Practical quantum key distribution with non-phase-randomized coherent states

TL;DR

This paper introduces a six-coherent-state phase-encoding QKD protocol that can tolerate high losses, making coherent-state QKD more viable for long-distance secure communication with realistic system parameters.

Contribution

It proposes a new six-coherent-state protocol with enhanced loss tolerance and a security proof based on semi-definite programming, extending the feasible distance for coherent-state QKD.

Findings

Tolerates up to 38 dB loss with realistic parameters

Can handle up to 56 dB loss with zero noise

Suggests coherent-state QKD as a promising high-speed secure method

Abstract

Quantum key distribution (QKD) based on coherent states is well known for its implementation simplicity, but it suffers from loss-dependent attacks based on optimal unambiguous state discrimination. Crucially, previous research has suggested that coherent-state QKD is limited to short distances, typically below 100 km assuming standard optical fiber loss and system parameters. In this work, we propose a six-coherent-state phase-encoding QKD protocol that is able to tolerate the total loss of up to 38 dB assuming realistic system parameters, and up to 56 dB loss assuming zero noise. The security of the protocol is calculated using a recently developed security proof technique based on semi-definite programming, which assumes only the inner-product information of the encoded coherent states, the expected statistics, and that the measurement is basis-independent. Our results thus suggest that coherent-state QKD could be a promising candidate for high-speed provably-secure QKD.

Tables

Table 1. Table 1: The statistics of each POVM for each coming states.

	$B_0^0$	$B_0^1$	$B_y^{\varnothing }$	$B_1^0$	$B_1^1$
$|{\varphi }_1⟩$	$P(0,1,0)$	$P(1,1,0)$	$P(\varnothing ,1,y)$	$P(0,1,1)$	$P(1,1,1)$
$|{\varphi }_2⟩$	$P(0,2,0)$	$P(1,2,0)$	$P(\varnothing ,2,y)$	$P(0,2,1)$	$P(1,2,1)$
$|{\varphi }_3⟩$	$P(0,3,0)$	$P(1,3,0)$	$P(\varnothing ,3,y)$	$P(0,3,1)$	$P(1,3,1)$
$|{\varphi }_4⟩$	$P(0,4,0)$	$P(1,4,0)$	$P(\varnothing ,4,y)$	$P(0,4,1)$	$P(1,4,1)$
$|{\varphi }_5⟩$	$P(0,5,0)$	$P(1,5,0)$	$P(\varnothing ,5,y)$	$P(0,5,1)$	$P(1,5,1)$
$|{\varphi }_6⟩$	$P(0,6,0)$	$P(1,6,0)$	$P(\varnothing ,6,y)$	$P(0,6,1)$	$P(1,6,1)$

Equations

$${\rho }_{\mu }={\int }_0^{2\pi }\frac{d\theta }{2\pi }|\sqrt{\mu }{e}^{i\theta }⟩⟨\sqrt{\mu }{e}^{i\theta }|=e^{-\mu }\sum _{n\ge 0}\frac{{\mu }^n}{n!}|n⟩⟨n|.$$

$$|{\tilde{0}}_{\mathrm{key}}⟩={|\alpha ⟩}_R\otimes {|\alpha ⟩}_S,$$

$$|{\tilde{1}}_{\mathrm{key}}⟩={|\alpha ⟩}_R\otimes {|-\alpha ⟩}_S,$$

$$|{\tilde{0}}_{\mathrm{test}}⟩={|\alpha ⟩}_R\otimes {|i\alpha ⟩}_S,$$

$$|{\tilde{1}}_{\mathrm{test}}⟩={|\alpha ⟩}_R\otimes {|-i\alpha ⟩}_S,$$

$$a_{0,\mathrm{key}}=(a_R+a_S)/\sqrt{2},$$

$$a_{1,\mathrm{key}}=(a_R-a_S)/\sqrt{2}.$$

$$a_{0,\mathrm{test}}=(a_R+i{a}_S)/\sqrt{2},$$

$$a_{1,\mathrm{test}}=(a_R-i{a}_S)/\sqrt{2}.$$

$$R_{\mathrm{key}}^{\infty }\ge \max \{0,p_{\det }(1-h_2(e_{\mathrm{bit}})-h_2(e_{\mathrm{ph}}))\},$$

