Practical decoy-state method for twin-field quantum key distribution

TL;DR

This paper presents a practical decoy-state method for twin-field quantum key distribution, demonstrating that using two to four decoy intensities suffices to outperform direct transmission limits with robustness against pulse fluctuations.

Contribution

The authors derive analytical bounds for decoy-state parameters in TF-QKD with 2-4 decoy intensities, optimizing performance and robustness.

Findings

Two decoy intensities are sufficient to surpass point-to-point capacity.

Four decoys nearly match the ideal infinite-decoy scenario.

Protocol is robust against intensity fluctuations.

Abstract

Twin-Field (TF) quantum key distribution (QKD) represents a novel QKD approach whose principal merit is to beat the point-to-point private capacity of a lossy quantum channel, thanks to performing single-photon interference in an untrusted node. Indeed, recent security proofs of various TF-QKD type protocols have confirmed that the secret key rate of these schemes scales essentially as the square root of the transmittance of the channel. Here, we focus on the TF-QKD protocol introduced by Curty et al, whose secret key rate is nearly an order of magnitude higher than previous solutions. Its security relies on the estimation of the detection probabilities associated to various photon-number states through the decoy-state method. We derive analytical bounds on these quantities assuming that each party uses either two, three or four decoy intensity settings, and we investigate the protocol's performance in this scenario. Our simulations show that two decoy intensity settings are enough to beat the point-to-point private capacity of the channel, and that the use of four decoys is already basically optimal, in the sense that it almost reproduces the ideal scenario of infinite decoys. We also observe that the protocol seems to be quite robust against intensity fluctuations of the optical pulses prepared by the parties.

Equations

$${\hat{\rho }}_{{\beta }_A}=\frac{1}{2\pi }{\int }_0^{2\pi }d\theta |{\beta }_A{e}^{i\theta }⟩⟨{\beta }_A{e}^{i\theta }|=\sum _{n=0}^{\infty }\frac{({\beta }_A^2{)}^n{e}^{-{\beta }_A^2}}{n!}|n⟩⟨n|$$

$$R\ge \max \{R_{10},0\}+\max \{R_{01},0\},$$

$$R_{k_c{k}_d}=p_X^{2}p(k_c,k_d)\left[1-fh(e_{k_c{k}_d})-h(e_{k_c{k}_d}^{\mathrm{ph}})\right],$$

$$p(k_c,k_d)=\sum _{b_A,b_B=0}^{1}p(b_A,b_B)p(k_c,k_d|b_A,b_B),$$

$$e_{10}$$

$$e_{01}$$

$$e_{k_c{k}_d}^{\mathrm{ph}}=\frac{1}{p(k_c,k_d)}\left[{\left(\sum _{n,m=0}^{\infty }{c}_{2n}{c}_{2m}\sqrt{Y_{2n2m}^{k_c,k_d}}\right)}^2+{\left(\sum _{n,m=0}^{\infty }{c}_{2n+1}{c}_{2m+1}\sqrt{Y_{2n+12m+1}^{k_c,k_d}}\right)}^2\right],$$

$$e_{k_c{k}_d}^{\mathrm{ph}}\le \frac{1}{p(k_c,k_d)}$$

$$Q_{k_c,k_d}^{{\beta }_A^2,{\beta }_B^2}=\sum _{n,m=0}^{\infty }{e}^{-{\beta }_A^2-{\beta }_B^2}\frac{({\beta }_A^2{)}^n({\beta }_B^2{)}^m}{n!m!}{Y}_{nm}^{k_c,k_d}.$$

$${\tilde{Q}}^{k,l}\equiv e^{{\mu }_k+{\mu }_l}{Q}^{k,l}=\sum _{n,m=0}^{\infty }\frac{Y_{nm}}{n!m!}{{\mu }_k}^n{{\mu }_l}^{m}k,l\in \{0,1\},$$

$$0\le Y_{nm}\le 1\forall n,m.$$

$$G_{11}$$

$$G_{11}=Y_{11}({\mu }_0-{\mu }_1{)}^2+\sum _{\stackrel{[}{n}+m>2]n,m=1}^{\infty }\frac{Y_{nm}}{n!m!}\left({\mu }_0^n-{\mu }_1^n\right)\left({\mu }_0^m-{\mu }_1^m\right).$$

$$Y_{11}^U=\frac{G_{11}}{({\mu }_0-{\mu }_1{)}^2},$$

$$G_{02}$$

$$G_{02}=$$

$$Y_{02}^U=\frac{2}{({\mu }_0+{\mu }_1)({\mu }_0-{\mu }_1{)}^2}\left[-G_{02}+\left(\sum _{m=1}^{\infty }\frac{{\mu }_0^m}{m!}-\frac{{\mu }_1^m}{m!}\right)\left(\sum _{n=2}^{\infty }{\mu }_1\frac{{\mu }_0^n}{n!}-{\mu }_0\frac{{\mu }_1^n}{n!}\right)\right],$$

$$Y_{02}^U=\frac{2\left(e^{{\mu }_0}-e^{{\mu }_1}\right)\left({\mu }_0-{\mu }_1+{\mu }_1{e}^{{\mu }_0}-{\mu }_0{e}^{{\mu }_1}\right)-2G_{02}}{({\mu }_0+{\mu }_1)({\mu }_0-{\mu }_1{)}^2}.$$

$$G_{20}$$

$$G_{20}=$$

$$Y_{20}^U=\frac{2}{({\mu }_0+{\mu }_1)({\mu }_0-{\mu }_1{)}^2}\left[-G_{20}+\left(\sum _{n=1}^{\infty }\frac{{\mu }_0^n}{n!}-\frac{{\mu }_1^n}{n!}\right)\left(\sum _{m=2}^{\infty }{\mu }_1\frac{{\mu }_0^m}{m!}-{\mu }_0\frac{{\mu }_1^m}{m!}\right)\right],$$

$$Y_{20}^U=\frac{2\left(e^{{\mu }_0}-e^{{\mu }_1}\right)\left({\mu }_0-{\mu }_1+{\mu }_1{e}^{{\mu }_0}-{\mu }_0{e}^{{\mu }_1}\right)-2G_{20}}{({\mu }_0+{\mu }_1)({\mu }_0-{\mu }_1{)}^2}.$$

