Secure quantum key distribution with realistic devices

TL;DR

This paper reviews recent theoretical and experimental advances in securing quantum key distribution (QKD) against practical device imperfections, highlighting progress like measurement-device-independent protocols that enhance real-world security.

Contribution

It provides a comprehensive overview of how practical security challenges in QKD are addressed through innovative protocols and improved understanding of device imperfections.

Findings

Measurement-device-independent protocols close critical security loopholes.

Researchers understand and manage practical device imperfections.

Recent advances enable secure QKD with realistic devices.

Abstract

In principle, quantum key distribution (QKD) offers information-theoretic security based on the laws of physics. In practice, however, the imperfections of realistic devices might introduce deviations from the idealized models used in security analyses. Can quantum code-breakers successfully hack real systems by exploiting the side channels? Can quantum code-makers design innovative counter-measures to foil quantum code-breakers? This article reviews theoretical and experimental progress in the practical security aspects of quantum code-making and quantum code-breaking. After numerous attempts, researchers now thoroughly understand and are able to manage the practical imperfections. Recent advances, such as the measurement-device-independent protocol, have closed the critical side channels in the physical implementations, paving the way for secure QKD with realistic devices.

Figures

Tables

Table 1. Table 1: List of quantum hacking strategies.

Attack	Source/Detection	Target component	Manner	Year
Photon-number-splitting Lütkenhaus (2000); Brassard et al. (2000)	Source	WCP (multi-photons)	Theory	2000
Detector fluorescence Kurtsiefer et al. (2001)	Detection	Detector	Theory	2001
Faked-state Makarov and Hjelme (2005); Makarov et al. (2006)	Detection	Detector	Theory	2005
Trojan horse Vakhitov et al. (2001); Gisin et al. (2006)	Source&Detection	Backflection light	Theory	2006
Time shift Qi et al. (2007a); Zhao et al. (2008)	Detection	Detector	Experiment∗	2007
Time side-channel Lamas-Linares and Kurtsiefer (2007)	Detection	Timing information	Experiment	2007
Phase remapping Fung et al. (2007); Xu et al. (2010)	Source	Phase modulator	Experiment∗	2010
Detector blinding Makarov (2009); Lydersen et al. (2010)	Detection	Detector	Experiment∗	2010
Detector blinding Gerhardt et al. (2011a, b)	Detection	Detector	Experiment	2011
Detector control Lydersen et al. (2011a); Wiechers et al. (2011)	Detection	Detector	Experiments	2011
Faraday mirror Sun et al. (2011)	Source	Faraday mirror	Theory	2011
Wavelength Li et al. (2011); Huang et al. (2013)	Detection	Beam-splitter	Experiment	2011
Dead-time Henning et al. (2011)	Detection	Detector	Experiment	2011
Channel calibration Jain et al. (2011)	Detection	Detector	Experiment∗	2011
Intensity Jiang et al. (2012); Sajeed et al. (2015b)	Source	Intensity modulator	Experiment	2012
Phase information Sun et al. (2012); Tang et al. (2013); Sun et al. (2015)	Source	Phase randomization	Experiment	2012
Memory attacks Barrett et al. (2013)	Detection	Classical memory	Theory	2013
Local oscillator Jouguet et al. (2013a); Ma et al. (2013b)∗∗	Detection	Local oscillator	Experiment	2013
Trojan horse Jain et al. (2014, 2015)	Source&Detection	Backflection light	Experiment	2014
Laser damage Bugge et al. (2014); Makarov et al. (2016)	Detection	Detector	Experiment	2014
Laser seeding Sun et al. (2015)	Source	Laser phase/intensity	Experiment	2015
Spatial mismatch  Sajeed et al. (2015a); Chaiwongkhot et al. (2019)	Detection	Detector	Experiment	2015
Detector saturation Qin et al. (2016)∗∗	Detection	Homodyne detector	Experiment	2016
Covert channels Curty and Lo (2019)	Detection	Classical memory	Theory	2017
Pattern effect Yoshino et al. (2018)	Source	Intensity modulator	Experiment	2018
Detector control Qian et al. (2018)	Detection	Detector	Experiment	2018
Laser seeding Sun et al. (2015); Huang et al. (2019); Pang et al. (2019)	Source	Laser	Experiment	2019
Polarization shift Wei et al. (2019a)	Detection	SNSPD	Experiment	2019
$\ast$Demonstration on commercial QKD system
$\ast \ast$Continuous-variable QKD

Table 2. Table 2: List of decoy-state QKD experiments and their performance.

Reference	Clock rate	Encoding	Channel	Maximal distance	Key rate (bps)	Year
Zhao et al. (2006b, a)	5MHz	Phase	Fiber	60km	422.5	2006
Peng et al. (2007)	2.5MHz	Polarisation	Fiber	102km	8.1	2007
Rosenberg et al. (2007)	2.5MHz	Phase	Fiber	107km	14.5	2007
Schmitt-Manderbach et al. (2007)	10MHz	Polarisation	Free-space	144km	12.8∗	2007
Yuan et al. (2007)	7.1MHz	Phase	Fiber	25.3km	5.5K	2007
Yin et al. (2008)	1MHz	Phase	Fiber	123.6km	1.0	2008
Wang et al. (2008)∗∗	0.65MHz	Phase	Fiber	25km	0.9	2008
Dixon et al. (2008)	1GHz	Phase	Fiber	100.8km	10.1K	2008
Peev et al. (2009)	7MHz	Phase	Fiber network	33km	3.1K	2009
Rosenberg et al. (2009)	10MHz	Phase	Fiber	135km	0.2	2009
Yuan et al. (2009)	1.036GHz	Phase	Fiber	100Km	10.1K	2009
Chen et al. (2009)	4MHz	Phase	Fiber network	20km	1.5K	2009
Liu et al. (2010)	320MHz	Polarisation	Fiber	200km	15.0	2010
Chen et al. (2010)	320MHz	Polarisation	Fiber network	130km	0.2K	2010
Sasaki et al. (2011)	1GHz	Phase	Fiber network	45km	304.0K	2011
Wang et al. (2013)	100MHz	Polarisation	Free space	96km	48.0	2013
Fröhlich et al. (2013)	125MHz	Phase	Fiber network	19.9km	43.1K	2013
Lucamarini et al. (2013)	1GHz	Phase	Fiber	80km	120.0K	2013
Fröhlich et al. (2017)	1GHz	Phase	Fiber	240km‡	8.4	2017
Liao et al. (2017a)	100MHz	Polarisation	Free space	1200km	1.1K	2017
Yuan et al. (2018)	1GHz	Phase	Fiber	2dB	13.7M	2018
Boaron et al. (2018)	2.5GHz	Time-bin	Fiber	421km‡	6.5	2018
∗Asymptotic key rate
∗∗Heralded single-photon source
‡Ultralow loss fiber

Table 3. Table 3: List of MDI-QKD experiments and their performance.

Reference	Clock rate	Encoding	Distance/loss	Key rate (bps)	Year	Notes
Rubenok et al. (2013)‡	2MHz	Time-bin	81.6km	${0.24}^{\ast }$	2013	Field-installed fiber
Liu et al. (2013)	1MHz	Time-bin	50km	$0.12$	2013	First complete demonstration
Ferreira da Silva et al. (2013)‡	1MHz	Polarisation	17km	${1.04}^{\ast }$	2013	Multiplexed synchronization
Tang et al. (2014b)	0.5MHz	Polarisation	10km	$4.7\times {10}^{-3}$	2014	Active phase randomization
Tang et al. (2014a)	75MHz	Time-bin	200km	$0.02$	2014	Fully automatic system
Tang et al. (2015)	75MHz	Time-bin	30km	$16.9$	2015	Field-installed fiber
Wang et al. (2015a)	1MHz	Time-bin	20km	${8.3}^{\ast }$	2015	Phase reference free
Valivarthi et al. (2015)	250MHz	Time-bin	60dB	$5\times {10}^{-2}$	2015	Test in various configurations
Pirandola et al. (2015)‡	10.5MHz	Phase	4dB	0.1	2015	Continuous variable
Tang et al. (2016b)	75MHz	Time-bin	55km	$16.5$	2016	First fiber network
Yin et al. (2016)	75MHz	Time-bin	404km	$3.2\times {10}^{-4}$	2016	Longest distance
Tang et al. (2016a)	10MHz	Polarisation	40km	10	2016	Include modulation errors
Comandar et al. (2016)‡	1GHz	Polarisation	102km	4.6K	2016	High repetition rate
Kaneda et al. (2017)‡	1MHz	Time-bin	14dB	0.85	2017	Heralded single-photon source
Wang et al. (2017a)	1MHz	Time-bin	20km	$6.3\times {10}^{-3}$	2017	Stable against polarization change
Valivarthi et al. (2017)	20MHz	Time-bin	80km	$100$	2017	Cost-effective implementation
Liu et al. (2018a)	50MHz	Time-bin	160km	${2.6}^{\ast }$	2018	Phase reference free
Liu et al. (2019a)	75MHz	Time-bin	100km	$14.5$	2019	Asymmetric channels
Wei et al. (2019b)	1.25GHz	Polarisation	20.4 dB	6.2K	2019	Highest repetition/key rate
∗Asymptotic key rate
‡No random modulations

Table 4. Table 4: List of TF-QKD experiments.

Reference	Distance/loss	Key rate (bps)	Year
Minder et al. (2019)	90.8dB	0.045∗	2019
Wang et al. (2019a)	300km	2.01k∗	2019
Liu et al. (2019b)	300km	39.2	2019
Zhong et al. (2019)	55.1dB	25.6∗	2019
Fang et al. (2019)	502km‡	0.118	2019
Chen et al. (2019)	509km‡	0.269	2019
∗Asymptotic key rate
‡Ultra-low loss fiber

Table 5. Table 5: List of some recent CV-QKD experiments and their performance.

Reference	Clock rate	Distance/loss	Key rate (bps)	Year	Notes
Jouguet et al. (2013b)	1MHz	80.5km	$\sim$250	2013	Full implementation
Qi et al. (2015)	25MHz	—	—	2015	Local LO
Soh et al. (2015)	250KHz	—	—	2015	Local LO
Huang et al. (2015a)	100MHz	25km	100K	2015	Local LO
Pirandola et al. (2015)	10.5MHz	4dB	0.1	2015	CV MDI-QKD
Huang et al. (2015b)	50MHz	25km	$\sim$1M	2015	High key rate
Kumar et al. (2015a)	1MHz	75km	490	2015	Coexistence with classical
Zhang et al. (2019b)	5MHz	50km	5.8K	2019	Field test
Zhang et al. (2020)	5MHz	202.8km‡	6.2	2020	Long distance
‡Ultra-low loss fiber

Table 6. Table 6: List of chip-based QKD experiments.

Reference	Clock rate	Distance/loss	Key rate (bps)	Year	Notes
Ma et al. (2016a)	10MHz	5km	0.95K	2016	Silicon, decoy-BB84
Sibson et al. (2017a)	1.72GHz	4dB	565K	2017	InP, DPS
Sibson et al. (2017b)	1.72GHz	20km	916K	2017	Silicon, COW
Bunandar et al. (2018)	625MHz	43km	157K	2018	Silicon, decoy-BB84
Ding et al. (2017)	5KHz	4dB	$\sim$7.5	2018	Silicon, high-dimension
Zhang et al. (2019a)	1MHz	16dB	0.14K	2019	Silicon, CV-QKD
Paraïso et al. (2019)	1GHz	20dB	270K	2019	InP, modulator-free
Wei et al. (2019b)	1.25GHz	140km	497	2019	Silicon, MDI-QKD

Table 7. Table 7: List of recent experiments of other QKD protocols.

Reference	Clock rate	Distance/loss	Key rate (bps)	Year
Quantum access network Fröhlich et al. (2013)	125MHz	19.9km	259	2013
Centric network Hughes et al. (2013)	10MHz	50km	—	2013
RR-DPS Guan et al. (2015)	500MHz	53km	$\sim$118.0	2015
RR-DPS Takesue et al. (2015)	2GHz	20km	2.0K	2015
RR-DPS Wang et al. (2015c)	1GHz	90km	$\sim$800	2015
RR-DPS Li et al. (2016)	10KHz	18dB	15.5	2016
High-dimension Lee et al. (2014)	8.3MHz	—	456	2014
High-dimension Zhong et al. (2015)	CW	20km	2.7M	2015
High-dimension Mirhosseini et al. (2015)	4KHz	—	6.5	2015
High-dimension Sit et al. (2017)	—	0.3km	$\sim$30K	2017
High-dimension Islam et al. (2017)	2.5GHz	16.6dB	1.07M	2017
Coherent-one-way Korzh et al. (2015)	625MHz	307km	3.2	2015
Modulator-free Yuan et al. (2016)	1GHz	40dB	$\sim$10	2018

Table 8. Table 8: List of recent developments of other quantum cryptographic protocols beyond QKD.

Protocol	Theory/Experiment	Notes
Noisy quantum storage Konig et al. (2012); Wehner et al. (2008); DamgÅrd et al. (2008)	Theory	Unconditional security
Oblivious transfer Erven et al. (2014)	Experiment	Noisy-storage model
Bit commitment Ng et al. (2012)	Experiment	Noisy-storage model
Bit commitment Kent (2012)	Theory	Relativistic assumption
Bit commitment Lunghi et al. (2013); Liu et al. (2014)	Experiment	Relativistic assumption
Bit commitment Lunghi et al. (2015); Chakraborty et al. (2015); Verbanis et al. (2016)	Experiment	Long commitment time
Digital signature Clarke et al. (2012)	Experiment	First demonstration
Digital signature Collins et al. (2014); Dunjko et al. (2014)	Experiment	No quantum memory
Digital signature Donaldson et al. (2016); Yin et al. (2017a)	Experiment	Insecure channel
Coin flipping Berlín et al. (2011); Pappa et al. (2014)	Experiment	Loss tolerance
Data locking Fawzi et al. (2013); Lloyd (2013); Lupo et al. (2014)	Theory	Loss tolerance
Data locking Liu et al. (2016); Lum et al. (2016)	Experiment	Loss tolerance
Blind quantum computing Broadbent et al. (2009); Barz et al. (2012)	Theory,Experiment	No quantum memory
Blind quantum computing Reichardt et al. (2013); Huang et al. (2017)	Theory,Experiment	Classical clients

Table 9. Table 9: List of related reviews to QKD.

Reference	Subject
Gisin et al. (2002)	Experimental basics of QKD
Scarani et al. (2009)	Theoretical basics of QKD
Lo et al. (2014); Diamanti et al. (2016); Zhang et al. (2018)	Practical challenges of QKD
Jain et al. (2016)	Quantum hacking attacks
Xu et al. (2015)	Measurement-device-independent QKD
Hadfield (2009); Zhang et al. (2015)	Single-photon detector
Ma et al. (2016b); Herrero-Collantes and Garcia-Escartin (2017)	Quantum random number generator
Coles et al. (2017)	Entropy uncertainty relation
Weedbrook et al. (2012); Diamanti and Leverrier (2015); Laudenbach et al. (2018)	Continuous-variable QKD
Sangouard et al. (2011); Pan et al. (2012); Munro et al. (2015)	Quantum repeaters
Kimble (2008); Wehner et al. (2018)	Quantum internet
Brunner et al. (2014)	Bell nonlocality/device-independent QKD
Fitzsimons (2017)	Blind quantum computing
Xavier and Lima (2020)	High-dimensional QKD

Table 10. Table 10: List of tolerable error rate bounds for different schemes and proofs. The upper bounds are evaluated by simple individual (intercept-and-resend) attacks Gottesman and Lo ( 2003 ) .

Scheme	One-way	Two-way	Upper bound
BB84	11.0%	20.0%	1/4
Six-state	12.7%	27.6%	1/3

Table 11. Table 11: Security assumptions and actual setup for BB84.

Component	Security assumption	Practical setup
Photon source	Ideal single photon	Coherent laser
Encoding state	Two-dimension	Arbitrary-dimension
Encoding state	Basis-independent	Source flaws
Measurement	Two-dimension	Arbitrary-dimension
Measurement	Basis-independent	Measurement flaws
Photon detection	Ideal SPD	Threshold detector

Table 12. Table 12: List of notations in phase error estimation.

Notation	Definition
$n_z$	number of bits measured in the $Z$-basis
$n_x$	number of bits measured in the $X$-basis
$e_{bx}$	bit error rate in the $X$-basis
$e_{pz}$	phase error rate in the $Z$-basis
$q_x$	sampling ratio $n_x/\left(n_x+n_z\right)$
$\theta$	deviation of the phase error rate
${\epsilon }_{ph}$	failure probability of phase error estimation

Table 13. Table 13: List of resource cost and the failure probabilities in the various steps. The numbers of consumed secret key bits are denoted with k 𝑘 k while the failure probabilities with ε 𝜀 \varepsilon . Alice sends out N 𝑁 N signals and Bob detected n 𝑛 n of them in the Z 𝑍 Z -basis measurement. The final key output length is l 𝑙 l . The tag length refers to authentication tag and - means no authentication is required. In error verification, no message but only an encrypted (authentication) tag is transmitted. The cost of error correction k e ​ c subscript 𝑘 𝑒 𝑐 k_{ec} is given by n ​ f ​ H ​ ( E ) 𝑛 𝑓 𝐻 𝐸 nfH(E) . No communication is required in phase error estimation. [Table adapted from Fung  et al. ( 2010 ) ]

Procedures	Message	Tag	Failure Prob
1. Raw key assign	$N$	-	-
2. Basis sift	$n$	$k_{bs}$	${\epsilon }_{bs}$ [Eq. (32)]
3. Bit error correction	$k_{ec}$	-	-
4. Error verification	-	$k_{ev}$	${\epsilon }_{ev}$ [Eq. (32)]
5. Phase error estimation	-	-	${\epsilon }_{ph}$ [Eq. (23)]
6. Privacy amplification	$\left(n+l-1\right)$	$k_{pa}$	${\epsilon }_{pa}$ [Eq. (34)]

Table 14. Table 14: The failure probability as a function of the fluctuation deviations, measured by the number of standard deviations, ( χ − 𝔼 L ​ [ χ ] ) / 𝔼 L ​ [ χ ] = ( 𝔼 U ​ [ χ ] − χ ) / 𝔼 L ​ [ χ ] = n ​ σ 𝜒 superscript 𝔼 𝐿 delimited-[] 𝜒 superscript 𝔼 𝐿 delimited-[] 𝜒 superscript 𝔼 𝑈 delimited-[] 𝜒 𝜒 superscript 𝔼 𝐿 delimited-[] 𝜒 𝑛 𝜎 (\chi-\mathbb{E}^{L}[\chi])/\mathbb{E}^{L}[\chi]=(\mathbb{E}^{U}[\chi]-\chi)/\mathbb{E}^{L}[\chi]=n\sigma , where χ 𝜒 \chi is counts in experiment. Here, ε G subscript 𝜀 𝐺 \varepsilon_{G} , ε ∞ subscript 𝜀 \varepsilon_{\infty} , ε 10000 subscript 𝜀 10000 \varepsilon_{10000} , and ε 70 subscript 𝜀 70 \varepsilon_{70} , respectively, denote failure probabilities for the bounds in the Gaussian approximate analysis, the rigourous method with large data size limit, and a data size of 10000 and 70. [A similar table is also presented in Zhang  et al. ( 2017 ) ]

Deviation	${\epsilon }_G$	${\epsilon }_{\infty }$	${\epsilon }_{10000}$	${\epsilon }_{70}$
$2\sigma$	${10}^{-1.34}$	${10}^{-0.57}$	${10}^{-0.57}$	${10}^{-0.57}$
$3\sigma$	${10}^{-2.57}$	${10}^{-1.65}$	${10}^{-1.65}$	${10}^{-1.54}$
$4\sigma$	${10}^{-4.20}$	${10}^{-3.17}$	${10}^{-3.17}$	${10}^{-2.65}$
$5\sigma$	${10}^{-6.24}$	${10}^{-5.13}$	${10}^{-5.09}$	${10}^{-3.92}$
$6\sigma$	${10}^{-8.70}$	${10}^{-7.52}$	${10}^{-7.43}$	${10}^{-5.36}$
$7\sigma$	${10}^{-11.59}$	${10}^{-10.34}$	${10}^{-10.13}$	${10}^{-6.95}$
$8\sigma$	${10}^{-14.91}$	${10}^{-13.60}$	${10}^{-13.18}$	${10}^{-8.67}$
$9\sigma$	${10}^{-18.65}$	${10}^{-17.29}$	${10}^{-16.60}$	${10}^{-10.50}$
$10\sigma$	${10}^{-22.82}$	${10}^{-21.41}$	${10}^{-20.36}$	${10}^{-12.38}$

Table 15. Table 15: Post-selection for MDI-QKD  Lo  et al. ( 2012 ) . Alice and Bob post-select the events where the relay outputs a successful result and they use the same basis in their transmission. Moreover, either Alice or Bob flips her/his bits, except for the cases where both of them select the diagonal basis and the relay outputs a triplet

	Singlet state $|{\psi }^{-}⟩$	Triplet state $|{\psi }^{+}⟩$
Coincident clicks	$D_{1H}$ & $D_{2V}$ or	$D_{1H}$ & $D_{1V}$ or
	$D_{2H}$ & $D_{1V}$	$D_{2H}$ & $D_{2V}$
Rectilinear basis	Bit flip	Bit flip
Diagonal basis	Bit flip	–

Table 16. Table 16: Security assumptions in DI-QKD and MDI-QKD. While DI-QKD has the advantage of being applicable to an uncharacterized source, it demands no unwanted information leakage from the measurement unit. MDI-QKD applies to any measurement units. This means that the measurement unit in MDI-QKD can be an entire black-box, purchased from untrusted vendors.

	DI-QKD	MDI-QKD
True random number generators	Yes	Yes
Trusted classical post-processing	Yes	Yes
Authenticated classical channel	Yes	Yes
No unwanted information leakage
from the measurement unit	Yes	No
Characterized source	No	Yes

Equations

$${\rho }_{ABE}=\sum _{k_A,k_B}Pr(k_A,k_B)|k_A⟩⟨k_A|\otimes |k_B⟩⟨k_B|\otimes {\rho }_E^{(k_A,k_B)},$$

$${\rho }_{ABE}^{ideal}=2^{-m}\sum _k{|k⟩}_A⟨k|\otimes {|k⟩}_B⟨k|\otimes {\rho }_E,$$

$$Pr(k_A\ne k_B)\le {ϵ}_{cor}.$$

$$\underset{{\rho }_E}{\min }\frac{1}{2}(1-p_{\text{abort}})||{\rho }_{AE}-{\rho }_{AE}^{ideal}|{|}_1\le {ϵ}_{sec},$$

$$\underset{{\rho }_E}{\min }\frac{1}{2}(1-p_{\text{abort}})||{\rho }_{ABE}-{\rho }_{ABE}^{ideal}|{|}_1\le ϵ.$$

$$|{\Phi }^{\pm }⟩$$

$$|{\Psi }^{\pm }⟩$$

$$e_b$$

$$e_p$$

$$r\ge 1-H(e_b)-H(e_p),$$

$$r$$

$$S(A|E)$$

$$=S({\rho }_B)-S({\rho }_{AB}),$$

$$S(A|E)=D({\rho }_{AB}||{\Delta }_z({\rho }_{AB})),$$

$${|{\Psi }_{\beta }⟩}_{A{A}_{0}B}=\frac{1}{\sqrt{2}}\sum _{\kappa }{|{\beta }_{\kappa }⟩}_A{|{\psi }_{\beta \kappa }⟩}_{A_{0}B},$$

$${\rho }_{\beta \kappa }$$

$${\rho }_x$$

$${\rho }_z$$

$${\rho }_x={\rho }_z.$$

$$M_x$$

$$M_z$$

$$M_x=M_z.$$

$$|k_{good}|$$

$$|k_{bad}|$$

$$|k_{good}^{\prime }|=|k_{bad}^{\prime }|$$

$$k_{good}^{\prime }\oplus k_{bad}^{\prime }$$

$$T^{\prime }{k}_{good}^{\prime }\oplus T^{\prime }{k}_{bad}^{\prime }$$

$$=T^{\prime }{k}_A$$

$$r\ge -H(E)+(1-\Delta )[1-H(e_p)].$$

$$r\ge -H(E)+\sum _g{q}_g[1-H(e_p^g)],$$

$$e_{pz}\le e_{bx}+\theta ,$$

$${\epsilon }_{ph}$$

$$\rho$$

$$|\alpha ⟩=e^{-|\alpha {|}^2/2}\sum _{n=0}^{\infty }\frac{{\alpha }^n}{\sqrt{n!}}|n⟩.$$

$${\rho }_{\mu }$$

Full text

1. I Introduction

2. I.1 Secure communication

3. I.2 Quantum key distribution (QKD)

4. I.2.1 BB84 protocol

5. I.2.2 Intuition of security

6. I.2.3 Overview of recent developments

7. I.3 Focus of this review

8. I.4 Outline of this review

9. II Security analysis

10. II.1 Security definition

11. II.2 Security proofs

12. II.2.1 Lo-Chau security proof

13. II.2.2 Shor-Preskill: reduction to prepare-and-measure schemes

14. II.2.3 Koashi’s complementarity approach

15. II.2.4 Entropic approach

16. II.3 Security assumptions

17. II.3.1 Source

18. II.3.2 Measurement

19. II.3.3 Channel

20. II.4 Practical security analysis

21. II.4.1 GLLP

22. II.4.2 Random sampling and finite-data size

23. III QKD Implementation

24. III.1 Encoding and decoding

25. III.2 Photon sources

26. III.2.1 Prepare-and-measure

27. III.2.2 Entanglement-based

28. III.3 Channel

29. III.4 Detection

30. III.5 Postprocessing

31. III.5.1 Error correction

32. III.5.2 Error verification and authentication

33. III.5.3 Privacy amplification

34. III.5.4 Finite-key length

35. IV Quantum Hacking

36. IV.1 Attacks at source

37. IV.1.1 Photon-number-splitting attack

38. IV.1.2 Phase-remapping attack

39. IV.1.3 Nonrandom-phase attack

40. IV.2 Attacks at detection

41. IV.2.1 Double-click attack

42. IV.2.2 Fake-state attack

43. IV.2.3 Time-shift attack

44. IV.2.4 Detector-control attack

45. IV.3 Other attacks

46. V Source Security

47. V.1 Decoy-state method

48. V.1.1 Theory

49. V.1.2 Experiment

50. V.2 Source flaws

51. V.2.1 Basis-dependent source

52. V.2.2 Nonrandom phase

53. V.2.3 Encoding flaws

54. V.3 Leaky source

55. VI Detection Security

56. VI.1 Countermeasures against detection attacks

57. VI.2 Measurement-device-independent scheme

58. VI.2.1 Time-reversed EPR QKD

59. VI.2.2 MDI-QKD protocol

60. VI.2.3 Theoretical developments

61. VI.2.4 Experimental developments

62. VI.3 Twin-field QKD

63. VII Continuous-Variable QKD

64. VII.1 Protocol and security

65. VII.1.1 Gaussian-modulated protocol

66. VII.1.2 Discrete modulated protocol

67. VII.1.3 Security analysis

68. VII.2 Experimental developments

69. VII.3 Quantum hacking and countermeasures

70. VIII Other Quantum Cryptographic Protocols

71. VIII.1 Device-independent QKD

72. VIII.2 Some New QKD implementations

73. VIII.2.1 Round-robin DPS QKD

74. VIII.2.2 High-dimensional QKD

75. VIII.2.3 QKD with wavelength-division multiplexing

76. VIII.2.4 Chip-based QKD

77. VIII.3 Other quantum cryptographic protocols

78. VIII.3.1 Quantum bit commitment

79. VIII.3.2 Quantum digital signature

80. VIII.3.3 Other protocols

81. IX Concluding Remarks

82. A General questions to QKD

I Introduction

I.1 Secure communication

For thousands of years, code-makers and code-breakers have been fighting for supremacy. With the recent rise of Internet of Things, cyber security has become a hot topic. Cyber warfare that can undermine the security of critical infrastructures, such as smart power grids and financial systems, threatens the well-being of individual countries and the global economy.

In conventional cryptography, two distant parties, traditionally called Alice and Bob, share a communication channel and they would like to communicate privately in the presence of an eavesdropper, Eve. The Holy Grail of secure communication is information-theoretical security. It is known that one could achieve information-theoretically secure communication via the one-time-pad (OTP) method Vernam (1926), if the two users, Alice and Bob, share a long random string that is kept secret from Eve. Note that, for the OTP scheme to be information-theoretically secure, it is important not to re-use the key Shannon (1949). That is to say that the key has to be as long as the message itself and can only be used once. How to distribute such a long key in the presence of Eve is called the key distribution problem. In fact, the key distribution problem is a central challenge in all kinds of encryption methods.

In principle, all conventional key distribution schemes that rely on classical physics and mathmatics can only provide computational security, because in classical physics, there is nothing to prevent an eavesdropper from copying the key during the key distribution process. Now, if Eve and Bob have the same key, whatever Bob can decrypt, Eve can decrypt too.

