Secret key distillation across a quantum wiretap channel under restricted eavesdropping

TL;DR

This paper investigates secret key distillation over a quantum wiretap channel with realistic eavesdropping constraints, showing that key rates can surpass those achievable against an unrestricted eavesdropper, with implications for practical quantum communication.

Contribution

It introduces a restricted eavesdropping model for quantum wiretap channels and demonstrates that key rates can exceed traditional capacities under these realistic conditions.

Findings

Key rates can surpass capacities with restricted eavesdropping.

Upper bounds on key rates are derived using relative entropy of entanglement.

The model applies to free-space quantum optical communication scenarios.

Abstract

The theory of quantum cryptography aims to guarantee unconditional information-theoretic security against an omnipotent eavesdropper. In many practical scenarios, however, the assumption of an all-powerful adversary is excessive and can be relaxed considerably. In this paper we study secret key distillation across a lossy and noisy quantum wiretap channel between Alice and Bob, with a separately parameterized realistically lossy quantum channel to the eavesdropper Eve. We show that under such restricted eavesdropping, the key rates achievable can exceed the secret key distillation capacity against an unrestricted eavesdropper in the quantum wiretap channel. Further, we show upper bounds on the key rates based on the relative entropy of entanglement. This simple restricted eavesdropping model is widely applicable, e.g., to free-space quantum optical communication, where realistic collection of light by Eve is limited by the finite size of her optical aperture. Future work will include calculating bounds on the amount of light Eve can collect under various realistic scenarios.

Tables

Table 1. TABLE I: Parameter values used for the SKR comparison in Fig.  20

Parameter	Symbol	Value
Alice’s signal-state transmission rate	$R$	1 Gbit/s
Overall Alice-to-Bob transmissivity	$\eta$	0.005
Alice’s signal-state average photon number	$\mu$	see Fig. 20
Alice-to-Eve transmissivity	${\eta }_E=\kappa \left(1-\eta \right)$	see Fig. 20
Average detector dark-count per bit interval	$n_d$	${10}^{-4}$
Reconciliation penalty	$f_L$	1.1

Equations

$$K_{\to }(\rho )\ge I(X;B{)}_{\omega }-I(X;E{)}_{\omega }.$$

$${\omega }^{XBE}={\int }_{x}dxp(x)|x⟩⟨x{|}^X\otimes {\rho }_x^{BE},$$

$$I(X;B{)}_{\omega }$$

$$I(X;E{)}_{\omega }$$

$${\rho }_x^B$$

$${\rho }_x^E$$

$${\rho }^B$$

$${\rho }^E$$

$$K_{\to }$$

$$=H({\rho }^B)-{\int }_{x}dxp(x)H\left({\rho }_x^B\right)$$

$$-\left(H({\rho }^E)-{\int }_{x}dxp(x)H\left({\rho }_x^E\right)\right)$$

$$=H({\rho }^B)-H({\rho }^E)$$

$$=H(B{)}_{\omega }-H(E{)}_{\omega }$$

$$=H(B{)}_{\psi }-H(E{)}_{\psi }$$

$$=H(B{)}_{\psi }-H(AB{)}_{\psi }$$

$$=I(A⟩B{)}_{\rho },$$

$$K_{\leftarrow }\ge I(A;Y{)}_{\omega }-I(Y;E{)}_{\omega }.$$

$${\omega }^{AYE}={\int }_{y}dyp(y)|y⟩⟨y{|}^Y\otimes {\rho }_y^{AE},$$

$$K_{\leftarrow }$$

$$=H({\rho }^A)-{\int }_{y}dyp(y)H\left({\rho }_y^A\right)$$

$$-\left(H({\rho }^E)-{\int }_{y}dyp(y)H\left({\rho }_y^E\right)\right)$$

$$=H({\rho }^A)-H({\rho }^E)$$

$$=H(A{)}_{\omega }-H(E{)}_{\omega }$$

$$=H(A{)}_{\psi }-H(E{)}_{\psi }$$

$$=H(A{)}_{\psi }-H(AB{)}_{\psi }$$

$$=I_R(A⟩B{)}_{\rho },$$

$${\rho }_y^A$$

$${\rho }_y^E$$

$${\rho }^A$$

$${\rho }^E$$

$$K_{\to }$$

$$=H({\rho }^B)-H({\rho }^E)-{\int }_{x}dxp(x)\left(H\left({\rho }_x^B\right)-H\left({\rho }_x^E\right)\right).$$

$$K_{\leftarrow }$$

$$=H({\rho }^A)-H({\rho }^E)-{\int }_{y}dyp(y)\left(H\left({\rho }_y^A\right)-H\left({\rho }_y^E\right)\right).$$

$$E_{\text{R}}(\mathcal{N}):=\underset{{\varphi }^{A{A}^{\prime }}}{\sup }{E}_R{\left(A;B\right)}_{\rho },$$

$$E_{\text{R}}(\rho ):=\underset{\sigma \in \text{SEP}}{\inf }D(\rho ||\sigma ),$$

$$D(\rho ||\sigma ):=\mathrm{Tr}\left(\rho \left(\log \rho -\log \sigma \right)\right).$$

$$g(x)=(x+1){\log }_2(x+1)-x{\log }_2(x)$$

$$H\left({\rho }_x^B\right)=H\left({\rho }_x^E\right)=0.$$

$$K_{\to }$$

$$=g\left(\eta \mu \right)-g\left(\kappa \mu \left(1-\eta \right)\right),$$

$$\text{centering}\underset{\mu \to \infty }{\lim }{K}_{\to }\ge {\log }_2\frac{\eta }{\kappa (1-\eta )}.\text{@add@centering}$$

Full text

I Introduction

Quantum key distribution (QKD) theoretically promises unconditional security in the physical layer. Bennett and Brassard [1] developed the first QKD protocol (BB84), whose security is guaranteed by the no-cloning theorem of quantum mechanics and one-time-pad encryption [2]. Numerous commercial products are available today that implement variants of the decoy-state BB84 (DS-BB84) protocol [3] based on polarization qubits encoded in weak coherent state pulses.