$$|\Phi ⟩=\frac{{|+⟩}_A{|{\varphi }_1⟩}_{BE}+{|-⟩}_A{|{\varphi }_2⟩}_{BE}}{\sqrt{2}}.$$

$$e_{\mathrm{bit}}$$

$$e_{\mathrm{ph}}$$

$$p(b|y,z)=⟨{\varphi }_z|B_y^b|{\varphi }_z⟩.$$

$$\begin{array}{rl}& (\text{i})\text{for}\text{any}y,B_y^b{B}_y^{b^{\prime }}=0,\forall b\ne b^{\prime },\\ & (\text{ii}){\Sigma }_b{B}_y^b=\mathbb{I},\\ & (\text{iii})(B_y^b{)}^2=B_y^b=(B_y^b{)}^{†}.\end{array}$$

$$\begin{array}{rl}& G={\Sigma }_{z,z^{\prime }=1}^n{G}^{z{z}^{\prime }}\otimes |e_z⟩⟨e_{z^{\prime }}|,\\ & \\ & \text{with,}{G}_{(i,j)}^{z{z}^{\prime }}=⟨{\varphi }_z|S_i^{†}\cdot S_j|{\varphi }_{z^{\prime }}⟩\end{array}$$

$$\begin{array}{rl}& {\mathcal{S}}_1=\{\mathbb{I},B_y^b\}\\ & {\mathcal{S}}_2={\mathcal{S}}_1\bigcup \{B_y^b{B}_{y^{\prime }}^{b^{\prime }}\}\\ & {\mathcal{S}}_3={\mathcal{S}}_2\bigcup \{B_y^b{B}_{y^{\prime }}^{b^{\prime }}{B}_y^b\}\\ & {\mathcal{S}}_4=\dots \end{array}$$

$$\begin{array}{rl}\text{for}{\mathcal{S}}_2:& ⟨{\varphi }_z|B_0^0{B}_1^0|{\varphi }_{z^{\prime }}⟩=⟨{\varphi }_z|B_0^0\cdot B_0^0{B}_1^0|{\varphi }_{z^{\prime }}⟩,\\ & ⟨{\varphi }_z|B_0^0{B}_1^0\cdot B_0^0|{\varphi }_{z^{\prime }}⟩=⟨{\varphi }_z|B_0^0\cdot B_1^0{B}_0^0|{\varphi }_{z^{\prime }}⟩,\\ & ⟨{\varphi }_z|B_0^0{B}_1^0\cdot B_1^0{B}_0^0|{\varphi }_{z^{\prime }}⟩=⟨{\varphi }_z|B_0^0{B}_1^0{B}_0^0|{\varphi }_{z^{\prime }}⟩,\dots \\ \text{for}{\mathcal{S}}_3:& ⟨{\varphi }_z|B_0^0{B}_1^0\cdot B_0^0{B}_1^0|{\varphi }_{z^{\prime }}⟩\\ & =⟨{\varphi }_z|B_0^0\cdot B_1^0{B}_0^0{B}_1^0|{\varphi }_{z^{\prime }}⟩\\ & =⟨{\varphi }_z|B_0^0{B}_1^0{B}_0^0\cdot B_1^0|{\varphi }_{z^{\prime }}⟩,\\ & ⟨{\varphi }_z|B_0^0{B}_1^0\cdot B_0^0{B}_1^0{B}_0^0|{\varphi }_{z^{\prime }}⟩\\ & =⟨{\varphi }_z|B_0^0{B}_1^0{B}_0^0\cdot B_1^0{B}_0^0|{\varphi }_{z^{\prime }}⟩,\dots \end{array}$$