Currently, the key distribution problem is often solved by public key cryptography. In public key cryptography, there are a pair of keys: a public key and a private key. An intended recipient Bob will publish the public key so that anyone, such as an intended sender Alice, can encrypt a message, called a plain text, with the public key and send the encrypted message, a cipher text, to Bob. On the other hand, only Bob with the private key can decrypt the cipher text to recover the plain text efficiently. The security of public key cryptography is based on computational assumptions. Given the public key, there is no efficient known algorithm for Eve to work out the private key or to recover the plain text, from the cipher text. For instance, the security of the best-known public key crypto-system, RSA Rivest et al. (1978), is based on the presumed hardness of factoring large integers. Unfortunately, public key cryptography is vulnerable to unanticipated advances in hardware and software. Moreover, in 1994, Peter Shor then at AT&T invented an efficient quantum algorithm for factorization Shor (1997). For this reason, if a large scale quantum computer is ever constructed, much of conventional cryptography will fall apart!

After more than two decades of intense theoretical and experimental efforts, primitive small scale quantum computers have already been built. Several big companies and a number of labs and start-ups are racing to build the world’s first practical quantum computer. For instance, Google AI Quantum Laboratory111Google Q: research.google/teams/applied-science/quantum has realized the quantum advantage (or supremacy) over state-of-the-art classical supercomputer for a specific computational task Arute et al. (2019), and plans to commercialize quantum computers within a few years Mohseni et al. (2017); IBM Q has already put its sixteen-qubit quantum processor online for client use222IBM Q: www.research.ibm.com/ibm-q; Rigetti has also provided the quantum cloud service333Rigetti: www.rigetti.com; Chinese Academy of Sciences (CAS) and Alibaba have established the Quantum Computing Laboratory to advance the research of quantum computing444CAS-Alibaba: quantumcomputer.ac.cn/index.html; Other companies, such as Intel, Microsoft, Baidu, Tencent, IonQ, Xanadu, Zapata and so forth, have also joined the international race to build a quantum computer. Moreover, China is building the National Laboratory for Quantum Information Science to support the revolutionary research in quantum information; The European Commission is planning to launch the flagship initiative on quantum technologies555ec.europa.eu/digital-single-market/en/news/quantum-europe-2017-towards-quantum-technology-flagship; USA has already launched the National Quantum Initiative Act in 2018666www.congress.gov/bill/115th-congress/house-bill/6227. All in all, the risk of successful construction of a quantum computer in the next decade can no longer be ignored.

Note that some data such as our DNA data and health data need to kept secret for decades. This is called long-term security. However, cryptographic standards could take many years to change. An eavesdropper intercepting encrypted data sent in 2019 may save them for decades as they wait for the future successful construction of a quantum computer. The eavesdropper could then retro-actively successfully crack an encryption scheme, therefore cryptographic standards need to consider potential future technological advances of the next few decades. For instance, Canadian Census Data is required to be kept confidential for 92 years777www12.statcan.ca/English/census01/Info/chief.cfm or until 2111. To ensure such security, we need to predict the future technology in the next century. As a comparison, the first general-purpose electronic computer, ENIAC, was formally dedicated in 1946, which was less than 92 years ago. This meant that general-purpose electronic computers did not even exist 92 years ago. Therefore, if history is any guide, we think that it is not realistic for one to predict with any confidence what types of technology would exist 92 years from now.

In 2015, the US National Security Agency (NSA) announced a plan for transition to quantum-safe crypto-systems. For instance, the US National Institute of Standards and Technology (NIST) has made a call for quantum-safe candidate algorithm nominations, which was due November 30, 2017888csrc.nist.gov/Projects/Post-Quantum-Cryptography. Over the next few years, those candidate algorithms will be evaluated.

Broadly speaking, there are two approaches to a quantum-safe encryption scheme. The first approach is to use conventional cryptography and to develop alternative public-key encryption schemes, such as hash-based or code-based encryption schemes, in which known quantum attacks such as Shor’s algorithm Shor (1997) do not apply. This approach is called post-quantum cryptography and it has the advantages of being compatible with existing crypto infrastructure while having high key rates that are available over long distances. Recently, Google has performed a test deployment of a post-quantum crypto algorithm in Transport Layer Security (TLS)999security.googleblog.com/2016/07/experimenting-with-post-quantum. One drawback of post-quantum algorithms is that those conventional algorithms are only shown to be secure against known quantum attacks. There is always a possibility that some smart conventional or quantum physicist or computer scientist might one day come up with clever algorithms for breaking them efficiently. As said, this would lead to a retroactive security breach in future for data transmitted today with potentially disastrous consequences.

The second approach is to use quantum cryptography Bennett and Brassard (1984); Ekert (1991), particularly quantum key distribution (QKD). It has the advantage of promising information-theoretical security based on the fundamental laws of quantum physics, i.e., the security is independent of all future advances of algorithm or computational power.

Note however that quantum cryptography cannot replicate all the functionalities of public key cryptography. In future, quantum cryptography is likely to be combined with the post-quantum cryptography to form the infrastructure of quantum-safe encryption scheme. For instance, the post-quantum cryptography can be used to perform the initial authentication. This authentication is only required in a short time, and once it is done, the generated QKD key will be secure. Therefore, we believe that the two approaches—post-quantum cryptography and quantum cryptography—are complementary to each other (rather than mutually exclusive).

I.2 Quantum key distribution (QKD)

The main goal of QKD is to achieve information-theoretical security by harnessing the laws of physics Bennett and Brassard (1984); Ekert (1991). The quantum no-cloning theorem dictates that an unknown quantum state cannot be cloned reliably Wootters and Zurek (1982); D.Dieks (1982). If Alice distributes a key via quantum (e.g., single-photon) signals, because there is only a single copy of the key to begin with, there is no way for Eve to clone the quantum state reliably to produce two copies of the same quantum state. Therefore, if Eve tries to eavesdrop in QKD, she will unavoidably introduce disturbance to the quantum signals, which will then be detected by the users, Alice and Bob. Alice and Bob can then simply discard such a key101010Note that a key is simply a random string of numbers and if a key is aborted, it will not be used. So, there is no loss in security in aborting. and try the key distribution process again.

Note that an important advantage of QKD is that, since the communication is quantum, once a QKD session is over, there is no classical transcript for Eve to keep. Therefore, an eavesdropper has to break a QKD session real-time or it will be secure forever. This is very different from conventional key distribution schemes.

I.2.1 BB84 protocol

The best-known QKD scheme is the Bennett-Brassard-1984 (BB84) protocol Bennett and Brassard (1984). The BB84 protocol allows two users, Alice and Bob, who share a quantum channel (e.g., an optical fiber or free-space) and an authenticated conventional classical channel, to generate a secure key in the presence of an eavesdropper with unlimited quantum computing powers. In the BB84 protocol, a sequence of single photons carrying qubit states are sent by Alice to Bob through a quantum channel. A schematic diagram of the BB84 protocol is illustrated in Fig. 1, and the steps of the protocol are listed in Box I.2.1.

Box I.B.1: BB84 protocol.

(1) For each signal, Alice randomly encodes a single photon with one of the four polarization states, namely, vertical, horizontal, 45-degree and 135-degree, and sends the photon through a quantum channel to Bob.

(2) For each signal, Bob chooses one of the two bases, rectilinear and diagonal, to perform a measurement on the polarization of a received photon. After detection, Alice and Bob publicly announces their basis choices through an authenticated conventional channel.

(3) Alice and Bob discard the polarization data that have been encoded and detected in different bases. They keep only those polarization data in the same basis. This remaining data forms the sifted key. Alice and Bob can choose a random sample of the sifted key bits and compare them to compute the quantum bit error rate (QBER).

(4) If the computed QBER is too high, they abort. Otherwise, they proceed with classical postprocessing such as error correction and privacy amplification to generate a secret key.

I.2.2 Intuition of security

The quantum no-cloning theorem guarantees that Eve cannot copy the unknown quantum state sent by Alice reliably Wootters and Zurek (1982); D.Dieks (1982). Furthermore, a key feature in quantum mechanics is the complementarity between the two conjugate bases, rectilinear and diagonal. Since the two measurements corresponding to the two bases do not commute with each other, there is no way to measure the two observables simultaneously without disturbing the state. Therefore, Eve who tries to eavesdrop and extract information on the polarization data will inevitably introduce disturbance to the state. Bob on the other hand, with the authenticated classical channel, has a fundamental advantage over Eve because he can compare his basis choice with Alice and determine the QBER for data that is encoded and detected in the same basis.

What happens if Eve attacks the quantum channel? A simple example of an eavesdropping strategy is the intercept-resend attack Bennett and Brassard (1984). In this attack, for each photon sent from Alice, Eve performs a measurement in a randomly chosen basis and re-sends a new photon to Bob according to her measurement result. Let us focus on those cases when Alice and Bob happen to use the same basis since they will throw away the rest. If Eve happens to use the correct basis (50%), then both she and Bob will decode Alice’s bit value correctly. No error is introduced by Eve. On the other hand, if Eve uses the wrong basis (50%), then both she and Bob will have random measurement results. This suggests that if Alice and Bob compare a subset of the sifted key, they will see a significant amount of errors. Here, for these bits, the photons will be passed on to Bob in the wrong basis, so regardless of Eve’s measurement result, Bob will have a 50% probability of measuring the opposite of Alice’s bit value. In other words, Eve’s attack will introduce 50% QBER for half of the total bits, and thus a total of 25% QBER. This example illustrates the basic principle behind QKD: Eve can only gain information at the cost of introducing disturbance, which will expose her interference.

I.2.3 Overview of recent developments

Theoretical developments. On the theoretical side, the first security proof of QKD was based on the uncertainty principle by Mayers Mayers (2001). Mayers’s proof was put into a conceptually simple framework based on entanglement distillation by Lo and Chau Lo and Chau (1999), building on the earlier work of quantum privacy amplification Deutsch et al. (1996) and entanglement distillation Bennett et al. (1996). Later on, Shor and Preskill employed the idea of the Calderbank-Shor-Steane (CSS) quantum error correcting code Calderbank and Shor (1996); Steane (1996) to simplify the entanglement-based proof to a prepare-and-measure protocol Shor and Preskill (2000). See also Biham et al. (2000); Devetak and Winter (2005); Koashi (2009) for security proofs of QKD.

Rather interestingly, the rigorous definition of secure keys was presented afterwards in 2000s Ben-Or et al. (2005); Renner and König (2005), where the composable security definition in conventional cryptography Canetti (2001) was introduced to quantum cryptography Ben-Or et al. (2005). A further development was the security proof for the consideration of finite-key effects in a more rigorous manner Renner (2008); Scarani and Renner (2008); Tomamichel et al. (2012).

Device imperfections in practical systems were investigated in security analyses Lütkenhaus (2000); Inamori et al. (2007), and the remarkable framework of the security analysis for realistic devices was established by Gottesman-Lo-Lütkenhaus-Preskill (GLLP) Gottesman et al. (2004). Moreover, new protocols, such as the decoy-state Hwang (2003); Lo et al. (2005); Wang (2005), differential-phase shift (DPS) Inoue et al. (2002), SARG-04 Scarani et al. (2004), coherent-one-way (COW) Stucki et al. (2005), measurement-device-independent (MDI) Lo et al. (2012) [see also Braunstein and Pirandola (2012)] and round-robin DPS Sasaki et al. (2014), were proposed to address the issues of device imperfections. In particular, the decoy-state protocol enables secure QKD with weak coherent pulses and the MDI protocol removes all side channels in the detection. Furthermore, device-independent QKD was proposed Mayers and Yao (1998); Barrett et al. (2005); Acín et al. (2007) to allow QKD with uncharaterized devices. Its security was proven effective against collective attacks Pironio et al. (2009); Masanes et al. (2011) [see also Hänggi et al. (2010)] and later against general attacks Vazirani and Vidick (2014); Arnon-Friedman et al. (2018).

Experimental developments. After more than two decades of efforts Gisin et al. (2002); Lo et al. (2014), QKD developments include the first laboratory demonstration performed in 1992 over 32.5-cm free space Bennett et al. (1992a), to the recent landmark accomplishment of quantum satellite QKD experiment in 2017 over 1200 km by China Liao et al. (2017a), and 7600 km in 2018 between China and Austria Liao et al. (2018). Note that this is a seven order of magnitude of improvement in terms of the distance of QKD. There are also on-going efforts on satellite-based quantum communications by Europe, USA, Canada, Japan, and Singapore Joshi et al. (2018). In fiber, the distance has been pushed to 500-km ultra-low loss fiber Fang et al. (2019); Chen et al. (2019).

In addition to long distances, high secret key rate is important for practical applications. Researchers have recently pushed the secret key rate of QKD from 1 Mbits/s over 50-km fiber Lucamarini et al. (2013) to more than 10 Mbits/s Yuan et al. (2018); Islam et al. (2017). Commercial QKD systems are currently available on the market by several companies such as ID Quantique, Quantum CTek, Qasky and Toshiba Europe. Several institutes, e.g., European Telecommunications Standards Institute (ETSI), International Organization for Standardization (ISO), and International Telecommunication Union (ITU), have made great efforts to address the standardization issues in QKD.

Besides point-to-point link, a number of field-test QKD networks have been conducted in USA Elliott et al. (2005), Europe Peev et al. (2009); Stucki et al. (2011), Japan Sasaki et al. (2011), China Chen et al. (2009, 2010); Wang et al. (2010), UK Dynes et al. (2019) and so forth. Based on trustful relays111111In trusted-relay scenario, Alice and Bob respectively share a secret key with a relay in the middle, and then the relay announces the XOR results of both keys publicly. With the announced result, Alice and Bob can get each other’s key via the XOR with her/his own key. The negative side for this method is that the relay must be trustful. However, the positive side is reducing the cost and complexity as compared to the all-connected point-to-point links, and extending the transmission distance., remote users can be connected beyond point-to-point links. Recently, China has successfully completed the 2000-km-long fiber-optic backbone link between Beijing to Shanghai Chen et al. (2020). UK has launched the Quantum Communications Hub project that aims to build quantum networks in England121212www.quantumcommshub.net/about-us/. US is deploying their first dark fiber quantum network connecting Washington DC to Boston over 800-km131313techcrunch.com/2018/10/25/new-plans-aim-to-deploy-the-first-u-s-quantum-network-from-boston-to-washington-dc/.

Overall, QKD is already mature for several real-life applications Qiu (2014). For instance, QKD was used to encrypt security communications in the 2007 Swiss election and the 2010 World Cup. In China, QKD is being widely used to ensure long-term security for numerous users in government, financial and energy industry Chen et al. (2020), including the People’s Bank of China, the China Banking Regulatory Commission, and the Industrial and Commercial Bank of China. Figure 2 shows a schematic diagram of the space-ground integrated quantum network Chen et al. (2020), constructed already in China, which spans more than 2000 km coverage area and has more than 600 QKD links.

I.3 Focus of this review

In the Code Book by Simon Singh Singh (2000), the author boldly proclaimed that quantum cryptography achieves the Holy Grail of cryptography by offering unconditional security. Therefore, quantum cryptography presents the final stage of evolution of cryptography. After quantum cryptography, cryptography will no longer continue to evolve. Is this really true?

In principle, QKD promises unconditional security based on the laws of physics. In practice, however, the realistic devices display imperfections, which might seldom conform to idealized theoretical models used in the security analysis by theorists. The deviations might also be vulnerable by some special attacks, i.e., quantum hacking. For this reason, an arms race has been going on in quantum cryptography among quantum code-makers and quantum code-breakers. The main goal is to assess the deviations between the system and the ideal, thus establishing the practical security for real QKD systems.

Table 1 summarizes the quantum hacking strategies developed in the last two decades. See also Jain et al. (2016) for an earlier review on the subject. Right after the QKD security proofs, in which ideal devices were presented, a well-known hacking strategy was proposed — photon number splitting (PNS) attack Lütkenhaus (2000); Brassard et al. (2000) that targets practical QKD source. The source device imperfection severely undermines the performance of a QKD system, typically below 30-km fiber Lütkenhaus (2000); Gottesman et al. (2004); Ma (2006). In order to close this side channel for a QKD source, the decoy state method has been proposed by quantum code-makers to make QKD practical with standard weak coherent pulses (WCPs) that are generated by attenuated lasers Hwang (2003); Lo et al. (2005); Wang (2005). Decoy-state QKD presents dramatic performance improvement over the conventional security proofs Gottesman et al. (2004), and it has become a standard technique in current QKD experiments. Table 2 provides a list of decoy-state QKD experiments.

After the decoy-state method, however, various quantum hacking attacks have been performed by quantum code-breakers against other components in practical QKD systems (see Table 1). To counter those attacks, a few important concepts have been proposed by quantum code-makers. One practical counter-measure against quantum hacking is the measurement-device-independent quantum key distribution (MDI-QKD) Lo et al. (2012) [see also Braunstein and Pirandola (2012)]. MDI-QKD completely removes all security loopholes in the detection system and ensures a QKD network security with untrusted relays. It is practical with current technology. Table 3 summarizes the MDI-QKD experiments after its invention.

In addition, an efficient version of MDI-QKD — twin-field (TF) QKD — has the potential to greatly extend the secure distance. Table 4 summarizes the recent TF-QKD experiments. Also, we note some of the recent developments of continuous-variable (CV) QKD (see Table 5), chip-based QKD (see Table 6), and other QKD protocols and implementations (see Table 7). We also summarize a list of some developments of recent quantum cryptographic protocols, besides QKD (see Table 8).

Note that the side channels are common problems to any cryptosystems, i.e., not only to quantum cryptography but also to conventional cryptographic systems. For instance, the power consumption of the CPU performing encryption and decryption and the timing of the signals are common side channels, which can threaten implementations of both quantum and conventional cryptographic systems Kocher et al. (1999); Brumley and Boneh (2005). Therefore, closing the side channels are essentially required in all cryptographic technologies. It is only through painstaking battle-testing that the security of a practical crypto-system could be established with confidence. The arms race between code-makers and code-breakers will continue in cryptographic systems.

Nonetheless, QKD is a physics-based crypto system and its security is working on the physical layer. Compared to the conventional mathematical-based cryptography, QKD can provide an accurate description of the physical realization of a cryptographic system, and the security can be proved based on this description. More importantly, QKD has the fundamental advantage of promising information-theoretical security, which is independent of all future advances of computational power. Furthermore, the recent advances, such as MDI-QKD, have closed the critical side channels in the detection of physical implementations, paving the way for secure QKD with realistic devices. Therefore, we believe that QKD does represent an important chapter in the history of code-making. We hope that QKD will play an important role in the quantum-safe encryption infrastructure for real applications, and it will bring us one step closer to the dream of information-theoretical security.

I.4 Outline of this review

This review will focus mainly on the practical security of realistic QKD systems. We begin with a discussion of security analysis in Section II and the basic implementation of QKD in Section III. In Section IV, we review various quantum hacking attacks against QKD implementations. In Section V, we review the security of a practical QKD source. In particular, we focus on the decoy-state protocol which is a standard method for secure QKD with attenuated lasers. In Section VI, we turn to detector security. We primarily review the MDI-QKD protocol and how it automatically foils all attacks on the detection system. In Section VII, we review the developments of CV-QKD schemes and their practical security aspects. Section VIII contains a review of other quantum cryptographic protocols. In Section IX, we present some concluding remarks.

For those readers who want to learn further basics of QKD, we refer to the two earlier reviews published in Review of Modern Physics, one by Gisin et al. that introduces the basic experimental elements and systems Gisin et al. (2002) and the other one by Scarani et al. that discusses the basic security analysis tools of various QKD protocols Scarani et al. (2009). An early review on the first stage of development of QKD can be found in the book by Sergienko Sergienko (2018). An earlier review on quantum attacks can be seen in Jain et al. (2016). A brief overview of the implementation security of QKD can be found in a survey article in Lo et al. (2014) and an ETSI white paper141414https://www.etsi.org/images/files/ETSIWhitePapers/ by Lucamarini et al. A short overview of the practical challenges associated with QKD can be found in Diamanti et al. (2016). Moreover, the entropy uncertainty relation, an important tool to analyze the security of QKD, can be seen in Coles et al. (2017), and the quantum random number generator, a basic element in a practical QKD system, can be found in Ma et al. (2016b); Herrero-Collantes and Garcia-Escartin (2017). A review on various techniques of single-photon detectors can be seen in Hadfield (2009); Zhang et al. (2015). Furthermore, we may not cover too much on some important topics, but we refer the readers to other review articles on the topics of CV-QKD Weedbrook et al. (2012); Diamanti and Leverrier (2015); Laudenbach et al. (2018), high-dimensional QKD Xavier and Lima (2020), quantum repeaters Sangouard et al. (2011); Pan et al. (2012); Munro et al. (2015), quantum Internet Kimble (2008); Wehner et al. (2018), Bell nonlocality and device-independent protocols Brunner et al. (2014), and blind quantum computing Fitzsimons (2017). These related review articles are summarized in Table 9.

II Security analysis

We review the security aspects of QKD, including the security definition, various security proofs and implementation assumptions. We present a general framework to address device imperfections in security analysis. While we mainly focus on the widely implemented BB84 protocol, most of the results can be extended to other QKD protocols. We shall leave the MDI-QKD case in Section VI.2, and the DI-QKD case in Section VIII.1.

II.1 Security definition

To prove the security of QKD, one needs to define the security criteria first. Ideally, a secure key satisfies two requirements. First, the key bit strings possessed by Alice and Bob need to be identical, i.e., be correct. Second, the key bit string should be uniformly distributed to anyone (say Eve) other than Alice and Bob, i.e., be secret. Due to practical issues, such as the finite data size and non-ideal error correction, Alice and Bob cannot generate an ideal key. In reality, it is reasonable to allow the key to have a small failure probability $\epsilon$. For some $\epsilon_{\text{cor}}$ and $\epsilon_{\text{sec}}$, we say that the QKD protocol is $\epsilon$-secure with $\epsilon=\epsilon_{\text{cor}}+\epsilon_{\text{sec}}$, if it is $\epsilon_{\text{cor}}$-correct and $\epsilon_{\text{sec}}$-secret Ben-Or et al. (2005); Renner and König (2005).

We define $K_{A}$ and $K_{B}$ (with the same length $m$) to be the key bit strings obtained by Alice and Bob, respectively. The secret key can be correlated to a quantum state $\rho_{E}$ held by Eve. The joint state $\rho_{ABE}$ is a classical-classical-quantum (c-c-q) state,

[TABLE]

where $k_{A},k_{B}\in\{0,1\}^{m}$ are the bit values. In particular, an ideal key state held by Alice and Bob is described by the private state,

[TABLE]

where $k_{A}=k_{B}=k$ implies that Alice and Bob hold the same string, and $\rho_{E}$ is independent of $k$, i.e., Eve has no information on the key string variable $K$.

A QKD protocol is defined to be $\epsilon_{\text{cor}}$-correct, if the probability distribution $Pr(k_{A},k_{B})$ of the final state $\rho_{ABE}$ in Eq. (1) satisfies,

[TABLE]

A QKD protocol is defined to be $\epsilon_{sec}$-secret Renner and König (2005), if the state $\rho_{AE}$ is close in trace distance to the single-party private state $\rho_{AE}^{ideal}$

[TABLE]

where $p_{\text{abort}}$ is the probability that the protocol aborts, $\rho_{AE}^{ideal}\equiv 2^{-m}\sum_{s}\ket{s}_{A}\bra{s}\otimes\rho_{E}$, and $||A||_{1}\equiv Tr[\sqrt{A^{\dagger}A}]$ is the trace norm. It turns out that the security definition from the trace-distance metric owns a composable security property Ben-Or et al. (2005); Renner and König (2005).

In general, following the definition from Ben-Or et al.’s work Ben-Or et al. (2005), a QKD protocol can be defined to be $\epsilon$-secure, if the final distilled c-c-q state $\rho_{ABE}$ is $\epsilon$-close to the ideal key state $\rho_{ABE}^{ideal}$ given in Eq. (2) with a proper chosen $\rho_{E}$

[TABLE]

Note that if a distilled state is $\epsilon$-close to the ideal key state, then the guessing probability for Eve on the final key is also bounded by $\epsilon$. Here, we want to emphasize that one should not interpret the security parameter $\epsilon$ used in the above definition as the guessing probability. In fact, the statement, a key is $\epsilon$-close to the ideal key, is much stronger than the statement, Eve’s guessing probability on a key is bounded by $\epsilon$. Let us show a simple example. Denote $l=-\log\epsilon$ and $l<m$. We consider an $m$-bit key $K_{bad}$, which concatenates a uniformly distributed $l$-bit string with $m-l$ bit of 0’s. Obviously, this key $K_{bad}$ does not satisfy the trance-distance (statistical distance in this case since everything is classical here) $\epsilon$-security definition used in Eq. (5), because the statistical distance between $K_{bad}$ and $K_{ideal}$ is close to 1 when $m\gg l$. However, the guessing probability of Eve on the key $K_{bad}$ is bounded by $\epsilon$. Clearly, the guessing probability alone is not a proper security parameter definition. This is a common mistake for those who are confused about the security foundation of (quantum) cryptography, see for example Yuen (2016). This common mistake has also been pointed out and clearly explained by Renner in Renner (2012).

II.2 Security proofs

II.2.1 Lo-Chau security proof

In the Lo-Chau security proof Lo and Chau (1999), the joint quantum state shared by Alice and Bob before the final key measurement is one of the Bell states,

[TABLE]

To see how security of QKD is related to entanglement, consider the case where Alice and Bob share $m$-pairs of perfect EPR pairs $\ket{\Phi^{+}}^{\otimes m}$. It is not hard to verify that if both of them perform the local $Z$ measurement, $M_{zz}$, on their halves of $m$ pairs, they will share the ideal key state $\rho_{ABE}^{ideal}$ in Eq. (2). In other words, the amount of distillable entanglement from quantum transmission would give a lower bound on the key generation rate.

The main job for a security analysis is to make sure that Alice and Bob eventually share (almost perfect) EPR pairs before they make the final $ZZ$ measurement to obtain secure key bits. The procedure to extract perfect EPR pairs from imperfect ones is called entanglement distillation Bennett et al. (1996). The main idea of the Lo-Chau security proof lies on quantum error correction Lo and Chau (1999), which proved the security of an entanglement-based QKD protocol. Let us recap the Bennett-Brassard-Mermin-1992 (BBM92) Bennett et al. (1992c) protocol, an entanglement version of BB84 in Box II.2.1. For the simplicity of description, we assume Alice and Bob own quantum memories, which will be removed shortly in the Shor-Preskill security proof Shor and Preskill (2000).

Box II.B.1: BBM92 protocol with quantum memories, an entanglement version of BB84.

(1) Alice prepares an EPR pair, $\ket{\Phi^{+}}$, stores one half of it locally, and sends the other half to Bob.

(2) Upon receiving a qubit, Bob stores the half of the EPR pair in a quantum memory. If the qubit is lost in the channel or the quantum storage fails, they discard the pair.

(3) Repeat the above two steps many times until Alice and Bob store $N$ pairs of qubits.

(4) With the help of pre-shared perfect EPR pairs, Alice and Bob apply a quantum error correcting code to correct all the errors in the $N$ pairs.

(5) After a random hashing test, Alice and Bob share almost perfect EPR pairs. They return the cost of pairs in the previous step and measure the rest in the local $Z$ basis to obtain the final key.

The (quantum) random hashing test happens in the two conjugate bases separately. In each basis, Alice and Bob can compare the parities of the qubits. Comparison of each parity will cost Alice and Bob an EPR pair. Once they agree on an enough number of parities, the states are stabilized by the operations, $X\otimes X$ and $Z\otimes Z$, with a small failure probability. This step comes from the error verification in classical error correction Fung et al. (2010). There are a few notes on this scheme.

This scheme is source-device-independent, which means that the source can be fully untrusted Koashi and Preskill (2003). In the first step, the state preparation can be done by Eve. Then, Eve prepares qubits pairs (designed to be EPR pairs) and sends to Alice and Bob who store the quantum states in memories. The rest steps, 4 and 5, are the same. 2. 2.

After quantum transmission, Alice and Bob share $N$ EPR pairs. Due to channel disturbance or Eve’s interference, these $N$ EPR pairs are generally imperfect and might be entangled with each other and Eve’s system. Here, we consider the most general coherent attacks. 3. 3.

In a security proof, it is crucial to evaluate the number of EPR pairs cost in Step 4.

When Alice and Bob both measure in the local $Z$ basis, an error occurs when the outcomes are different. We call it a bit error. Similarly, when they both measure in the $X$ basis, a phase error occurs when the outcomes are different. Denote the bit and phase error rates to be $e_{b}$ and $e_{p}$, respectively,

[TABLE]

Since we are considering the most general coherent attacks, the errors are in general not independent but correlated. Note that bit and phase errors can be defined in any two complementary bases in the qubit case. For quantum signals measured in a particular basis, where the bit error is defined, the phase error denotes the hypothetical error if these signals were measured in its complementary basis. For higher dimension cases, such definitions would be slightly trickier with more than one types of phase errors.