$$G_{00}$$

$$G_{00}=$$

$$Y_{00}^U=$$

$$G_{02}=$$

$$Y_{0m}^U=\min \left\{\frac{m!}{({\mu }_0-{\mu }_1)({\mu }_0^m-{\mu }_1^m)}\left[-G_{02}+(e^{{\mu }_0}-e^{{\mu }_1})({\mu }_0-{\mu }_1+{\mu }_1{e}^{{\mu }_0}-{\mu }_0{e}^{{\mu }_1})\right],1\right\},$$

$$Y_{n0}^U=\min \left\{\frac{n!}{({\mu }_0-{\mu }_1)({\mu }_0^n-{\mu }_1^n)}\left[-G_{20}+(e^{{\mu }_0}-e^{{\mu }_1})({\mu }_0-{\mu }_1+{\mu }_1{e}^{{\mu }_0}-{\mu }_0{e}^{{\mu }_1})\right],1\right\}.$$

$$G_{11}=\sum _{n,m=1}^{\infty }\frac{Y_{nm}}{n!m!}\left({\mu }_0^n-{\mu }_1^n\right)\left({\mu }_0^m-{\mu }_1^m\right).$$

$$G_{11}=\sum _{n,m=1}^{\infty }\frac{{\mu }_0^n-{\mu }_1^n}{n!}\frac{{\mu }_0^m-{\mu }_1^m}{m!}-\frac{({\mu }_0^2-{\mu }_1^2{)}^2}{4}+\frac{({\mu }_0^2-{\mu }_1^2{)}^2}{4}{Y}_{22}^L,$$

Full text

The last few decades have witnessed major advancements in the field of quantum communication [1, 2], with quantum key distribution (QKD) [3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13] being its most developed application. Recent experiments over about 400 km of optical fibers [14, 15] and over about 1000 km of satellite-to-ground links [16, 17] demonstrated that QKD over long distances is possible. Despite such remarkable experimental achievements, the private capacity of point-to-point QKD is intrinsically limited by fundamental bounds [18, 19]. These bounds state that in the high-loss regime the key rate scales basically linearly with the transmittance of the channel connecting the end-users Alice and Bob, i.e. it decreases exponentially with the total channel length. This imposes strict practical constraints on the possibility of achieving point-to-point QKD over arbitrary long distances.

A way to overcome this limitation is to employ one or more intermediate nodes in the quantum channel connecting the parties. For instance, the use of quantum repeaters [20] yields a polynomial scaling of the communication efficiency with the distance [21]. Moreover, a quantum repeater scheme can be arbitrarily iterated along the quantum channel, thus increasing in principle the total communication distance between Alice and Bob as much as desired. Unfortunately, however, quantum repeaters are very challenging to build in practice with current technology: they either require quantum memories [20, 21, 22] or quantum error correction [23, 24]. Of course, technology is improving, and quantum repeaters may become viable in the future.

Other solutions, which attain a square-root improvement in the scaling of the key rate with respect to the transmittance of the channel, are obtained by placing a single untrusted relay between Alice and Bob. Such protocols include, for instance, Measurement-Device-Independent-QKD [6] (MDI-QKD) with quantum memories [25, 26] and adaptive MDI-QKD featuring quantum non-demolition measurements [27]. The philosophy behind both types of protocols is that the central relay is able to adapt the pairings of photons received from Alice and Bob to the photon losses. In this way, for every signal sent by Alice and Bob to the central relay, just one of the two signals is required to arrive, leading to the mentioned square-root improvement in the key rate scaling. However, both protocols still require two-photon interference in the central node, as in the original MDI-QKD scheme [6]. More recently, [28] proposed the Twin-Field (TF) QKD protocol, still characterized by an untrusted central node, and conjectured a square-root improvement in the key rate scaling. This scaling has been later on confirmed in [29, 30] for two variants of the original scheme. The advantage of TF-QKD lies in the fact that it is designed to generate key bits from single-photon interference in the central node, thus naturally retaining the scaling with the square-root of the transmittance without the need to adapt to photon losses via sophisticated devices.

Since the original proposal, there has been an intense research activity to develop different versions of TF-QKD protocols equipped with their security proofs [29, 30, 31, 32, 33] as well as to investigate their experimental feasibility [34, 35, 36]. Among these protocols, the one that seems to deliver the higher secret ket rate [37] is that introduced in [33]. Its security relies on the ability to estimate the detection statistics (usually called yields) of various Fock states sent by Alice and Bob through the decoy-state method [38, 39, 40]. The key-rate simulations provided in [33] indeed exhibit an improved scaling with the loss, but the estimation of the yields is only carried out by means of numerical tools based on linear programming and considering only the case of three decoy intensity settings.

In this paper, we derive analytical bounds on the yields which are required to evaluate the key rate formula of [33], assuming two, three and four decoy intensity settings. In so doing, we are able to show, for instance, that the use of two decoy intensity settings is already enough to beat the point-to-point private capacity bound reported in [19]. Also, we show that the use of four decoys is basically optimal in the sense that the resulting secret key rate is already very close to the ideal scenario which assumes infinite decoy intensity settings. Analytical bounds imply a fully-analytical expression for the protocol’s secret key rate, which could be very convenient for performance optimization in scenarios where the number of parameters is high, like for instance in finite-key security analyses. In addition, we study how the performance of TF-QKD is affected under intensity fluctuations, which are inevitable in practice, and we demonstrate that the protocol in [33] seems to be actually quite robust against such fluctuations.

Like in [33], for simplicity, here we focus on the asymptotic-key rate scenario. However, we remark that by using the techniques reported in [41], it is cumbersome but straightforward to adapt our analytical methods also to the finite-key rate scenario, where, as mentioned above, it becomes particularly useful to have analytical bounds for the main quantities that enter the key rate formula.

The article is structured as follows. In Sec. 1 we present the TF protocol from [33] and highlight the main yields that need to be bounded. In Sec. 2 we provide the analytical bounds on the yields for the case of two decoys (the cases of three and four decoys are treated in C and D, respectively). In Sec. 3 we provide simulations of the secret key rate versus the loss for a typical channel model (briefly described in A), and we also evaluate the effect of intensity fluctuations. We conclude the paper in Sec. 4.