$$\begin{array}{rl}\text{maximize}:& e_{\mathrm{ph}}\\ \text{subject to}:& ⟨{\varphi }_z|{\varphi }_{z^{\prime }}⟩={\lambda }_{z{z}^{\prime }},\forall z,z^{\prime }\\ & G\ge 0,\\ & \mathrm{Tr}(F_{k}G)=p_k,\\ & \mathrm{Tr}(R_{k}G)=g_k,\\ & e_{\mathrm{bit}},p_{\det }\text{fixed to experimental model}\end{array}$$

$$\begin{array}{rl}{N}_j(z,y)=& (1-p_{\mathrm{dc}})[\frac{{⟨\sqrt{\eta }{\varphi }_z|}_R+(-1{)}^j{e}^{-iy\frac{\pi }{2}}{⟨\sqrt{\eta }{\varphi }_z|}_S}{\sqrt{2}}|0⟩\\ & ⟨0|\frac{{|\sqrt{\eta }{\varphi }_z⟩}_R+(-1{)}^j{e}^{iy\frac{\pi }{2}}{|\sqrt{\eta }{\varphi }_z⟩}_S}{\sqrt{2}}],\\ C_j(z,y)=& 1-N_j(z,y),\end{array}$$

$$\begin{array}{rl}& T(\text{mathdblquotechar}0\text{mathdblquotechar},z,y)=C_0(z,y)N_1(z,y)+\frac{C_0(z,y)C_1(z,y)}{2},\\ & T(\text{mathdblquotechar}1\text{mathdblquotechar},z,y)=C_1(z,y)N_0(z,y)+\frac{C_0(z,y)C_1(z,y)}{2},\\ & T(\text{mathdblquotechar}\varnothing \text{mathdblquotechar},z,y)=N_0(z,y)N_1(z,y).\end{array}$$

$$\begin{array}{rl}& P(0,z,y)=(1-\epsilon )T(\text{mathdblquotechar}0\text{mathdblquotechar},z,y)+\epsilon T(\text{mathdblquotechar}1\text{mathdblquotechar},z,y),\\ & P(1,z,y)=(1-\epsilon )T(\text{mathdblquotechar}1\text{mathdblquotechar},z,y)+\epsilon T(\text{mathdblquotechar}0\text{mathdblquotechar},z,y),\\ & P(\varnothing ,z,y)=T(\text{mathdblquotechar}\varnothing \text{mathdblquotechar},z,y).\end{array}$$

$$\begin{array}{rl}{p}_{det}& =T(\text{mathdblquotechar}0\text{mathdblquotechar},1,0)+T(\text{mathdblquotechar}1\text{mathdblquotechar},1,0)\\ & =1-(1-p_{\mathrm{dc}}{)}^2{e}^{-2\eta |\alpha {|}^2},\\ e_{bit}& =\frac{\epsilon T(\text{mathdblquotechar}0\text{mathdblquotechar},1,0)+(1-\epsilon )T(\text{mathdblquotechar}1\text{mathdblquotechar},1,0)}{p_{det}}\\ & =\frac{\frac{p_{dc}}{2}+\epsilon (1-p_{dc})+(\frac{p_{dc}}{2}-\epsilon )(1-p_{dc})e^{-2\eta |\alpha {|}^2}}{p_{det}}.\end{array}$$

Full text

††preprint: APS/123-QED

I Introduction

Quantum key distribution (QKD) Bennett and Brassard (1984) is one of the most established quantum information technologies to date. Its basic goal is to distribute secret keys between two remote users (called Alice and Bob) embedded in an untrusted network. Importantly, unlike conventional key distribution methods, QKD is provably-secure and can be safely used with any cryptographic protocol that requires long-term security assurance. For an overview of QKD and its recent developments, we refer the interested reader to Refs. Gisin et al. (2001); Scarani et al. (2009); Lo et al. (2014).