In order to distill perfect EPR pairs from imperfect ones with errors defined in Eq. (7), Alice and Bob can employ quantum error correction. Entanglement distillation can be done in two steps via bit and phase error correction. In bit error correction, Alice hashes her qubits in the $Z$ basis by applying Control-NOT (C-NOT) to ancillary perfect EPR pairs, as shown in Fig. 3. Alice sends the measurement results of ancillary qubits to Bob, which serves as error syndrome in error correction. In the infinite data size limit, the number of perfect EPR pairs cost in this procedure is given by the Shannon entropy, $NH(e_{b})$. By applying Hadamard gates, one can switch between bit and phase spaces. Then, similarly, the phase error correction will cost additional $NH(e_{p})$ EPR pairs.

Finally, the net rate of EPR pairs generated is given by,

[TABLE]

where $H(e)=-e\log e-(1-e)\log(1-e)$ is the binary Shannon entropy function. Note that this formula is not tight in general. If two-way classical communication is allowed in quantum error correction, more key can be distilled Gottesman and Lo (2003); Chau (2002).

In reality, when the data size is finite, the entanglement distillation might fail with a small failure probability, which can be understood as the failure probability of quantum error correction. In original security proofs Lo and Chau (1999); Shor and Preskill (2000); Koashi (2009), the fidelity between the key state $\rho_{ABE}$ to the ideal state $\rho_{ABE}^{ideal}$ is often used as an intermediate measure to finally bound the mutual information between the final key and Eve’s system. In fact, this definition is not composable. In order to make the security parameter composable Ben-Or et al. (2005); Renner and König (2005), one can apply the connections between fidelity and trace distance using a general inequality relating them [see Section III in Fung et al. (2010)].

II.2.2 Shor-Preskill: reduction to prepare-and-measure schemes

In general, this quantum error correction based entanglement distillation procedure, which is the essence of the Lo-Chau security proof, requires quantum memories and quantum computers. However, these quantum memories and quantum computers are not available with the current technology Lo and Chau (1999). In order to remove this quantum memory or quantum computer requirement, one can move the final measurement ahead of the two error correction steps. The bit error correction becomes classical error correction, and the phase error correction becomes privacy amplification Shor and Preskill (2000). There are a few steps for this permutation of operations to work.

Quantum bit and phase error correction operations commute, as shown in Fig. 3. This is due the fact that Alice and Bob use EPR pairs as ancillary qubits. 2. 2.

The $Z$-basis measurement on the ancillary EPR qubits commutes with all the operations for error correction. This is straightforward to see since there are only two possible operations on ancillary qubits, $I$ and $X$ (from C-NOT), both of which commute with the $Z$ measurement. 3. 3.

The $Z$-basis measurement on the Alice and Bob qubits commutes with the bit error correction. This is true since the $Z\otimes Z$ measurement commutes with C-NOT. After moving the $Z$ measurement ahead, the C-NOT operation becomes regular exclusive-OR ($XOR$) on the two outcome bits. 4. 4.

The $Z$-basis measurement on the Alice and Bob qubits commutes with the phase error correction. This relies on the usage of EPR pair ancillary states. 5. 5.

In phase error correction, after locating the errors, phase error correction does not affect the values of final key measurement in the $Z$ basis. Thus, no “correction” operation is needed. Of course, the EPR pairs are still cost in this step. 6. 6.

Then, all the quantum operations become classical bit operations, essentially, hashing. 7. 7.

In order to perform privacy amplification, one still needs to estimate the phase error rate $e_{p}$. Now, let us focus on the case that the key bits are measured in the $Z$ basis. The phase error rate can be estimated by measuring the key bits in the $X$ basis. Of course, in order for this estimation to work, one needs to make sure the sampling is fair, which raises the critical assumptions in security proof discussed in Section II.3.

After considering the permutation of quantum error correction and measurement, Alice and Bob can directly measure the EPR pairs once they receive them. Suppose Alice prepares the original EPR pairs, measures halves of the pairs, and sends the rest halves to Bob. Conditioned on Alice’s measurement outcomes, the states sent from Alice to Bob are pure. It is equivalent for Alice to prepare these states directly and send to Bob. Now, the entanglement-based protocol is reduced to a prepare-and-measure one.

Reduction from quantum bit error correction to classical error correction is easy to understand. Let us take Fig. 3 for example. Alice and Bob need to compare the ancillary qubit measurement results. Since the final $Z\otimes Z$ measurement commute with C-NOT operation, one can measure all the qubits in the $Z$ basis first and $XOR$ the bit values of all the measurement outcomes of the control qubits to the target qubits. The CNOT links shown in Fig. 3 can be understood as a hashing matrix, meaning it is equivalent to construct a matrix and multiply with the raw bit string. Of course, such error correction is linear. In general, any error correcting code can be applied, once bit and phase error correction can be decoupled.

Reduction from quantum phase error correction to privacy amplification is trickier. In general, after Hadamard gates, C-NOT operation does not commute $Z$ measurement any more. In fact, those two operations become anti-commute. In this case, Alice and Bob can design phase error correcting code such that it commutes with the $Z$ measurement. Again, let us take the linear code as an example. Certain number of parity bits need to be exchanged for error correction. Assuming universal hashing, Alice sends $NH(e_{p})$ bits to Bob and Bob corrects the phase errors. Note that final key measurement must commute with this hashing. Then, they can use the null space of the hashing matrix as for the final key space. The equivalence between the phase error correction and privacy amplification is illustrated in Fig. 4. This can also be understood as a random number extraction. Alice and Bob use phase error rate to estimate the randomness in the key and apply universal hashing to extract out true randomness.

In quantum error correction, we assume Alice and Bob to use ancillary EPR pairs. As shown in Fig. 3, with EPR pairs, bit and phase error correction operations commute with each other. That is, one can decouple these two error correction steps Lo (2003). In the Shor-Preskill security proof Shor and Preskill (2000), no ancillary EPR pairs are employed. Instead, the CSS quantum error correcting code Calderbank and Shor (1996); Steane (1996) is used to decouple these two steps.

After the reduction to prepare-and-measure schemes, the data postprocessing can be divided into two steps: error correction and privacy amplification. Error correction is a step to reconciliate Alice’s and Bob’s sifted key. If we allow one-way key reconciliation, the cost in this step is $H(A|B)$, where $A$ and $B$ represent the random variables of Alice’s and Bob’s sifted key, respectively. In a symmetric channel, where the detected numbers of bits 0’s and 1’s are the same, the cost per bit is given by $H(e_{b})$ as shown in Eq. (8). It turns out that the cost can be reduced if we allow two-way key reconciliation. The optimal key rate is an open question even in the classical key agreement case Maurer and Wolf (1999).

Privacy amplification is a procedure for Alice and Bob to distill a common private key from a raw key about which Eve might have partial information Bennett et al. (1995). The concept of privacy amplification is closely related to the randomness extraction problem De et al. (2012); Ma et al. (2013a). The difference is that in privacy amplification local randomness is a free resource, which in randomness extraction any randomness is valuable. Note that initially, the classical treatment on privacy amplification Bennett et al. (1995) is only applicable to QKD under restrictive assumptions, i.e., the adversary has no quantum memory. Later on, however, this treatment has been generalized to the case where the adversary has quantum memory Renner (2008). Details of data postprocessing, which distills a secure key from the raw data measured in quantum transmission (see Fig. 6), are presented in Section III.5.

In the end, Eq. (8) gives the key rate of the BB84 protocol. Considering the symmetric case where the bit and phase error rates are the same, it is not hard to see that the tolerable error rate of Eq. (8) is 11%, comparing to 7% in the Mayers’s proof Mayers (2001). Similar to the entanglement distillation case, this formula is not tight. With two-way classical communication, one can achieve advantage distillation Gottesman and Lo (2003) using bit-flip error detection. Nonetheless, phase error detection remains forbidden in the absence of quantum computers. From the QKD postprocessing point of view, the bit and phase errors might be correlated. Alice and Bob can perform some preprocessing to reduce the total amount of key cost in error correction and privacy amplification. For example, they can group bits into pairs and compare parities and discard the ones with different parities. In this way, one can reduce the errors in remaining bits. This is called B step Gottesman and Lo (2003). It terms out that, such prepossessing is useful in practical QKD processing Ma et al. (2006). With two-way classical communication, one can also increase the tolerable error rates Gottesman and Lo (2003); Chau (2002). Also, with the six-state protocol Bruß (1998); Lo (2001), it has been shown that the tolerable error rate is higher. We list all the tolerable error rates in Table 10. Apparently, there are gaps between the lower (tolerable) and upper error rate bounds. This is an open question in QKD as well as in entanglement distillation for many years, which is also related to key agreement problem in classical communication case Maurer and Wolf (1999).

II.2.3 Koashi’s complementarity approach

The aforementioned security analyses by Lo-Chau and Shor-Presill based on quantum error correction complication certainly enjoy the strong intuition from entanglement to privacy. In fact, it turns out that entanglement (or a quantum channel that is capable of transmitting entangled state) is a precondition for secure QKD Curty et al. (2004). The main drawback of this approach is its complication of introducing a virtual entanglement-based protocol. Although the bit and phase error correction can be decoupled in postprocessing by employing the CSS quantum error correcting code Shor and Preskill (2000) or ancillary EPR pairs Lo (2003), these two steps always mix together in security proofs. Sometimes, constructing a virtual entanglement protocol could be highly nontrivial Tamaki et al. (2003); Tamaki and Lütkenhaus (2004); Fung et al. (2009). Error correction and privacy amplification are very different procedures in conventional cryptography. The former is to guarantee that Alice and Bob share an identical key, while the latter is to make sure they share a private key. One key observation is that error correction step is not directly related to quantum laws in the security analysis. That is, if Alice and Bob only want to share an identical key, they can just transmit classical states to do the job. From this observation, Koashi has developed a simplified security proof framework based on complementarity Koashi (2009).

In Koashi’s approach, error correction and privacy amplification are decoupled from the beginning. Alice and Bob perform error correction first to make sure that the two bit strings are the same. Now, the problem becomes how many private key bits can be distilled from Alice’s (same as Bob’s) error corrected key. In this case we only need to deal with two parties, Alice and Eve. Denote the length of Alice’s key string to be $N$. Alice’s $N$-bit string can be regarded as the $Z$-basis measurement outcome of $N$ qubits $\rho_{A}\in\mathcal{H}_{2^{N}}$. Note that, under the most general coherent attacks, these $N$ qubits are correlated (or even entangled) with each other. The key idea is that in a virtual protocol, if each qubit of $\rho_{A}$ is measured in the complementary $X$-basis measurement and only $+1$ results are obtained, then $\rho_{A}=\ket{+}^{N}$, where $\ket{+}$ is the eigenstate of $X$ with the eigenvalue $+1$. In this ideal scenario, no one (including Eve) can predict Alice’s key bits without accessing the measurement results directly. Like EPR pairs discussed in the Lo-Chau security proof, this ideal case will render perfect privacy. Interestingly, this unpredictability on the (computational) $Z$-basis is quantified by the coherence measure in the resource theory Yuan et al. (2015), which is recently connected to the security of QKD Ma et al. (2019).

In general, $\rho_{A}$ is not a product of $\ket{+}$ states. In this framework, the phase error rate $e_{p}$ is defined as the ratio of getting $-1$ eigenstates of the complementary $X$-basis measurement on $\rho_{A}$. The parameter $e_{p}$ can be estimated differently in different QKD protocols. For instance, in BB84, essentially Alice randomly chooses some qubits to be measured in the $X$-basis and use random sampling to estimate $e_{p}$. Details of random sampling for parameter estimation will be discussed in Section III.5. Now, Alice can perform a virtual phase error correction on her $N$ qubits by the similar means discussed in the Lo-Chau phase error correction. Alice can hash the $X$-basis measurement outcomes and find the error syndrome. After phase error correction, Alice’s state becomes close to $\ket{+}^{N}$, again, measured by fidelity or trace distance.

The key difference between Lo-Chau and Koashi security proofs lies on the definition of the phase error rate $e_{p}$. In Lo-Chau security proof, $e_{p}$ is defined on Bob’s system relative to Alice’s, while in Koashi’s, it is defined on Alice’s (or Bob’s) side locally depending on protocols and Bob (Alice) can have an arbitrary system (irrelevant for security). In Koashi’s approach, the complementary basis can be chosen arbitrary as long as $e_{p}$ can be estimated accurately. Meanwhile, along the line of complementarity approach, security proofs based on entropic uncertainty relations Coles et al. (2017) have been developed Koashi (2006); Berta et al. (2010).

In summary, the Lo-Chau, Shor-Preskill and Koashi security proofs are all based on the phase error correction. Note that, in this line of approach, the estimation of $e_{p}$ is the core of the security analysis. Sometimes, more sophisticated tools like semi-definite programming is employed to upper bound the phase error rate Wang et al. (2019c). Recently, there is an effort to make a connection between Shor-Preskill’s type security proof Shor and Preskill (2000); Koashi (2009) and Entropic approach Renner (2008) by Tsurumaru Tsurumaru (2018).

So far, the security proof we reviewed here focuses on the BB84 protocol. Obviously, the security proof based on phase error correction can be extended to other protocols, like Bennett-1992 (B92) Bennett (1992); Tamaki et al. (2003) and six-state protocols Bruß (1998); Lo (2001). Meanwhile, this technique can also be employed to general qudit systems Chau (2005). Note that there is also security proof based on the idea of twisted states Horodecki et al. (2008, 2008). Intuitively twisted states include shields. It allows the phase error correction syndrome to be hidden in the shield and thus become unaccessible to Eve. In principle, a virtual conceptual measurement on the joint state of Alice and Bob’s shield will allow them to extract the missing phase error correction syndrome to complete the quantum error correction process. In practice, Alice and Bob do not need to perform such a virtual measurement.

II.2.4 Entropic approach

There is another line of security analysis Renner (2008); Renner et al. (2005); Scarani and Renner (2008); Tomamichel et al. (2012); Coles et al. (2017) that originates from the communication complexity and quantum memory approach Ben-Or (2002); Renner (2008). Based on the entanglement distillation idea, a framework has been established for a general $\rho_{AB}$ by Devetak and Winter Devetak and Winter (2005). In this quantum-entropy based framework, Alice and Bob share many i.i.d. copies of $\rho_{AB}$, on which they perform measurements to obtain key bits. The Devetak-Winter key rate formula is given by

[TABLE]

where $S(A|E)$ is conditional quantum entropy, $S(A)=-\Tr(\rho_{A}\log\rho_{A})$ is the von Neumann entropy. In the derivation, we assume the worst case scenario where $\rho_{ABE}$ is pure. In fact, the privacy amplification term can also be written in a relative entropy form Coles et al. (2016),

[TABLE]

where $\Delta_{z}(\rho_{AB})=\sum_{i}\outerproduct{i}{i}_{A}\rho_{AB}\outerproduct{i}{i}_{A}$ is the partial dephasing operation on system A in the $Z$ basis and the relative entropy function $D(\rho||\sigma)=\Tr\rho\log\rho-\Tr\rho\log\sigma$. This allows us to give an operational interpretation of coherence in QKD Ma et al. (2019).

The density matrix information $\rho_{AB}$ is unknown to Alice and Bob due to Eve’s interference. They have to monitor $\rho_{AB}$ in real time, say via tomography. Thus, the Devetak-Winter analysis is normally applied to the i.i.d. case, where Eve interferes all rounds of QKD identically and independently, i.e., collective attack Renner (2008); Scarani and Renner (2008). Nonetheless, the security analysis can be extended to the case of coherent attack by further analysis Tomamichel et al. (2012); Coles et al. (2017), such as the de Finetti theorem Renner (2007), the post-selection technique Christandl et al. (2009) and uncertainty relation for smooth entropies Tomamichel and Renner (2011). Another advantage of this approach is that the security of a complicated QKD scheme can be analyzed numerically Coles et al. (2016); Winick et al. (2018).

II.3 Security assumptions

We will discuss the security assumptions made in general security proofs. We focus on the BB84 protocol, but most of the discussions can be applied to other protocols, such as B92, BBM92, and the six-state protocols. In security proofs Lo and Chau (1999); Shor and Preskill (2000); Koashi (2009), as shown in Section II.2, we assume Alice sends ideal qubit states in $\{\ket{0},\ket{1},\ket{+},\ket{-}\}$ and Bob performs ideal qubit $Z$-basis and $X$-basis measurement. The channel, on the other hand, is assumed to be under a full control of Eve.

Nevertheless, in actual experiments these assumptions can be problematic. Table 11 summarizes the main differences between the security assumptions of security proofs and typical experimental setups. These differences, if unnoticed, might essentially open the security issue of basis dependency between $Z$-basis and $X$-basis, thus causing the problem of quantum hacking attacks (see Table 1).

II.3.1 Source

First, let us relax the requirement on source by considering a more general source. In a prepare-and-measure QKD protocol, Alice randomly prepares system $B$ on one of the four states, $\{\rho_{x0},\rho_{x1},\rho_{z0},\rho_{z1}\}$, and sends it to Bob. These four states can be denoted as $\rho_{\beta\kappa}$, where $\beta\in\{X,Z\}$ represents the encoding basis, and $\kappa\in\{0,1\}$ represents the encoding key bit. Here, we consider four states with two bases, but such scenario can be easily extended to more general cases with an arbitrary number of states and bases.

The prepare-and-measure protocol can be linked to the entanglement-based one as follows. Define the purification of state $\rho_{\beta\kappa}$ as $\ket{\psi_{\beta\kappa}}_{A_{0}B}$, where system $A_{0}$ is an ancillary system. From an entanglement-based view of protocol, Alice sends out state $\rho_{\beta\kappa}$ is equivalent to her preparing

[TABLE]

then measuring system $A$ in the $\beta$-basis, and sending out system $B$ according to measurement result $\kappa$. Here, system $A$ is a qubit system, $\ket{\beta_{\kappa}}_{A}$ is the $\beta$-basis eigenstate whose eigenvalue is $\kappa$. For the ideal BB84 protocol, there is no ancillary system $A_{0}$ (or $A_{0}$ is just a detached trivial system), since all encoding states $\rho_{\beta\kappa}$ are pure. Then, the states sent by Alice are,

[TABLE]

the four BB84 states.

To send out $\rho_{x\kappa}$, in the entanglement-based equivalent protocol, Alice prepares $\ket{\Phi^{+}}_{AB}=\dfrac{1}{\sqrt{2}}(\ket{++}+\ket{--})_{AB}$, measures system $A$ on the $X$ basis, and obtains the measurement result $\kappa$. Similarly, to send out $\rho_{z\kappa}$, Alice first prepares $\ket{\Phi^{+}}_{AB}=\dfrac{1}{\sqrt{2}}(\ket{00}+\ket{11})_{AB}$, measures $A$ on the $Z$ basis, and obtains the measurement result $\kappa$. No matter which basis Alice wants to send, the initial entangled states prepared are the same. Let us denote the $X$-basis state and $Z$-basis state are

[TABLE]

which are the quantum state transmitted given Alice and Bob choose the $X$ and $Z$ bases, respectively. Thus, in the ideal BB84 source case, the state sent out by Alice is independent of the basis choice,

[TABLE]

We call this kind of source basis-independent Koashi and Preskill (2003); Ma et al. (2007).

In the original proposal of the BB84 protocol, the basis choice is assumed to be unknown to Eve. This is also a crucial assumption in security proofs Lo and Chau (1999); Shor and Preskill (2000), as shown in Section II.2. This is important for phase error estimation. If the source is basis-dependent, one cannot simply use one basis information to estimate the other. This is guaranteed by Eq. (14). In fact, as long as the source is basis-independent, it can be in arbitrary dimension or state. It can even be assumed to be under the control of Eve.

In practice, it is hard to construct single-qubit sources. Instead, entangled photon sources are widely used as a basis-independent source. Notice that, for entangled photon sources to work as a basis-independent source, the measurement for heralding has to be basis-independent. Later in Section II.4.1, we will show that the security can be guaranteed once the source contains a certain amount of basis-independent components.

In some QKD schemes, such as BBM92 Bennett et al. (1992c), Alice and Bob choose basis after the quantum signals transmitted through the channel. In BBM92 protocol, Alice prepares an entangled source, holds one part by herself and sends another to Bob. Alice measures her own part in some basis to realize the basis choice and encoding. In these schemes, the quantum source can even be assumed to be in the possession of Eve. Then for these schemes, Eq. (14) can be guaranteed by the experimental setting.

II.3.2 Measurement

The requirement on measurement is very similar. Again, take the BB84 protocol as an example. There are four measurement outcomes labeled by two bits, $\beta,\kappa$. The corresponding four POVM elements are $M_{\beta\kappa}$,

[TABLE]

Here, $\{M_{x0}$, $M_{x1}\}$ form the $X$-basis measurement, while $\{M_{z0},M_{z1}\}$ form the $Z$-basis measurement. We also require the measurement to be basis-independent,

[TABLE]

On the measurement side, the requirement is more strict. For the security proof presented in Section II.2, it must be qubit measurements in the $X$ and $Z$ bases. Such requirement can be extended to more general projection measurements.

In practice, a squashing model is widely employed Gottesman et al. (2004); Beaudry et al. (2008); Fung et al. (2011). In a squashing model, an arbitrary quantum state (from the channel) is projected to a qubit or vacuum. Then the $X$ or $Z$ measurement is performed. It has been proved that a typical threshold detector model adapts to the squashing model Beaudry et al. (2008); Tsurumaru and Tamaki (2008).

Now, one can see that the assumptions on the source and measurement are quite different. For source, one only needs to guarantee its basis-independent property in Eq. (14). On measurement, it must be specific projection measurements. In practice, the source requirement is easier to meet comparing to the measurement requirement. Hence, there are more practical security issues on measurement than on source. A full security analysis needs to take account of these measurement deviations. We present it in Section II.4.1. This problem is finally resolved by MDI-QKD (see Section VI.2).

II.3.3 Channel

In security proofs, the channel is assumed to be under the full control of Eve. Thus, in principle, we do not put any requirement on channel. In fact, if any implementation deviation from the ideal QKD protocol can be put into the channel, it will not cause any security problems. For example, detectors normally have a finite efficiency. The loss caused by detectors can be moved to channel. Then, a detector can be replaced by a 100% efficiency one in security analysis.

Now, the question is what kind of implementation deviations can be moved to channel. The implementation deviation can be regarded as some deviation operation acting on an ideal implementation. The key requirement is that the deviation operation must commute with basis switch operation. Alice and Bob each uses a basis switching device (say, a phase modulator in phase-encoding schemes). The channel is defined as the operation on the quantum signals in between the two basis switching devices.

II.4 Practical security analysis

In practice, there are two issues that need to be addressed: device imperfection and statistical fluctuation. In Section II.3, we review the assumptions in the security proofs. In reality, these assumptions might be fully satisfied. Implementation devices might be (slightly) deviated from the ideal case used in the security proofs. When the deviation is small enough, we expect that a secure key can still be generated. In Section II.4.1, we review the quantification of device imperfections and its effects on the security analysis.

In principle, the error rates defined in Eq. (7) cannot be obtained accurately since they are measured in complementary bases. In the security proofs reviewed in Section II.2, we employ random sampling to estimate the error rates. When the data size goes to infinite, the error rates approach error probabilities, which can be estimated accurately. In a finite data size, such parameter estimation would render a finite confidence interval. In Section II.4.2, we review the parameter estimation with random sampling by calculating the failure probabilities and parameter bounds.

In Section III.5, we review the classical postprocessing of QKD and explain how can Alice and Bob distill secure keys in the raw bit strings from quantum measurement to final secure keys, with the help of public discussions. Note that some of the discussions need to be encrypted and/or authenticated.

II.4.1 GLLP

There exist deviations between realistic QKD systems and the ideal QKD protocol. In order to achieve practical security of a QKD system, Alice and Bob need to characterize these device deviations or imperfections carefully and take them into account in the security analysis. Based on previous works on the topics Lütkenhaus (2000); Inamori et al. (2007), Gottesman, Lo, Lütkenhaus, and Preskill (GLLP) established a general framework for security analysis with realistic devices Gottesman et al. (2004).

First, Alice and Bob need to characterize their devices to see how much deviation from the ideal ones used in the security proofs. One can employ typical distance measures, like fidelity and trace distance, to quantify the deviation. In principle, Alice and Bob can perform some virtual measurement on the devices for each run in realtime to see whether it works the same as the “ideal device" or its “orthogonal case". Then, they can tag the sifted key bit as “good" if the virtual measurement projects to the ideal case, and tag “bad" if it is “orthogonal case". Of course, in reality, Alice and Bob do not know the virtual measurement result. Instead, they know the ratio of these two cases. Both source and measurement imperfections can fit into this scenario. The GLLP security analysis essentially tells us how to extract secure bits when the good bits are mixed with bad ones. So far, the discussion is rather abstract, in the following discussions, we take the source imperfection as an example.

The framework is generic. Here, let us take the BB84 protocol for example. In reality, a weak coherent state photon source is widely used as an approximate single photon source. With phase randomization, one can treat it as a mixture of Fock states Lo et al. (2005). The vacuum and single-photon components are basis-independent, whereas the multiphoton components are not. In principle, Alice can measure the photon number to tag each encoded state being basis-independent or not (this is the aforementioned virtual measurement part). Denote the ratio of Bob’s detected bits from the basis-independent source (good part, e.g. vacuum and single-photon component in the BB84 protocol) to be $1-\Delta$, and the rest (bad parte.g., multiphoton components in the BB84 protocol) is $\Delta$. Details of the source model and its security analysis will be presented in Section III.2.

With Alice’s tagging information (photon number in this example), she can sort the sifted key bit string $k_{A}$ into two sub-strings, $k_{good}$ and $k_{bad}$, where

[TABLE]

Following the phase error correction security proof, the underlying phase error rate of $k_{good}$ is $e_{p}$, which can be estimated accurately via complement measurements. The phase error rate of $k_{bad}$ is unknown. In the worst case scenario, the phase error rate of the string $k_{bad}$ could be as high as 1/2. The main idea of the GLLP security analysis is that if Alice and Bob employ linear privacy amplification, such as the matrix hashing introduced in Section III.5, they can still distill secure keys from $k_{good}$ by accessing $k_{A}$ only.

Denote $k_{good}^{\prime}$ to be the bit string if Alice modifies the sifted key bit string by setting the bad bit positions to be 0. Similarly, denote $k_{bad}^{\prime}$ to be the bit string if Alice sets the good bit positions to be 0. Then,

[TABLE]

Suppose a hashing matrix $T$ can distill secure bits from $k_{good}$. That is, $Tk_{good}$ is a secure key. Then, it is not hard to show that $T^{\prime}k_{good}^{\prime}$ results in the same secure key if one extends the matrix $T$ to $T^{\prime}$ by inserting new columns corresponding to the bad positions of $k_{good}^{\prime}$. That is, $T$ is a sub-matrix of $T^{\prime}$ by taking certain column vectors. Here comes the clever trick of GLLP: since $T^{\prime}k_{good}^{\prime}$ is private, the $XOR$ result

[TABLE]

is also private even Eve knows everything about $T^{\prime}k_{bad}^{\prime}$. Note that the new added columns from $T$ to $T^{\prime}$ can be arbitrary. In practice, Alice can just pick up a universal hashing matrix $T^{\prime}$ to do privacy amplification and its sub-matrix $T$ will automatically a smaller-size universal hashing matrix.

Therefore, the secure key rate formula of GLLP is given by

[TABLE]

where $E$ is the total QBER. This key rate formula can be viewed as an extension to Eq. (8). Furthermore, we do not need to restrict ourselves to two tags case, good and bad. In principle, Alice and Bob can label sifted key bits with an arbitrary dimensional tag $g$ and for each $g$ they can derive its corresponding phase error rate $e_{p}^{g}$. With the same argument as above, we can extended the GLLP formula Ma (2008),

[TABLE]

where $q_{g}$ is the ratio of sifted key bits with the tag $g$ and $\sum_{g}q_{g}=1$. Here, we assume Alice and Bob cannot access the tag $g$ in reality and hence they have to do the error correction part for all bits together. If they can really read out tags for each run, they can divide this error correction part as well.

II.4.2 Random sampling and finite-data size

The infinite data size limit ($N\rightarrow\infty$) is used for the key-rate formula Eq. (8) and (21). When the data size is finite, the phase error rate, $e_{p}$, used for evaluate the amount of privacy amplification cannot be measured accurately. Instead, Alice and Bob can bound $e_{p}$ via certain complementary measurements.

In the BB84 protocol, the phase error probability in the $Z$-basis is the same as the bit error probability in the $X$-basis. In the following discussions, we assume Alice and Bob obtained the sifted key in the $Z$-basis measurement and want to estimate the underlying phase error rate $e_{p}$. Thus, by sampling the qubits in the $X$-basis, Alice and Bob can bound $e_{p}$. This is a typical random sampling problem. Given a certain number of phase error rates in $n_{x}+n_{z}$ positions, Alice and Bob randomly sample $n_{x}$ positions for phase error testing and find $n_{x}e_{bx}$ errors. The sampling problem lies on bounding the phase error rate $e_{pz}$ in the remaining $n_{z}$ positions. The (upper) bound is related to the failure probability by a hypergeometric function Fung et al. (2010).