1 The TF-QKD protocol

As discussed above, we consider the TF-QKD protocol presented in [33] and sketched in figure 1. Alice and Bob establish a secret shared key by sending optical pulses to a central untrusted node, $C$. It is assumed that the node $C$ shares a phase reference with Alice and Bob, which can be achieved by the transmission of strong optical pulses. The protocol is composed of the following five steps:

Alice (Bob) chooses the $X$-basis with probability $p_{X}$ and the $Z$-basis with probability $p_{Z}=1-p_{X}$. Upon choosing the $X$-basis, Alice (Bob) prepares an optical pulse in a coherent state ${|{\alpha}\rangle}$ or ${|{-\alpha}\rangle}$ at random, corresponding to the key bit $b_{A}=0$ ($b_{B}=0$) or $b_{A}=1$ ($b_{B}=1$), respectively. Upon choosing the $Z$-basis, she (he) prepares an optical pulse in a phase-randomized coherent state:

[TABLE]

($\hat{\rho}_{\beta_{B}}$) whose intensity $\beta_{A}^{2}$ ($\beta^{2}_{B}$) is drawn randomly from a set $\mathcal{S}_{A}=\{\beta^{2}_{i}\}_{i}$ ($\mathcal{S}_{B}=\{\beta^{2}_{j}\}_{j}$) of real nonnegative numbers. 2. 2.

Both parties send their optical pulses to the untrusted node $C$ via optical channels in a synchronized manner. 3. 3.

The central node $C$ applies a balanced beamsplitter to the incoming pulses and features two threshold detectors at its output ports. The detector placed at the output port associated to constructive (destructive) interference is denoted by $D_{c}$ ($D_{d}$). 4. 4.

The node $C$ announces the measurement outcome $k_{c}$ ($k_{d}$) of detector $D_{c}$ ($D_{d}$), with $k_{c}=0$ and $k_{c}=1$ ($k_{d}=0$ and $k_{d}=1$) corresponding to a no-click and a click event, respectively. 5. 5.

Alice and Bob form their raw keys with the bits $b_{A}$ and $b_{B}$ collected when both parties chose the $X$-basis and node $C$ reported a click in only one detector ($k_{c}+k_{d}=1$). Bob flips his bits $b_{B}$ for which the click occurred in $D_{d}$.

1.1 Secret key rate formula

The security analysis performed in [33] yields the following lower bound on the asymptotic key rate $R$:

[TABLE]

where the terms $R_{k_{c}k_{d}}$, for $(k_{c},k_{d})\in\{(1,0),(0,1)\}$, are defined as:

[TABLE]

with $h(x)=-x\log_{2}x-(1-x)\log_{2}(1-x)$ being the binary entropy function, $f$ the inefficiency function associated to error correction, and $p(k_{c},k_{d})$ the conditional probability that node $C$ announces the outcome $(k_{c},k_{d})$ when both parties selected the $X$-basis. The probability $p(k_{c},k_{d})$ can be expressed as:

[TABLE]

where $p(b_{A},b_{B})$ is the joint probability of Alice and Bob preparing the coherent states ${|{(-1)^{b_{A}}\alpha}\rangle}$ and ${|{(-1)^{b_{B}}\alpha}\rangle}$, respectively. According to the protocol description above, we have: $p(b_{A},b_{B})=1/4\,\,\forall\,b_{A},b_{B}$. $p(k_{c},k_{d}|b_{A},b_{B})$ instead denotes the conditional probability that node C announced $(k_{c},k_{d})$ given that Alice and Bob sent the coherent states ${|{(-1)^{b_{A}}\alpha}\rangle}$ and ${|{(-1)^{b_{B}}\alpha}\rangle}$, respectively. Since we consider the asymptotic key-rate scenario, we assume that $p(k_{c},k_{d}|b_{A},b_{B})$ coincides with the correspondent distribution observed by the parties.

Finally, the terms $e_{k_{c}k_{d}}$ and $e^{\mathrm{ph}}_{k_{c}k_{d}}$ in (1.3) represent the bit-error rate in the $X$-basis and an upper bound on the phase-error rate, respectively. The former is defined as:

[TABLE]

and the latter as:

[TABLE]

where the coefficients $c_{n}$ are defined as $c_{n}=e^{\frac{-\alpha^{2}}{2}}\alpha^{n}/\sqrt{n!}$ and the yields $Y^{k_{c},k_{d}}_{nm}$ are the conditional probabilities that node $C$ announces the outcome $(k_{c},k_{d})$ given that Alice and Bob emitted an $n$-photon state and an $m$-photon state, respectively. Note that the only yields contributing to (1.7) are those $Y^{k_{c},k_{d}}_{nm}$ such that $n+m$ is an even number.

The yields $Y^{k_{c},k_{d}}_{nm}$ are quantities that are not directly observed by the parties, however they can be estimated either numerically or analytically with techniques based on the decoy-state method [38, 39, 40]. Here we consider the analytical approach. In particular, we assume that Alice and Bob have at their disposal either two, three or four decoy intensity settings when choosing the $Z$-basis. To each further decoy intensity correspond additional linear constraints on the yields, leading to tighter estimations of $Y^{k_{c},k_{d}}_{nm}$ and thus to a higher key rate. However, a finite number of decoys only allows to derive non-trivial upper bounds111Every yield is a probability, thus it is trivially bounded by 1. on a limited number of yields in (1.7), whereas the other yields are set to 1. Nevertheless, even bounding just four yields in a non-trivial way is enough for the secret key rate to beat the point-to-point private capacity bound (PLOB bound) [19] at high losses (see Sec. 3). Also, as we show below, with four decoy intensity settings one can already obtain a secret key rate very close to that achievable with infinite decoy intensity settings.