In prepare-and-measure QKD, there are generally two classes of coherent-state protocols, namely those that are based on phase randomization and those that give the phase reference information to Eve (the adversary). In the former, one first uniformly randomizes the phase of the coherent state ${\lvert\sqrt{\mu}e^{i\theta}\rangle}$ to create a mixture of photon number states, i.e.,

[TABLE]

This mixture follows a Poisson distribution and emits a single-photon state with probability $\mu e^{-\mu}$ and multi-photon states with probability $1-e^{-\mu}(1+\mu)$, where $\mu$ is the mean photon number of the signal. Then, by using a statistical technique called the decoy-state method to bound the fraction of detected single-photon states, one can get secret key rates that are comparable to that with a true single-photon source Hwang (2003); Lo et al. (2005); Wang (2005). In the following, we shall refer to phase-randomized coherent-state QKD as decoy-state QKD since they often mean the same protocol in practice.

In the case that the phase reference is given to Eve, she no longer sees a mixture of photon number states, but a coherent state ${\lvert\alpha_{x}\rangle}$ that is randomly drawn from a set of possible preparations $\{{\lvert\alpha_{x}\rangle}\}_{x}$, which is necessarily linearly independent. Crucially, based on this phase information, Eve can optimize her attack strategy to distinguish between different subsets of the preparation set Dus̆ek et al. (2000); Sun et al. (2012); Tang et al. (2013). In the worst case scenario (given the channel loss is sufficiently high), she can determine the exact value of $x$ by performing unambiguous state discrimination. For this reason, most existing security analyses of non-phase-randomized coherent-state QKD show that the tolerable channel loss is significantly below that of decoy-state QKD Yuen (1996); Lo and Preskill (2007). For example, assuming standard experimental settings, we find that the maximum distance (fiber length) of the phase-encoding coherent-state QKD protocol is generally shorter than 100 km, while decoy-state QKD can achieve up to about 250 km (see the simulation results below).

However, in practice, it may be more attractive to consider non-phase-randomized coherent-state QKD. The main reason is that the set of security assumptions for non-phase-randomized coherent-state QKD is typically less stringent than that of decoy-state QKD. To appreciate this point, we note that it is very important for decoy-state QKD systems to completely randomize the phase of their quantum signals. If this assumption is not met, then there could be serious security loopholes Sun et al. (2012); Tang et al. (2013). Recently, it has been pointed out that the requirement of ideal continuous phase randomization can be replaced by discrete phase randomization Cao et al. (2015). This work represents an important step towards making decoy-state QKD more practical, however it introduces additional complexity into the security analysis, which can be tricky when considering finite-length keys. Thus, for practical reasons, it may still be of interest to investigate new coherent-state QKD protocols that can distribute secret keys over longer distances.

In order to achieve good secret key rates using non-phase-randomized coherent states, it is important to have a tight estimation of Eve’s information about the secret key. While in principle one could obtain a tight estimation of Eve’s information by considering all the possible eavesdropping strategies, it is computationally intractable to fully characterize them, especially if the underlying Hilbert space dimension is unknown. To resolve this technical difficulty, here we employ the numerical tool introduced in Ref. Wang et al. (2019) to bound Eve’s information, which roughly speaking, converts the characterization problem of Eve’s strategies into a tractable hierarchy of semi-definite programs (SDP). It has been shown in Ref. Wang et al. (2019) that the SDP method provides a tighter bound on Eve’s information as compared to existing methods that use the so-called quantum coin method Lo and Preskill (2007). Additionally, the SDP method is semi-device-independent (SDI) Pawłowski and Brunner (2011); Bowles et al. (2014); Wang et al. (2015); Woodhead and Pironio (2015); Himbeeck et al. (2017); Rusca et al. (2019), namely the detailed characterization of Bob’s measurements is no longer necessary, but different to previous SDI which based on dimension or energy assumption, the analysis here is made based on the known inner product information of the coherent states. As such, the security certified by this method is robust against a large class of quantum device flaws and imperfections.