Specifically, the main objective is to evaluate the deviation $\theta$ of the phase error rate from the tested value, the bit error rate in the complementary basis, due to the finite-size effect. Here we recap the results from Section IX of Fung et al. (2010) and list the variables in Table 12. The phase error rate $e_{pz}$ is bounded by

[TABLE]

with a failure probability of

[TABLE]

where $\xi(\theta)=H(e_{bx}+\theta-q_{x}\theta)-q_{x}H(e_{bx})-(1-q_{x})H(e_{bx}+\theta)$. If we take the Taylor expansion of Eq. (23), one can obtain the first order approximation essentially the same as the Gaussian limit used in the Shor-Preskill security proof Shor and Preskill (2000).

Another approach to deal with the problem of finite-size effect is by employing the smooth min-entropy Renner (2008), which is a valid measure of randomness in the non-asymptotic cases, and degenerates to Shannon entropy in the i.i.d. limit. This approach has been applied to QKD to prove the finite-key security with almost tight bounds Tomamichel and Renner (2011); Tomamichel et al. (2012). Moreover, the smooth min-entropy approach is rather general to deal with non-i.i.d. case and can be applied to other quantum information processing protocols, such as one-shot coherence resource theory Zhao et al. (2018) and device-independent QKD Arnon-Friedman et al. (2018). Note that for the security analysis of QKD systems with realistic devices, the finite data size effects are much more complicated. We shall review it in Section V.1.

III QKD Implementation

In practice, security of a QKD system is often related to its implementation. A QKD implementation is composed of three parts: source, channel, and detection. In a rigorous security proof, the channel is assumed to be under the full control of Eve, who can replace the channel with any quantum operation she desires. In the security proof model, no implementation assumption is required on the channel. As a result, the security of the system does not depend on the physical realization of the quantum channel. Therefore, the practical security for the channel is not an issue. For the quantum source and detection, on the other hand, a security proof normally requires some assumptions on practical realization.

Photons are most widely used for communication, due to their robustness against decoherence due to noisy environment and fast traveling speed. Hence, we mainly focus on the quantum optical realization of QKD systems. We first discuss the encoding and decoding methods, then briefly introduce the practical source, channel and detection devices, and finally the classical postprocessing. Here, we primarily review the practical components of a discrete-variable QKD (DV-QKD) system, while the discussions for continuous-variable QKD (CV-QKD) can be found in Section VII.

III.1 Encoding and decoding

Different encoding and decoding methods are reflected on source, channel, and detection. For discrete-variable QKD schemes, Alice needs to figure out an efficient method to encoding her qubit (or qudit) into the quantum states. Accordingly, Bob needs to develop an efficient method to read out the quantum information encoded by Alice.

In general, for qubit-based QKD, the quantum information can encoded into two quantum modes, $s$ and $r$, and their relative phases. Normally, the two modes are assumed to be orthogonal, say, using orthogonal polarizations or distinct time bins. Then, for a photon, the states $\{\ket{10}_{sr},\ket{01}_{sr}\}$ form a Hilbert space, named $Z$ basis. Here, “0" and “1" refer to the photon number in a mode. Two complementary bases, $X$ and $Y$, are defined with the relative phases. The $X$ and $Y$ basis states can be written as, $\{\ket{10}_{sr}\pm\ket{01}_{sr}\}$ and $\{\ket{10}_{sr}\pm i\ket{01}_{sr}\}$.

In reality, a widely applied method is polarization encoding, which utilizes the polarization modes. The horizontal and vertical polarizations of a photon, denoted by $\ket{10}_{HV}$ and $\ket{01}_{HV}$, are used for the $Z$ basis encoding. Then, the $X$ basis states, $\{\ket{10}_{HV}\pm\ket{01}_{HV}\}$, denote the linear polarization modes along the directions of $\pm 45^{\circ}$, respectively. The $Y$ basis states, $\{\ket{10}_{HV}\pm i\ket{01}_{HV}\}$, denote the left- or right-handed circular polarizations. In the decoding process, the basis choice is realized by a polarization controller (Fig. 5), and the polarization measurement is realized by polarization beam splitter (PBS) connected with single photon detectors.

Another common method is time-bin phase encoding, where Alice chooses two pulses, a signal pulse and a reference pulse, for two encoding modes, denoted by $s$ and $r$, respectively. Similar to the polarization encoding, for a single photon, the two time-bin modes form the $Z$ basis, $\{\ket{10}_{sr},\ket{01}_{sr}\}$. Here, the qubit in the $Z$ basis determines whether the photon stays in the signal time bin or the reference time bin. The $X$ and $Y$ basis states, $\{\ket{10}_{sr}\pm\ket{01}_{sr}\}$ and $\{\ket{10}_{sr}\pm i\ket{01}_{sr}\}$, denote the photons with a relative phase $0,\pi$ and $\pi/2,3\pi/2$ between the signal and reference pulses, respectively. In the decoding process, an interferometer (Fig. 5) is employed to extract the phase information.

For qudit-based QKD, Alice and Bob need to find $d$ orthogonal modes and the encoding and decoding are similar. For example, the orbital angular momentum is the freedom of photons on spatial distribution, which contains a large Hilbert space. By encoding the high-dimensional key information into the orbital angular momentum, one can enhance the performance of QKD Gröblacher et al. (2006); Cerf et al. (2002). Another example is to encode with multiple time bins. In differential phase shift (DPS) QKD, the relative phase or each time-bin pulse is only [math] or $\pi$, and the key is encoded into relative phase of two neighbouring pulses. Round-Robin-DPS QKD Sasaki et al. (2014) encoding and decoding the phase difference circularly.

III.2 Photon sources

Here, we mainly discuss various practical photon sources for QKD: weak coherent-state source, thermal source, heralded single photon source, and entangled photon source. For most of prepare-and-measure QKD protocols, a single photon source is preferred. However, it is experimentally challenging to realize a high-quality and high-performance single photon source. We will discuss the photon sources according to different QKD schemes.

III.2.1 Prepare-and-measure

In a standard prepare-and-measure scheme like BB84, the common way is to employ other practical weak light sources to approximate the single photon source. In general, they are modulated to be a Fock state mixture,

[TABLE]

where $P(n)$ is the photon number distribution and $\ket{n}$ is the $n$-photon number state. For different types of sources, the photon number distribution will also be different. Normally, the single photon component, $\ket{1}\bra{1}$, is required to be dominant comparing to higher order components.

The weak coherent-state source is the most widely employed in QKD, which can be easily realized by attenuating laser lights. The light generated by a laser can be regarded as a coherent pulse $\ket{\alpha}$ within the coherence time, where $\alpha$ is a complex number, and $\mu=|\alpha|^{2}$ is the average photon number. The coherent state can be expanded in the Fock basis as

[TABLE]

The phase of $\alpha$ reflects the relative phase between different photon number components. To realize a photon source in the form of Eq. (24), Alice can randomize the phase of coherent pulses, and make it a mixture of photon number states Lo et al. (2005),

[TABLE]

where the photon number follows a Poisson distribution, $P_{\mu}(n)=e^{-\mu}\dfrac{\mu^{n}}{n!}$. In many QKD protocols, such as BB84, only single photon component is secure for key distribution. Thus, the light intensity $\mu$ is typically in the single photon level, $\mu=O(1)$.

The thermal source is a Fock state mixture, expanded by

[TABLE]

where $\mu$ is the average photon number and the photon number follows a thermal distribution $P_{th}(n)$. Note that for a small average photon number $\mu\leq 2$, the single photon component ratio is bigger in a Poisson distribution than in a thermal distribution. This is the reason why the weak coherent state source normally can outperform the thermal one in QKD Curty et al. (2010).

III.2.2 Entanglement-based

For the entanglement-based QKD protocol, such as BBM92 Bennett et al. (1992c), an entangled photon source via the parametric down-conversion (PDC) process is normally adopted. In a PDC process, a high frequency photon is converted to a pair of low frequency photons. A PDC source emits a superposition state of different number of photon pairs Walls and Milburn (2008); Ma and Lo (2008),

[TABLE]

where $\chi$ is the nonlinear parameter for the down-conversion process, $\mu=\sinh^{2}\chi$ is the average photon pair number, and $\ket{n,n}$ represents $n$ photon pairs in two optical modes.

The PDC process is widely used to generate photon pairs. In this case, four optical modes are used. For example, a typical PDC photon source emits photon pairs in two directions. In each direction, the photon can be in $H$ or $V$ polarization. The two optical modes are entangled in polarization. Comparing to Eq. (28), due to different collection means, the amplitudes of photon pair numbers are slightly different from the one in Eq. (28) Kok and Braunstein (2000); Ma et al. (2007),

[TABLE]

where $\chi$ is the nonlinear parameter for the down-conversion process, $\mu=2\sinh^{2}\chi$ is the average number of entangled photon pairs, and $|\Phi_{n}\rangle$ is the state of an $n$-entangled-photon pair,

[TABLE]

In the aforementioned example, $a$ and $b$ represent two direction of the light, and $\ket{n-m,m}_{a}$ represents $n-m$ photons in the $H$ polarization and $m$ photons in the $V$ polarization. The number of the entangled-photon pairs follows a Super-Poissonian distribution, slightly different from the thermal distribution,

[TABLE]

Notice that the PDC source can also be used as a heralded photon source in the prepare-and-measure scheme. If we only focus on one of the optical modes (normally called signal mode), tracing out the other (normally called idle mode), the photon number follows the thermal distribution, $P_{th}(n)$ given in Eq. (27). A typical usage of a PDC source for heralded photon involves measuring the idle optical mode locally as a trigger and encoding the signal mode for QKD. In this case, once Alice obtains a trigger locally, she can largely rule out the vacuum component in the signal mode. In fact, conditioned on whether or not a detection clicks on the idle mode, the photon number distribution is different on the signal mode. Such source can be used as a passive decoy-state source Adachi et al. (2007); Ma and Lo (2008). Note that when $\mu$ is very small, such heralded photon source can well approximate a single photon source, which is widely used in multi-photon processing Pan et al. (2000).

III.3 Channel

Theoretically, we put no assumption on the quantum channel used for QKD. However, in the real-world implementation, we will build the QKD channel with mature optical communication technology to enhance the performance of QKD protocol. There are two widely adopted channels for QKD: fiber and free space. The most common channel used in QKD is built with commercial optical fiber. For a standard commercial single mode fiber (SMF), losses depend exponentially on the channel distance $l$ as $10^{-\alpha l/10}$, where the loss rate $\alpha$ is roughly $0.2$ dB/km for telecom wavelength at around 1550 nm. The loss rate can be remarkable if we extend the transmission distance to over $400$ km fiber Yin et al. (2016); Fang et al. (2019). Besides loss, a fiber-based QKD implementation should also solve several problems, such as chromatic dispersion, polarization mode dispersion, birefringence and so forth Gisin et al. (2002).

Free space channel features some advantages compared to optical fiber. There are several atmospheric transmission windows, such as 780–850 nm and 1520–1600 nm, which have a low loss with an attenuation less than 0.1 dB/km in clear weather Bloom et al. (2003). More importantly, the attenuation is even negligible in the outer space above the Earth’s atmosphere, which enables long-distance QKD over $1000$ km between ground and satellite Liao et al. (2017a). Furthermore, the decoherence of polarization or of any other degree of freedom is practically negligible. However, there are also some drawbacks concerning the free space. For instance, the weather conditions influence the losses of free space heavily. The effective apertures of the sending and receiving telescopes, influenced by alignment, movements and atmospheric turbulence, contribute coupling losses and affect the performance of free space QKD.

III.4 Detection

For DV-QKD schemes, single photon detection is realized with threshold detectors which can only distinguish the vacuum (zero photon) from single photon or multi-photon cases. Besides, some imperfections may exist in the single-photon detector (SPD): the detector efficiency $\eta$ is not $100\%$, which means some non-vacuum signals will not cause a click on the SPD; there exists a dark count factor $p_{d}$, which means some vacuum signals will incorrectly cause a click. This will affect the performance of QKD systems.

The measurement model is based on the threshold SPDs mentioned above. For the single-photon subspace, the detection here can be regarded as $X/Y$ basis qubit measurement. However, there is multi-photon component in the final signal, and the behavior of the measurement device will be different from the required $Z$-basis and $X$-basis measurement in DV-QKD. For example, there will be double-click signals caused by multi-photon component, which will not happen in the ideal $X/Y$ basis detection. To address this issue, the squashing model of measurement is proposed, combined with the random-assignment of double-clicked signals Beaudry et al. (2008); Fung et al. (2011).

In 2012, the MDI-QKD scheme Lo et al. (2012) was proposed to fill the detection loophole. The design of measurement devices in MDI-QKD is similar to the one in point-to-point QKD protocol. In discrete variable MDI-QKD scheme, the measurement device, assumed to be manipulated by the adversary, can be divided into two categories, single detection and coincidence detection. The coincident detection MDI-QKD schemes Ma and Razavi (2012) is based on the schemes in which the two communication parties, Alice and Bob, encode their key information into a single photon, and build correlation between their key value by a Bell state projection. The single detection MDI-QKD scheme Lucamarini et al. (2018); Ma et al. (2018) can be regarded as the detection on the coherent states rather than the single photon. They both build correlations between Alice’s and Bob’s bit values by Bell state projections.

III.5 Postprocessing

Postprocessing is a procedure for Alice and Bob to distill a secure key from the raw data measured in quantum transmission with the help of public discussions. The flow chart of QKD postprocessing is shown in Figure 6.

There are a few practical aspects need to be taken into consideration when the number of signals are finite, i.e., the finite-key effect. For example, the error correction efficiency may not reach to the Shannon limit; depending on the data size, normally a factor is applied. Also, on the privacy amplification side, there will be a small failure probability. Some public communication between Alice and Bob need to be authenticated and/or encrypted. Table 13 summarizes the resource cost and the failure probabilities in the various steps.

The first step is raw key assignment, which depends on different schemes. For example, in the commercial BB84 implementation, Alice and Bob discard all the no-clicks and randomly assign double-clicks. In the MDI-QKD, this step is based on the announcement of the measurement site. In DI-QKD, Alice and Bob can perform arbitrary assignment. Of course, any improper assignment will reduce the key rate.

During the public discussions, some of the classical communication need to be authenticated, as listed in Table 13. In the security proofs we reviewed, we assume the encryption of classical communication in error correction. Such encryption can be avoided in other security proofs. In this case, there may be some restriction on the error correction procedure and more follow-up privacy amplification is required. For example, in the original Shor-Preskill security proof, such encryption is not necessary when the CSS code is employed. In practice, there is an advantage to using error correction without encryption, since if Alice and Bob abort the QKD procedure after error correction, no pre-shared secret bits will be lost due to encryption. In the following discussions, we assume the number of bits communicated in error correction is counted for later privacy amplification. Thus, in privacy amplification, the extraction ratio will be $r$ given in Eq. (21) without considering the finite data size effects. If the one-time pad encryption is used for error correction, the privacy amplification ratio will be higher (by removing the error correction term in Eq. (21)). After that, certain amount of secure key bits need to return to the keep pool for encryption consumption. In the end, the final key rate will still be same in the encryption and non-encryption cases.

III.5.1 Error correction

For practical error correction, normally an efficiency factor $f>1$ is put before the $H(E)$ term Eq. (21), which means the actual cost is larger than the theoretical Shannon limit. Previously, a widely used error correction protocol for QKD is Cascade Brassard and Salvail (1994). The Cascade protocol is simple and highly efficient that is able to achieve an error correction factor of around $1.1\sim 1.2$ for a large QBER range from 0% to beyond 11%. In the Cascade protocol, Alice and Bob divide their sift key bit strings into blocks and compare parities of each block to look for errors. They perform a binary search to locate the error when the parity of a block is different. The process repeats for a few times with different block sizes and permutation to ensure all the error bits are corrected. The Cascade protocol is highly interactive because the binary search requires $1+\log_{2}(n)$ communications and successful error correction often requires several passes. Later, several improved protocols have been proposed to reduce the interaction rounds Buttler et al. (2003); Nakassis et al. (2004); Elliott et al. (2005).

Another family of error correcting codes is forward error correction, which only needs to send one syndrome from Alice to Bob. Due to its light classical communication load, the forward error correction is widely implemented in commercial QKD systems. One outstanding example is the low-density parity-check (LDPC) code MacKay and Neal (1996). The LDPC code works well for QKD due to its the high error correction efficiency and very limited communication requirement. The design and optimization of LDPC codes in QKD postprocessing is similar to the classical case, which can be divided into three steps.

The first step is to find a good degree distribution MacKay et al. (1999); Richardson and Urbanke (2001) for the target error rate. 2. 2.

The second step is to generate a good parity-check matrix. Like in classical communication, the small cycles may contribute to localized information transmitted in decoding. Thus, a good parity-check matrix generation algorithm should yield a relatively large girth. Progressive edge-growth is one of the most successful algorithms to generate parity-check matrix eliminating small cycles Hu et al. (2005). 3. 3.

The third step is to decode with Bob’s key string and the received syndrome. The brief-propagation algorithm Fossorier et al. (1999), which is also known as the sum-product algorithm, is highly efficient in decoding.

The standard LDPC algorithm is only optimum at its designed rate for the designed QBER. But the actual QBER is fluctuating from round to round. The rate compatible LDPC can solve this problem with puncturing and shorting Ha et al. (2006). The main technology here is to select a mother code close to the target rate, and then to adjust the code rate with puncturing. The puncturing operation can be done multi-times, in order to find a best code rate suitable for the actual error rate. This method has been employed in QKD Elkouss et al. (2009); Martinez-Mateo et al. (2010). Besides efficiency, another important factor of error correction is the throughput. The limitation for the Cascade code is the highly interactive communications, and for LDPC is the computational cost in iterative decoding. It was reported the throughput with both the Cascade Pedersen and Toyran (2013) and the LDPC Dixon and Sato (2014) codes can be higher than 10 Mbps. Note that the computing in decoding LDPC is always assisted with GPU acceleration.

III.5.2 Error verification and authentication

Before error correction, Alice and Bob sample the sifted key bits to roughly estimate the error rates. Then they perform error correction. After error correction, Alice and Bob can perform error verification to make sure they share the same key Lütkenhaus (1999); Ma et al. (2011). Then, the failure probability for error correction is reflected in error verification step when finite data size is considered. It is not hard to see that the two jobs, error verification and message authentication, are very similar. In both cases, Alice and Bob want to make sure the bit strings on the two ends are the same. The only difference is that authentication tag might reveal information about the message, but error verification should not. This difference can be overcome by encrypting the tag, which has already been done in most of information-theoretically secure authentication schemes. If we employ the LFSR-based Toeplitz matrix construction, the relation between the tag length (the same as the key cost) and the failure probability is given by

[TABLE]

where $n$ is the message length and $k$ is the key cost.

After error correction and error verification, Alice and Bob are almost sure that they have located all the errors. Then, they can accurately count the number of bit errors and hence the rate $e_{b}$ defined in Eq. (7). If Alice and Bob choose not to encrypt error correction, they can count the amount of classical communication used in the error correction, $k_{ec}$. Then they perform addition amount of privacy amplification. For example, in the ideal devices case of Eq. (8) and infinite data limit, $k_{ec}=nH(e_{b})$. The final key output length is given by $l=rn$.

III.5.3 Privacy amplification

Practical privacy amplification turns out to be very efficient in terms of finite data size effect, once the necessary parameters, such as the phase error rates, are estimated as reviewed in Section II.4.2. Denote the error corrected bit strings for Alice and Bob to be $k_{A}=k_{B}$ with a length of $n$ and the output length to be $l$. In the infinite key limit, $l/n=r$ given in Eq. (21) if error correction is not encrypted. In the privacy amplification procedure, Alice randomly chooses a universal hashing matrix $T\in\{0,1\}^{l\times n}$ and sends it to Bob via a public classical channel. The final key will be given by $Tk_{A}=Tk_{B}$, with a small failure probability.

Privacy amplification works for general classes of two-universal hash functions Tomamichel et al. (2011). In particular, the universal hashing function based on Toeplitz matrices is widely used for privacy amplification. An $l\times n$ Toeplitz matrix is a Boolean matrix with the structure of

[TABLE]

where $a_{i}\in\{0,1\}$ for $-n+1\leq i\leq l-1$. The Toeplitz matrix can also be concisely written as $T_{(i,j)}=a_{i-j}$ where $T_{(i,j)}$ is the $(i,j)$ element of $T$. Apparently, an $l\times n$ Toeplitz matrix can be specified by $N+K-1$ bits, as opposed to $N\times K$ bits for completely random matrices. The main advantage of Toeplitz matrix hashing is that the computational complexity for $Tk_{A}$ is $O(n\log n)$ by the fast fourier transform (FFT).

Following the security proofs reviewed in Section II.2, the matrix $T$ should be related to the phase error correction. In order to ensure the phase error correction to commute with the final key measurement, we require the null space of $H$ to be capable of correcting the underlying phase errors. For universal hashing functions, such error correcting capability can be evaluated with certain failure probabilities. Details of derivation can be found in Section X of Fung et al. (2010). The failure probability for privacy amplification with Toeplitz hashing is given by,

[TABLE]

If Alice transmit the Toeplitz matrix to Bob, then she needs to authenticate that communication as well, which would add an extra term of Eq. (32) to $\varepsilon_{pa}$. Here in privacy amplification, by sacrificing $t_{pa}$ extra bits in privacy amplification, one can obtain a failure probability of $2^{-t_{pa}}$. More general discussions for hash functions besides Toeplitz hashing can be seen in Tomamichel et al. (2011).

Note that message authentication can be done more efficiently by piling up classical communication data and authenticate them at once. That is, the authentication terms listed in Table 13 can be done once with one authenticated tag and one failure probability. The main drawback of this saving data and authenticating approach is that it might require lots of local data storage. In QKD system design, it is normally preferred that each procedure of postprocessing is isolated.

From the simulation results Fung et al. (2010), we learn that the failure probabilities for authentication, error verification, and privacy amplification are not the main contributions to the total system one. In fact, the one in phase error rate estimation, Eq. (23), is the dominate term. The summation of failure probabilities evaluated here can be converted to the trace-distance measure in Eq. (5).

III.5.4 Finite-key length

When the failure probability of the postprocessing procedure is $\epsilon$, the final key is $\sqrt{\epsilon(2-\epsilon)}$-secure in accordance with the composable security definition given in Eq. (5). Finally, by including the finite-data statistics for parameter estimation (see Sec. II.4.2) and the postprocessing costs (see Table 13), we have the finite-key length $NR$ for the finite-size security of QKD, which can be written as Fung et al. (2010),

[TABLE]

with a failure probability of

[TABLE]

where $l$ is given by,

[TABLE]

where the variables can be found in Table 12.

Notice that one can also utilize the smooth min-entropy approach to obtain the finite-key length Renner (2008); Scarani and Renner (2008) or the tight bounds Tomamichel et al. (2012). Note that for QKD systems with realistic devices, the finite-key length is slightly complicated, we refer to Lim et al. (2014) for decoy-state QKD, Curty et al. (2014) for measurement-device-independent QKD, Lorenzo et al. (2019) for twin-field QKD, Arnon-Friedman et al. (2018) for device-independent QKD and Furrer et al. (2012); Leverrier et al. (2013) for continuous-variable QKD.

IV Quantum Hacking

In theory, it is traditional to divide Eve’s hacking strategy to three main classes: individual, collective and coherent (or general) attack. Individual attack means that Eve interacts with each secure qubit in the channel separately and independently; Collective attack means that Eve prepares independent ancilla, interacts each qubit independently, but can perform a joint measurement on all the ancilla; Coherent attack means that Eve can prepare an arbitrary joint (entangled) state of the ancilla, which then interact with the qubits in the channel before being measured jointly. The last one does not limit Eve’s capabilities beyond what is physically possible. Any QKD system aiming to implement an informational-theoretically secure protocol therefore has to be proven secure against coherent attacks. Another aspect which cannot be neglected is security in a finite size scenario. No key transmission session can be endless and the resulting statistical fluctuations have to be taken into account Scarani et al. (2009).

In this section, different from the theory attacks, we focus on the practical attacks which exploit the device imperfections in QKD systems. Specifically, Eve may try to exploit the imperfections in real QKD systems and launch the so-called quantum hacking not covered by the original security proofs. Researchers have demonstrated several quantum hacking attacks in practical QKD systems. An earlier review on quantum hacking attacks can be seen in Jain et al. (2016). Here we will provide a review for the quantum attacks to both the source and the detection. The detection attacks are similar to those reviewed in Jain et al. (2016), but we provide more details for the attacks at source which exploit the multiple photons, timing or phase information of the laser source. Also, some new attacks after Jain et al. (2016) will also be mentioned. Table 1 summarizes a list of the attacks developed from early 2000 to the present.

IV.1 Attacks at source

In the standard QKD scheme, it is assumed that Alice (state preparation) is placed in a protected laboratory and she prepares the required quantum state correctly. Unfortunately, imperfect state preparation may leak information about the secret key. Indeed, practical preparation may introduce some errors due to imperfect devices or Eve’s disturbance Lütkenhaus (2000); Brassard et al. (2000); Fung et al. (2007); Xu et al. (2010); Sun et al. (2012); Tang et al. (2013); Sun et al. (2015). To steal the information about the states, Eve can also actively perform the Trojan-horse attack Gisin et al. (2006); Jain et al. (2014, 2015) on intensity modulators and phase modulators. This section will review some examples of attacks at source.

IV.1.1 Photon-number-splitting attack

The first well known kind of hacking strategy that was considered is the photon-number-splitting (PNS) attack Lütkenhaus (2000); Brassard et al. (2000) aiming at the imperfect photon source. As described in section III.2, because of technological challenge, weak coherent pulses (WCPs) generated by a highly attenuated laser are widely used in QKD implementations. Since the photon number of a phase-randomized WCP follows the Poisson distribution (Eq. (26)), there is a non-zero probability for multiple-photon pulses, i.e., those pulses containing two or more photons. Consequently, Eve may exploit the multiple-photon pulses and launch the PNS attack. In this attack, for each WCP, Eve first utilizes a quantum non-demolition (QND) measurement to obtain the photon number information. Conditioned on the QND measurement result, Eve either blocks the one-photon pulse or splits the multiple-photon pulse into two. She stores one part of the multiple-photon pulse and sends the other part to Bob. Later on, during the basis-reconciliation process of the BB84 protocol, Eve can get the secret key information for the multiple-photon pulse without introducing any errors. By doing so, Alice and Bob could not notice Eve’s attack.

The PNS attack restricts the secure transmission distance of QKD typically below 30 km Gottesman et al. (2004). Actually, in early 2000s, there were not many research groups working on QKD experiments Hughes et al. (2000); Ribordy et al. (2000); Gobby et al. (2004). Researchers in the field had a doubt on the future of QKD, and they generally thought that QKD may be impractical with WCP source. This concern severely limits the development of QKD at that time. Fortunately, the discovery of the decoy state method perfectly resolved the problem of PNS attack and made QKD practical with standard WCP Hwang (2003); Lo et al. (2005); Wang (2005). More details on the decoy state method will be discussed in section V.

IV.1.2 Phase-remapping attack

Phase modulators are commonly used to encode random bits in the source of phase-coding QKD systems Gisin et al. (2002). In practice, a phase modulator has finite response time, as shown in Fig. 7a. Ideally, the pulse passes through the phase modulator in the middle of the modulation signal and undergoes a proper modulation (time $t_{0}$ in Fig. 7a). However, if Eve can change the arrival time of the pulse, then the pulse will pass through the phase modulator at a different time (time $t_{1}$ in Fig. 7a), and the encoded phase will be different. This phase-remapping process allows Eve to launch an intercept-and-resend attack, i.e., phase-remapping attack Fung et al. (2007). The phase-remapping attack is a particular threat for the bidirectional QKD schemes, such as the plug-and-play QKD structure Stucki et al. (2002).

In 2010, the phase-remapping attack was successfully demonstrated in a commercial ID-500 plug-and-play QKD system (manufactured by ID Quantique151515https://www.idquantique.com/) Xu et al. (2010), as shown in Fig. 7b. In this experiment, Eve utilized the same setup as Bob to launch her attack. Eve modified the length of the short arm of her Mach-Zehnder interferometer by adding a variable optical delay line (VODL in Fig. 7b) to shift the time delay between the reference pulse and the signal pulse. To remap the phase small enough into the low QBER range, Eve shifted the forward signal pulse out and only the backward signal pulse in the phase modulation range by using VODL, and properly aligned the polarization direction of the backward signal pulse orthogonal to the principal axis of the phase modulator by using a polarization controller (PC in Fig. 7b). The experiment demonstrated that Eve could get full information and only introduce a QBER of 19.7%, which is much lower than the well-known 25% error rate for an intercept-and-resend attack in BB84.

IV.1.3 Nonrandom-phase attack

Phase randomization is a basic assumption in most security proofs of QKD Gottesman et al. (2004); Hwang (2003); Lo et al. (2005); Wang (2005). Although the security of QKD with non-random phase had been proven Lo and Preskill (2007), the performance is very limited in distance and key rate. By assuming that the overall phase is uniformly distributed in [0, $2\pi$], a coherent state with intensity can be reduced into a classical mixture of photon number states, i.e., Eq. (26). This can greatly simplify the security proofs and allow one to apply classical statistics theory to analyze quantum mechanics. In practice, however, the phase randomization assumption may be violated in practice, thus resulting in various attacks Sun et al. (2012); Tang et al. (2013); Sun et al. (2015).