While discrete variable (DV) protocols such as the DS-BB84 showcase the power of quantum cryptography, the key rates achievable are low and the systems are difficult to integrate with existing telecommunication systems. Hence, nowadays there is a thrust to develop QKD systems that can overcome these challenges. In this regard, continuous variable (CV)-QKD schemes, e.g., based on coherent laser light and heterodyne detection are being viewed as viable solutions [4, 5].

Traditionally, the security proofs of quantum key distribution against a wiretapping adversary, an eavesdropper Eve, assume that Eve can perform any operation allowed by the laws of quantum physics on the transmitted light, and has access to all the light that is lost in transmission. However, this is not the case in some realistic applications, especially in free-space communication channel where it is reasonable to consider a potential Eve who is restricted in her information collection capabilities.

In this work, we present a secure key rate analysis for a secret key distillation scheme over a quantum wiretap channel from a sender Alice to receiver Bob, where the eavesdropper Eve is restricted to receive only a fraction of the photons lost in transmission as shown in Fig. 1. As a result, some of the light is rendered inaccessible to any of the parties involved and lost to the environment. Such a restriction is widely applicable, e.g., in optical wireless communication [6], where a realistic Eve would be limited by the size of the aperture of her receiver, or be forbidden to collect light from an exclusion zone around Alice-to-Bob line of sight. We consider both passive eavesdropping where Eve injects the vacuum state into the channel, and an instance of active eavesdropping, where Eve injects a thermal state into the channel. 111Note that other possible restrictions on Eve include, e.g., a noisy quantum memory [7] of finite size and coherence time, and a noisy communication channel where some of the noise is well characterized and provably of non-adversarial origin, which does not benefit Eve either. However, in this work, we focus on the restricted light collection capability of Eve. The analysis would include both direct and reverse reconciliation [8, 9] as they improve differently under restricted eavesdropping.

The main findings of our analysis include the following:

• •

Invoking the Hashing inequality [10] for secret key distillation over a communication channel with one-way public discussion, we write down lower bounds on asymptotic achievable key rates under the restricted eavesdropping model. We show that these key rates can exceed the direct transmission capacity of the channel in a traditional unrestricted eavesdropping model. This implies both higher key rates as well as longer transmission distances.

• •

We provide upper bounds on the key rates under the restriction on Eve based on the relative entropy of entanglement ($E_{\textrm{R}}$). In the case of the pure loss channel, the $E_{\textrm{R}}$ upper bound closely matches the achievable rate with heterodyne detection and reverse reconciliation.

• •

We present a comparison of a CVQKD protocol based on Gaussian modulated coherent states and heterodyne detection, and the DS-BB84 DVQKD protocol based on polarization encoding of weak coherent states, under both passive and active restricted eavesdropping models.

The paper is organized as follows: Sections II and III describe the methods employed in establishing the achievable key rates and the upper bounds on secret key distillation under restricted eavesdropping. These methods apply to passive as well as active eavesdropping, and direct and reverse information reconciliation schemes. In Section IV, we present the results obtained by applying these methods to the entanglement-based model for secret key distillation based on the two-mode squeezed vacuum state and heterodyne detection. In Section V, we present results comparing achievable key rates (under the restricted eavesdropping model) in CVQKD with Gaussian modulated coherent states and heterodyne detection, and in DS-BB84 protocol. We conclude with a summary in Section VI.

II Achievable rates for secret key distillation under restricted eavesdropping

Consider the entanglement-based model for bipartite secret key distillation shown in Fig. 1, where Alice prepares an asymptotically large number of independent and identically distributed (i.i.d.) copies of an entangled pure state $\psi^{AA^{\prime}}$ and transmits the $A^{\prime}$ systems through a wiretap channel. In this limit, the optimal attack for an eavesdropper Eve is known to be a collective attack [11], namely wherein she performs an identical symbol-by-symbol active attack on each transmission, resulting in i.i.d. copies of a bipartite state $\rho^{AB}$ being shared between Alice and Bob.

Let us first recall key rate analysis for secret key distillation against an unrestricted Eve ($\kappa=1$ in Fig. 1).

II-A Unrestricted Eve

In traditional security analysis for key distillation over a quantum wiretap channel, where the eavesdropper Eve is assumed to have access to all the light that is lost in transmission, she holds the full purification of the state $\rho^{AB}$. In other words, Eve holds a quantum system $E$ such that the systems $A$, $B$ and $E$ are in a pure state $|\psi\rangle^{ABE}$ satisfying $\rho^{AB}=\operatorname{Tr}_{E}(\psi^{ABE})$. In the case of a thermal noise channel with loss, Eve holds the purification of both the state $\rho^{E^{\prime}}$ she injected into the channel as well as the output of the channel to Bob, namely a pure state $|\psi\rangle^{ABER}$, $R$ being the purifying system of Eve’s input $\rho^{E^{\prime}}$. Note that the systems $ER$ in this case can be thought of as one joint purifying system $E$. Hence the system $E$ in subsequent discussion in this section also includes the case of the thermal noise channel.