We remark that standard decoy-state-based QKD protocols require to lower bound the value of a few yields (typically those associated to vacuum and single-photon pulses) [42], while the TF-QKD protocol considered here upper bounds the value of the phase-error rate (1.7) by upper bounding several yields. In particular, we upper bound the yields $Y^{k_{c},k_{d}}_{nm}$ for $(n,m)\in\mathcal{I}$, where $\mathcal{I}$ is a certain subset of $\{(n,m)|\,n,m\in\mathbb{N}_{0}\}$ which depends on the number of decoys. Thanks to the derived upper bounds on the yields (which we shall denote by $Y^{U,\,k_{c},k_{d}}_{nm}$) we are able to estimate the phase error rate (1.7) as follows:

[TABLE]

2 Yields estimation

When both Alice and Bob choose the $Z$-basis in the first step of the TF-QKD protocol, they prepare phase-randomized coherent states with intensities $\beta^{2}_{A}$ and $\beta^{2}_{B}$, respectively, and send them to $C$. From Eve’s viewpoint, she cannot distinguish this scenario from the case in which the parties prepared number states ${|{n}\rangle}$ and ${|{m}\rangle}$ according to the Poissonian distributions $P_{\beta_{A}^{2}}(n)$ and $P_{\beta_{B}^{2}}(m)$ (see Eq. 1.1), where $P_{\mu}(n)=e^{-\mu}\mu^{n}/n!$. Therefore Eve’s attack can only depend on the number states ${|{n}\rangle}$ and ${|{m}\rangle}$ but not on the signals’ intensities $\beta_{A}^{2}$ and $\beta_{B}^{2}$. As a consequence, the probability that Eve announces outcomes $(k_{c},k_{d})$ only depends on the number of photons $(n,m)$ she received from Alice and Bob, i.e. the yields $Y^{k_{c},k_{d}}_{nm}$ are independent of the decoy intensities chosen by the parties.

For this reason, one can derive a set of linear constraints on the yields $Y^{k_{c},k_{d}}_{nm}$ by expressing the experimentally observed gains $Q^{\beta_{A}^{2},\beta_{B}^{2}}_{k_{c},k_{d}}$ –which are defined as the conditional probabilities that node $C$ announced the outcome $(k_{c},k_{d})$ given that Alice and Bob sent phase-randomized coherent states of intensities $\beta_{A}^{2}$ and $\beta_{B}^{2}$, respectively– in terms of the yields:

[TABLE]

As it is clear from (2.1), to every distinct pair of decoy intensities $(\beta_{A}^{2},\beta_{B}^{2})$ corresponds a new constraint on the set of infinite yields $\{Y^{k_{c},k_{d}}_{nm}\}_{n,m}$, which leads to tighter upper bounds and thus to a higher secret key rate. On the other hand, having a large number of decoy intensities is experimentally demanding, hence the need to derive the tightest possible bounds on the yields with a limited number of decoys.

In this Section we present a simple analytical method to obtain tight bounds on the yields of largest contribution222The same method can –in principle– be applied to any yield, however the limited number of decoy settings prevents from obtaining a non-trivial bound on every yield. in (1.7) –i.e. relative to the largest coefficients $c_{n}$– when the parties use two intensity settings in the $Z$-basis. It is basically a Gaussian elimination-type technique but involving infinite-size coefficient matrices. In particular, the guiding principle that we use is to combine the constraints (2.1) so that in the resulting expression the yield to be bounded is the one with the largest coefficient, while the yields which had larger coefficients in the initial constraints have been removed in the combination. However, in some cases it turns out that is not possible to remove all the yields with larger coefficients than the one to be bounded, due to a lack of decoy intensity settings (i.e. constraints). In other cases, we manage to remove from the resulting expression even some yields which had a smaller coefficient than the one to be bounded. Such a procedure can be readily extended to the case of three and four decoy intensity settings. The results for these last two cases are presented in C and D, respectively.

From now on, we assume that both optical channels linking the parties to the central node $C$ have the same transmittance $\sqrt{\eta}$. Therefore the set of optimal decoy intensities $\beta_{A}^{2}$ and $\beta_{B}^{2}$ is the same for both parties [43] and we define it as: $\{\mu_{0},\mu_{1}\}$. In order to simplify the notation, we also omit the measurement outcome $(k_{c},k_{d})$ from the constraints given by (2.1). Hence the yields are subjected to the following four equality constraints:

[TABLE]

and to the inequality constraints:

[TABLE]

Below we derive upper bounds on the yields: $Y_{00},Y_{11},Y_{02}$ and $Y_{20}$.

2.1 Upper bound on $Y_{11}$

Consider the following combination of gains:

[TABLE]

The subscript in $G_{11}$ indicates the yield that is going to be bounded with this combination of gains. In (2.4) the coefficients of the yields $Y_{0m}$ and $Y_{n0}$, for any $n$ and $m$, are identically zero. Thus (2.4) can be rewritten as:

[TABLE]

We observe that the coefficients that multiply the yields $Y_{nm}$ are always positive, being the product of two factors of equal sign. A valid upper bound for $Y_{11}$ is obtained considering the worst-case scenario for the other yields, taking into account that (2.3) holds. Since all the yields’ coefficients carry the same sign in (2.5) –regardless of the relation between $\mu_{0}$ and $\mu_{1}$–, the yield $Y_{11}$ is maximal when all the other yields are minimal. Thus the upper bound on $Y_{11}$ is extracted by setting all the other yields to zero in (2.5):

[TABLE]

where $G_{11}$ is defined in (2.4).

We remark that by combining the gains as in (2.4), we manage to obtain a closed expression for $Y_{11}$ in which the contribution of all the yields $Y_{0m}$ and $Y_{n0}$ is removed. Additionally, $Y_{11}$ is now the yield with the “highest weight” in (2.5) since it has the largest coefficient. All the yields’ bounds presented in this work follow the same philosophy.