The first example is the USD attack demonstrated in Tang et al. (2013). When the phase of WCPs is not properly randomized, the quantum state will be a pure state. Then in decoy state QKD Hwang (2003); Lo et al. (2005); Wang (2005), it is possible for Eve to distinguish the signal state and decoy state with an unambiguous state discrimination (USD) measurement. Hence, Eve first measures each of Alice’s WCPs to distinguish between signal state and decoy state by performing a USD measurement, which is combined with positive operator-valued measurement (POVM) operators without disturbing the quantum state sent by Alice. After the USD, Eve performs the PNS attack. Since Eve knows which state the pulse belongs to (signal or decoy), she could do different strategies for signal state and decoy state. As a result, the key assumption in decoy state QKD Lo et al. (2005) – a decoy state and a signal state have the same characteristics – is violated.

The second example is the laser seed-control attack which was proposed and demonstrated in Sun et al. (2015). Semiconductor laser diode (SLD) is normally used as a single-photon source in most commercial and research QKD systems. In the interdriven mode, the semiconductor medium of the SLD is excited from loss to gain by each driving current pulse. A laser pulse is generated from seed photons originating from spontaneous emission. The phase of the laser pulse is determined by the seed photons. Since the phase of the seed photons is random, the phase of each laser pulse is random inherently. However, if a certain number of photons are injected from an external source into the semiconductor medium, these photons will also be amplified to generate laser pulses. Consequently, the seed photons consist of two parts: one from spontaneous emission and the other part from the external source. Both parts will affect the phase of the resulting laser pulse. If the injected photons greatly outnumber the photons from spontaneous emission, the phase of the output laser pulse is largely determined by the phase of the injected photons. Therefore, Eve can control the phase of Alice’s signal laser by illuminating the SLD from an external control source and successfully violate the phase randomization assumption Gottesman et al. (2004).

IV.2 Attacks at detection

The detection component is much more vulnerable to quantum hacking attacks than the source. Since Eve controls the channel and can send any signals (e.g strong optical pulses combined with X-ray and neutrinos) to Bob and Bob has no choice but to receive Eve’s signal and any filters used by Bob may be imperfect, it may be hard for Bob to isolate his lab and avoid side channels or detector control from/by Eve. For instance, a significant number of attacks have been proposed to hack single-photon detectors (SPDs)161616The vulnerabilities of SPDs are mainly due to their complex working mechanism: the detection is affected by incoming light and the control electronic circuits. Therefore, Eve can manipulate the intensity, the time, or the wavelength of incoming light to control the responses of SPDs. Makarov (2009); Lydersen et al. (2010); Gerhardt et al. (2011a, b); Wiechers et al. (2011); Sauge et al. (2011). SPDs are regarded as the “Achilles heel" of QKD by C. H. Bennett171717C. H. Bennett, “Let Eve do the heavy lifting, while John and Won-Young keep her honest,” http://dabacon.org/pontiff/?p=5340. This section will review some examples of attacks at detection. The first two examples, double-click attack and fake-state attack, were proposed only in theory. The last two examples, time-shift attack and detector-blinding attack, were successfully demonstrated in experiment.

IV.2.1 Double-click attack

Since QKD systems require the detection of two different bit values, bit 0 and bit 1, they require at least two SPDs. The double-click event refers to the case where both SPDs detect signals. The double-click event will introduce a QBER of 50% when either one of the two bits is selected. A naive strategy is to determine double-click events as abnormal events and discards these events so as to minimize the QBER. However, this strategy results in the problem of double-click attack. In this attack, Eve simply floods Bob’s polarization beam splitter with multiple photons or a strong pulse of the same polarization. Then, when Bob makes a measurement using a conjugate basis different from that of Eve, a double-click event occurs and it is discarded; when the receiver makes a measurement using the same basis as Eve’s, a normal event is detected. Consequently, Alice and Bob finally share the same information with Eve. To solve this problem, Lütkenhaus has proposed that double-click events are not discarded and bit 0 or bit 1 is randomly allocated by Bob whenever a double-click event occurs Lütkenhaus (1999, 2000).

IV.2.2 Fake-state attack

In 2005, Makarov et al. proposed a faked-state attack, which exploits the efficiency mismatch of two detectors in a practical QKD system Makarov and Hjelme (2005); Makarov et al. (2006). In practice, the standard SPDs such as Si/InGaAs APDs are often operated in a gated mode. Therefore, the detection efficiency of each detector is time-dependent. Since QKD systems require the detection of two different bit values, 0 and 1, they often employ at least two SPDs. It is inevitable that finite manufacturing precision in the detector and the electronics, and difference in optical path length will slightly misalign the two detector gates, and cause detector-efficiency mismatch. This is illustrated in Fig. 8a. At the expected arrival time T, the detection efficiencies of the two detectors are identical. However, if the signal is chosen to arrive at some unexpected times (such as $t_{1}$ and $t_{2}$ in Fig. 8a), it is possible that the detector efficiencies of the two detectors, $\eta_{0}$ and $\eta_{1}$, differ greatly. This problem often exists in practical QKD systems, and it will leave a back door for Eve to attack the system.

The faked-state attack is an intercept-and-resend attack. For each signal, Eve randomly chooses one of the two BB84 basis to perform a measurement and obtain a measurement result. Then, she re-sends the opposite bit value from her measurement result in the opposite basis, at a time when the detector for the opposite bit has a lower detection efficiency than the other detector. As analyzed in Makarov et al. (2006), Eve introduces less than 11% QBER if the detection efficiency $\eta\leq$6.6%. The faked-state attack, while conceptually interesting, is hard to implement in a real-life QKD system. This is because it is an intercept-resend attack and as such involves finite detection efficiency in Eve’s detectors and precise synchronization between Eve and Alice-Bob’s system. A typical countermeasure against detector efficiency mismatch is the four-state QKD protocol Makarov et al. (2006).

IV.2.3 Time-shift attack

Motivated by the faked-state attack, in 2007, Qi et al. Qi et al. (2007a) proposed the time-shift attack. This is also based on the detection-efficiency mismatch for gated SPDs in the time domain, but is much easier to implement. Let us suppose Fig. 8a illustrates the detection efficiencies of the two gated SPDs in a real-life QKD system. Eve can simply shift the arrival time of each pulse sent from Alice by employing a variable optical delay line. For example, Eve randomly shifts the pulse from Alice to arrive at $t_{1}$ or $t_{2}$ through a shorter path or a longer path of optical line. This shifting process can partially reveal the bit value of Bob: if the pulse arrives at $t_{1}$ (or $t_{2}$) and Bob announces receipt, the bit value is more likely to be 0 (1). Moreover, Eve can carefully set how many bits should be shifted forward and how many should be shifted backward to ensure that the distribution of bit 0 and bit 1 received by Bob is balanced. Hence, the time-shift attack does not make any measurement on the quantum state, and quantum information is not destroyed.

Since Eve does not need to make any measurement or state preparation, the time-shift attack is practically feasible with current technology. In 2008, it has been successfully implemented on a commercial QKD system by Zhao et al. Zhao et al. (2008) as shown in Fig. 8b. This is one of the first successful demonstrations of quantum hacking on a widely-used commercial QKD system. In their experiment Zhao et al. (2008), Eve got an information-theoretical advantage in around 4% of her attempts. The successful implementation of the quantum attack shows that a practical QKD system has non-negligible probability to be vulnerable to the time-shift attack.

IV.2.4 Detector-control attack

The detector-control attack is the most powerful attack and it has been successfully demonstrated on several types of practical QKD systems Makarov (2009); Lydersen et al. (2010). In general, the detector-control attacks can be divided into three categories: (i) detector-blinding attack Makarov (2009); Lydersen et al. (2010, 2011a); Huang et al. (2016a), where Eve illuminates bright light to control detectors; (ii) detector-after-gate attack Wiechers et al. (2011), where Eve just sends multi-photon pulses at the position after the detector gate; (iii) detector-superlinear attack Lydersen et al. (2011b); Qian et al. (2018), where Eve exploits the superlinear response of single-photon detectors during the rising edge of the gate.

Most available SPDs are InGaAs/InP APDs operating in a Geiger mode Hadfield (2009), in which they are sensitive to a single photon. The working principle of this type of APDs is shown in Fig. 9a. In the detector blinding attack, by sending a strong light to Bob, Eve can force Bob’s SPDs to work in a Linear mode instead of Geiger mode, as shown in Fig. 9a. In the Linear mode, the SPD, such as the one based on InGaAs APD, is only sensitive to bright illumination. This detector operation mode is called “detector blinding". After blinding the detectors, Eve sends a bright pulse with tailored optical power such that Bob’s detector always reports a detection event from the bright pulse, but never reports a detection event from a pulse with half power. This is illustrated in Fig. 9b. Consequently, Eve can successfully launch an intercept-and-resend attack without increasing QBERs. For example, when Eve uses the same basis as Bob to measure the quantum state from Alice, Bob gets a detection event as if there were no eavesdropper. But if Eve uses the opposite basis from Bob to measure the quantum state from Alice, her bright pulse will strike each of Bob’s detectors with half power, and neither detector will report a detection event. In practice, a simple detector blinding attack will introduces a 50% total loss. However, Eve can place her intercept-unit close to Alice’s laboratory while compensating the loss in the remaining fiber by re-sending brighter states.

The detector-control attack is applicable to various types of SPDs, such as gated APDs Lydersen et al. (2010); Huang et al. (2016a), passively or actively quenched APDs Makarov (2009); Sauge et al. (2011), superconducting nanowire single-photon detectors (SNSPDs) Lydersen et al. (2011a), and so forth. A full field implementation of the attacking strategy has been investigated in Gerhardt et al. (2011a). The blinding attack was also demonstrated to fake the violation of Bell’s inequality Gerhardt et al. (2011b). How to remove the detector-control attacks is a challenge in the field of QKD. One proposed countermeasure is carefully operating the single-photon detectors inside Bob’s system and monitoring the photocurrent for anomalously high values Yuan et al. (2010, 2011). This work also highlights that mis-operation of QKD devices allows the loophole to be exploited, which is related to the best-practice criteria for all QKD devices in QKD implementations Koehler-Sidki et al. (2018). Recently, Qian et al. propose another countermeasure against the detector-control attacks by introducing a variable attenuator in front of the detector Qian et al. (2019). However, these countermeasures may seem ad hoc and lead away from provable security models of QKD and can often be defeated by advanced hacking technologies. A practical and promising solution is the MDI-QKD protocol, which will be reviewed in section VI.2.

IV.3 Other attacks

Another well-know hacking strategy is the Trojan-horse attack (THA), as shown in Fig. 10, in which Eve sends a probe light to Alice or Bob and reads their information from the backscattered probe light. In 2001, Vakhitov et al. proposed the large pulse attack Vakhitov et al. (2001) and Kurtsiefer et al. analyzed the possibility of THA by detecting the detector fluorescence of Si-based avalanche photodiodes Kurtsiefer et al. (2001). Gisin et al. studied the problem of THA in the QKD implementations where light goes two ways Gisin et al. (2006). Later, Jain et al. performed a comprehensive analysis of the risk of THA against typical components in standard QKD systems Jain et al. (2014, 2015). Recently, the backflash photons caused by detection events in single-photon detectors was exploited to realize the detector-backflash attack Pinheiro et al. (2018). A countermeasure against the THA is to add proper isolations and consider the leaking information in privacy amplification, which will be reviewed in Section V.3.

Besides the above attacks, Lamas-Linares and Kurtsiefer demonstrated that the timing information revealed during public communicating can be exploited to attack the entanglement-based QKD system Lamas-Linares and Kurtsiefer (2007). In two-way QKD system such as the “plug-and-play" structure, Sun et al. studied the imperfections of Faraday mirror and proposed the Faraday-mirror attack Sun et al. (2011); Jain et al. experimentally demonstrated that the calibration routine of a commercial “plug-and-play" system can be tricked into setting a large detector efficiency mismatch, and proposed an attack strategy on such a compromised system with a QBER less than 7% Jain et al. (2011). Moreover, Li et al. Li et al. (2011) studied the imperfection of a practical beam splitter and demonstrated a wavelength-dependent beam-splitter attack on top of a polarization-coding QKD system. The detector dead-time issue was widely studied in Rogers et al. (2007) and demonstrated in Henning et al. (2011). Andun et al. and Makarov et al. demonstrated the laser damage attack by using a high-power laser to damage the SPDs Bugge et al. (2014); Makarov et al. (2016). Recently, Huang et al. show that the decoy states can be distinguishable if they were generated by modulating the pump current of a semiconductor laser diode Huang et al. (2018), and Wei et al. exploited the efficiency mismatch in the polarization degree of freedom to hack SNSPD Wei et al. (2019a).

Most of the imperfections reviewed so far are in fiber-based QKD systems. There are also quantum attacks reported for free-space QKD systems Nauerth et al. (2009); Sajeed et al. (2015a); Chaiwongkhot et al. (2019). For instance, imperfect encoding methods result in side channels from which encoded states are partially distinguishable Nauerth et al. (2009). The imperfection due to non-single-mode quantum signals is a crucial issue in free-space QKD. Eve can exploit this imperfection and launch the spatial-mode attack against a free-space QKD system. This problem has been carefully studied in Sajeed et al. (2015a); Chaiwongkhot et al. (2019), following an earlier discussion on the origins of detection efficiency mismatch in Fung et al. (2009). Besides DV-QKD, the practical security of CV-QKD also deserves future investigations, which will be reviewed in Section VII.3.

More generally, as noted in Curty and Lo (2019), in principle, there are simply too many side channels for Alice and Bob to close. This is because Eve might , in principle, attack Alice’s and Bob’s system via X-ray, neutrons, neutrinos or even gravitational waves. And, whatever detection systems Alice and Bob have will probably have limited ranges of responses. Moreover, classical post-processing units pose a serious threat to the security of QKD. Most QKD security framework assumes without proofs that classical post processing units are secure. However, in conventional security, it is well known that hardware Trojans and software Trojans are commonly used to compromise the security of conventional cryptographic system. It was proposed in Curty and Lo (2019) to use redundancies in QKD units and classical post-processing units to achieve security through e.g., verifiable secret sharing.

V Source Security

In this section, we review various approaches to resolve the security issues of practical sources. On one hand, the imperfections in quantum state preparation, including multi-photon components of laser, nonrandomized phases, encoding flaws and so forth, need to be carefully quantified and taken into account in security analysis. In particular, we will discuss the decoy state QKD protocol in more details. On the other hand, practical countermeasures are required to prevent the Trojan horse attacks on the source. Note that we focus on the BB84 protocol, but most of techniques can be extended to other protocols.

V.1 Decoy-state method

Decoy-state method is a common way to combat with source imperfection by introducing extra sources for better channal characterization. In the decoy-state method, the user randomly modify the source states during the quantum stage; after that, he reveal which state is used in each turn. Eve cannot modify her attack to different source states, but in the postprocessing the users can estimate their parameters conditioned on that knowledge. The decoy-state method is used mostly to bound the multi-photon components in a practical photon source.

In practical photon sources, multi-photon components are inevitable. As reviewed in Section IV.1.1, Eve can split a multi-photon pulse and save one photon from it for later hacking. Since Alice and Bob cannot tell whether a detection comes from a single-photon component or multi-photon component and Eve controls the channel, they have to pessimistically assume all the multi-photon states cause clicks with 100% efficiency. All the losses come from the single-photon states. In order to reduce the effects of multi-photon components, Alice has to use very low intensity optical pulses. In the case of coherent state photon source, it has been shown that the optimal intensity used is close to the channel transmittance $\eta$ Lütkenhaus (2000); Ma (2006),

[TABLE]

where $\eta$ includes channel transmission and detection efficiency. Then, final key rate will quadratically depend on the transmittance $\eta$, $R=O(\eta^{2})$.

Various protocols Inoue et al. (2002); Hwang (2003); Scarani et al. (2004) have been proposed to over the key rate limit caused by the PNS attacks, among which the most effective one is the decoy state method Hwang (2003); Lo et al. (2005); Wang (2005). In the decoy-state QKD scheme, instead of using one intensity for encoding, Alice employs a few additional intensities of optical pulses (as decoy states) in order to monitor the transmittance of different photon number components. After Bob detects the signals, Alice announces the intensities she uses for each pulse. With detection rate for decoy states, Alice and Bob can bound tightly the number of detections from single-photon components. If Eve simply changes the transmittance for different photon number states as adopting in the PNS attacks, she will inevitably change the detection rates for signal and decoy states differently. Without Alice’s intensity information ahead, Eve has to let a significant amount of single-photon states passing in order to maintain the ratio of detection rates among signal and decoy states. The decoy state idea was first proposed by Hwang Hwang (2003) who considered using a strong decoy signal with intensity around 2 photons as a decoy state.

The security proof of the decoy-state method is given later in Lo et al. (2005), where a photon number channel model Ma (2008) is employed. With an infinite number of decoy state, Alice and Bob can estimate the detections from all photon number components accurately. After adopting the GLLP security analysis, reviewed in Section II.4.1, one can show that the optimal intensity of optical pulses can be increased to $O(1)$, which results in a key rate having a linear dependence of transmittance, $O(\eta)$ Lo et al. (2005). The decoy-state method significantly booming the performance of practical QKD. The schematic diagram of the decoy-state method is shown in Fig. 11.

In the meantime, practical decoy-state methods with only a vacuum and weak decoy states were proposed Hoi-Kwong Lo (2004); Ma (2004) and tight bounds were derived later Wang (2005); Ma et al. (2005). In the original security proof, continuous phase randomization is assume to decohere phases between different photon number components. As discussed later in Section V.2.2, phase randomization is necessary but can be relaxed to discrete phase randomization Cao et al. (2015). In fact, the uniformly discrete phase randomization with discrete phase number $m=10$ can already achieve a good approximation of continuous phase randomization.

V.1.1 Theory

For the source with different photon number components, one can assume a photon number channel model Ma (2008). The decoy state method is a tomography to the photon number channel model, providing tighter estimations on single photon component Lo et al. (2005). In the decoy state method, the source is operated at different photon number distributions, leading to different measurement outcome statistics. The communication partners can estimate the channel parameters of yield $Y_{n}$ and QBER $e_{n}$ for each photon number component. One crucial assumption in the decoy-state QKD is that the signal state and decoy states are identical except for their average photon numbers. This means after Eve’s photon-number measurement, she has no way of telling whether the resulted photon number state is originated from the signal state or decoy states. Hence, the yield $Y_{n}$ and QBER $e_{n}$ can depend on only the photon number, $n$, but not which distribution (decoy or signal) the state is from. That is,

[TABLE]

The implementations of decoy state method can be divided into active ones and passive ones. In the active decoy state method, the user perpares the source signals with different intensities to change the probability distributions of each photon number component. A simple solution for decoy state preparation, as shown in Fig. 11, is to use an amplitude modulator (AM) to modulate the intensities of each WCP to the desired intensity level. This is indeed the implementations reported in most of decoy state QKD experiments. Another solution for decoy state implementation is to use multiple laser diodes of different intensities to generate different states Peng et al. (2007). In the passive decoy state method, heralded single photon source are often applied Mauerer and Silberhorn (2007); Adachi et al. (2007); Ma and Lo (2008). The probability distribution is changed by observing different measurement outcomes of the heralded photons.

A popular source for decoy state method is the phase-randomized weak coherent state source, as shown in Eq. (26). To apply the active decoy method, Alice randomly adjusts the intensity $\mu$ of the coherent state, which is related to different Poisson distribution $P_{\mu}(n)$. Alice estimates the single photon yield $Y_{1}$ and error $e_{1}$ by solving the equation provided by the observed gain $Q_{\mu}$ and quantum bit error rate (QBER) $E_{\mu}$ related to different intensity $\mu$

[TABLE]

where $P_{\mu}(n)=\mu^{n}e^{-\mu}/n!$ for the coherent state case.

Following the GLLP security analysis, Eq. (20), the key rate is given by

[TABLE]

where $Q_{1}=Y_{1}\mu e^{-\mu}$. Here, the gain $Q_{\mu}$ and QBER $E_{\mu}$ can be directly obtained from experiment, and the signal intensity $\mu$ is set by Alice. With a tight estimation on $Y_{1}$ and $e_{1}$ by solving the linear equations in the form of Eq. (40), the key rate can be improved from $O(\eta^{2})$ to $O(\eta)$.

In practice, only several different intensities are enough to make an accurate estimation. The most popular practical decoy state method is vacuum and weak decoy state method Hoi-Kwong Lo (2004); Ma (2004). That is, Alice randomly generates coherent states with three different intensities $\{0,\nu,\mu\}$, where states with intensity $\mu$ is the signal states for key generation, and states with intensity $\nu<\mu$ and vacuum state with intensity [math] is for parameter estimation. The two parameters need to estimate in Eq. (41) can be bounded by Ma et al. (2005),

[TABLE]

A similar result is also derived in Wang (2005).

For finite-data size effect, Ma et al. took the first step to analyze the statistical fluctuations using standard error analysis, which essentially assumes i.i.d. channel behavior Ma et al. (2005). The idea is that instead of directly using $Q_{\mu}$ and $E_{\mu}$ obtained from the experiment directly, one assumes these parameters fluctuates according to a normal distribution. Then, in Eq. (42), one can substitute the upper and lower bounds of $Q_{\mu}$ and $E_{\mu}$. The failure probability for this estimation would link to the number of standard deviations used for bounds.

The finite data size effect has been discussed in a more rigorous manner in Lim et al. (2014); Zhang et al. (2017). It turns out that the formulas used in the standard error analysis approach Ma et al. (2005) can be directly applied with a different value of failure probabilities in parameter estimation, as presented in Table 14.

Other than weak coherent state photon sources, one can also use PDC source or thermal source, as reviewed in Section III.2. As long as the photon number distribution of the source is different from Poisson distribution, one can employ the passive decoy state scheme Adachi et al. (2007); Ma and Lo (2008), where Alice splits the pulses with a beam splitter, detects one arm as triggers, and uses the other arm for QKD encoding. Conditioned on the detection of triggering signals, the photon number distribution of the encoding arm is different. Alice can announce her local detection after Bob’s detection. Then, they can have linear gains for photon pulses with different (conditional) photon number distributions for the decoy-state method analysis. It turns out that even with phase randomized coherent states, one can employ the passive decoy state method Curty et al. (2010).

V.1.2 Experiment

The decoy state methods have been widely implemented in different QKD systems. The decoy-state experiments are summarized in Table 2. Fig. 12 shows the four initial decoy-state QKD experiments. Zhao et al. reported decoy state experiments Zhao et al. (2006b, a) up to 60-km fiber on top of a commercial plug-and-play QKD system; Peng et al. Peng et al. (2007) implemented decoy-state QKD over 102-km fiber using a one-way polarization-encoding QKD system; Rosenberg et al. Rosenberg et al. (2007) implemented decoy-state QKD over 107-km fiber using a one-way phase-encoding QKD system; Schmitt-Manderbach et al. achieved 144 km decoy state QKD in free space Schmitt-Manderbach et al. (2007). These experiments demonstrated that decoy state BB84 was secure and feasible under real-world conditions.

Since then, more and more experimental efforts have been made to QKD deployments in labs and field tests. In 2007, Yuan et al. realized a stabilized one-way phase-encoding decoy state QKD system Yuan et al. (2007). Later, Dixon et al. implemented decoy state QKD with a high clock rate of 1 GHz Dixon et al. (2008) and Liu et al. extended decoy state QKD to long distance of 200-km fiber Liu et al. (2010). Importantly, a number of field QKD networks with the decoy-state implementation have been built in Europe Peev et al. (2009), Japan Sasaki et al. (2011), China Chen et al. (2009, 2010); Wang et al. (2010) and so forth. An illustration of the Tokyo QKD network is shown in Fig. 13.

In the mean time, Wang et al. experimentally implemented decoy state with a PDC source Wang et al. (2008). Also, the passive decoy-state method has also been demonstrated Sun et al. (2014). Recently, the decoy state experiment has been extended to a record-breaking distance of 1,200 km in free space Liao et al. (2017a) and 421 km in ultra low-loss optical fiber Boaron et al. (2018). Due to its convenient implementation and remarkable enhancement on performance, the decoy-state method becomes a standard technique in current QKD implementations.

V.2 Source flaws

V.2.1 Basis-dependent source

In practice, there is often some difference between $\rho_{x}$ and $\rho_{z}$, i.e., Eq. (14) might not be fulfilled. Then, in the worst case scenario, we should assume Eve is capable of distinguishing the basis choice and hence she can attack two basis states separately. This kind of source is called basis-dependent source. Obviously, the more state dependence on the basis, the easier for Eve to distinguish the bases and hence a lower key rate.

Without loss of generality, we take $Z$-basis as example. The general Shor-Preskill’s key rate formula is Shor and Preskill (2000)

[TABLE]

where $e_{Z}^{p}$ is the $Z$-basis phase error rate, defined in Eq. (7).

For a basis-dependent source, $e_{Z}^{p}\neq e_{X}$ since $\rho_{Z}\neq\rho_{X}$. However, if $\rho_{X}$ is close to $\rho_{Z}$, we can still bound $e_{Z}^{p}$ from measured $e_{X}$. In the GLLP security analysis framework Gottesman et al. (2004), the basis dependence is quantified by a bias,

[TABLE]

where $F(\rho_{X},\rho_{Z})=\sqrt{\sqrt{\rho_{Z}}\rho_{X}\sqrt{\rho_{Z}}}$ is the fidelity between the two states. Given this bias, the phase error rate used in the key rate formula can be bounded by Koashi (2009); Lo and Preskill (2007),

[TABLE]

For the practical photon sources presented in Section III.2, Alice and Bob have more information than the bias in Eq. (44). For example, in principle, they can measure the photon number $n$, with which they can tag each quantum signal. Then, in phase error correction of entanglement distillation process, which would be reduced to privacy amplification for prepare-and-measure schemes, they could take advantage of these tagging. With tagging, the GLLP key rate formula can be written as Gottesman et al. (2004),

[TABLE]

where $E$ is the total QBER, $\Delta$ is the ratio of tagged signals, and $e_{z}^{p}$ is the phase error rate of the untagged signals. Here, we use the same notation of the bias $\Delta$ in Eq. (44).

V.2.2 Nonrandom phase

A general example of source flaw is to use the weak coherent states with nonrandom phases to encode the basis and key information Lo and Preskill (2007). Their difference is treated as source flaw, i.e, a basis-dependence of the source. The encoded state $\ket{\psi_{\beta\kappa}}_{B}$ is

[TABLE]

where $\alpha$ is constant and $\mu=2|\alpha|^{2}$ is the intensity. In this case, the basis dependence $\Delta$ is

[TABLE]

Note that in the practical QKD experiment, we will post-select the clicked signals. In this case, to calculate the basis dependence, we have to take the channel transmittance $\eta$ into account. In a worst-case scenario, the channel loss is caused by Eve’s selection on the transmitted signals. To clarify this, we can consider Eve performs a unambiguous state discrimintation (USD) attack Dušek et al. (2000), where Eve performs USD to discriminate $\rho_{X}$ and $\rho_{Z}$. If the discrimination is successful, Eve can learn the basis and key, then he generates the same state $\rho_{\beta\kappa}$, and sends it to Bob; if the discrimination fails, Eve partially blocks the signal as loss. In this case, the basis dependence $\Delta^{\prime}$ of left signals will be amplified by $\eta$

[TABLE]

From Eqs. (43), (45),and (49), we can calculate the key rate. However, the achievable key generation rate scales only quadratically with the transmittance $\eta$ in the channel, i.e., $r=O(\eta^{2})$. This question can be potentially solved using the scheme of discrete phase randomization Cao et al. (2015).

V.2.3 Encoding flaws

Another example of source flaw is the encoding flaws in the phase and polarization encoding due to the device imperfections in the encoding devices. This will also make the source basis-dependent. Although GLLP allows the security proof to consider th encoding flaws, the key rate drops dramatically Gottesman et al. (2004). This is because GLLP has a pessimistic consideration by assuming that the encoding flaws are in arbitrary dimensions. To address this issue, a loss-tolerant protocol was proposed in Tamaki et al. (2014), which makes QKD tolerable to channel loss in the presence of source flaws Yin et al. (2014).

On the basis of the assumption that the single-photon components of the states prepared by Alice remain inside a two-dimensional Hilbert space, it was shown that Eve cannot enhance state preparation flaws by exploiting the channel loss and Eve’s information can be bounded by the rejected data analysis. The intuition for the security of loss-tolerant QKD protocol Tamaki et al. (2014) can be understood in the following manner. By assuming that the state prepared by Alice is a qubit, it becomes impossible for Eve to perform an unambiguous state discrimination (USD) attack. Indeed, in order for Eve to perform a USD attack, the states prepared by Alice must be linearly independent; but by having three or more states in a two-dimensional space, in general the set of states prepared by Alice is linearly dependent, thus making USD impossible. The above loss-tolerant protocol has been further developed and demonstrated experimentally for decoy-state BB84 Xu et al. (2015b); Boaron et al. (2018) and MDI-QKD Tang et al. (2016a).