When either Alice or Bob performs a measurement, Devetak and Winter [10] proved an achievable rate ($K_{\textrm{CQQ}}$) for secret key distillation from the resulting state with one-way public classical communication assistance—a result known as the Hashing inequality. Here CQQ stands for “Classical-Quantum-Quantum”, indicating that either Alice or Bob has performed a measurement on her/his quantum system, while the other and Eve are yet to measure their respective quantum systems. For example, in a reverse reconciliation scheme, Bob performs a measurement, while Eve and Alice retain their quantum systems unmeasured. (Likewise, CCQ stands for “Classical-Classical-Quantum”, which indicates that both the communicating parties have performed measurements. $K_{\textrm{CCQ}}$ reflects the corresponding achievable key rate, and will be discussed in Section V in the context of QKD protocols.)

The Hashing lower bound on the key rate for direct reconciliation, namely when Alice measures system $A$ to give rise to a classical outcome $X$ that is publicly communicated to Bob is given by

[TABLE]

Here the state $\omega^{XBE}$ is

[TABLE]

and the quantum mutual information quantities $I(X;B)_{\omega}$ and $I(X;E)_{\omega}$ are the following Holevo information quantities

[TABLE]

where $H(\cdot)$ denotes the von Neumann entropy. We also have

[TABLE]

where $\rho_{x}^{BE}$ is the density matrix of system $BE$ conditioned on the measurement result $X=x$. $|b\rangle$ and $|e\rangle$ each represents a complete (usually orthonormal) basis of system $B$ and $E$. Since each conditional state $|x\rangle\langle x|^{X}\otimes\rho_{x}^{BE}$ is a pure state, we have $H\left(\rho_{x}^{B}\right)=H\left(\rho_{x}^{E}\right)$. This leads to

[TABLE]

which is the expression for coherent information [10, 12] of $\rho^{AB}$. Here Eq. (13) follows from the fact that the marginal states of systems $B$ and $E$ for the states $\omega$ and $\psi$ are the same. Equation (14) follows from the fact that for a tripartite pure state $\psi^{ABE}$, $H(AB)_{\psi}=H(E)_{\psi}$.

For reverse reconciliation, similarly, by changing the roles of Alice and Bob, we arrive at an expression for a Hashing lower bound on the secret key distillation rate $K_{\leftarrow}$ given by

[TABLE]

Here the state $\omega^{AYE}$ is

[TABLE]

and $Y$ is the classical outcome of measuring Bob’s quantum system $B$. Now if $\psi^{ABE}$ is a pure state, $\rho_{y}^{AE}$ is also a pure state, which gives us $H(\rho_{y}^{A})=H(\rho_{y}^{E})$. And similar to the direct reconciliation case this leads to

[TABLE]

which is the expression for reverse coherent information [13, 10, 14] of $\rho^{AB}$. Similarly here Eq. (22) follows from the fact that the marginal states of systems $A$ and $E$ for the states $\omega$ and $\psi$ are the same. Equation (23) follows from the fact that for a tripartite pure state $\psi^{ABE}$, $H(AB)_{\psi}=H(E)_{\psi}$. And we also have

[TABLE]

II-B Restricted Eve

When Eve only has restricted access to the wiretapped light, i.e., $\kappa<1$ in Fig. 1, she does not have access to the full purification of the bipartite state $\rho^{AB}$ shared between Alice and Bob. That is, the systems $A$, $B$, and $E$ are not in a pure state anymore. It is rather together with the system $F$, which is lost to the environment, that these systems are in a pure state $|\psi\rangle^{ABEF}$.

In the direct reconciliation case after Alice measures system $A$ into a classical register $X$, with the tripartite state between Alice, Bob and Eve being $\rho^{ABE}=\int_{x}\!dx\,p(x)|x\rangle\langle x|^{A}\otimes\rho_{x}^{BE}$, we have

[TABLE]

The second term $\int_{x}\!dx\,p(x)\left(H\left(\rho_{x}^{B}\right)-H\left(\rho_{x}^{E}\right)\right)$ now does not vanish. Similarly, in reverse reconciliation case we have

[TABLE]

III Upper Bound for Secret Key Distillation under Restricted Eavesdropping

In this Section, we recall the relative entropy of entanglement of a channel [15] ($E_{\textrm{R}}$), which serves as an upper bound on the entanglement and secret key distillation capacities of the channel under unrestricted eavesdropping when assisted by unlimited two-way classical communication assistance between the communicating parties, and apply it to the restricted eavesdropping model. (See also [16] for a related definition of Rains information of a channel, which is relevant specifically in the context of entanglement distillation.)

Definition 1

The relative entropy of entanglement of a channel $\mathcal{N}_{A^{\prime}\rightarrow B}$ is defined as [15]

[TABLE]

where

[TABLE]

$\rho^{AB}=\mathcal{N}_{A^{\prime}\rightarrow B}\left(\phi^{AA^{\prime}}\right)$, and $D(\rho||\sigma)$ is the relative entropy between states $\rho$ and $\sigma$. When the support of $\rho$ contains that of $\sigma$,

[TABLE]

While the relative entropy of entanglement is the relative entropy of a state with its closest separable (SEP) state in Hilbert space, the relative entropy of entanglement of a channel is the relative entropy of entanglement of the state distributed across the channel optimized over all possible inputs to the channel.