2.2 Upper bound on $Y_{02}$

Consider the following combination of gains:

[TABLE]

In (2.7) the coefficients of the yields $Y_{n0}$ and $Y_{1m}$ are identically zero. Thus (2.7) can be rewritten as:

[TABLE]

Like in the derivation of $Y_{11}$’s bound given by (2.6), a valid upper bound for $Y_{02}$ is obtained by considering the worst-case scenario for the remaining yields in (2.8). More specifically, $Y_{02}$ is maximal when the yields whose coefficient has the same sign as $Y_{02}$’s coefficient are minimal, and the yields whose coefficient has opposite sign to $Y_{02}$’s are maximal. Recalling constraint (2.3), this means setting $Y_{01}$ and $Y_{0m}$ to zero and $Y_{nm}$ with $n\geq 2$ and $m\geq 1$, to 1 in (2.8). In so doing, after rearranging the terms we obtain:

[TABLE]

which leads to the following upper bound on $Y_{02}$:

[TABLE]

2.3 Upper bound on $Y_{20}$

Consider the following combination of gains:

[TABLE]

In (2.11) the coefficients of the yields $Y_{n1}$ and $Y_{0m}$ are identically zero. Thus (2.11) can be rewritten as:

[TABLE]

A valid upper bound for $Y_{20}$ is obtained by setting to zero the yields whose coefficient has the same sign as $Y_{20}$’s coefficient, and by setting to 1 the yields whose coefficient has opposite sign to $Y_{20}$’s. In the case of (2.12) this means setting $Y_{10}$ and $Y_{n0}$ to zero and $Y_{nm}$ with $n\geq 1$ and $m\geq 2$, to 1. In this way we obtain:

[TABLE]

which leads to the following upper bound on $Y_{20}$:

[TABLE]

2.4 Upper bound on $Y_{00}$

Consider the following combination of gains:

[TABLE]

In (2.15) the coefficients of the yields $Y_{1m}$ and $Y_{n1}$, for any $n$ and $m$, are identically zero. Thus (2.15) can be rewritten as:

[TABLE]

As usual we extract an upper bound on $Y_{00}$ by setting to their lowest value the yields whose coefficient has the same sign as $Y_{00}$’s coefficient (which correspond to the $Y_{nm}$ with $n,m\geq 2$), and by setting to their maximum value the yields whose coefficient has opposite sign to $Y_{00}$’s coefficient (which correspond to $Y_{0m}$ and $Y_{n0}$). We know that every yield is trivially bounded by (2.3). However, in order to derive a tighter bound on $Y_{00}$, we employ non-trivial bounds for all the yields $Y_{nm}$ with $n+m\leq 4$ in (2.16). The upper bound on $Y_{00}$ thus satisfies:

[TABLE]

In this equation $Y^{U}_{ij}$ are upper bounds and $Y^{L}_{ij}$ are lower bounds. From (2.17) we obtain the following upper bound on $Y_{00}$:

[TABLE]

where $Y^{U}_{02}$ and $Y^{U}_{20}$ are given in (2.10) and (2.14), respectively. The expressions for $Y^{U}_{03}$ and $Y^{U}_{04}$ in (2.18) can be found by starting from the same expression (2.8) that we used to derive $Y^{U}_{02}$, i.e.:

[TABLE]

From this expression we can extract an upper bound on any generic $Y_{0m}$ as follows:

[TABLE]

where we employ the constraint (2.3). Similarly, the expressions for $Y^{U}_{30}$ and $Y^{U}_{40}$ are obtained starting from (2.12) and deriving an upper bound on a generic $Y_{n0}$ as follows:

[TABLE]

At last, the expression for $Y^{L}_{22}$ can be derived from the same combination of yields which led to $Y^{U}_{11}$. In particular, from (2.5) we have that:

[TABLE]

Then, by setting to 1 all the yields whose coefficient has equal sign to $Y_{22}$’s we obtain:

[TABLE]

which yields:

[TABLE]

Note that the upper bounds derived on $Y_{04}$ and $Y_{40}$ in this Section could be used to improve the estimation of the phase error rate given by (1.8). However, the resulting improvement in the secret key rate would be extremely small in this case and we neglect it for simplicity.

3 Simulations

In this Section we provide plots of the secret key rate given by (1.2) against the overall loss ($-10\log_{10}\eta$) measured in dB of the two optical channels linking Alice and Bob to node $C$. The channel model we use to simulate the quantities that would be observed experimentally –i.e. the gains $p(k_{c},k_{d}|b_{A},b_{B})$ and $Q^{\beta_{A}^{2},\beta_{B}^{2}}_{k_{c},k_{d}}$– is given in A [33]. It accounts for: the loss in the optical channels together with the non-unity detection efficiency of $D_{c}$ and $D_{d}$ (altogether described by the parameter $\eta$), the polarization and phase misalignments introduced by the channel and a dark count probability $p_{d}$ in each detector. For concreteness, in all the plots below we assume fixed polarization and phase misalignments of 2%, independently of the channel loss. Note that, as pointed out in [33], the TF-QKD protocol analyzed in this work is quite robust against phase mismatch. This is so because phase misalignment only affects the quantum bit error rate but not the phase error rate.

For illustration purposes every plot is obtained for three different values of the dark count rate of the detectors, $p_{d}\in\{10^{-6},10^{-7},10^{-8}\}$. The plots are obtained by numerically optimizing333The optimization is carried out by using the built-in function “NMaximize” of the software Wolfram Mathematica 10.0. the secret key rate –for every value of the loss– over the signal intensity ($\alpha^{2}$) and over one decoy intensity, while for simplicity the other decoy intensities are fixed to near-to-optimal values for all values of the overall loss. More specifically, we preliminarily performed an optimization of the key rate over the whole set of intensity settings and noticed that most of the decoy intensities are roughly constant with the loss and tend to be as low as possible. For instance, if we consider the case with two decoy intensity settings ($\mu_{0}$ and $\mu_{1}$, with $\mu_{0}>\mu_{1}$), we observe that the optimal value for the weakest decoy $\mu_{1}$ is basically the lowest possible for any value of the loss. In practice, however, it might be difficult to generate very weak signals due to the finite extinction ratio of a practical intensity modulator [44], so we fix $\mu_{1}$ to a reasonable small value from an experimental point of view, say $\mu_{1}=10^{-5}$ [34, 36], while keeping the optimization over the remaining intensities. Similarly, if we consider the case with three decoy intensity settings ($\mu_{0}$, $\mu_{1}$ and $\mu_{2}$, with $\mu_{0}>\mu_{1}>\mu_{2}$), we find that the optimal values for the weakest decoys $\mu_{1}$ and $\mu_{2}$ are also the lowest possible for any value of the loss. Moreover, in this last case, we show in B that the system performance remains basically unchanged if one increases the value of the weakest intensity to say $\mu_{2}=10^{-3}$, which might be even easier to implement experimentally than $10^{-5}$. Thus, we fix $\mu_{2}=10^{-3}$ and we differentiate it from $\mu_{1}$ by, for example, one order of magnitude (i.e. we take $\mu_{1}=10^{-2}$). The same argument holds in the case with four decoy intensity settings (see B), where we fix $\mu_{2}=10^{-3}$, $\mu_{1}=10^{-2}$, and $\mu_{0}=10^{-1}$. We remark, however, that our method is general in the sense that the analytical upper bounds on the yields can be evaluated with any desired combination of intensity settings, while we select these particular decoy intensity values only for illustration purposes. Also, let us emphasize that the optimal decoy intensity values in the finite-key regime might be different from the values mentioned above. The analysis of the finite-key regime is, however, beyond the scope of this paper. Importantly, it turns out that the resulting asymptotic secret key rates in these scenarios are almost indistinguishable from those obtained by optimizing the value of all the intensity settings.