V.3 Leaky source

As discussed in Section IV.3, the source is vulnerable under the Trojan-horse attack (THA). In particular, Eve could inject bright light pulses into Alice’s transmitter and then measure the back-reflected light to extract information about Alice’s state preparation process. This problem has been analyzed in Lucamarini et al. (2015). The authors evaluated the security of a QKD system in the presence of information leakage from Alice’s phase modulator (PM), which is used to encode the bit and basis information of the generated signals. A key observation is that, the joint state of Alice’s transmitted signals and Eve’s back-reflected light from her THA is not basis-independent but it depends on Alice’s basis choice. The security of the system can be analyzed by quantifying Eve’s information and considering this information in privacy amplification, based on the techniques introduced in Lo and Preskill (2007). Recently, these seminal results have been generalized to prove the security of decoy-state QKD in the presence of arbitrary information leakage from both the PM and the intensity modulator (IM) Tamaki et al. (2016); Wang et al. (2018c). Here the IM is normally used to select the intensity setting for each emitted signal. Consequently, it is possible to quantify the amount of device isolation, against THA, so as to achieve a certain performance with a realistic leaky QKD system.

VI Detection Security

In this section, we review the various approaches to address the detection security of practical QKD. We will review the MDI-QKD protocol and its extensions in more details.

VI.1 Countermeasures against detection attacks

Many approaches have been proposed to defeat the attacks at detection. The first one is security patch. That is, once one discovers a new type of attack, a corresponding countermeasure against this attack can be proposed and realized in an existing QKD system. This approach usually only requires modifying the software or the hardware of a current system. For instance, the time-shift attack introduced in the previous section can be avoided by simply shifting the gating window of the detectors at random Qi et al. (2007a). The detector blinding attack could, in principle, be avoided by monitoring the detector’s photocurrent for anomalously high values Yuan et al. (2011); da Silva et al. (2012) or by randomly varying the detector efficiency Lim et al. (2015). Although security patch can defeat certain attacks, the patched countermeasures themselves might open other loopholes. This could as a result, introduce one more layer of security risk Sajeed et al. (2015b); Huang et al. (2016a); Qian et al. (2019). Furthermore, the major issue associate with the security patch is that they only prevent the known attacks. For potential and unknown attacks, the countermeasures may fail. Therefore, security patch is only ad-hoc, which abandons the information-theoretic security framework of QKD.

The second approach is to fully characterize the devices using in a QKD system and precisely describe the devices in mathematical models. Then the models can be included in the security proof to estimate the real secure key rate based on an imperfect setup. A well-known example is the GLLP security proof Gottesman et al. (2004). While this approach seems straightforward, developing models to fully match the practical behavior of various QKD devices is rarely possible because the components are complex. Even so, there are several ongoing theoretical efforts to consider as many imperfections as possible into the security proof Fung et al. (2009); Marøy et al. (2010); Tamaki et al. (2014); Lucamarini et al. (2015); Tamaki et al. (2016). Nevertheless, this approach is limited by our understanding of the devices and a complete knowledge of the devices is rather challenging. Hence full characterization is still ad-hoc.

The third approach is device-independent QKD (DI-QKD), which will be reviewed in Section VIII.1. Note that there are also proposals for semi-device-independent QKD, where one party’s measurements are fully characterized while the other’s are unknown Branciard et al. (2012); Pawłowski and Brunner (2011); Smith et al. (2012).

The final approach is MDI-QKD protocol, which closes all detection attacks and is practical with current technology. In below, we will review MDI-QKD in detail.

VI.2 Measurement-device-independent scheme

MDI-QKD generates secret keys based on the “time-reversed" entanglement protocol and leaves all the single photon detections to a public untrusted relay (Eve).

VI.2.1 Time-reversed EPR QKD

The idea of measurement-device-independent (MDI) is inspired by the Einstein-Podolsky-Rosen (EPR) based QKD protocol Ekert (1991); Bennett et al. (1992c). This is illustrated in Fig. 14 Biham et al. (1996). In the initial EPR-based protocol (Fig. 14a), Alice and Bob individually prepare an EPR pair at each side and send one photon from each pair to an untrusted center party, Charles. Charles then performs a Bell state measurement (BSM) for entanglement swapping. The measurement result is announced. Once the BSM is finished, Alice and Bob measure the other photon of the EPR pairs locally by choosing between the $X$ and $Z$ basis randomly. Comparing a subset of their measurement results allows Alice and Bob to know whether Charles is honest. Then Alice and Bob can generate the secret by using the BBM92 protocol Bennett et al. (1992c).

Note that the EPR protocol can also work in a time-reversal version, as shown in Fig. 14b. That is, Alice and Bob can measure their local photons first, instead of waiting for Charles’ measurement results. This order of preparation and measurement is equivalent to that of the prepare-and-measurement QKD scheme, in which Alice and Bob prepare BB84 states and send them to Charles to perform the BSM. After that, the Charles’ honesty can be checked by comparing a part of Alice’s and Bob’s results. Importantly, Charles’ BSM is only used to check the parity of Alice’s and Bob’s bits, and thus, it does not reveal any information about the individual bit values. This time-reversal EPR protocol forms the main concept behind MDI-QKD.

This time-reversed EPR QKD protocol has been first proposed in Biham et al. (1996). Later, Inamori provided a security proof Inamori (2002). Nevertheless, these two important works offered very limited performance and, therefore, they have been largely forgotten by the QKD community. For instance, the scheme in Biham et al. (1996) requires perfect single-photon sources and long-term quantum memories, which renders it unpractical with current technology. Inamori’s scheme Inamori (2002) uses practical weak coherent pulses (WCPs) but it does not include decoy states, since it was proposed long before the advent of the decoy-state protocol. Moreover, the two early papers Biham et al. (1996); Inamori (2002) were not specifically considering the side channel problem in QKD at all. In 2012, Braunstein and Pirandola performed a general security analysis of the time-reversed EPR QKD approach Braunstein and Pirandola (2012) and proved that detector side-channel attacks can be eliminated by using teleportation where any incoming quantum signals are excluded from access to the detectors. Note that the idea of using teleportation for the specific purpose of removing side channels was first discussed in footnote 21 of Lo and Chau (1999).

VI.2.2 MDI-QKD protocol

The MDI-QKD proposal Lo et al. (2012) [see also Braunstein and Pirandola (2012)] builds on the time-reversed EPR QKD. In particular, the main merits of the proposal, introduced by Lo, Curty and Qi Lo et al. (2012), are twofold: first, it identified the importance of the results in Biham et al. (1996); Inamori (2002) to remove all detector side-channels from QKD implementations; second, it significantly improved the system performance with practical signals by including decoy states. The protocol can be summarized in four steps:

Alice and Bob randomly and individually prepare one of four BB84 states using phase-randomized WCPs together with decoy signals. Then they send the states to an untrusted party, Charles. 2. 2.

An honest Charles performs a BSM that makes Alice’s and Bob’s states interfere with each other, generating a Bell state. An example of a BSM implementation with linear optics in shown in Fig. 15: Charles interferes the incoming pulses at a 50:50 beam-splitter (BS), which has on each end a polarizing beam-splitter (PBS) that projects the photons into either horizontal ($H$) or vertical ($V$) polarization states. A “click” in the single-photon detectors $D_{\rm 1H}$ and $D_{\rm 2V}$, or in $D_{\rm 1V}$ and $D_{\rm 2H}$, indicates a projection into the singlet state $\ket{\psi^{-}}=(\ket{HV}-\ket{VH})/\sqrt{2}$, while a “click” in $D_{\rm 1H}$ and $D_{\rm 1V}$, or in $D_{\rm 2H}$ and $D_{\rm 2V}$, implies a projection into the triplet state $\ket{\psi^{+}}=(\ket{HV}+\ket{VH})/\sqrt{2}$. Other detection patterns are considered unsuccessful. 3. 3.

Whether Charles is honest or not, he announces the outcome of his claimed BSM using a classical public channel when he claims to obtain a successful measurement. 4. 4.

Alice and Bob keep the data that correspond to Charles’ successful measurement events and discard the rest. Next, similar to the sifting in BB84 protocol, Alice and Bob announce their basis choices for sifting the events and keep the events using same bases. Based on Charles’ measurement result, Alice flips part of her bits to guarantee the correct correlation with those of Bob. The post-selection strategy is illustrated in Table 15. Finally, they use the decoy-state method to estimate the gain and QBER of the single-photon contributions.

In MDI-QKD, both Alice and Bob are senders, and they transmit signals to an untrusted third party, Eve, who is supposed to perform a Bell state measurement (BSM). Since the BSM is only used to post-select entanglement, it can be treated as an entirely black box. Hence, MDI-QKD can remove all detection side-channels. The assumption in MDI-QKD is that the source should be trusted. The security assumptions of MDI-QKD, together with DI-QKD (see Section VIII.1), are summarized in Table 16. A comparison of practical security between MDI-QKD and DI-QKD, as commented by Charles H. Bennett in QCrypt 2018181818See slide 6 of Charles H. Bennett’s talk in Lightning Talks session of QCrypt 2018: http://2018.qcrypt.net/, is summarized in Box VI.2.2.

Box VI.B.2: A security remark about MDI-QKD and DI-QKD by Charles H. Bennett.

MDI-QKD at first sounds weaker than DI-QKD, but in fact it is stronger. In MDI-QKD, Eve’s untrusted device remains outside Alice’s and Bob’s trusted enclosures. They need only trust themselves not to have inadvertently created a side channel to Eve through incompetent design of their do-it-yourself (DIY) light sources. By contrast, in DI-QKD they must trust Eve not to have deliberately created side channels from the untrusted devices to herself.

VI.2.3 Theoretical developments

The decoy-state analysis is essential for MDI-QKD. The analysis is different from that of conventional decoy-state BB84 in that now both Alice and Bob send decoy signals to a common receiver (instead of only Alice sending decoy signals to Bob), which makes the mathematics slightly more complex. Fortunately, it has been shown that it is enough to obtain a tight estimation if Alice and Bob employ just a few decoy settings each. The authors of Ma et al. (2012) and Wang (2013), respectively, proposed a numerical method based on linear programming and an analytical approach based on Gaussian elimination. Both approaches assume that Alice and Bob can prepare a vacuum intensity. Following the similar analytical line, the authors of Xu et al. (2013a) studied the situation where none of the two decoy intensities are vacuum191919A vacuum state is normally hard to realize in practice due to the finite extinction ratio of a practical intensity modulator. A full parameter optimization method was proposed in Xu et al. (2014). Soon after, Yu et al proposed to use joint constraints for a better key rate Yu et al. (2015), and Zhou et al. Zhou et al. (2016) proposed a four-intensity method, in which the key generation is conducted in $Z$ basis and the decoy analysis is performed only in $X$ basis. By doing so, the four-intensity method is efficient in the case of short data size. Recently, the four-intensity method was extend to seven-intensity method which can substantially enhance the key rate for MDI-QKD over asymmetric channels Wang et al. (2018d). All these results provide experimentalists a clear path to implement MDI-QKD with a finite number of decoy states.

For finite-key analysis, the authors of Ma et al. (2012) provided an analysis that assumes a Gaussian distribution for the statistical fluctuations. Remarkably, Curty et al. Curty et al. (2014) presented a rigorous finite-key security proof against general attacks by using min-entropy analysis and Chernoff bound. In addition, this result satisfies the composable security definition. All these results confirm the feasibility of long-distance implementations of MDI-QKD within a reasonable time-frame of signal transmission. Simulations of the secret key rates with different kinds of decoy-state methods and finite-key analysis methods is shown in Fig. 16.

Other practical aspects were also extensively analyzed in theory. Besides polarization encoding in the original MDI-QKD protocol Lo et al. (2012), alternative schemes including phase encoding Tamaki et al. (2012) and time-bin encoding Ma and Razavi (2012) were proposed and analyzed. To extend the transmission distance further, one could include quantum memories Abruzzo et al. (2014); Panayi et al. (2014), entanglement sources Xu et al. (2013b) or adaptive operations Azuma et al. (2015b). Moreover, a key security assumption in MDI-QKD is the source should be trusted. Recently, there have been efforts to prove the security of MDI-QKD when Alice’s and Bob’s encoding devices are flawed Tamaki et al. (2014); Xu et al. (2015b), or when their apparatuses are not fully characterized Yin et al. (2014). Furthermore, a plug-play type of MDI-QKD was proposed in Xu (2015); Choi et al. (2016) and experimentally demonstrated in Tang et al. (2016a).

VI.2.4 Experimental developments

Table 3 summarizes the MDI-QKD experiments after its invention. The main experimental challenge of MDI-QKD is to perform a high-visibility two-photon interference between photons from two (Alice’s and Bob’s) independent laser sources Lo et al. (2012), which is not required in conventional QKD schemes. To do so, Alice’s photons should be indistinguishable from those of Bob. Importantly, if one implements MDI-QKD over telecom fibres, it is necessary to include feedback controls to compensate the time-dependent polarization rotations and propagation delays caused by the two separated fibres. Note that in standard BB84 QKD systems, the requirement of compensating polarization rotations and propagation delays can be relaxed by using phase encoding, because the two optical pulses, which interfere with each other at the receiver’s end, pass through the same optical fibre and thus experience the same polarisation rotation and phase change. Therefore, one can achieve high interference visibility without performing any polarization control. Nevertheless, this advantage of phase encoding (in comparison to other encoding schemes) cannot be directly translated to MDI-QKD, because the two pulses pass through two independent quantum channels.

In 2013, several groups performed independent experimental study for MDI-QKD. Liu et al. Liu et al. (2013) reported the first demonstration of MDI-QKD with random modulation for encoding states and decoy states over 50 km fiber. Simultaneously, Rubenok et al. were the first to demonstrate the feasibility of high-visibility two-photon interference between two independent lasers, passing through separate field-deployed fibres in a real world environment Rubenok et al. (2013). Later, Ferreira da Silva et al. observed a similar interference using polarization encoding in the lab Ferreira da Silva et al. (2013) and Tang et al. reported a full demonstration of polarization encoding MDI-QKD with random modulation of encoding states and decoy states Tang et al. (2014b). All these four initial experiments, when taken together, complete the cycle needed to demonstrate the feasibility of MDI-QKD using off-the-shelf optoelectronic devices. Their experiment diagrams are illustrated in Fig. 17.

MDI-QKD is attractive not only because of its security against detection attacks, but also due to its practicality. It can resist high channel loss and reach long distance. Tang et al., implemented MDI-QKD over 200 km fiber Tang et al. (2014a) and in field environment Tang et al. (2015) by increasing the system clock rate from 1 MHz to 75 MHz, by developing an automatic feedback system, and utilizing superconducting single photon detectors (SNSPDs).

In 2016, two millstone MDI-QKD experiments that were subsequently reported. In the first one, Yin et al., extended the MDI-QKD distance to a record-breaking distance of 404 km by optimizing the implementation parameters and using a ultra-low loss fiber (0.16 dB/km) Yin et al. (2016). Importantly, the key rate achieved in the experiment at 100 km is around 3 kbps, which is sufficient for one-time-pad encoding of voice message. The results demonstrated in Yin et al. (2016) are shown in Fig. 16a. In the second one, Comandar et al., increased the system clock rate of MDI-QKD to 1 GHz by exploiting the technique of optical seed lasers Comandar et al. (2016). The 1 GHz system demonstrated the feasibility for MDI-QKD to reach 1 Mbps key rate. The achieved secret rates in Comandar et al. (2016) are shown in Fig. 16b.

Besides long distance and high rate, several research groups have analyzed the practical aspects in the implementation of MDI-QKD. For instance, Valivarthi et al., analyzed the trade-offs among complexity, cost, and system performance associated with the implementation of MDI-QKD Valivarthi et al. (2015) and implemented a cost-effective system Valivarthi et al. (2017). Wang et al., demonstrated a reference-frame-independent MDI-QKD that requires no phase reference between Alice and Bob Wang et al. (2015a, 2017a) and this scheme was recently improved to a clock rate of 50 MHz by Liu et al. Liu et al. (2018a). Tang et al., demonstrated MDI-QKD with source flaws Tang et al. (2016a). Roberts et al., reported a reconfigurable system to switch between QKD and MDI-QKD Roberts et al. (2017). Aside from the MDI-QKD demonstration with WCP sources, Kaneda et al. demonstrated MDI-QKD using heralded single-photon source Kaneda et al. (2017). Furthermore, a continuous-variable version of MDI-QKD was also proposed and studied Pirandola et al. (2015), which will be reviewed in Section VII.

With all the above experimental efforts, MDI-QKD is ready for the applications in the future quantum network. Particularly, MDI-QKD is well suited to construct a centric star-type QKD network even with untrusted relays. Indeed, Tang et al., performed the first implementation of a field MDI-QKD network Tang et al. (2016b), which has four nodes with one untrusted relay node and three-user nodes. Note that if the central relay is trusted, one can reconfigure the MDI-QKD network to allow many quantum communication protocols Roberts et al. (2017). Moreover, high-rate MDI-QKD over asymmetric fiber channels was demonstrated recently in Liu et al. (2019a), based on the theoretical proposal in Wang et al. (2018d). The asymmetric MDI-QKD is valuable to practical metropolitan network settings, where the channel losses are naturally asymmetric and the user nodes could be dynamically added or deleted. Furthermore, Wei et al., have implemented the first chip-based MDI-QKD at 1.25 GHz clock rate Wei et al. (2019b). This is important to develop a low-cost and secure quantum network, where the expensive devices such as single-photon detectors can be placed in the central untrusted relay and each user requires only a simple Si chip.

VI.3 Twin-field QKD

Fundamental bound Takeoka et al. (2014) and secret key capacity (SKC) Pirandola et al. (2017) have been obtained for the secure key rate vs distance of QKD. It was proven that, in the absence of relays, the key rate basically scales linearly with transmittance $O(\eta)$, where $\eta$ is the transmittance of the channel between Alice and Bob. This is called the linear bound (of the secret key rate of a lossy quantum channel). There are tremendous research interests towards developing a feasible scheme, known as quantum repeater Sangouard et al. (2011), to overcome the fundamental rate-distance limit. However, the deployment of quantum repeater is still beyond current technology.

Remarkably, Lucamarini et al. Lucamarini et al. (2018) have proposed a novel phase-encoding MDI-QKD protocol, called twin-field QKD (TF-QKD), which shows the possibility to overcome the SKC. In TF-QKD (see Fig. 18), weak optical pulses are generated by two phase-locked laser sources, which are phase-randomized and then phase-encoded with secret bits and bases. The pulses are sent to Charlie for interference on a beam splitter; depending on which detector clicks, Charlie can infer whether the secret bits of the users (Alice and Bob) are equal or different, but cannot learn their absolute values. TF-QKD essentially uses single-photon interference Duan et al. (2001), and the implementation requires only standard optical elements without the requirement of quantum memory Sangouard et al. (2011). The key goal of TF-QKD protocol is to achieve a quadratic improvement (i.e., scaling to $O(\sqrt{\eta})$ to key rate as a function of channel transmittance. Unfortunately, in the original paper Lucamarini et al. (2018), such a quadratic improvement was only proven for a restricted class of attacks by Eve.

Following the TF-QKD scheme Lucamarini et al. (2018), Ma et al. Ma et al. (2018) proposed a protocol named phase-matching QKD (PM-QKD) and proved its unconditional security, inspired by the previous phase-encoding MDI-QKD protocol Tamaki et al. (2012), and the MDI version of the Bennett1992 protocol Ferenczi (2013). PM-QKD employs coherent states as information carriers directly and uses the decoy state method in an indirect way. In a sense, PM-QKD adopts a (discrete-modulation) continuous-variable encoding and discrete-variable single-photon detection. The performance of PM-QKD is shown in Figure 19. One can clearly see that its key rate can go beyond the linear SKC with certain realistic parameter settings.

On the other hand, with the BB84-type two-basis analysis, Tamaki et al. Tamaki et al. (2018) proposed a modified $X/Y$-basis protocol, and Wang et al. Wang et al. (2018e) proposed an $X/Z$-basis protocol, where the single-photon states are used regarded as the information carrier. Afterwards, the simplified coherent-state-based protocols without phase-randomization on the key generation mode have been proposed Curty et al. (2019); Cui et al. (2019); Lin and Lütkenhaus (2018) and analyzed in the infinite data size case. Later on, Maeda et al. Maeda et al. (2019) introduce an efficient parameter estimation method for the PM-QKD protocol and complete the finite-size analysis. All these recent theory works make the new TF-type MDI-QKD protocols important for the deployment of QKD over long distances.

Interestingly, the security of PM-QKD, different from the usual BB84-type two-basis protocol, is closely related to the symmetry of source state with respect to the encoding operation. To clearly establish the correlation between encoding symmetry and privacy, Zeng et al Zeng et al. (2019) establish a symmetry-based security proof method for a general type of MDI-QKD protocols. For these MDI-QKD protocols, there exist symmetric source states, which promise perfect privacy, i.e., with no information leakage. Therefore, for a generic source state input, the privacy of the protocol only depends on the ratio of the symmetric component contained in it, irrelevant of the channel noise. As a result, this symmetry-based security proof allows higher error tolerance compared with the original complementarity-based proof. For example, PM-QKD is proved to be able to yield positive key even with high bit error rate up to $50\%$ and surpassing the linear key rate bound even with bit error rate of $13\%$ Zeng et al. (2019).

From a technical point of view, the replacement of two-photon detection to single-photon detection is the key reason for the quadratic improvement, but single-photon interference with two remote independent lasers requires subwavelength-order phase stability for optical channels Duan et al. (2001), which is more demanding in long-distance communication than achieving two-photon interference which does not require phase stability between the two photons. Nonetheless, TF-QKD protocols are expected to be feasible with the current techniques of active phase randomization, optical phase-locking and so forth. Indeed, in 2019, four research groups have reported the experimental demonstrations on the feasibility of TF-QKD respectively Liu et al. (2019b); Wang et al. (2019a); Zhong et al. (2019); Minder et al. (2019). Very recently, the PM-QKD experiment has been realized with the random modulations and the consideration of finite-key effect Fang et al. (2019), whose key rate surpass the linear key rate bound via $302$ km and $402$ km commercial fibre; through a $502$ km ultra-low loss fibre with $87.1$ dB total loss, PM-QKD can yield key rate of $0.118$ bps with unconditional security. By using the ultra-stable cavity and optical phase lacking, the sending-or-not-sending version of TF-QKD protocol was demonstrated over $509$ km ultra-low loss fibre Chen et al. (2019), where the achieved secure key rate is even higher than that a traditional QKD protocol running with a perfect repeaterless QKD device. A proof-of-principle experiment has demonstrated TF-QKD over optical channels with asymmetric losses Zhong et al. (2020). Table 4 summarizes the recent TF-QKD experiments.

VII Continuous-Variable QKD

Broadly speaking, QKD can be divided into two classes, namely discrete variable (DV) or continuous variable (CV). Different from DV or qubit-based QKD, the secret keys in CV-QKD are encoded in quadratures of the quantized electromagnetic field and decoded by coherent detections Weedbrook et al. (2012). Coherent detection is a promising candidate for practical quantum-cryptographic implementations due to its compatibility with existing telecom equipment and high detection efficiencies without the requirement of cooling. CV-QKD protocols can be divided into several categories, according to the prepared state of coherent Grosshans and Grangier (2002) or squeezed state Hillery (2000), the modulation schemes of Gaussian Cerf et al. (2001) or discrete modulations Ralph (1999a); Hillery (2000); Reid (2000a), the detection schemes of homodyne Grosshans and Grangier (2002) or heterodyne detections Weedbrook et al. (2004), the error correction schemes of direct or reverse reconciliations Grosshans et al. (2003), and so forth.

In this section, we will primarily review the simplest and the most widely developed CV-QKD protocol – Gaussian-modulated coherent state (GMCS) protocol Grosshans and Grangier (2002); Grosshans et al. (2003) – which is believed as the core of today’s implementations. We will briefly discuss the security analysis and experimental developments of CV-QKD, together with a focus on the practical security aspects in its implementations, including the side channels and the advanced countermeasures. We will not cover too much about other CV-QKD protocols Silberhorn et al. (2002); Pirandola et al. (2008); Weedbrook et al. (2010a); Usenko and Grosshans (2015), which can be found in an earlier review Weedbrook et al. (2012). We also refer the readers to two recent CV-QKD reviews for the security analysis and practical issues Diamanti and Leverrier (2015), the issues of trusted noise Usenko and Filip (2016) and the models of implementation and noise Laudenbach et al. (2018).

VII.1 Protocol and security

VII.1.1 Gaussian-modulated protocol

The first Gaussian (continuous) modulated protocol ia a Gaussian-modulated squeezed state protocol Cerf et al. (2001), where the key is encrypted in the displacement of a squeezed state. The random choice of the direction to squeeze is similar to the basis choice in the BB84 protocol. The squeeze state protocol was later extended to GMCS protocols Grosshans and Grangier (2002); Grosshans et al. (2003) since coherent states are easier to prepare in practice. We summarize the prepare-and-measure version of a general GMCS protocol in Box VII.1.1. A difference from a DV-QKD protocol is that, in a coherent state protocol, the key information of both ’basis’ is encrypted into the prepared state simultaneously per channel use. Therefore, Bob’s measurement can be correlated with Alice’s key in either basis or both bases.

Box VII.A.1: GMCS QKD protocol.

(1) Alice produces two random numbers $x_{A}$ and $p_{A}$ from random numbers following a Gaussian distribution with a variance of $V_{A}N_{0}$, where $N_{0}$ is the vacuum noise unit.

(2) Alice prepares a coherent state $\ket{x_{A}+ip_{A}}$ and sends it to Bob through an untrusted quantum channel.

(3) Bob chooses homodyne (heterodyne) detection to measure $X$ and $P$ randomly (simultaneously) and obtains the outcomes $x_{B}$ and $p_{B}$.

(4) After repeating the above process $N$ times, Alice and Bob sift the measurement results by a classical channel, and obtain $N$ pairs of raw key, i.e, the correlated Gaussian variables, in the homodyne detection protocol ($2N$ pairs in heterodyne detection protocol).

(5) Alice and Bob perform the postprocessing on the raw key including parameter estimation, error correction and privacy amplification.

In GMCS protocol Grosshans and Grangier (2002); Grosshans et al. (2003), the source is a mixture of coherent state $\ket{\alpha_{j}}=\ket{x_{j}+ip_{j}}$ with quadrature components $x_{j}$ and $p_{j}$ as the realizations for two i.i.d. random variables $X$ and $P$. These two random variables obey the same zero-centred Gaussian distribution $\mathcal{N}(0,V_{m})$, where $V_{m}$ is the modulated variance. The total variance of the Gaussian modulated source is $V=V_{s}+V_{m}$, where $V_{s}$ is the intrinsic quadrature uncertainty of coherent state. Another type of GMCS scheme is coherent-state source mixed with trusted thermal noise Weedbrook et al. (2010b) whose total variance is $V=V_{s}+V_{m}+V_{th}$ with an additional thermal variance $V_{th}$. This type of protocol is also widely used due to its low cost in state preparation together with the feasibility for QKD in the wavelength longer than optical band. The decoding process is based on coherent detection measuring quadratures of optical fields. For CV-QKD schemes, coherent detection can be classified into homodyne detection and heterodyne detection, measuring quadratures of optical fields Weedbrook et al. (2012).

Note that the coherent state protocol with homodyne detection can be modified to a no-switching protocol using heterodyne detection, which enables the communication partners to extract secure key from both quadrature measurements Weedbrook et al. (2004). Post-selection Silberhorn et al. (2002) and two-way communication Pirandola et al. (2008) can also be applied to improve the performance. So far, the GMCS protocol is believed to be the best understood protocol in terms of security and implementation. Its implementation is also relatively simple, as it requires only standard technology in telecommunication.

VII.1.2 Discrete modulated protocol

Besides Gaussian-modulated protocol, there exists a different type of protocol using discrete modulation. Here the key is encoded into the random phases of coherent states, and the source is a $N$-discrete randomized coherent state mixture. In fact, discrete modulated protocol was proposed earlier than Gaussian modulated protocol Ralph (1999b); Hiroshima (2006); Reid (2000b). However, due to its non-Gaussian nature, a complete security proof of discrete modulated protocol that gives a good key rate in practice is challenging. In a discrete modulated protocol, Alice prepares an alphabet of $N$ coherent states $\ket{\alpha_{k}}=\ket{|\alpha|e^{i2k\pi/N}}$, where $k$ is the secret key. Bob uses either homodyne or heterodyne detection to estimate $k$. Discrete modulated protocol is more practical, because (i) a real Gaussian modulation can never be perfectly implemented, and (ii) it can simplify the crucial step of error correction. Early proofs of discrete modulated protocol restrict attacks to be a linear quantum channel between Alice and Bob Leverrier and Grangier (2009). Though there are proofs for specific protocols where $N=2$ Zhao et al. (2009) or $N=3$ Brádler and Weedbrook (2018), the key rate is quite pessimistic and cannot be generalized into multiple state cases.