III-1 Unrestricted Eve

Using the relative entropy of entanglement, Pirandola et al. (PLOB) [15] gave an upper bound to the energy-unconstrained, two-way unlimited Local Operations and Classical Communication (LOCC)-assisted entanglement and secret key distillation capacity of lossy and noisy bosonic channels. For a pure loss channel $\mathcal{N}_{\eta}$ of transmissivity $\eta$, the relative entropy of entanglement upper bound is given by $\max\{K_{\rightarrow},K_{\leftarrow}\}\leq E_{\textrm{R}}(\mathcal{N}_{\eta})=-\log_{2}(1-\eta)$. Since this upper bound matches the reverse coherent information lower bound [13, 17], the above rate characterizes the capacity. (See also [18] for a strong converse theorem for the upper bound.)

For a thermal noise channel $\mathcal{N}_{\eta,n_{e}}$ of transmissivity $\eta$ and thermal noise $n_{e}$, which is the mean photon number in the thermal state that Eve injects into the channel, the relative entropy of entanglement upper bound is known to be [15] $\max\{K_{\rightarrow},K_{\leftarrow}\}\leq E_{\textrm{R}}(\mathcal{N}_{\eta,n_{e}})=\log_{2}\left(\frac{\eta}{1-\eta}\right)-g\left(n_{e}\right)$, where [19, 20]

[TABLE]

is the von Neumann entropy of a thermal state of mean photon number $x$.

The bipartite separable quantum states closest in relative entropy divergence to a two-mode entangled quantum states shared across the channel that are required in giving the above $E_{\textrm{R}}$ bounds are found using the Positive-Partial Transpose (PPT) criterion for separability of quantum states [21, 22].

III-2 Restricted Eve

In the restricted eavesdropping model in Fig. 1, the state of interest now is the tripartite state $\rho^{AFB}$, which is purified by the fourth system $E$ that Eve possesses (unlike the unrestricted case, where system $F$ does not exist and the state of interest is bipartite). We apply the PPT criterion across the bipartition $AF$ and $B$ and give relevant $E_{\textrm{R}}$ upper bounds in this scenario. See Appendix A for details of the calculation.

IV Achievable Rate and Upper Bound Derivation with Numerical Results

In this Section, we apply the methods of secure key rate (SKR) analysis and upper bounds presented in Secs. II and III to bosonic pure loss and thermal noise channels fed with an input two-mode squeezed vacuum (TMSV) state $|\Psi\rangle^{AA^{\prime}}=(\cosh r)^{-1}\sum_{n=0}^{\infty}(\tanh r)^{n}|n\rangle|n\rangle$. The achievable rates are given for heterodyne detection either at Alice or Bob, which correspond to direct and reverse information reconciliation scenarios, respectively.

IV-A Achievable Rates

IV-A1 Pure Loss Channel

First we will show the achievable rate with direct reconciliation, namely where Alice performs heterodyne detection on her system, as depicted in Fig. 2. Assuming a TMSV state input, we calculate the achievable rate for this setup.

Since the heterodyne measurement on $A$ projects the other part $A^{\prime}$ of the TMSV onto a coherent state $\rho_{x}^{A^{\prime}}=|\alpha\rangle$, we know that the state at the beam splitters’ outputs conditioned on measurement result $x$, namely $\rho_{x}^{B}$, $\rho_{x}^{E}$, $\rho_{x}^{F}$ are also coherent states with attenuated amplitudes. Since they are pure states we have

[TABLE]

So, using Eq. (30), we have

[TABLE]

where $\mu=\sinh^{2}(r)$ is the average photon number in the light Alice transmits to Bob, which leads to

[TABLE]

Equation (40) [23] gives the limiting value of the key rate when the input photon number is taken to infinity. This limit can be shown to be the optimal input strength that maximizes the key rate. Notice that the dependence of the direct reconciliation achievable rate in Eq. (40) on Eve’s restriction $\kappa$ is in the denominator inside the log function. Thus, restricting Eve’s received power can help increase the achievable rate beyond the rate achievable against an unrestricted Eve ($\kappa=1$ in Eq. (40)), namely $\log_{2}\left(\frac{\eta}{1-\eta}\right)$. It is interesting to note that the increase in achievable rate is accomplished without affecting the channel from Alice to Bob, but rather by modifying the channel from Alice to Eve.

In the case of an unrestricted Eve and direct reconciliation, we need to have $\eta>(1-\eta)$ to attain a positive key rate in Eq. (40). This gives us $\eta>0.5=3\textrm{dB}$ which is known as the ”3dB limit” for direct reconciliation where key rate drops to zero when channel transmissivity is below 3dB. Similarly for the key rate to be greater than zero in the restricted Eve case, we need to have $\eta>\kappa(1-\eta)$, which gives $\eta>\frac{\kappa}{1+\kappa}$. This condition captures the limitation of direct reconciliation with regard to the transmission distance, namely that the key rate vanishes beyond a threshold distance.

Now, consider the case of reverse reconciliation, as depicted in Fig. 3. Here, Bob performs heterodyne measurement on his system $B$ and sends side information through a classical communication channel to Alice to help her distill secret key. Using Eq. (32), and recognizing that $Y$ is a continuous variable, we get

[TABLE]

and

[TABLE]

Since in this case the post-measurement conditional states are not pure, we derived the covariance matrix of corresponding states and calculated the von Neumann entropies, which turns out as shown in Eq. (42). Since the argument of the $h$ functions in Eq. (42) have no dependence on the probability distribution of $y$, we get Eq. (43) by integrating over $y$. Taking the limit of input mean photon number $\mu\rightarrow\infty$, we obtain the optimal achievable rate given in Eq. (44).