The optimal values of the signal and decoy intensities which are optimized as a function of the loss are also plotted in this Section. In this regard, we also study how the key rate is affected when the intensities are subjected to fluctuations around their optimal values in Subsec. 3.4.

3.1 Two decoy intensity settings

In figure 2 we plot the secret key rate against the overall loss for the case where Alice and Bob use two decoy intensity settings each. The solid lines are obtained by bounding from above the yields $Y_{00},Y_{02},Y_{20}$ and $Y_{11}$ by means of the expressions derived in Sec. 2 and by optimizing the rate over the signal intensity $\alpha^{2}$ and the decoy intensity $\mu_{0}$, while the other decoy intensity is fixed to $\mu_{1}=10^{-5}$ as explained above. The optimal values for $\alpha^{2}$ and $\mu_{0}$ are shown in 3(a) and 3(b), respectively. The dashed lines are instead obtained by employing the exact expression of the yields444By “exact expression” we mean that if the experimental apparatus were accurately described by the channel model in A, then the yields associated to that experimental setup would be precisely predicted by (1.6). which is given by (1.6) for the channel model considered. This represents the ideal scenario in which the parties have an infinite number of decoys through which they can estimate all the yields precisely. Note that in order to obtain the dashed lines in figure 2 we use the exact expression of the yields $Y_{nm}$ only for $n,m\leq 12$ while we set the other yields to 1. This is enough to basically reproduce the behavior of the secret key rate when all the infinite number of yields are computed via the channel model’s formula given by (1.6), as argued in [33]. The dashed lines are only optimized over the signal intensity, since the yields are directly given by the channel model. Finally, we also insert in figure 2 the PLOB bound on the secret key capacity [19], which reads as follows in terms of the transmittance $\eta$ :

[TABLE]

In figure 2 we observe that even by means of just two decoy intensity settings the key rate can beat the PLOB bound, provided that the dark count rate is $p_{d}\lesssim 10^{-7}$ . This happens because with two decoys the parties can already non-trivially estimate the yields $Y_{nm}$ with $n+m\leq 2$ as we showed in Sec. 2, and these yields are the most relevant terms in the phase-error rate formula given by (1.7) [33]. Note that we did not estimate the yields $Y_{01}$ and $Y_{10}$ since only the yields $Y_{nm}$ with $n+m$ an even number contribute to the phase-error rate (1.7).

However, figure 2 also shows that there is a sensible gap between the rates where the yields are estimated with two decoys (solid lines) and the best possible rates one could achieve (dashed lines) if all the yields were known. This clearly indicates that, although two decoys allow to estimate the yields of largest contribution in the phase-error rate, such estimations are not sufficiently tight and the ability to estimate a larger number of yields would increase the performance of the protocol.

By considering figure 3 and the fixed value of the decoy intensity $\mu_{1}$, one notices that the optimal intensities are rather small and thus, in a real experimental implementation, intensity fluctuations might be an issue. In Subsec. 3.4 we address this problem by studying how the key rate is affected under intensity fluctuations and show that for fluctuations up to about 40% the change in the key rate performance is minimal.

Also, we notice that the optimal values of the signal intensity $\alpha^{2}$ (see 3(a)) and the decoy intensity $\mu_{0}$ (see 3(b)) are almost constant with the loss, for losses $\gtrsim 20\mbox{ dB}$. This means that in a scenario where the loss in the quantum channels varies dynamically with time within a reasonable interval, one could still fix the signal intensity and both decoy intensities to constant values which happen to be close to the optimal ones. This argument also holds in the case of three (see Subsec. 3.2) and four decoy intensity settings (see Subsec. 3.3).

3.2 Three decoy intensity settings

In figure 4 we plot the secret key rate against the overall loss for the case where Alice and Bob use three decoy intensity settings each. The solid lines are obtained by bounding from above the relevant yields $Y_{nm}\,\mbox{such that}\,n+m\leq 4$ (i.e. we upper bound the yields $Y_{00},Y_{02},Y_{20},Y_{11},Y_{13},Y_{31},Y_{04},Y_{40}$ and $Y_{22}$). The exact expressions for the different upper bounds on the yields can be found in C, and we omit them here for simplicity. The solid lines are optimized over the signal intensity $\alpha^{2}$ and the decoy intensity $\mu_{0}$, while the weakest decoy intensities are fixed for simplicity to $\mu_{1}=10^{-2}$ and $\mu_{2}=10^{-3}$. As explained above, the resulting secret key rate in this scenario is almost indistinguishable from that obtained by optimizing over all the intensity settings. The optimal values for $\alpha^{2}$ and $\mu_{0}$ are shown in 5(a) and 5(b), respectively. The dashed lines are again obtained by employing the exact expression of the yields given by the channel model (1.6) and coincide with those plotted in figure 2.

We observe in figure 4 that the use of three decoys yields a significant improvement in the protocol’s performance with respect to the two-decoys case (see figure 2). As a matter of fact, in figure 4 the solid lines are almost overlapping the dashed lines for most values of the channel loss. This is due to the fact that with three decoys the parties constrain the yields with nine independent equations (instead of four equations as in the two-decoys case), which enable a tighter estimation of $Y_{00},Y_{02},Y_{20}$ and $Y_{11}$ and the non-trivial estimation of five additional yields.