In this work, we propose a six-coherent-state protocol and show that it offers significant advantages in both secret key rate and transmission distance over existing coherent-state QKD protocols Lo and Preskill (2007); Wang et al. (2019). The organization of the paper is as follows: in Sec. II, for pedagogical reasons, we first review a standard coherent-state QKD protocol that encodes the secret key into the relative phase of the coherent states. In Sec. III, we first introduce a six-coherent-state protocol which allows the test coherent states to use different mean photon number from that of the key states. Then, we use the method introduced in Ref. Wang et al. (2019) to derive the secret key rate of the protocol and simulate its expected performance using standard experimental parameters. Finally, we conclude our findings in Sec. IV.

II Phase-encoding BB84 coherent-state QKD

In this section, we first review a popular coherent-state QKD protocol, which is inspired by the celebrated Bennett & Brassard 1984 (BB84) QKD Bennett and Brassard (1984). Here, the protocol encodes the secret bit into the relative phase of two coherent states, where the first coherent state is the signal state (the modulated signal) and the second coherent state is the reference state (fixed and whose phase reference is given to Eve). More specifically, Alice sends one of four states randomly:

[TABLE]

where the phase of $\alpha$ is relative to a fixed classical phase reference frame that Eve can access. Here, the subscript $S$ and $R$ denote the signal state and reference state, respectively. Then, Bob measures the signal he receives in either key basis or test basis. When Bob measures the signal in key basis, he combines the two modes in an interferometer, and directs modes $a_{0,\rm{key}}$, $a_{1,\rm{key}}$ to two different threshold photon detectors, where

[TABLE]

In ideal case, if Alice sends ${\lvert\tilde{0}_{\rm{key}}\rangle}$ to Bob and he measures in the key basis, detector $D_{0}$ (model $a_{0,\rm{key}}$) will click (with some probability depending on the channel loss ) and detector $D_{1}$ (model $a_{1,\rm{key}}$) will not click. Likewise, if Alice sends ${\lvert\tilde{1}_{\rm{key}}\rangle}$, then detector $D_{0}$ will not click and detector $D_{1}$ will click with some probability. Hence, Bob can determine the bit value that Alice encodes in key basis. When Bob measures in the test basis, he directs modes $a_{0,\rm{test}}$, $a_{1,\rm{test}}$ to the detectors, where

[TABLE]

Similarly, Bob can determine the bit value that Alice encodes in test basis. Then, Alice and Bob retain only the successful events in which they choose the same basis through public communication. After performing error correction step and privacy amplification step, Alice and Bob obtain the final secure key.

To prove the security of the protocol, one can either use the quantum coin method Lo and Preskill (2007) or the SDP method proposed in Ref. Wang et al. (2019). It has been demonstrated in the latter that the SDP method provides a tighter security analysis. Interestingly, Ref. Wang et al. (2019) also suggested that it may be useful to vary the test coherent states. In particular, the authors demonstrated that, in the case of coherent-one-way QKD, it is possible to significantly extend the key distribution distance by varying the intensity of the test coherent state in the protocol. In light of this observation, we propose the following phase-encoding QKD protocol.

III Six-coherent-state QKD

Here, we detail our proposed six-coherent-state protocol, and illustrate one of its possible implementation schemes in Fig. 1.