Equation (44), when $\kappa=1$, reduces to $-\log_{2}(1-\eta)$, which is also the PLOB bound based on $E_{\textrm{R}}$, discussed in Sec. IV-B, and hence the capacity. If we compare Eq. (44) for $\kappa<1$ with pure loss unrestricted model capacity $-\log_{2}(1-\eta)$, not only do we have $\kappa$ showing up in the denominator inside the logarithm, but we also have one correction term: $-(g(\frac{\mu(1-\eta)}{1+\eta\mu})-g(\frac{(1-\eta)\kappa\mu}{1+\eta\mu}))$. This correction term changes differently with $\kappa$ compared to the first term $\log_{2}(\frac{1}{\kappa(1-\eta)})$. Unlike the case with the unrestricted Eve, we find that the achievable rate with reverse reconciliation is not always better than the rate with direct reconciliation.

In Fig. 4 (a), we plot the SKR as a function of the restriction on Eve $0<\kappa<1$ for a channel transmissivity of $\eta=0.6$. When high values of $\kappa$ are assumed, which includes the unrestricted Eve’s case ($\kappa=1$), we find that reverse reconciliation gives a higher achievable rate than direct reconciliation. However when low values of $\kappa$ are assumed the rate with direct reconciliation is seen to exceed the rate with reverse reconciliation.

In Fig. 4 (b), we plot the direct and reverse reconciliation achievable rates as a function of the channel transmissivity $\eta$ for a given value of the restriction on Eve $\kappa=0.1$. Since channel loss usually increases as transmission distance increases, we can see that the reverse reconciliation scheme has a longer useful transmission distance than the direct reconciliation scheme, which is similar to the case when Eve is unrestricted as was shown in  [13]. However, here both direct reconciliation and reverse reconciliation can achieve rates that are higher than the unrestricted Eve’s capacity, which was achievable with reverse reconciliation.

IV-A2 Thermal Noise Channel

For the thermal noise channel, Eve’s input to the channel is now a thermal state of mean photon number $n_{e}$.

Since the thermal state is not a pure state, we need to take into account its purifying system $R$. So, here we assume that Eve holds a TMSV with mean photon number $n_{e}$. She injects one mode $E^{\prime}$ into the channel while keep the other mode as a purification and then does a joint operation on systems $E$ and $R$.

First we look at the case of direct reconciliation, depicted in Fig. 5. Again using Eq. (30), we have

[TABLE]

Here the state $\omega^{XBER}$ is

[TABLE]

$\nu^{ER}_{i}$s are the symplectic eigenvalues of the reduced covariance matrix of modes $E$ and $R$. Finally, we have

[TABLE]

Here if we compare Eq. (49) with the direct reconciliation achievable rate for an unrestricted Eve case over the thermal noise channel [15] $\log(\frac{\eta}{(1-\eta)})-g(n_{e})$, we can see that $\kappa$ shows up in the denominator inside the logarithm function in a way similar to the case of the pure loss channel. However, here we still have a correction term $-g(n_{e}(1-\eta))+g(n_{e}(1-\eta\kappa))$, which vanishes when $\kappa\rightarrow 1$.

Now, for the reverse reconciliation case depicted in Fig. 6, we use Eq. (32) to obtain our results

[TABLE]

Here the state $\omega^{AYER}$ is

[TABLE]

$\nu^{ER}_{i}$ ($i=1,2$) are the symplectic eigenvalues of the covariance matrix corresponding to system $ER$ and $\nu^{ER}_{y_{i}}$ ($i=1,2$) are the symplectic eigenvalues of the covariance matrix corresponding to the post-measurement system $ER|y$ after the measurement of Bob’s state $B$. Finally, we have

[TABLE]

In Eq. (54) we have $\kappa$ showing up in the denominator inside the log function compared to the reverse reconciliation achievable rate for thermal noise channels under unrestricted Eve’s case $\log_{2}\left(\frac{1}{\kappa\left(1-\eta\right)}\right)-g\left(n_{e}\right)$. Also, we have correction terms of which the exact form is given below:

[TABLE]

With the above results Eqs. (55)-(63), we first plot the direct and reverse reconciliation achievable rates as functions of the input mean photon number $\mu$ in Fig. 7.

Here in Fig. 7, we can see that the achievable rate for both direct reconciliation and reverse reconciliation is increasing with increasing input mean photon number $\mu$. So $\mu=\infty$ is optimal. Also, depending on the channel parameters, either direct or reverse reconciliation could have the higher rate.

For the figures below, unless specified otherwise, the achievable rate is plotted with $\mu$ taken to infinity.

In Figs. 8-10, we separately plot the direct and reverse reconciliation achievable rates as functions of the thermal noise strength $n_{e}$, channel transmissivity $\eta$, and the restriction factor $\kappa$. We can see that both direct and reverse reconciliation key rates decrease with increasing noise, increasing $\kappa$ and increasing channel loss ($-10\log_{10}(\eta)$).

Since reverse reconciliation generally gives us a greater transmission range than direct reconciliation (see Fig. 9 as transmissivity $\eta$ usually decreases with increasing transmission distance for a given channel), below we show achievable rates with reverse reconciliation for different parameters. We also plot the capacity of the pure loss channel against the unrestricted Eve, $-\log_{2}(1-\eta)$, for comparison. In Fig. 11, we show that even though generally with increasing noise the SKR goes down and tends to have a shorter transmission distance, with small $\kappa$ it is still possible to exceed the pure loss unrestricted Eve’s capacity for some values of channel loss. Then we fix the noise $n_{e}$ and change $\kappa$ in Fig. 12. It is shown that for different values of noise, even when noise is very high, a small $\kappa$ can improve the achievable rate dramatically.

IV-B Upper Bounds

In this Section we apply the method discussed in Section III and Appendix A to get upper bounds for secret key distillation under restricted eavesdropping.