Recently, the numerical method of security analysis has been proposed Coles et al. (2016), where the security analysis is transformed into a convex optimization problem with the constraints that the statistics of certain observable should be compatible with experimental data. Following this line, there are two independent works analyzing the asymptotic security of the quadrature-phase-shift-keying (QPSK) protocol Ghorai et al. (2019); Lin et al. (2019), i.e., $N=4$. With a photon number cut-off assumption on Bob’s side, it is feasible to compute the target function and constraints as a function of Alice and Bob’s two-mode state. Such a photon number cut-off assumption is valid since composable security proofs of CV-QKD usually require a projection onto a low-dimensional subspace of the Fock space, via some energy test Renner and Cirac (2009). These proofs can be generalized to multiple state cases, showing that the key rate converges to Gaussian modulated protocols when $N\rightarrow\infty$. Moreover, another security proof was reported lately by applying entropic continuity bounds and approximating a complex Gaussian probability distribution with a finite-size Gauss-Hermite constellation Kaur et al. (2019). Currently, to generalize those existing security proofs to the finite-size case remains an important open question.

VII.1.3 Security analysis

Intuitively, the security of coherent state protocol comes from the fact that coherent states are non-orthogonal, which ensures the no-cloning theorem. To rigorously analyze the security, it is convenient to consider an entanglement-based protocol. Alice prepares an two-mode EPR state $\ket{EPR}_{AA^{\prime}}$. She keeps one mode $A$ in her lab and sends the other mode $A^{\prime}$ to Bob through a noisy channel $\mathcal{E}_{A^{\prime}\rightarrow B}$. Alice performs heterodyne detection on her mode and gets a coherent state output, which is identical to preparing a coherent state to Bob from Eve’s point of view. We assume the worst case scenario where Eve holds a purification of $\rho_{AB}$, then the tripartite state shared by Alice, Bob and Eve is given by

[TABLE]

where $id_{A}$ denotes the identity map on Alice’s mode $A$ and $\mathcal{U}_{A^{\prime}\rightarrow BE}$ is an isometry. Alice and Bob’s secure information under collective attack in asymptotic limit, for reverse reconciliation, is given by the Devetak-Winter formula Devetak and Winter (2005),

[TABLE]

where $\chi(B:E)$ is the Holevo bound Holevo (1973). The supremum is computed over all possible quantum channels compatible with the statistics obtained in the parameter estimation step in implementation. The secure key can be distilled as long as Alice and Bob’s mutual information is larger than the maximum of Bob’s classical information accessible to Eve through the quantum channel between Bob and Eve.

Specifically, in the parameter estimation step, Alice and Bob exchange the statistics calculated from a subset of the sifted raw key, and estimate the covariance matrix of the two-mode state share by them,

[TABLE]

where $V_{A}$ and $V_{B}$ are the variance of the quadratures, $I_{2}$ is the two-dimensional identity matrix, and $Z$ is the covariance calculated by the experimental data.

Thanks to the Gaussian optimality proved in Navascués et al. (2006); García-Patrón and Cerf (2006); Wolf et al. (2006), the optimal collective attack Eve can implement is the one based on Gaussian operations, which result in a two-mode Gaussian state. Owing to the one-to-one correspondence between Gaussian states and covariance matrix, we can directly calculate the secure key rate under collective attack by the covariance matrix. Suppose the optimal attack is characterized by a Gaussian channel of transmittance $T$ and excess noise $\xi$, then there will be the following relations

[TABLE]

And the mutual information between Alice and Bob is given by

[TABLE]

where $\omega=1,2$ corresponds to Bob’s homodyne detection and heterodyne detection, respectively. The Holevo bound is calculated by

[TABLE]

where the second equation is because Eve holds a purification of $\rho_{AB}$ and $b$ is Bob’s measurement result. Both $S(AB)$ and $S(E|b)$ can be calculated from the corresponding covariance matrix $\gamma_{AB}$ and $\gamma_{E|b}$ Navascués and Acín (2005); Grosshans (2005). The form of $V(E|b)$ depends on homodyne detection or heterodyne detection that Bob performs. Notice that to obtain a secret key, the two important parameters are the transmittance $T$ and excess noise $\xi$, which should be carefully estimated in the parameter estimation step.

The above security analysis is restricted to collective attacks in the asymptotic limit of infinitely long keys. On one hand, one needs to generalize the collective attacks to coherent (or general) attacks, which is a challenging problem in CV-QKD. Fortunately, it turns out that collective attacks are as efficient as coherent attacks assuming the permutation symmetry of the classical postprocessing Renner and Cirac (2009). The phase-space symmetries and the postselection technique Christandl et al. (2009) can also be exploited to perform a reduction from general to collective attacks Leverrier et al. (2013). Recently, a new type of Gaussian de Finetti reduction was proposed which confirms the belief that proving the security against Gaussian collective attacks in CV-QKD is sufficient obtain the security against coherent attacks Leverrier (2017).

On the other hand, the security analysis should be extend to finite-key case. The finite-key rate will have a deviation from the asymptotic limit, which is due to the statistical fluctuations in parameter estimation. Moreover, other deviations arise when we assume Gaussian attacks and consider collective attacks instead of coherent attacks. These issues were well addressed in the literatures Furrer et al. (2012); Leverrier et al. (2013); Leverrier (2015). Based on postselection technique Christandl et al. (2009), the security of GMCS CV-QKD was proven against general attacks in the finite-size regime Leverrier et al. (2013), but the security proof is not composable. For composable security proof, Furrer et al. provide the first proof for CV-QKD with squeezed states using the entropic uncertainty principle Furrer et al. (2012), whereas the analysis is only moderately tolerant to loss. For coherent-state protocols, Leverrier gives the first composable security proof against only collective attacks Leverrier (2015), and proposes a new type of Gaussian de Finetti reduction which shows the potential for finite-key security with small data sizes Leverrier (2017). Nevertheless, the current proof techniques for composable security against coherent attacks still require rather large block sizes, e.g., $>10^{13}$ Leverrier (2017). The composable security of CV-QKD against coherent (or general) attacks in a realistic finite-size regime remains an outstanding open issue for the future study of improved proof techniques.

Beside coherent state, the squeezed state protocol has also been widely studied for CV-QKD. In a squeezed state protocol Hillery (2000); Cerf et al. (2001), Alice squeezes the $X$ quadrature of a vacuum state and displaces it by an amount $a$, which follows a Gaussian distribution of variance $V_{A}$. Then she adds a random phase of [math] or $\pi/2$ on it, which is equivalent to randomly choosing a direction to squeeze. Finally she randomly displaces the output state along the other direction (not the squeezing direction) following another Gaussian variable of variance $V$. The two variance $V_{A}$ and $V$ should satisfy $V_{A}+V^{-1}=V$ such that Eve cannot distinguish which quadrature is squeezed. Bob randomly measures $X$ or $P$ quadrature. Alice and Bob perform the postprocessing after a certain rounds of measurements. The squeezed state protocol is more similar to the DV-QKD protocols than the coherent state protocol. Its security is based on an entropic uncertainty principle Cerf et al. (2001). The composable security of finite size analyses have also been given in Furrer et al. (2012); Furrer (2014), together with experimental verifications Gehring et al. (2015).

VII.2 Experimental developments

The widely implemented CV-QKD protocol is the GMCS protocol Grosshans and Grangier (2002); Grosshans et al. (2003) (see Box VII.1.1) due to its simplicity in preparation, modulation and detection of coherent states. An illustration of the implementation is shown in Fig. 20 Lodewyck et al. (2007). Alice employs a laser diode to generate optical pulses, each of which is split into signal and local oscillator (LO) by a fiber-optic coupler. The signal pulses are modulated in amplitude and phase according to a Gaussian distribution, and attenuated to the desired modulation variance with a variable attenuator. The LO is time delayed and then combined with the signal at Alice’s output. Bob passively demultiplexes the signal and LO using a coupler and then performs the measurement using a shot-noise-limited homodyne detector. Bob can select the quadrature to be measured by adjusting the measurement phase with a phase modulator placed in the LO path. An advanced feature of this implementation is that it consists entirely of standard fiber optics and telecommunication components.

Reverse reconciliation was introduced to the GMCS protocol in 2003 Grosshans et al. (2003), which allows GMCS to beat the 3-dB loss limit. Moreover, a free-space experiment at visible light wavelength was also performed there. With telecom wavelength, GMCS was performed over practical distance of optical fibers (of 25km and 5km respectively) in Qi et al. (2007b); Lodewyck et al. (2007). Meanwhile, the heterodyne detection Lance et al. (2005) and Gaussian post-selection Symul et al. (2007) were also demonstrated. Later, the feasibility of GMCS CV-QKD was also extensively tested in field environments Fossier et al. (2009). The secure distance was substantially extended to 80 km based on the improved efficiency of the post-processing techniques Jouguet et al. (2013b). By controlling the excess noise, the distance was further extended to 100 km standard fiber Huang et al. (2016c). Recently, state-of-the-art CV-QKD implementations were sequentially reported, such as high-rate demonstrations with a secret key rate up to 3.14 Mbits/s in the asymptotic limit over 25-km fiber Wang et al. (2018b), a 4-node field network Huang et al. (2016b), a field test over 50-km commercial fiber Zhang et al. (2019c), a long-distance CV-QKD over about 200-km ultralow loss fiber Zhang et al. (2020), a Si photonic chip-based CV-QKD implementation Zhang et al. (2019a) and so forth. Although we focus on the GMCS implementations, we note several other important experiments, such as the squeezed-state protocols Gehring et al. (2015) and a CV-QKD experiment with entangled states over 50-km fiber Wang et al. (2018a). Some recent developments of CV-QKD are shown in Table 5.

From a practical point of view, CV-QKD presents the key advantage that it only requires standard telecommunication technology which is compatible with classical optical communications, i.e., it uses the coherent detection techniques instead of single-photon detection technology as required in DV-QKD. Moreover, the LO in CV-QKD can serve as a built-in single mode filter, which makes it naturally resistant against background noises Qi et al. (2010). This is particularly useful in the practical situations, including the coexistence of QKD with classical channels via DWDM Qi et al. (2010); Kumar et al. (2015b), the daylight free-space CV quantum communication Heim et al. (2014); Peuntinger et al. (2014); Vasylyev et al. (2017); Wang et al. (2019b). Nonetheless, CV-QKD systems are in general sensitive to losses, which restricts the secure distance, normally below 100 km fiber Jouguet et al. (2013b). However, in theory, CV-QKD may provide higher key rates than DV-QKD at relatively short distances because of its high dimensionality Jouguet et al. (2014), while the exact rate in terms of bits/s depends on the technology of real implementation. High-rate CV-QKD requires high-speed and real-time implementations of several challenging techniques Wang et al. (2018b), such as low-noise homodye detector, efficient error correction codes, precise parameter estimation etc. Also, the composable security proofs against general attacks still require a very large block sizes to allow a positive key in the finite-key regime Leverrier (2015), which cascades a challenge on the stability of the system. These issues are important subjects for future research.

VII.3 Quantum hacking and countermeasures

Similar to DV-QKD, the implementations of CV-QKD also suffer from side channels. On the source part, the Trojan horse attacks can probe Alice’s modulators in CV-QKD systems Jain et al. (2014). Similar to DV-QKD, a countermeasure is to put an optical isolator and a monitoring detector at the output of Alice’s setup. The imperfections in state preparation may also cause an increase of the excess noise and misestimate of the channel loss Liu et al. (2017). On the detection part, the wavelength dependence of the beam splitter can be exploited by Eve to hack CV-QKD based on heterodyne detection Huang et al. (2013); Ma et al. (2013c). Qin et al. demonstrated the detector saturation attack Qin et al. (2016) and blinding attack Qin et al. (2018) against homodyne detectors in CV-QKD by exploiting the nonlinear behavior of coherent detectors. A wavelength filter is effective against the first attack, and a proper monitor at detection may counter the second attack. A more general solution is to perform the real-time shot noise measurement as analyzed in Kunz-Jacques and Jouguet (2015); Zhang et al. (2019d).

To completely remove the detection attacks, a CV version of MDI-QKD was proposed Pirandola et al. (2015). See also Li et al. (2014); Ma et al. (2014) for a security analysis against restricted attacks. The concept is similar to the MDI-QKD protocol discussed in Section VI.2, but here Alice and Bob prepare coherent states with a Gaussian modulation and send them to Charlie. Charlie then mixes them on a balanced beam splitter, measures a different quadrature for both output modes and publicly announces his measurement results. The security of CV MDI-QKD can be analyzed by considering the entanglement-based version of the protocol Lupo et al. (2018). A proof-of-principle CV MDI-QKD experiment was demonstrated in free space with advanced detection techniques in 2015 Pirandola et al. (2015). Nonetheless, afull implementation with practical lengths of optical fibers is still a great challenge which has not been reported in the literature yet, partly because of the requirement of high-efficiency detection Xu et al. (2015a). Even so, CV MDI-QKD has the potential to provide slightly higher key rates, and it might be interesting for network communication over relatively short distances Pirandola et al. (2015).

Besides, an additional threat for CV-QKD is the transmission of LO, which can be manipulated by Eve. The attacks by controlling the transmitted LO were proposed in Ma et al. (2013b). Eve can also exploit a subtle link between the local oscillator calibration procedure and the clock generation procedure employed in practical setups Jouguet et al. (2013a). A countermeasure for the LO attacks consists of implementing a rigorous and robust real-time measurement of the shot noise Kunz-Jacques and Jouguet (2015); Zhang et al. (2019d). A better solution is the locally LO (LLO) CV-QKD scheme Qi et al. (2015); Soh et al. (2015) (see Fig. 21), which can completely avoid the transmission of the LO through the insecure channel. In this scheme, Bob uses a second, independent laser to produce LO pulses locally for the coherent detection. A challenge here is how to effectively establish a reliable phase reference between Alice’s and Bob’s independent lasers, which require a careful synchronization of the frequencies and phases. This can be achieved by sending the reference or pilot-aided pulse along with the signal pulse from Alice. Bob can use his LO pulse to perform coherent detection for the reference pulse to estimate the relative phase between Alice’s and Bob’s lasers. A phase correction can thus be established on Alice and Bob’s signal data in order to generate the secret key. Due to the enhanced security of LLO CV-QKD, there has been great attention in this scheme. In 2015, three groups have independently demonstrated LLO CV-QKD Qi et al. (2015); Soh et al. (2015); Huang et al. (2015a). These experiments are shown in Fig. 21. Afterwards, a LLO CV-QKD experiment with pilot and quantum signals multiplexed in the frequency domain was reported in Kleis et al. (2017), a comprehensive framework to model the performance of LLO CV-QKD was reported in Marie and Alléaume (2017), a pilot-assisted coherent intradyne reception methodology for LLO CV-QKD was proposed and demonstrated in Laudenbach et al. (2017), and a high rate LLO CV-QKD was demonstrated in Wang et al. (2018b).

VIII Other Quantum Cryptographic Protocols

VIII.1 Device-independent QKD

A QKD protocol is device-independent if its security does not rely on trusting that the quantum devices used are truthful. A schematic illustration of device-independent QKD (DI-QKD) is shown in Fig. 22. DI-QKD Mayers and Yao (1998); Barrett et al. (2005); Acín et al. (2007) (hinted earlier by Ekert Ekert (1991)) relaxes all modelling assumptions about the quantum devices and allows the users to do QKD with uncharaterized devices. DI-QKD performs self-testing of the underlying devices, i.e., the devices cannot pass the test unless they carry out the QKD protocol securely. As a result, as long as certain necessary assumptions are satisfied, one can prove the security of DI-QKD based solely on a Bell nonlocal behaviour, typically the violation of a Bell’s inequality, which certifies the presence of quantum correlations in a self-testing manner. Table 16 lists a summary of the necessary assumptions of DI-QKD Pironio et al. (2009). The security proofs have required the assumption that the devices have no memory between trials, or that each party has many, strictly isolated devices Barrett et al. (2005); Acín et al. (2007); Pironio et al. (2009); Masanes et al. (2011). If the devices have memory or the devices are reused, DI-QKD will suffer from the memory attacks Barrett et al. (2013) and covert channels Curty and Lo (2019).

The security proof for DI-QKD is a challenging task, because in DI-QKD, both the quantum state (generated by the source) and the measurement operators (by the detection devices) are untrusted or under Eve’s control. Fortunately, recent theory efforts have significantly advanced the developments of DI-QKD to be possible in a large quantum system Reichardt et al. (2013), secure for a large class of protocols by independent measurements Masanes et al. (2011), secure against general attacks Vazirani and Vidick (2014); Miller and Shi (2016) and robust against noise Arnon-Friedman et al. (2018). In the asymptotic case against collective attacks, the key rate formula can be expressed as a function of the Bell violation value. For a protocol where Alice and Bob carry out a CHSH-type Bell test for self-testing privacy, the key rate formula can be given by Pironio et al. (2009),

[TABLE]

where the quantum bit error rate $E$ determines the amount of randomness consumed for error correction, and the violation value $S$ of the CHSH inequality determines the amount of randomness for privacy amplification.

Though DI-QKD is remarkable in theory, unfortunately, it is hard to realize with current technology, because it needs almost perfect efficiency of single-photon detection Masanes et al. (2011). In experiments, however, the emitted photons may not be detected due to the losses in the transmission or the limited detection efficiency of imperfect detectors. In addition, a faithful realization of DI-QKD requires that the Bell inequality is violated under the following two conditions: (i) The measurement settings are not correlated with the devices; (ii) The devices observe a no-signalling behaviour in generating the outcomes. To meet these conditions, a so-called loophole-free Bell test normally needs to be carried out. A key problem in a loophole-free Bell test is the limited detection efficiency which is referred to as efficiency loophole Pearle (1970). It has been proved that for the simplest bipartite Bell inequalities with binary inputs and outputs, a detector efficiency of at least 2/3 is necessary for a faithful Bell inequality violation Eberhard (1993). For the purpose of DI-QKD, a much higher efficiency is needed due to the requirement of information reconciliation. To guarantee the no-signalling behaviour between devices, i.e., the locality loophole, a space-like separated measurement set-up can be implemented Aspect (1975). The requirement of uncorrelated inputs is referred to as the free-will loophole, which cannot be closed completely. Nonetheless, practical QRNGs can be used to overcome the problem to some extent.

Recently, an exciting news is that researchers have demonstrated the Bell’s inequality which simultaneously closed the locality loophole and the detection loophole in the same experiment Hensen et al. (2015); Shalm et al. (2015); Giustina et al. (2015); Rosenfeld et al. (2017); Liu et al. (2018b). This is a milestone result towards the realization of DI-QKD. In future, the advanced technologies might make DI-QKD more practical, and ideas such as qubit amplification Gisin et al. (2010) might also be proved useful to increase the key rate and distance of DI-QKD, though the key rate might be relatively low Curty and Moroder (2011); Seshadreesan et al. (2016). Recent theoretical progresses have proposed the two-way classical communication to enhance the noise tolerance Tan et al. (2020), and provided the detailed analysis towards the realization of DI-QKD Murta et al. (2019). Overall, we do believe that DI-QKD is an important subject for future research.

VIII.2 Some New QKD implementations

Besides the efforts in the security with imperfect devices, quite a few new QKD protocols have been proposed and implemented during the past ten years, which are summarized in Table 7.

VIII.2.1 Round-robin DPS QKD

In general, there exists a threshold of the error rate for each scheme, above which no secure key can be generated. This threshold puts a restriction on the environment noises. Especially, in the key rate formula, the bit error can be directly computed from the experimental data, whereas the phase error needs to be estimated or bounded. In the BB84 protocol with strong symmetries, both error rate are approximately the same in the long key length limit. In other protocols, normally there is a relation between the two error rates. In the end, when the bit error rate goes beyond some threshold level, no secure key can be generated. For example, BB84 cannot tolerate error rates beyond 25% considering a simple intercept-and-resend attack Bennett and Brassard (1984). This threshold puts a stringent requirement on the system environment, which makes some practical implementations challenging.

Round-robin differential phase shifted (RRDPS) QKD, proposed by Sasaki, Yamamoto and Koashi Sasaki et al. (2014) in 2014, essentially removes this restriction and can in principle tolerate more environment disturbance. In this protocol, Eve’s information can be bounded only by user’s certain experiment parameters other than the error rates. In particular, the phase error rate $e_{p}$ is determined by the user’s own settings rather than the channel performance, which makes the protocol fundamentally interesting and tolerate more errors.

In the RRDPS QKD protocol, the sender Alice puts a random phase, chosen from $\{0,\pi\}$, on each of $L$ pulses, with an average photon number of $\mu$ in such an $L$-pulse signal. Upon receiving the block, the receiver Bob implements a single-photon interference with an Mach-Zehnder interferometer (MZI), as shown in Fig. 23a. Bob can randomly adjust the length difference of the two arms of the MZI. After obtaining a detection click, Bob first identifies which two pulses interfere and then announces the corresponding indices $i$, $j$ to Alice. Alice can derive the relative phase between the two pulses as the raw key, and Bob can record the raw key from the measurement results. The phase error rate depends only on the number of photons in the $L$-pulse signal and $L$, not the bit error rate. By setting a larger $L$, the phase error tends to 0, and the scheme can tolerate a higher bit error rate.

Triggered by the original protocol, an alternative passive type of RRDPS QKD is proposed by Guan et al. Guan et al. (2015). As is shown in Fig. 23b, when Bob receives a block from Alice, he prepares a local $L$-pulse reference in plain phases, i.e., all phases are encoded at phase 0. This $L$-pulse reference interferes with the $L$-pulse signal sent by Alice on a beam splitter. For each block, Bob records the status of his two detectors with time stamps, $i$ and $j$. If Bob’s reference is in phase with Alice’s signal, i.e. Bob has a phase reference, the whole setup is essentially a huge Mach-Zehnder interferometer. Any detection signal at time slot $i$ will tell the phase difference between $i$ and the phase reference. Then the encoding bit value can be figured out by Bob. If the phase Bob’s reference is random relative to Alice’s signal, the interference is a Hong-Ou-Mandel type interference Hong et al. (1987) instead of a MZI. Bob post-selects the block where there are exactly two detections and announces their positions i and j (if i = j, the detection result is discarded). The raw key is the relative phase between these two pulses in the L-pulse signal. Alice can derive this phase difference from her record. While Bob can infer the bit value depending on that the coincidence happens between two different detectors or one detector at two different time slots. The security proofs of the two protocols are beyond the scope of the paper and we refer the readers to the original papers Sasaki et al. (2014); Guan et al. (2015).

The first published experimental result is based on the passive protocol Guan et al. (2015), as shown in Fig. 24a. Comparing to the original protocol, the passive one avoids randomly adjusting the length difference of the MZI. Based on the current technology, the main adjust-delay method is to utilize optical switches, which cannot provide both high speed and low insertion loss simultaneously. But meanwhile, it requires remote optical phase locking, which is challenging in the real deployment.

The key point for an active RRDPS is to realize the random time delay. Takesue et al. Takesue et al. (2015) exploits a one-input, four-output optical splitter followed by four silica waveguides based MZI with 0.5,1.0,1.5,2.0 ns temporal delays respectively, as is shown in Fig. 24b. Any two delays constitute a new MZI and the whole system realizes a $L=1-5$ variable delay. With this delay, the authors achieved secure key rate through 30 km fiber with an error rate of $18\%$. Later, Wang et al. Wang et al. (2015c), shown in Fig. 24c, combines a three-port circulator, a beam splitter, two $1\times 8$ optical switches followed with two groups of fiber delays. The two optical switches shall actively choose different delays and achieve a $L$=1 to 64 bit variable-delay Faraday-Michelson interferometer. Based on the delay, Wang et al. distributed a secret key over a distance of 90 km fiber. In addition, Li et al. Li et al. (2016) exploited a different configuration, which can be seen in Fig. 24d. They put 7 MZI in series to achieve a 127-value variable delays. And each MZI is constructed of a Pockels cell, a fiber, or free-space link with specific length and two polarizing beam splitters (PBSs). The Pockels cell, controlled by a random number, may change the polarization of the photon and thus provide a delay. Very recently, the secure distance is extended to 140 km by increasing the bound on information leakage Yin et al. (2018).

VIII.2.2 High-dimensional QKD

Besides the qubit-based QKD, the secret keys can also be encoded with multi-level system, i.e. high-dimensional QKD (HD-QKD). HD-QKD can provide higher key rate per particle comparing to the qubit system Bourennane et al. (2001), and it has a higher tolerance to noise Cerf et al. (2002). A recent review on the subject can be seen in Xavier and Lima (2020). The first experimental attempts of HD-QKD are using higher-order dimensional alphabets with spatial degrees of freedom of photons Walborn et al. (2006) or energy-time entangled photon pairs Ali-Khan et al. (2007). The later is shown in Fig. 25a. With this setup, Ali-Khan et al. can generate a large-alphabet key with over 10 bits of information per photon pair, albeit with large noise. QKD with 5% bit error rate is demonstrated with 4 bits of information per photon pair, where the security of the quantum channel is determined by the visibility of Franson interference fringes.

Zhang et al. Zhang et al. (2014b) reported a complete security proof of time-energy entanglement QKD using dual-basis interferometry. Mower et al. Mower et al. (2013) suggested to utilize dispersive optics to replace the Franson interferometer and demonstrated its security against collective attack. In this scheme, as shown in Fig. 25b Lee et al. (2014), Alice or Bob utilize normal or abnormal group-velocity dispersive element to measure the frequency basis. The absolute group delays of their dispersive elements are matched such that the group-velocity dispersion is nonlocally canceled. Alice and Bob use time basis measurements for generating keys and frequency basis measurements for bounding Eve’s maximum accessible information about the time basis measurements. This is based on the fact that the dispersion cancelation only happens with entanglement and any reduced entanglement visibility due to eavesdropping will bring a broaden time correlation measurement.

With the time energy entangled photon pairs, Zhong et al. observed a secure key rate of $2.7Mbps$ after 20 km fiber transmission with a key capacity of $6.9$ bits per photon coincidence Zhong et al. (2015). Recently, high-rate QKD using time-bin qudits was reported in Islam et al. (2017). Time energy type HD-QKD has advantage with a constant clock rate because it can utilize more time slots with high time resolution single photon detector. However, the advantage will be offset when the clock rate can be increased to the bandwidth of the single photon detector Zhang et al. (2008). One solution is to utilize a degree of freedom other than time, for example, the optical angular momentum (OAM). The first HD-QKD for OAM was published in 2006 Gröblacher et al. (2006). Qutrit entangled photon pairs were utilized to generate quantum key. In an E91-type protocolEkert (1991), the violation of a three-dimensional Bell inequality verifies the security of the generated keys. A key is obtained with a qutrit error rate of approximately 10%. Later, Etcheverry et al. report an automated prepare-and-measure HD-QKD with 16-dimensional photonic states Etcheverry et al. (2013); Mafu et al. exploit high-dimension OAM up to five dimensions for HD-QKD Mafu et al. (2013); Mirhosseini et al. use the OAM of weak coherent state and the corresponding mutually unbiased basis of angular position Mirhosseini et al. (2015); Sit et al. Sit et al. (2017) implement a field test of OAM HD-QKD in the city of Ottawa, where 4-dimensional OAM HD-QKD was implemented and a QBER of 11% was attained with a corresponding secret key rate of 0.65 bits per sifted photon (see Fig. 25c). Recently, Cozzolino et al., demonstrated OAM HD-QKD over a 1.2-km-long multi-mode fiber Cozzolino et al. (2019). Different groups utilized spatial-division multiplexing optical fibres, such as multi-core fibres, to perform HD-QKD Cañas et al. (2017); Ding et al. (2017).

Naively, one might think that since a HD-QKD system offers a higher key rate per signal than a qubit-based QKD system. It seems always better to use a HD-QKD system. One has to be very careful in making such a comparison, because key rate per signal may not be the best measure when the signal size itself is big. Key rate per second (certain period of time) can be a better merit for applications. In fact, a HD-QKD protocol uses many e.g. time-bins/modes for each signal. Now, if one were to use the many time-bins/modes separately and in parallel (with many sets of high-speed single photon detectors), one would actually get a higher key rate in such a multiplexed QKD system. At the end of the day, the private capacity per mode of a simple prepare-and-measure QKD system is limited by fundamental bounds Takeoka et al. (2014); Pirandola et al. (2017). The key rate of HD-QKD is still limited by those fundamental bounds. Nonetheless, HD-QKD may be useful in a practical situation, where the single photon detector has long dead time or resetting time and it can not operate at high speed Zhong et al. (2015). Overall, the practical advantages of HD-QKD in real-life applications remain to be seen in future.

VIII.2.3 QKD with wavelength-division multiplexing

Except for the new protocols, reducing the cost of QKD system is another important topic in the field. Wavelength-division multiplexing (WDM) technology, which enables the coexistence of QKD and telecom communication in a single fiber, is exploited to reduce the cost of the channel.