Preparation.-Alice randomly prepares one of those six quantum code states $\{{\lvert\psi_{z}\rangle}\}_{z=1}^{6}$: ${\lvert\psi_{1}\rangle}={\lvert\sqrt{\mu_{1}}\rangle}_{R}{\lvert\sqrt{\mu_{1}}\rangle}_{S}$, ${\lvert\psi_{2}\rangle}={\lvert\sqrt{\mu_{1}}\rangle}_{R}{\lvert-\sqrt{\mu_{1}}\rangle}_{S}$, ${\lvert\psi_{3}\rangle}={\lvert\sqrt{\mu_{2}}\rangle}_{R}{\lvert i\sqrt{\mu_{2}}\rangle}_{S}$, ${\lvert\psi_{4}\rangle}={\lvert\sqrt{\mu_{2}}\rangle}_{R}{\lvert-i\sqrt{\mu_{2}}\rangle}_{S}$, ${\lvert\psi_{5}\rangle}={\lvert\sqrt{\mu_{3}}\rangle}_{R}{\lvert e^{i\theta_{1}}\sqrt{\mu_{4}}\rangle}_{S}$, ${\lvert\psi_{6}\rangle}={\lvert\sqrt{\mu_{3}}\rangle}_{R}{\lvert e^{-i\theta_{2}}\sqrt{\mu_{4}}\rangle}_{S}$, shown in Fig. 2. Then, she sends it to Bob via the quantum channel. The states ${\lvert\psi_{1}\rangle}$ and ${\lvert\psi_{2}\rangle}$ are used to extract keys, while the rest are used to estimate Eve’s information about the secret key. In this case, the key bit is encoded in the relative phase of the signal state and reference state. Here, the intensities and phases are free parameters, which will be used to optimize the secret key rate.

Measurement.-Upon receiving the state, Bob directs it to the interferometer to recover the bit information. We use positive-operator valued measures (POVMs) to describe Bob’s interference operations: Bob randomly performs one of two possible POVMs denoted by $\{B_{y}^{b}\}$, where $y\in\{0,1\}$ represents basis choice. Taking signal loss and detection inefficiency into account, each measurement has three possible outcomes $b\in\{0,1,\emptyset\}$, where $\emptyset$ represents the empty detection event. In the event that both detectors click, Bob assigns a random bit to it. Additionally, we require that Bob’s measurements satisfy basis-independent assumption: measurement operators corresponding to detection loss are the same for both measurement settings, i.e. ${B_{0}^{\emptyset}}={B_{1}^{\emptyset}}$. This is to ensure that the probability of detecting a signal is independent of Bob’s measurement choice, which is necessary to rule out detection side-channel attacks exploiting the channel loss  Lydersen et al. (2010). Thus Bob’s three-outcome POVM is equivalent to a two-outcome POVM that determines the key bit, preceded by a basis-independent “filter”.

Parameter estimation and key distillation.-Alice and Bob announce their basis choices through the public channel and decide if the error rates fulfill certain thresholds. If the test is successful, then Alice and Bob proceed with error correction and privacy amplification to extract a secret key.

To compute the security of the protocol, we can use a certain entropic uncertainty relation for quantum memories Berta et al. (2010) and Fano’s inequality Cover and Thomas (2006). Using these, it can be shown that the asymptotic secret key rate of QKD against collective attacks is

[TABLE]

where $e_{\rm{bit}}$ and $e_{\rm{ph}}$ are the bit error rate and phase error rate of the key basis, $p_{\rm{det}}$ is the probability of detection in key basis, and $h_{2}(\cdot)$ is the binary entropy function. The extension to general attacks is then achieved by using proof techniques like the post-selection technique Christandl et al. (2009) or entropy accumulation theorem Dupuis et al. (2016). These results imply that it is sufficient to consider security against collective attacks.

III.1 SDP optimization problem for bounding Eve’s information

From Eq. (5), we see that the secret key rate is obtained once we know the detection probability, bit error rate, and the phase error rate. To obtain these values, we first consider that Alice, Bob and Eve share a purified tripartite state ${\lvert\Phi\rangle}$ after the transmission,

[TABLE]

where Eve’s set of possible operations has been considered in ${\lvert\phi_{1}\rangle}_{BE}$ and ${\lvert\phi_{2}\rangle}_{BE}$. Conditioned on Bob observing a successful detection, the bit error rate of the key basis is then given by

[TABLE]

The phase error rate in this case is the bit error rate that Alice and Bob would have observed if ${\lvert\Phi\rangle}$ has been measured in the $\{{\lvert+i\rangle\!\langle+i\rvert},{\lvert-i\rangle\!\langle-i\rvert}\}$ basis by Alice and $B_{1}$ basis by Bob. Mathematically, this is given by