IV-B1 Pure Loss Channel

First we look at the pure loss case. An upper bound on the secret key distillation capacity under the restricted eavesdropping model considered here follows from the broadcast channel result [24, Eq. (26)] [25, Eq. (8)] as:

[TABLE]

Here the notation $B;AF$ means that the closest separable state for the relative entropy entanglement calculation is a state separating system $B$ from systems $AF$. In Ref. [24, 25], the key to obtaining the above bound was the different physical realizations of the same broadcast channel, one of them being as shown in Fig. 13. Since only vacuum states are injected from $F^{\prime}$ and $E^{\prime}$ in Fig. 13, it is equivalent to our model in Fig. 1 with $\eta_{B}=\eta$ and $\eta_{C}=(1-\kappa)(1-\eta)$. Thus, the upper bound expression for our restricted eavesdropping case is obtained as

[TABLE]

In Fig. 14 we apply Eq. (65) to compare the upper bound with the lower bound for different values of $\kappa$. We plot the relative entropy entanglement upper bound and the lower bound for three $\kappa$ values, denoted by different colors. Here the lower bound is taken as the maximum of direct and reverse reconciliation rates.

Here we can see that when $\kappa$ is close to 1, the upper bound almost matches the lower bound. And they match each other when $\kappa=1$ which corresponds to the unrestricted case [15]. However when $\kappa$ decreases the upper bound becomes looser, but still highly constrain the region in which the capacity for secret key distillation can lie.

One interesting thing to see from Fig. 14 is that the region where direct reconciliation gives a higher rate than reverse reconciliation has a large overlap with the region where the upper bound and lower bound are closest to each other. For example, when $\kappa=0.01$ in Fig. 14 the upper bound and lower bound diverge from each other close to the point where direct reconciliation starts to give a lower rate than reverse reconciliation. Another observation from the plot is that when $\kappa$ decreases the lower bound tends to decrease slower with increasing channel loss at least when channel loss is low.

IV-B2 Thermal Noise Channel

Next, we look at the thermal noise channel. We plot the relative entropy of entanglement upper bound $E_{\textrm{R}}(B;AF)$ calculated as described in Appendix A along with the lower bounds of Eqs. (49) and (54) in Fig. 15. Here we can see that when noise is introduced into the channel the upper bound becomes looser compared to the pure loss channel, which is similar to what was found for unrestricted eavesdropping [15]. These gaps between our upper bounds and lower bounds narrow the search region for this problem’s capacity.

V Comparison between CV and DVQKD under Restricted Eavesdropping

In this Section, we present a comparison between achievable rates against a restricted Eve for the Gaussian-modulated CVQKD protocol (with coherent states, heterodyne detection and reverse reconciliation) and the corresponding lower bounds for the DV protocol DS-BB84 ($K_{\textrm{DS-BB84}}$) that are derived in Appendix B. For better illustration, we also include the upper bounds from Sec. IV-B.

First we look at the pure loss channel. In Fig. 16, we plot the CV achievable rate with reverse reconciliation ($K_{\textrm{CQQ}}$) and the CV reverse secure key rate when heterodyne detection is performed on both communication sides ($K_{\textrm{CCQ}}$), and compare with $K_{\textrm{DS-BB84}}$. Here the CCQ case corresponds to actual CVQKD, where Alice sends Gaussian modulated coherent states and Bob performs heterodyne detection. For generality, in a thermal noise channel (when $n_{e}=0$ this goes back to the pure loss channel):

[TABLE]

the state $\omega^{XYER}$ is

[TABLE]

Here $H(\rho^{X})$ and $H(\rho_{y}^{x})=H(p(y|x))$ are classical differential entropy of corresponding probability distribution and conditional probability distribution. In Fig. 16, we can see in the pure loss channel for any value of input power, the CV reverse reconciliation scheme generally has rates that are higher than DS-BB84. Also in the analysis of DS-BB84 there is an optimal input photon number which is why we see the peak in those green curves whereas the optimal input photon number in the CV scheme is infinity, and hence the rate keeps increasing with increasing input photon number.

Next we look at the thermal noise channel. In Fig. 17, we can see that both $K_{\textrm{CQQ}}$ and $K_{\textrm{CCQ}}$ increase with increasing $\mu$, whereas the DV rate first increases then decreases. This shows us that the optimal input photon number is different between two schemes. We can also see that although in the pure loss channel CVQKD always have higher SKR than DS-BB84, in a thermal noise channel DS-BB84 can have higher rate for certain channel parameters and input mean photon number.

However, In practical implementation it is not realistic to assume that Alice and Bob can extract all $I(X;Y)$ information through information reconciliation stage. So here in Fig. 18 we take the reconciliation efficiency $\beta$ into consideration and replot the curves from Fig. 17. We can see now for CVQKD we do have a finite optimal input mean photon number, which is beneficial for implementation since infinite mean photon number is impractical. Instead of Eq. (66) we use:

[TABLE]

the state $\omega^{XYER}$ is

[TABLE]

We also plot the comparison between CVQKD and DS-BB84 in Fig. 19, where the rate of DS-BB84 is optimized over input photon number. The rate for CVQKD is for optimal, i.e., infinite, input photon number (assuming $\beta=1$ and $f_{L}=1$). We also plot the relative entropy of entanglement upper bound calculated in this paper together with the PLOB lower bound and upper bound for thermal noise channel [15] for reference. It shows the comparison between optimized DV and CV rates with thermal noise $n_{e}=0.5$ as a function of the channel loss ($n_{d}=n_{e}$). We can see that although generally CVQKD has a higher rate, it appears that its achievable rate doesn’t necessarily offer a longer distance. Also it can be shown that by assuming such restriction we are getting a higher capacity region.