Moreover, in the case of three decoys the optimal signal intensity $\alpha^{2}$ (see 5(a)) is roughly double the value of the correspondent intensity when using two decoys (see 3(a)). The reason for this is connected to the role of $\alpha^{2}$ in the protocol’s key rate. In fact, the prefactor $p(k_{c},k_{d})$ with $k_{c}+k_{d}=1$ of the key rate formula given by (1.3) increases for increasing $\alpha^{2}$: the higher the mean number of photons sent by the parties (within certain limits) the higher the probability of having a click in one of the two detectors. On the other hand, increasing $\alpha^{2}$ excessively also affects the phase-error rate. Note that by setting some yields to 1 in the phase error rate formula given by (1.7) we give rise to addends like $c_{2n}c_{2m}$ and $c_{2n+1}c_{2m+1}$ which increase for increasing $\alpha^{2}$, leading to an overall increase of the phase-error rate and thus decrease of the key rate. The optimal value of $\alpha^{2}$ is thus given by the trade-off between the effect of the prefactor $p(k_{c},k_{d})$ and that of the terms $c_{2n}c_{2m}$ and $c_{2n+1}c_{2m+1}$. Now, by noting that the contribution of the therms $c_{2n}c_{2m}$ and $c_{2n+1}c_{2m+1}$ decreases for increasing $n,m$, we understand that their negative effect on the key rate is diminished in the case of three decoys since we non-trivially estimate more yields, i.e. a lower number of yields is set to 1. This allows $\alpha^{2}$ to acquire higher values with respect to the two-decoys case, as we observed in 5(a).

Finally we point out that such an argument does not apply to the discussion about the optimal value of the decoy intensity $\mu_{0}$ in the case of two and three decoys. As a matter of fact, the key rate does not depend on the decoy intensities in the same way as on the signal intensity: the decoy intensities only appear in the yields’ bounds inserted in the phase-error rate. Additionally, the analytical bounds on the yields when using two or three decoys cannot be compared in a straightforward way. Nonetheless we observe a similar behavior of the optimal $\mu_{0}$ for two (see 3(b)) and three decoys (see 5(b)).

3.3 Four decoy intensity settings

In figure 6 we plot the secret key rate against the overall loss for the case where Alice and Bob use four decoy intensity settings each. Like in the three-decoys case, the solid lines are obtained by bounding from above the yields $Y_{00},Y_{02},Y_{20},Y_{11},Y_{13},Y_{31},Y_{04},Y_{40}$ and $Y_{22}$ by means of four decoys. In particular, for the yields $Y_{00},Y_{02},Y_{20},Y_{11}$ and $Y_{22}$ we use the exact same analytical bounds derived with three decoys since they are tight enough, and the use of a fourth decoy intensity would just make them more cumbersome without providing a significant improvement of the resulting secret key rate. For the remaining four yields we instead derived tighter bounds with the help of the fourth intensity $\mu_{3}$ (see D). The solid lines are obtained by optimizing the rate over the signal intensity $\alpha^{2}$ and the fourth decoy intensity $\mu_{3}$. It turns out that the optimal values for the other decoy intensities are basically the lowest possible for any value of the loss, so, as explained above, for simplicity we fix the smallest one to an experimentally reasonable small value (say $\mu_{2}=10^{-3}$), and then we differentiate it from the other two decoys, $\mu_{1}$ and $\mu_{0}$, by one order of magnitude, i.e., we take $\mu_{1}=10^{-2}$ and $\mu_{0}=10^{-1}$. Importantly, this decision has a neglectable effect on the resulting secret key rate, when compared to that obtained by optimizing over all intensity settings. The optimal values for $\alpha^{2}$ and $\mu_{3}$ are shown in 7(a) and 7(b), respectively. The dashed lines are the same as in figure 2 and figure 4.

With four decoys (see figure 6) the key rates basically reproduces the ideal ones (dashed lines) in which all the yields are known, with the gap being at maximum of 1 dB at the very end of the plot lines (i.e. in the very high loss regime). This demonstrates that there is no need to bound further yields than the nine yields we bounded in the cases of three and four decoys. Of course, the tighter estimation of the yields $Y_{13},Y_{31},Y_{04}$ and $Y_{40}$ achieved with four decoys results in an improvement of the key rate with respect to the case of three decoys (see figure 4), especially in the region of high losses.

Concerning the optimal signal intensity (see 7(a)), we notice a slight increase with respect to the three-decoys case (see 5(a)) due to the tighter estimation of some yields in the phase-error rate formula, which allows their correspondent coefficients to acquire a slightly higher value under an increase of $\alpha^{2}$.

Finally, the reason why the optimal $\mu_{3}$ plot (see 7(b)) looks quite different (with values above $1$) from the optimal $\mu_{0}$ plots for the cases of two and three decoys (see 3(b) and 5(b)) is the following. In the TF-QKD protocol considered, the most important yields (i.e., those with a bigger impact on the resulting phase error rate) are those associated to pairs of pulses with zero or with a very low number of photons. It is therefore very important to be able to estimate these yields as tightly as possible. For this, we have that the optimal intensities $\mu_{0}$ and $\mu_{1}$ ($\mu_{0}$, $\mu_{1}$ and $\mu_{2}$) for the case with two (three) decoys are well below $1$, just like in standard decoy-state QKD protocols [39, 40]. However, as explained above, here we use the intensity $\mu_{3}$ to improve the upper bounds for the yields $Y_{13}$, $Y_{31}$, $Y_{04}$ and $Y_{40}$. That is, the intensity $\mu_{3}$ is only used to estimate yields associated to pairs of pulses with a total number of photons equal to four. Thus, it is natural that the optimal value of $\mu_{3}$ is not too low and greater than $1$.