[TABLE]

One can see that $p_{\rm{det}}$ and $e_{\rm{bit}}$ are experimentally accessible, while the phase error rate $e_{\rm{ph}}$, which related to Eve’s information about the secret bit is not. To get a tight estimation of $e_{\rm{ph}}$, in principle one should optimize over Eve’s set of possible operations, namely captured in the transformed states ${\lvert\phi_{1}\rangle}_{BE}$ and ${\lvert\phi_{2}\rangle}_{BE}$ under the constraints imposed by the expected statistics. However, as we mentioned earlier, this type of characterization problem is often intractable or impossible to solve directly.

Here, we employ the numerical tool introduced in Ref. Wang et al. (2019) to estimate the phase error rate, which converts the initial characterization problem into a hierarchy of semi-definite programs. More specifically, each hierarchy forms a convex set which outer-approximates the quantum set. Importantly, by going to higher hierarchies, the approximation becomes tighter. The quantum set here means the set of measurement statistics compatible with the set of prepared quantum signals and Bob’s measurements. Thus, in using this method, we can optimize over the various convex sets to bound Eve’s information, which in turn, provides a lower bound on the secret key rate of the protocol.

With this SDP method, the detailed characterization of the quantum signals and measurements, including their dimension, is no longer required in the analysis. Therefore, the transmission channel can be seen as an isometric evolution in higher dimension that takes the initial quantum signal state $\lvert\psi_{z}\rangle$ to some pure output signal state $\lvert\phi_{z}\rangle$, which is shared between the receivers Bob and the network environment (possibly Eve). The inner product of the output states is preserved after the transmission, i.e. ${\langle\phi_{z}\rvert\phi_{z}^{\prime}\rangle}={\langle\psi_{z}\rvert\psi_{z}^{\prime}\rangle}=\lambda_{zz^{\prime}}$. In the same way, the POVMs $\{B_{y}^{b}\}$ can be assumed as projective measurements in higher dimension. Then, we say that the probabilities of observing outcomes $b$ given setting $y$ and $z$ admits a quantum system, if there exist a quantum state ${\lvert\phi_{z}\rangle}$ and operators $B_{y}^{b}$ such that

[TABLE]

where the operators $\{B_{y}^{b}\}$ follow the properties:

[TABLE]

A family of necessary conditions satisfied by the quantum observed probabilities thus can be introduced. Denote $\mathcal{S}=\{S_{1},...,S_{m}\}$ as a finite set of $m$ operators, where each element is a linear combination of products of $\{B_{y}^{b}\}$. We define the $nm\times nm$ block Gram matrix ${G}$:

[TABLE]

in which ${G}_{(i,j)}^{zz^{\prime}}$ is defined as the inner-product of the vectors ${\langle\phi_{z}\rvert}S_{i}^{\dagger}$ and $S_{j}{\lvert\phi_{z^{\prime}}\rangle}$, for all $z,z^{\prime}\in[n]$, $i,j\in[m]$. ${G}_{(i,j)}^{zz^{\prime}}$ is the $ij$-entry of the matrix ${G}^{zz^{\prime}}$ and $\{{\lvert e_{z}\rangle}\}_{z=1}^{n}$ represents the standard orthonormal basis of $\mathbb{R}^{n}$. Evidently, the matrix ${G}$ is Hermitian and positive-semi-definite (PSD) Horn and Johnson (2013) by definition.

Taking $\mathcal{S}=\{\mathbb{I},B_{0}^{0},B_{1}^{0},B^{\emptyset}\}$ for example, the matrix ${G}$ is depicted in Fig. 3. The whole matrix ${G}$ is partitioned into $6\times 6$ sub-blocks $\{{G}^{zz^{\prime}}\}_{zz^{\prime}}$ by the classifier $z$, where each sub-block has size $4\times 4$ and is illustrated in Fig. 4.