VI Conclusions and Summary

In summary, we showed lower bounds (achievable rates) for secret key distillation under restricted eavesdropping across pure loss and thermal noise channels based on heterodyne detection. We showed that putting a reasonable restriction on Eve can increase the key rate and extend the transmission range under the same channel conditions. We also showed that unlike the case in unrestricted eavesdropping model, in restricted eavesdropping model direct reconciliation has a potential of providing higher secure key rate under certain channel parameters. Furthermore, we calculated upper bounds using the relative entropy of entanglement for both pure loss and thermal noise channel, and showed that the upper bound is fairly close to the achievable rates with heterodyne detection, for pure loss channel even nearly being the capacity under the restricted eavesdropping model. We also showed a comparison of achievable rates between Gaussian modulation CVQKD and DS-BB84 protocol under restricted eavesdropping with perfect or imperfect reconciliation. All our results capture how the key rates and the transmission distances can increase with the assumption of restricted eavesdropping.

One possible avenue for future work is to find the better detection scheme than heterodyne detection or tighter upper bounds under restricted eavesdropping.

VII Acknowledgements

KPS thanks Mark M. Wilde for valuable discussions. The authors thank Tim Ralph for pointing us to a related work [26]. The authors also gratefully acknowledge financial support from General Dynamics on a QIS IRAD project, and the Office of Naval Research for funding under the Communications and Networking with Quantum Operationally-Secure Technology for Maritime Deployment (CONQUEST) program under contract number N00014-16-C2069, and a MURI program on free-space QKD under contract number N00014-13-1-0627.

Appendix A Calculating the Relative Entropy of Entanglement Upper Bound

The covariance matrix $V$ of an $N-$mode Gaussian state $\rho$ is the real symmetric matrix defined by

[TABLE]

where ”{}” denotes the anticommutator $\{\hat{A},\hat{B}\}=\hat{A}\hat{B}+\hat{B}\hat{A}$. $\hat{r}$ represents the grouped quadrature operators of the $N$ modes involved

[TABLE]

and $d$ denotes the quadrature means

[TABLE]

A valid quantum covariance matrix satisfies the Heisenberg uncertainty principle given by

[TABLE]

where

[TABLE]

Calculating the $E_{\textrm{R}}$ upper bounds for the pure loss and thermal noise channels involves finding the closest separable state to the Gaussian entangled state shared across the channel when one share of a TMSV input is transmitted through the channel. This is accomplished using the positive partial transpose (PPT) criterion, which is a necessary and sufficient condition for separability of 1-vs-$n-$mode bipartite Gaussian states [27, 28]. The PPT criterion, for a Gaussian state, translates into a condition on its covariance matrix [27, 28]. For a two-mode covariance matrix $V_{2}$, the condition reads

[TABLE]

where $\Omega^{PT}_{2}=\begin{pmatrix}0&1\\ -1&0\end{pmatrix}\otimes\begin{pmatrix}1&0\\ 0&-1\end{pmatrix}$. Equation (77) is to be understood as the Heisenberg uncertainty principle after one of the two modes has been time reversed, i.e., $\hat{p}\rightarrow-\hat{p}$ (in this case the second mode), which corresponds to partial transposition.

For a general entangled two-mode covariance matrix of the form

[TABLE]

the closest separable state can be obtained by writing down a covariance matrix

[TABLE]

(where $c$ is an unknown parameter) and determining $c$ using Eq. (77) for $V_{2}^{\textrm{sep}}$. The value of $c$ such that the smallest eigenvalue of $V_{2}^{\textrm{sep}}-i\Omega^{PT}_{2}$ is zero is found to be [29, 15]

[TABLE]

and the covariance matrix $V_{2}^{\textrm{sep}}$ for the value of $c$ in Eq. (80) corresponds to a separable quantum state. The relative entropy between the states corresponding to $V_{AB}$ in Eq. (78) and $V_{2}^{\textrm{sep}}$ in Eq. (79) for $c$ given by Eq. (80), when optimized over the input mean photon number gives the upper bounds mentioned in Sec. III against traditional unrestricted eavesdropping [15].

While the closest separable state gives the tightest relative entropy of entanglement upper bound, a close enough separable state still gives a valid upper bound. We give an $E_{\textrm{R}}$ upper bound for the restricted eavesdropping model by extending the above method. For the three-mode entangled covariance matrix of the form

[TABLE]

that we have in the restricted eavesdropping model, we write down a covariance matrix

[TABLE]

where $c$ is an unknown parameter and numerically solve for $c$ such that the smallest eigenvalue of $V_{3}^{\textrm{sep}}-i\Omega^{PT}_{3}$ is zero. Here,

[TABLE]

The relative entropy between the states corresponding to $V_{ABF}$ and $V^{\textrm{sep}}_{3}$ of Eqs. (87) and (94) optimized over the input mean photon number is the upper bound we plot in Secs. IV-B and V. The reason for choosing $V_{3}^{\textrm{sep}}$ in this form is to simplify the optimization complexity (with only one variable $c$ to be solved) and also because we are only concerned with the separability between modes $A$ and $B$ in the task of distilling secret key (covariance terms other than the covariance between mode $A$ and $B$ are thus left unchanged). In above calculation we are actually studying the separability of mode $AF$ and $B$, which is similar to what was discussed in [25] where a second receiver party (Charlie) in broadcast channel assists the communication between Alice and Bob. Also the reason for not considering separating mode $A$ from mode $BF$ is because that would just be studying a quantum channel with different transmissivity with no restrictions on Eve.