In order to protect ultra-weak QKD signals, most of previous QKD experiments are implemented in dark fibers. This implies dedicated fiber installations for QKD networks, which bears cost penalties in fiber leasing and maintenance, as well as limitations on the network scale. In classical optical communications, WDM technology has been widely exploited to increase the data bandwidth and reduce the requirement of fiber resource. Then, it is natural for QKD to coexist with classical optical communication based on WDM technology. The scheme of simultaneously transmitting QKD with conventional data was first introduced by Townsend in 1997 Townsend (1997). A series of QKD experiments integrating with various classical channels have been demonstrated Chapuran et al. (2009); Eraerds et al. (2010); Patel et al. (2012, 2014); Wang et al. (2015b); Dynes et al. (2016). Currently, by using spectral and temporal controls, state-of-the-art developments have been made to realize co-propagation of QKD with one 100 Gbps dense wavelength-division multiplexing (DWDM) data channel in 150 km ultra-low loss fiber at $-5dBm$ launch power Fröhlich et al. (2017). By setting QKD wavelength to 1310 nm and inserting $100GHz$ DWDM filters, Wang et al. implement QKD together with classical traffic with $11dBm$ input power over 80 km fiber spools Wang et al. (2017b). A field trial of simultaneous QKD transmission and four 10 Gbps encrypted data channels was implemented over 26 km installed fiber at $-10dBm$ launch power Choi et al. (2014).

Recently, the coexistence of QKD and commercial backbone network of $3.6Tbps$ classical data over 66 km fiber at 21 dBm launch power has been demonstrated Mao et al. (2018). The system provides 3 kbps secure key rate with a 2.5% quantum bit error rate. Note that in current backbone networks, the data traffic is around Tbps and the launch power is around 20 dBm. In that sense, the recent work Mao et al. (2018) demonstrate the possibility of coexistence of QKD with backbone network.

VIII.2.4 Chip-based QKD

Integrating QKD system has attracted more and more attention due to its advantage at compact size, low energy consumption and potential for low cost Orieux and Diamanti (2016). QKD, including optics and electronics, is a complicated system. Thus an integrated QKD system research should include integrating both optics and electronics. Fortunately, the integrated circuits (IC) is already commercialized and integrated optics is also well developed in industry. Table 6 summarizes a list of chip-based QKD experiments.

In 2005, a commercial unbalanced Mach-Zahnder interferometer made of planar lightwave circuits (PLC) based on silica-on-silicon technology was exploited for the first time in a QKD system Takesue et al. (2005) to replace the fiber based interferometer. Comparing to its fiber counterpart, PLC interferometer is more stable and can maintain its phase for several hours without any feedback Takesue et al. (2007); Nambu et al. (2008). Meanwhile, IC is exploited in a research towards compact and low cost QKD system Duligall et al. (2006). As is shown in Fig. 26a. Alice module uses off-the-shelf IC components in a driver circuit to control four AlInGaP LEDs to emit four polarized BB84 states. The channel is a several-meter free space link, which is supposed to find application in a future quantum based Automated Teller Machine and even in a smart phone Pizzi et al. (2012) according to the authors. Along this direction of research, Gwenaelle Vest et al. demonstrated an integrated QKD sender Vest et al. (2015), where an array of four vertical cavity surface emitting lasers (VCSELs) emit synchronized picosecond optical pulses, which are coupled to micro-polarizers generating the polarization qubits. The final size of the QKD device can be as small as $25mm\times 2mm\times 1mm$, which makes the system a strong candidate for short distance free-space QKD applications.

On the metropolitan fiber network side, many individual users in the network will trust a central relay station. This is so called network-centric structure Hughes et al. (2013) or access network Fröhlich et al. (2013). In such a structure, many users are all the senders and share only one central relay receiver. In that sense, the receiving station can have more space and expensive and bulky detection system can be used. Therefore, the community concentrates more integration efforts in the sending side. Hughes et al. provided a QCard Hughes et al. (2013) in their pioneering paper, as is shown in Fig. 26b. The QCard has a similar size as an electro-optic modulator or a normal key. It incorporates a distributed feedback laser and modulator. The laser is attenuated into single photon level and modulated into BB84 polarization-state with decoy state. The repetition frequency is 10 MHz at the wavelength of 1550 nm, the telecom band.

Recently, the size of the QKD sender has reduced dramatically. In 2014, Zhang et al. put forward an on-chip LiNbO3 polarization rotator and demonstrated the reference-frame-independent QKD protocol to overcome unstable fibre birefringence Zhang et al. (2014a). In 2015,, the same group from University of Bristol implemented integration of QKD based on an indium phosphide transmitter chip and a silicon oxynitride receiver chip Sibson et al. (2017a). This chip is shown in Fig. 26d. The authors exploited the chips in three different QKD protocols, namely BB84, coherent-one-way and differential-phase-shift QKD.

Later, researchers from University of Toronto Ma et al. (2016a) and Bristol Sibson et al. (2017b) exploited Silicon photonics to build QKD sender system, respectively. As shown in Fig. 26c, Ma et al. Ma et al. (2016a) fabricated the QKD sender chip with a standard Si photonic foundry process and integrated two ring modulators, a variable optical attenuator and a polarization modulator in a $1.3mm\times 3mm$ die area. Meanwhile, Sibson et al. Sibson et al. (2017b) demonstrated coherent one-way QKD, polarization encoded BB84, and time-bin encoded BB84 based on Si photonic devices. The authors achieve estimated asymptotic secret key rates of up to 916 kbps and QBER as low as 1.01% over 20 km of fiber. The clock rate of later experiment is much higher than the former one. However, Ma et al. integrated more components on the chip, i.e., the whole QKD emitter.

Very recently, other research groups have demonstrated high-speed Si photonic chips for high dimensional QKD over multimode fiber Ding et al. (2017), transceiver circuit Cai et al. (2017) and metropolitan QKD Bunandar et al. (2018). Moreover, CV-QKD is naturally suitable for photonic chip integration as its implementation is compatible with current telecom technologies (see Section VII). In particular, CV-QKD essentially uses the same devices as classical coherent communication, and only homodyne detector is required rather than the dedicated single-photon detector. Indeed, a recent experiment demonstrates Si photonic chips for CV-QKD, which integrates all the optical components (except the laser source) Zhang et al. (2019a). Furthermore, based on the directly phase modulated light source Yuan et al. (2016); Roberts et al. (2018), a modulator-free QKD transmitter chip was demonstrated in Paraïso et al. (2019). This approach has the advantages that do not require conventional phase modulators, and it is versatile to accommodate several QKD protocols, such as BB84, COW and DPS, using the same optics.

VIII.3 Other quantum cryptographic protocols

So far, QKD is the most developed and mature subfield of quantum cryptography. Meanwhile, quantum cryptography has many other protocols Broadbent and Schaffner (2016), which also have achieved quite remarkable progresses. A list of recent developments of other quantum cryptographic protocols is shown in Table 8. We will review a few examples.

VIII.3.1 Quantum bit commitment

Bit commitment is another important and fundamental cryptographic task that guarantees a secure commitment between two mutually mistrustful parties. Alice first commits her to a particular bit value $b$. After a period of time, Alice reveal the bit value to Bob. A success bit commitment requires that Bob can not learn $b$ before Alice reveals it, which is called concealing criterion. Meanwhile, Alice should not change $b$ once she made the commitment. This is called binding criterion. Bit commitment is a building block for many cryptographic primitives, including coin tossing Brassard and Crépeau (1991), zero-knowledge proofs Goldwasser et al. (1989); Goldreich et al. (1986), oblivious transfer Bennett et al. (1992b); Unruh (2010) and secure two-party computation Kilian (1988).

In conventional cryptography, bit commitment is based on computational complexity assumptions similar to public key exchange protocols and might be vulnerable to quantum attacks. Unfortunately, it has been proven that information-theoretically secure bit commitment is impossible even if Alice and Bob are allowed to use quantum resources in the standard quantum circuit model by Mayers Mayers (1996, 1997) and by Lo and Chau Lo and Chau (1997). Subsequently, such a no-go theorem has been further extended to case with superselection rules Kitaev et al. (2004). For an re-examination of this result, see e.g. D’Ariano et al. (2007). Furthermore, information-theoretic security of oblivious transfer and two-party secure computations are also proven to be impossible in Lo (1997).

Interestingly, if we take into account the signalling constraints implied by the Minkowski causality in a relativistic context, it has been shown that there are bit commitment protocols offering unconditional security Kent (2012); Kaniewski et al. (2013). On the experimental side, two groups implemented the secure relativistic quantum bit commitment simultaneously in 2013. One followed the original protocol and utilized decoy state method in free-space channel Liu et al. (2014) and the other exploited a revised protocol with a plug and play system, in fiber link Lunghi et al. (2013). Both experiments were secure against any quantum or classical attack. The commitment time is defined as the maximal time during which the commitment can be held. The commitment time in these two experiments, however is limited to 21 ms if all attendees are located on Earth considering the relativistic constrains. Later, new protocols with weaker security but longer commitment time was proposed Lunghi et al. (2015); Chakraborty et al. (2015). A 24-hour committed experiment Verbanis et al. (2016) was presented, which is secure against only classical attacks. Alternatively, secure quantum bit commitment can be achieved with some additional physical assumptions as, for example, that the attacker’s quantum memory is noisy Ng et al. (2012).

VIII.3.2 Quantum digital signature

Comparing to the previous two-party protocols, digital signature has one sender and multiple recipients, requiring that the messages cannot be forged or tampered with. Classical digital signature mainly exploits the Rivest-Shamir-Adleman protocol Rivest et al. (1978), the security of which is based on the mathematical complexity of the integer factorization problem. Based on the quantum physics, quantum digital signature (QDS) protocol was provided Gottesman and Chuang (2001), which could provided information-theoretical security Guest (2001). Although novel, this protocol needs nondestructive state comparison, long-time quantum memory, and a secure quantum channel for real application. Thereafter, QDS has attracted a great deal of interest in both theory Andersson et al. (2006); Dunjko et al. (2014); Wallden et al. (2015) and experiment Clarke et al. (2012); Collins et al. (2014); Donaldson et al. (2016). All the three requirements have been fixed sequentially Clarke et al. (2012); Collins et al. (2014); Donaldson et al. (2016). Later, more than 100 km QDS experiment has been demonstrated based on decoyed BB84 system Yin et al. (2017a) and DPS QKD Collins et al. (2016), which are also secure against PNS attack. Very recently, measurement-device-independent (MDI) QDS have been implemented in both lab Roberts et al. (2017) and field Yin et al. (2017b).

VIII.3.3 Other protocols

QKD has been assuming that the eavesdropper has unlimited power as long as it is not violated quantum physics. A protocol is said to be information-theoretically secure if it allows an adversary (e.g. an eavesdropper) to have unlimited quantum computing power as long as it does not violate quantum mechanics. As noted in Section VIII.3.1 above, information-theoretic security is not possible for quantum bit commitment, quantum oblivious transfer and two-party secure quantum computation. Naturally, restriction on adversary’s power can expand the territory of quantum cryptography. Wehner et al. Wehner et al. (2008) proposed one realistic assumption that quantum storage of qubits is noisy and demonstrated that an oblivious transfer protocol is unconditionally secure for any amount of quantum-storage noise DamgÅrd et al. (2008); Konig et al. (2012). Similar as bit commitment, oblivious transfer protocol is another primitive cryptograph protocol between two entrusted parties. The demonstration of the protocol was performed based on a modified entangled QKD system Erven et al. (2014). The experiment exchanged a 1,366 bit random oblivious transfer string in 3 minutes and include a full security analysis under the noisy storage model, accounting for all experimental error rates and finite size effects.

Similar to bit commitment and oblivious transfer, a quantum protocol for coin flipping Blum (1981) can be unconditionally secure when considering relativistic constrains. This also means that without relativistic designs, no bias coin flipping could not be unconditionally secure Lo and Chau (1998). Nevertheless, a quantum protocol can limit the cheating probability strictly lower than $1/\sqrt{2}$ Aharonov et al. (2000); Kitaev (1999). The first experimental demonstration was provided with OAM qutrit entangled photon pairs, which shows the quantum advantage in coin flipping for the first time Molina-Terriza et al. (2005). As a proof of principle demonstration, this experiment does not consider the channel loss. Theoretical and experimental efforts have been attempted towards this direction Nguyen et al. (2008); Berlín et al. (2011); Pappa et al. (2014). For instance, an implementation of the loss-tolerant protocol using an entangled-photon source was provided Berlín et al. (2011). The secure distance was extended to 15 km with a modified plug and play system Pappa et al. (2014).

Quantum data locking DiVincenzo et al. (2004) allows one to lock information in quantum states with an exponentially shorter key, presenting an efficient solution to many resource-limited secure applications. However, the original quantum data-locking scheme may suffer from significant qubit loss. In 2013, Fawzi, Hayden, and Sen (FHS) developed a loss-tolerant quantum data-locking scheme Fawzi et al. (2013), in which the possible information leakage can be made arbitrarily small in a lossy environment while the unlocked information is significantly larger than the key size. This feature makes the protocol attractive also in secure communication Lloyd (2013); Lupo et al. (2014). Two groups have implemented the loss tolerant protocols respectively Liu et al. (2016); Lum et al. (2016).

Quantum secret sharing was proposed to share a secret quantum state among multiple parties Cleve et al. (1999) or to use quantum states to share classical secrets Hillery et al. (1999); Cleve et al. (1999). Moreover, secure multi-party computing has been extended to quantum computation with quantum inputs and circuits Crépeau et al. (2002).

In distributed quantum computing, quantum crypto protocols are still inevitable. Quantum computing is currently attracting tremendous interest from both academic and industry Mohseni et al. (2017). However, due to its implementation complexity and cost, the future path of quantum computation is strongly believed to delegate computational tasks to powerful quantum servers on cloud Fitzsimons (2017). Universal blind quantum computing (UBQC) Broadbent et al. (2009) is an effective method for a common user, who has limited or no quantum computational power, to delegate computation to an untrusted quantum server, without leaking any information about the user’s input and computational task. The security or blindness of the UBQC protocol is unconditional, i.e., the server cannot learn anything about user’s computation except its size. A proof of concept demonstration was reported in 2012 Barz et al. (2012). Recently, UBQC protocol with completely classical clients was proposed Reichardt et al. (2013) and demonstrated in experiment Huang et al. (2017). UBQC with weak coherent states was proposed in Dunjko et al. (2012), and adding the ingredient of decoy states, an efficient experimental demonstration with weak coherent states was made in Jiang et al. (2019). Because of the developments in the field of quantum computing, we expect that BQC will play an important role in the future infrastructure of delegated quantum computation Fitzsimons (2017).

IX Concluding Remarks

In this review, we have discussed the security aspects of practical QKD. These range from the security proofs of practical QKD (Section II), the implementation (Section III), the practical vulnerabilities (Section IV), to the solutions of advanced QKD protocols (Sections V, VI and VII) and the advances of other quantum cryptographic protocols (Section VIII.3).

Historically, QKD has been a concrete playground for concepts in quantum mechanics. The study of QKD often leads to unexpected insights in other areas of quantum information. For instance, apparently the concept of quantum teleportation was invented during a search for a security proof of QKD Bennett et al. (1993). We expect that in future the study of QKD will continue to lead to many new insights in other subfields of quantum information.

Meanwhile, as a new technology stemming from the counterintuitive theory of quantum physics, QKD might not be easy to be understood and recognized by a general audience. For broad interest, in Appendix A, we summarize a few frequently asked questions/concerns on practical QKD, together with our views on how they can be overcome. Finally, we discuss the perspectives on the past, the present and the future about the developments of QKD.

Overall, during the past three decades, the theory and practice of QKD have developed extensively. These developments can be divided into several stages, which can be summarized as follows (with a focus on DV-QKD).

Stage 1. After the invention by Bennett-Brassard Bennett and Brassard (1984) and Ekert Ekert (1991), QKD was first demonstrated in the early 1990s Bennett et al. (1992a), which started a series of theories and experiments Townsend et al. (1993); Townsend (1994); Franson and Jacobs (1995); Muller et al. (1996) to prove the possibility of QKD. 2. 2.

Stage 2. The implementation of QKD was extended from laboratory to outdoor environments, and various technical difficulties were studied Townsend (1997); Buttler et al. (1998); Hughes et al. (2000); Ribordy et al. (2000); Gobby et al. (2004). See ref. Gisin et al. (2002) for a review on the developments in early experiments. Meanwhile, on the theory side, the security proof of QKD was a major challenge until a few papers appeared and solved the problem Mayers (2001); Lo and Chau (1999); Shor and Preskill (2000); Biham et al. (2000). These results put the security of QKD on a solid foundation. 3. 3.

Stage 3. With the security proofs for QKD under imperfect devices Gottesman et al. (2004); Hwang (2003); Lo et al. (2005); Wang (2005), the feasibility of QKD was demonstrated from short range to long range, up to the scale of 100-km standard fiber Zhao et al. (2006b); Rosenberg et al. (2007); Peng et al. (2007) and free space Schmitt-Manderbach et al. (2007). 4. 4.

Stage 4. QKD was extensively deployed from point-to-point to small-scale metropolitan networks in field Elliott et al. (2005); Chen et al. (2009); Peev et al. (2009); Sasaki et al. (2011). Meanwhile, the practical security loopholes, particularly those for detection devices, were identified Lydersen et al. (2010) and then removed by the advanced MDI-QKD protocol Lo et al. (2012) [see also Braunstein and Pirandola (2012)]. 5. 5.

Stage 5. The feasibility of QKD was extended to long distances and high rates, such as in a scale of 400 km Yin et al. (2016); Boaron et al. (2018) over ultra low-loss fiber and 1200-km over free space Liao et al. (2017a), and a secret key rate of over 10 Mbits/s with GHz QKD system Yuan et al. (2018). 6. 6.

Stage 6. QKD was implemented from small scale to large scale that covers a wide area Chen et al. (2020). See Fig. 2 for an example of the QKD network which has more than 700 QKD links, and covers more than 2,000 km area. New TF-QKD protocols Lucamarini et al. (2018) were proposed to enable secure QKD over even longer distances Fang et al. (2019); Chen et al. (2019).

In future, towards the ultimate goal of a global QKD network, we expect that more and more QKD networks will be built in different countries. Besides physics, communities of computer science, engineering, optics, mathematics and so forth may work together to realize this goal. We do believe that a revolutionized global QKD network for secure communication stemming from quantum physics will be deployed and find widespread applications in the near future. This review is concluded with a discussion on a few directions for future research.

Quantum repeaters. Quantum repeater can achieve an effective restoration of the quantum information without resorting to a direct measurement of the quantum state Briegel et al. (1998); Duan et al. (2001), enabling the realization of global quantum network in existing optical networks. Quantum repeater has received intense research efforts in recent years Kimble (2008); Sangouard et al. (2011); Pan et al. (2012); Wehner et al. (2018). Nonetheless, the limited performance of quantum memory is still a major obstacle in realizing practical quantum repeaters without a future experimental breakthrough Sangouard et al. (2011); Yang et al. (2016). New recent approaches manage to reduce the need for a quantum memory by using all-photonic quantum repeaters Azuma et al. (2015a); Hasegawa et al. (2019); Li et al. (2019), but they require the resources of large-scale cluster states. Overall, we believe that quantum repeater is an important subject for future research. The first goal is to realize a practical quantum repeater that can beat the fundamental limits of direct quantum communication Takeoka et al. (2014); Pirandola et al. (2017). 2. 2.

Standardization. Towards the widespread applications, the commercial standards for QKD should be established. Important progress has been made in this direction, such as the efforts of ETSI, ISO/IEC, CCSA and ITU by several countries. One important direction is to include the practical security into the standardization process, by defining the best practices to operate QKD systems and standardizing those countermeasures to guarantee the security of a QKD setup. We encourage future research to establish the commercial standards for QKD. 3. 3.

Battle-testing security. We have provided a review on the practical vulnerabilities in Section IV, together with the solutions of advanced countermeasures and QKD protocols. However, the practical security issue has not been perfectly solved. For instance, as discussed in Section VI.2, a security assumption in MDI-QKD is that the source should be trusted without loopholes. It is important to verify this assumption in practice. Hence, the research in analyzing the practical security of QKD setup should continue. This includes the developments of practically-secure QKD systems building on the experience gained from the research on practical vulnerabilities and advanced countermeasures. It is highly important to battle-test existing QKD implementations, quantify and validate the security claims of real-world QKD systems, and design real-life QKD systems with testable security assumptions. 4. 4.

Small-size, low-cost, long-distance system. Recent developments of integrated QKD system have been reviewed in Section VIII.2.4. These developments should continue to further reduce the costs and sizes of QKD, and to realize robust fully-integrated chip-based QKD systems. One important direction is to develop the star-type quantum access network Hughes et al. (2013); Fröhlich et al. (2013), in which the expensive devices such as single-photon detectors can be placed in the central relay and many users share this relay. Each user requires only a low-cost transmitter such as a compact QCard Hughes et al. (2013) or a simple Si chip Ma et al. (2016a); Sibson et al. (2017a). Together with MDI-QKD, the central relay can be untrusted. Wei et al., already implemented the first chip-based MDI-QKD at high secret key rates Wei et al. (2019b). This is particularly valuable for star-type metropolitan QKD networks. Moreover, by using the new type of twin-field QKD Lucamarini et al. (2018), the distance can be further extended for intercity QKD. Therefore, we expect that MDI-type QKD networks will play an important role in the future global quantum network. 5. 5.

QKD network with untrusted relays. The previously deployed networks were based on trusted relays Elliott et al. (2005); Chen et al. (2009); Peev et al. (2009); Sasaki et al. (2011); Chen et al. (2020), which may raise the concern about the security properties of the relays. To remove this concern, it is important to develop QKD network with untrusted relays. In fact, MDI-QKD is naturally suitable for a star-type metropolitan network with an untrusted relay. Tang et al., already put forward the first implementation of a MDI-QKD network Tang et al. (2016b). We expect that metropolitan MDI-QKD networks will be built soon. Besides, the TF-QKD can also be adopted to extend the transmission distance with an untrusted relay. Moreover, in entanglement-based QKD, the relay can be fully untrusted. A possible direction is to develop a entanglement-based QKD network, e.g., based on satellite Yin et al. (2019). For ultralong-distance QKD in fiber, it needs the quantum repeaters Sangouard et al. (2011) to realize QKD networks with untrusted relays. We expect that with the technical improvements, quantum-repeater assisted QKD network may be achieved in the near future. 6. 6.

Satellite-based QKD. The reported satellite-based QKD was based on a low-earth-orbit (LEO) satellite of Micius Liao et al. (2017a, 2018). To increase the coverage time and area for a more efficient satellite-based QKD network, one can launch higher-orbit quantum satellites and implement QKD in daytime. Important progress has been made in this direction Hughes et al. (2002); Liao et al. (2017b). An ultimate goal is to realize a satellite-constellation-based global quantum network.

Acknowledgement

We thank enlightening discussions with and helpful comments from the reviewers and the numerous colleagues including, K. Azuma, D. Bacco, C. H. Bennett, Y.-A. Chen, A. Huang, D. Huang, M. Lucamarini, Y. Liu, S. Pirandola, B. Qi, K. Tamaki, K. Wei, G. B. Xavier, Z. Yuan P. Zeng and H. Zhou. F. Xu, X. Ma, Q. Zhang and J.-W. Pan were supported by the National Key Research and Development (R&D) Plan of China, the National Natural Science Foundation of China, the Anhui Initiative in Quantum Information Technologies and the Chinese Academy of Sciences. H.-K. Lo was supported by NSERC, US Office of Naval Research, CFI, ORF, MITACS Accelerate, Royal Bank of Canada (RBC) and Huawei Canada.

Appendix A General questions to QKD

We summarize a few frequently asked concerns on QKD and our views on how they can be overcome.

Concern 1. Since RSA is secure under current computational power, we do not need QKD now.

Our view. Some important data such as government secrets and health data need to kept secret from decades, i.e., long-term security. RSA cannot guarantee long-term security, because one can record the encrypted information and later on decrypt it when the quantum computer comes up or new advanced algorithm is discovered. In contrast, QKD can provide everlasting security, which is independent of all future hardware advances. Hence, QKD is required today for the transmission of top-secret data. 2. 2.

Concern 2. QKD vs post-quantum cryptography.

Our view. QKD and post-quantum cryptography are two parallel research directions. They go hand in hand with each other. It is not an “either-or" situation. Post-quantum cryptography has the advantages of being compatible with existing crypto infrastructure, but it has the drawback that its security cannot be proven or it is only secure against known quantum attacks. In contrast, QKD has the advantage of proven security based on the laws of quantum physics, but it is a symmetric-key algorithm, which can not replicate all the functionalities of public-key cryptography. In future, we believe that QKD is likely to be combined with the post-quantum cryptography to jointly form the infrastructure of quantum-safe encryption scheme. 3. 3.

Concern 3. QKD does not address large parts of the security problem.

Our view. The secure keys generated from QKD have widespread applications, such as encryption and authentication. Note that in QKD, authentication is only required in a short period, and once it is done, QKD can be employed for encryption in a rather long period202020As an example, one can even use public key based authentication scheme in the initial authentication of a QKD session. Provided that the public key based authentication scheme is secure during the short time for initial authentication, the generated QKD key will be secure forever. Therefore, post-quantum cryptography and QKD may go hand in hand.. Moreover, with the developments on high key-generation rate, QKD is also suitable for some of the future challenges such as securing the Internet of Things, big data, or cloud applications. Furthermore, as mentioned in Section VIII.3.2, there exists quantum digital signature schemes with information-theoretical security. 4. 4.

Concern 4. Distance limitation.

Our view. In fiber, even without quantum repeater, the feasibility of QKD has been proved in experiments over long ranges of 400-500 km Yin et al. (2016); Boaron et al. (2018); Fang et al. (2019); Chen et al. (2019). Using trusted relays, the distance has been extend to 2000 km fiber Chen et al. (2020). Using quantum satellite, QKD has been demonstrated 7600-km Liao et al. (2018). Moreover, with the help of quantum repeaters Briegel et al. (1998); Duan et al. (2001), QKD is feasible over arbitrarily long distance even with untrusted relay nodes. Important progress has been made in the developments of quantum repeaters Pan et al. (2012); Munro et al. (2015). 5. 5.

Concern 5. Cost limitation.

Our view. The recent developments of integrated QKD, such as compact transmitter Hughes et al. (2013) and Si photopic chip-based QKD systemsMa et al. (2016a); Sibson et al. (2017a); Wei et al. (2019b), demonstrated already the possibility of low-cost hardware for QKD. Hence QKD is very likely to be cost-effective. See Section VIII.2.4 for detail. 6. 6.

Concern 6. Point-to-point limitation.

Our view. Small-scale metropolitan QKD networks were intensively deployed in field by several countries Elliott et al. (2005); Chen et al. (2009); Peev et al. (2009); Sasaki et al. (2011). A large-scale network which covers a wide area was established lately Chen et al. (2020). These networks already enable secure QKD for multiple users instead of point-to-point. Furthermore, the recent discovery of MDI-QKD protocols Lo et al. (2012) and TF-QKD protocols Lucamarini et al. (2018) work well in a star-type network setting Xu et al. (2015a) by sharing a single detection system between multiple users. A prototype of MDI-QKD network has already been implemented in 2016 Tang et al. (2016b). Therefore, these QKD networks and advanced QKD protocols enable QKD for network settings beyond point-to-point. 7. 7.

Concern 7. Trusted-relay limitation.

Our view. The discovery of MDI-QKD protocols Lo et al. (2012) and TF-QKD protocols Lucamarini et al. (2018) enable QKD with untrusted relays. Moreover, entanglement-based QKD works well with untrusted relays, and it has been demonstrated between two ground stations separated by a distance over 1120 kilometers Yin et al. (2019). Furthermore, quantum repeaters Briegel et al. (1998); Duan et al. (2001) enable secure QKD over arbitrarily long distance even with untrusted relay nodes. Hence trusted node is not a true limitation in QKD. 8. 8.

Concern 8. Hardware patches are expensive.

Our view. MDI-QKD already enables secure QKD with untrusted measurement devices, in which the expensive measurement devices do not need to be recalled/replaced once they are installed. Moreover, chip-based QKD makes the patches for hardware at a low-cost and simple manner. We believe that a star-type of MDI-QKD network, together with chip-based transmitter, is promising to realize a low-cost and practical QKD for applications. 9. 9.

Concern 9. Security loopholes in practical QKD.

Our view. Researchers in the filed of QKD have extensively understood and managed the security loopholes. All quantum attacks reported in the literature have been reviewed in Section IV. Those crucial loopholes have been eliminated by designing advanced countermeasures (Sections V, VI and VII). In particular, MDI-QKD has removed the weakest security link, i.e., the detection, in a standard QKD system Lo et al. (2012). Secret sharing ideas have been proposed to foil covert channels and malicious classical post-processing units Curty and Lo (2019). Advanced technology in the future might make DI-QKD feasible Hensen et al. (2015). Therefore, the gap between theory and practice of QKD has been reduced remarkably, and a number of loopholes have been completely removed. These achievements have made QKD a robust solution for secure communication. 10. 10.

Concern 10. Denial of service (DoS) attack.

Our view. One solution for DoS attack is to use alternative channel links by designing suitable network architectures. For instance, a circle type of QKD network has been implemented in the Beijing metropolitan network (see Fig. 2). Moreover, Tokyo Sasaki et al. (2011) and SECOQC Peev et al. (2009) QKD networks have demonstrated robustness against DoS attacks already. The other solution is that the secure communication can be done offline. One can load the secret keys, generated from QKD, to USB or mobile phones. The secure communication via mobile phone will be immune to DoS attack. This method already finds commercial use, see e.g., the QUKey212121www.quantum-info.com/English/product/2017/1007/394.html.