3.4 Intensity fluctuations

Here we investigate the robustness of the TF-QKD protocol against intensity fluctuations that may occur in the preparation of the pulses sent by Alice and Bob. This is motivated by the fact that the optimal signal and decoy intensities that the parties should adopt in order to maximize the key rate for a given loss are quite small, thus the effect of intensity fluctuations might be an issue in practice. On the other hand, we also note that the optimal value of a given decoy or signal intensity is either constant or varies very moderately with the loss.

Here we consider the simple scenario in which the intensity fluctuations are symmetric, i.e., we assume that the intensity of Alice’s signal matches perfectly with the intensity of Bob’s signal. Or, to put it in other words, we consider that Alice’s and Bob’s signals suffer from the same intensity fluctuations and thus their intensities are equal. This means that such analysis is only valid to evaluate auto-compensating TF-QKD set-ups like, for instance, the one introduced in [36]. It cannot be used however to analyze set-ups where more than one laser source is used [34, 35]. Although we do not expect a dramatic change of our results when asymmetric intensity fluctuations are considered in the latter case, specially if they are not too large.

Also, we assume that the signal and all the decoy intensities suffer from a fluctuation of magnitude 30%, 40% or 50% around their optimal value. This means for example that, for a fluctuation say of 30%, the signal intensity $\alpha^{2}$ and all the decoy intensities $\mu_{k}$ fluctuate in the intervals: $0.7\,\alpha_{\mathrm{opt}}^{2}\leq\alpha^{2}\leq 1.3\,\alpha_{\mathrm{opt}}^{2}$ and $0.7\,\mu^{\mathrm{opt}}_{k}\leq\mu_{k}\leq 1.3\,\mu^{\mathrm{opt}}_{k}$, respectively, where $\alpha^{2}_{\mathrm{opt}}$ and $\mu^{\mathrm{opt}}_{k}$ represent the optimal values. We then account for the worst-case scenario by numerically minimizing the key rate over all the intensities constrained in their respective fluctuation interval. Only in this way we can still guarantee that the resulting key rate is associated to a secure protocol.

The results of this study are given in figure 8. Here we plot the original key rates –i.e. without fluctuations of the signal and decoy intensities– as dashed lines555The dashed lines of the key rates without fluctuations correspond to the solid lines in figure 2, figure 4 and figure 6. and the key rates affected by intensity fluctuations as solid lines. The plots are given for the same dark count rates and misalignments used in Sec. 3, in the case of two, three and four decoy intensity settings. The color of the solid lines becomes brighter for increasing fluctuation magnitude.

We observe that the performance of the protocol is considerably affected by intensity fluctuations in the case of two decoys, while the effect becomes almost negligible for three and four decoys. The reason for this lies in the fact that the tightness of the yields’ bounds has a stronger dependence on the value of the decoy intensities when the number of decoys –and thus constraints on the yields– is low. In other words, if the parties have at their disposal a larger number of decoys, they can properly combine the numerous constraints on the yields and obtain inherently tight bounds, i.e. bounds that are tight regardless of the actual values of the intensities involved. If, instead, the parties have few decoys, say two, then the bounds they derive on the yields can be tight or loose depending on the values assigned to the decoy intensities, since the constraints on the yields are fewer.

In conclusion, in the case of two decoys the parties can tolerate intensity fluctuations up to 40%, which correspond to a decrease in the protocol’s key rate especially in the high-loss region, quantified by a reduction of about 5 to 6 dB of the maximum tolerated loss666By “maximum tolerated loss” we mean the loss threshold above which the protocol’s key rate becomes roughly zero.. Remarkably, with three decoys the decrease of the maximum tolerated loss would be under 5 dB for fluctuations up to 50%. Finally, for four decoys the protocol’s performance remains almost the same for fluctuations up to about 50% around the optimal values (except when the dark count probability is the smallest considered: $p_{d}=10^{-8}$). We deduce that the TF-QKD protocol introduced in [33] seems to be quite robust against intensity fluctuations.

4 Conclusions

In this paper we have investigated in detail the performance of the Twin-Field quantum key distribution (TF-QKD) protocol presented in [33] in the realistic scenario of a finite number of decoy intensity settings at the parties’ disposal. Indeed, the protocol requires that Alice and Bob use the decoy-state method [38, 39, 40] to estimate the phase-error rate by upper bounding certain yields. Unlike most QKD protocols which employ such method, in this case the protocol’s key rate depends –in principle– on infinitely many yields and it is essential to upper bound (rather than lower bound) their values. Clearly, the more yields the parties tightly upper bound, the better the protocol’s performance is. We have introduced an analytical method to perform such estimation when Alice and Bob use two, three or four decoy intensity settings each. The yields’ analytical bounds provided in this work imply a fully-analytical expression for the protocol’s secret key rate, which is very convenient for performance optimization (e.g. in the finite-key scenario). Also, we remark that the secret key rates obtained with our analytical bounds basically overlap those achievable with numerical tools like linear programming for most values of the overall loss, which confirms that the analytical approach is actually quite tight.

In so doing, we have shown that the TF-QKD protocol can beat the PLOB bound [19] even with just two decoys for reasonable values of the setup parameters, which include: the loss, the dark count rate, the polarization misalignment and the phase mismatch. Furthermore the plots assuming four decoys demonstrate that one can approximately achieve the best possible performance by tightly estimating only nine yields. The optimization of the key rate over the signal and decoy intensities indicates that their optimal values are all either constant or weakly-dependent on the loss of the channel. This means that the protocol is particularly suitable for contexts where the channel loss varies in time, for instance in the scalable MDI-QKD networks conceived in [43]. Finally we have investigated the scenario where the intensities of the optical states prepared by Alice and Bob are affected by fluctuations and observed that the protocol seems to be very robust against such phenomena.

A natural continuation of this work would take into account the finite-key effects due to the finite number of pulses sent by the parties to the central relay. This could be done by combining the results presented in this paper with the finite-keys estimation techniques used in [41].

We thank Dagmar Bruß and Hermann Kampermann for helpful discussions, and an anonymous referee for very useful comments. This project has received funding from the European Union’s Horizon 2020 research and innovation programme under the Marie Skłodowska-Curie grant agreement No 675662, and from the Spanish Ministry of Economy and Competitiveness (MINECO), the Fondo Europeo de Desarrollo Regional (FEDER) through grant TEC2017-88243-R.