Appendix B Restricted Eve Secure Key Rate for DS-BB84

In this appendix we derive the SKR for DS-BB84 with a restricted Eve that we used in Sec. V. As a prelude, however, we reprise a result from [2]—using notation that will be convenient for what follows—for an unrestricted Eve. In both cases, the SKRs are asymptotic-regime results for photon-number splitting attacks. Moreover, for both cases we assume that Alice and Bob use polarization encoding in which all four polarization states are equally likely. In particular, Alice uses a weak coherent-state source that transmits signal-state pulses—containing $\mu$ photons per pulse on average at a rate $R$ states/s—over an Alice-to-Bob channel with transmissivity $\eta_{c}$. She also transmits sufficient decoy states to accurately estimate—in the asymptotic regime—the fraction of her signal pulses that contain single photons. Bob uses 50–50 active basis selection and a pair of single-photon detectors each with quantum efficiency $\eta_{q}$ and $n_{d}$ dark counts on average per pulse interval $1/R$.

When Eve is unrestricted, we must assume that she can interact with all the light Alice sends to Bob. From [2] we then have that

[TABLE]

where $I_{AB}$ is Alice and Bob’s Shannon information (in bits/s) and $I_{AE}$ is Alice and Eve’s Shannon information (in bits/s). Alice and Bob’s Shannon information obeys

[TABLE]

where: $B_{1}$ is the event that Bob gets a total of 1 click from his two detectors during a signal-pulse interval when Alice and Bob use the same basis, making $\Pr(B_{1})$ the probability of a sift event; $B_{e}$ is the sift event in which Bob’s detector click is from the detector associated with the wrong polarization, making $\Pr(B_{e})$ the raw-key error probability, a quantity usually called the quantum bit error rate [30];

[TABLE]

is the binary entropy function; and $f_{L}\geq 1$ is Alice and Bob’s reconciliation penalty. In words, this formula states that $I_{AB}$ is the sift rate $R\Pr(B_{1})/2$, i.e., the rate at which Alice and Bob choose the same basis and Bob gets a total of 1 click from his detectors, multiplied by Alice and Bob’s Shannon information per sift event $1-f_{L}H_{2}[\Pr(B_{e})]$, i.e., the entropy of Alice’s transmission to Bob minus the information leaked during reconciliation.

To find Alice and Eve’s Shannon information rate, consider what happens when Alice transmits an $n$-photon signal pulse. When $n=0$, Eve gets no information. When $n=1$, Eve gets partial information, but this comes at the expense of her creating errors. When $n\geq 2$, Eve gets complete information by means of a photon-number splitting attack. Consequently, Alice and Eve’s Shannon information rate obeys

[TABLE]

where $A_{n}$ is the event that Alice’s signal pulse contains $n$ photons. Here, $I_{AE}$ equals Alice and Bob’s sift rate $R\Pr(B_{1})/2$ multiplied by the entropy of Alice’s transmission to Bob reduced by entropies of the sift events associated with Alice’s transmission of a 0 photon signal pulse and those of the sift events associated with Alice’s transmission of a 1 photon signal pulse and Eve’s interaction therewith.

The probabilities necessary to instantiate the preceding Shannon information expressions are easily found. The probability of a sift event equals the probability of a click on one of Bob’s detectors and no click on the other detector:

[TABLE]

where $\eta\equiv\eta_{q}\eta_{c}$ is the overall Alice-to-Bob transmissivity (the channel transmissivity times the detector quantum efficiency) and we have used statistically independent Poisson statistics for the counts generated by each detector. We have that $\Pr(A_{0}\mid B_{1})=\Pr(A_{0}B_{1})/\Pr(B_{1})$, where the joint probability of Alice sending 0 photons and that transmission’s resulting in a sift event is

[TABLE]

Similarly we have that $\Pr(A_{1}\mid B_{1})=\Pr(A_{1}B_{1})/\Pr(B_{1})$, where the joint probability of Alice sending 1 photon and that transmission’s resulting in a sift event is

[TABLE]

Bob’s conditional error probability for a sift event, given Alice sent 1 photon, is thus

[TABLE]

where the numerator is the joint probability that Alice has transmitted 1 photon, it results in a sift event, and Bob’s single click comes from the detector associated with the wrong polarization. Bob’s unconditional error probability for a sift event is given by

[TABLE]

where the numerator is the probability for a sift event in which Bob’s 1 click comes from the detector associated with the wrong polarization. Substituting these probabilities into Eqs. (97), and (99), and then evaluating Eq. (96), gives us Alice and Bob’s SKR for an unrestricted Eve,

[TABLE]

Alice and Bob’s SKR can be significantly better when Eve is restricted, i.e., when she can only interact with a fraction $\eta_{E}$ of the light transmitted by Alice and that fraction is disjoint from the $\eta_{c}$ fraction that arrives at Bob’s receiver. It follows that Eve gets no information when Alice’s signal pulse contains 0 photons and she gets complete information about every signal pulse from which she collects a photon and Bob gets a total of 1 click from his two detectors. We can now use Eq. (96) to get Alice and Bob’s SKR, with $I_{AB}$ given by Eqs. (97), (100) and (106), and $I_{AE}$ given by

[TABLE]

where $E_{0}$ is the event that Eve collects none of Alice’s photons. Thus we get

[TABLE]

for the DS-BB84 system with a restricted Eve, where

[TABLE]

because $B_{1}$ and $E_{0}$ are statistically independent events.

Figure 20, obtained using the parameters given in Table I, illustrates the very significant SKR increase afforded by Eve’s being restricted in her access to Alice’s transmitted light, i.e., when $\kappa\equiv\eta_{E}/(1-\eta)\ll 1$.