are independent and zero-mean. Furthermore, since \bigl{|}\xi(m_{k},u_{k})\bigr{|}\leq 1 and $0\leq c(m_{k},u_{k})\leq 1$, \bigl{|}X_{k}\bigr{|}\leq 1 holds for all $k$. Thus, (84) holds if we interpret $\mathrm{Pr}(\cdot)$ and $\mathbb{E}[\cdot]$ as the conditional probability and the conditional mean. Using the definition of the type, we can rewrite the sums over index $k$ as

[TABLE]

and

[TABLE]

We choose $t$ to be

[TABLE]

which satisfies

[TABLE]

Substituting (85), (86), (87) to (84), we obtain the following:

[TABLE]

Then (43) implies (44).

Appendix C Proof of Lemma 1

For $y^{N}\in{{\cal Y}}^{N}$, define a set

[TABLE]

Since ${\cal E}$ is a closed convex set, ${\cal E}_{{\cal X}\times{\cal Y}}(y^{N})$ is also a closed convex set. Using the set, we can rewrite $T(y^{N})$ as

[TABLE]

Consider a probability mass function $Q(x,y)$ given by

[TABLE]

Then we have

[TABLE]

Let

[TABLE]

Then, we have (Pythagorean theorem [28])

[TABLE]

For $(x^{N},y^{N})\in{\cal X}^{N}\times{\cal Y}^{N}$ with $\tilde{P}_{x^{N},y^{N}}\in{\cal E}_{{\cal X}\times{\cal Y}}$, we have

[TABLE]

and hence

[TABLE]

Combined with (93), we have

[TABLE]

On the other hand, for $P\in{\cal E}_{{\cal X}\times{\cal Y}}(y^{N})$,

[TABLE]

and hence

[TABLE]

Combining (90), (98), and (100) leads to (50).