The entries of every sub-block ${G}^{zz^{\prime}}$ partly reflect the properties of $(\emph{i})$ - $(\emph{iii})$ satisfied by the operators and the overlaps of the signal states. For instance, property (ii) implies that we can introduce the identity operator $\mathbb{I}$ and remove one of the operators; property (i) implies ${G}^{zz^{\prime}}_{2,2}={\langle\phi_{z}\rvert}B_{0}^{0}B_{0}^{0}{\lvert\phi_{z^{\prime}}\rangle}={\langle\phi_{z}\rvert}B_{0}^{0}{\lvert\phi_{z^{\prime}}\rangle}$ and ${G}^{zz^{\prime}}_{2,4}={\langle\phi_{z}\rvert}B_{0}^{0}B^{\emptyset}{\lvert\phi_{z^{\prime}}\rangle}=0$; meanwhile the property (iii) implies ${\langle\phi_{z}\rvert}B_{y}^{b}B_{y}^{b^{\prime}}{\lvert\phi_{z}\rangle}=({\langle\phi_{z}\rvert}B_{y}^{b^{\prime}}B_{y}^{b}{\lvert\phi_{z}\rangle})^{\dagger}$. In addition, since the overlaps of the code states are known, we have ${\langle\phi_{z}\rvert}\mathbb{I}{\lvert\phi_{z^{\prime}}\rangle}=\lambda_{zz^{\prime}}$.

From the definition, each set $\mathcal{S}$ of operators yields a different Gram matrix ${G}$ and different linear constraints. The choice of a particular $\mathcal{S}$ may seem arbitrary, but not all operators in $\mathcal{S}$ are independent. Moreover, they can be organized in a hierarchical structure, such that $\mathcal{S}$ can be defined inductively,

[TABLE]

Thus, with each increase of the hierarchy, not only the dimension of the Gram matrix becomes larger, but also more new linear constraints are introduced. For example,

[TABLE]

We denote the quantum set by $\mathsf{Q(\lambda)}$, which is formed by the probability distributions admitting a quantum system and the overlaps of the code states. Moreover, let the set of probability distributions defined by hierarchy of step $n$ be denoted as $\mathsf{Q(\lambda)_{n}}$. Then, we have that $\mathsf{Q(\lambda)}\subseteq\mathsf{Q(\lambda)_{n}}$. In fact, it has been demonstrated in Ref. Wang et al. (2019) that in the limit of $n$ (i.e., $n\rightarrow\infty$), $\mathsf{Q(\lambda)_{n}}$ converges to $\mathsf{Q(\lambda)}$. Ultimately, this means that the secret key rate obtained by the SDP can only be tighter when considering higher hierarchies.

To compute Eq. (5), we thus only need to maximize $e_{\rm{ph}}$ using SDP under the conditions that $p_{\rm{det}}$ and $e_{\rm{bit}}$ are fixed to some experimental model. In particular, the SDP problem for maximizing the phase error rate is:

[TABLE]

where $F_{k}$’s and $R_{k}$’s are constant matrices. Note that $F_{k}$’s are used to pick up the terms in ${G}$ which are associated with the observed distributions $p(b|x,y)$; meanwhile $R_{k}$’s are used to pick up the terms in ${G}$ which are associated with the linear constraints induced by the quantum operators and states.

III.2 Numerical simulation

We simulate the secret key rate of the protocol using a realistic model, which includes total loss (including channel loss and detection efficiency), misalignment error of the optics, and the dark counts of single photon detectors. As Bob uses two threshold detectors, there are four possible outcomes when he measures a signal. By mapping double clicks randomly into 0 or 1, Bob’s measurement realizes a POVM with three outcomes: 0, 1 and inconclusive. Note that the double clicks are interpreted as key bits Inamori et al. (2007); Lo and Preskill (2007). In order to obtain a realistic detection model, we consider the error model illustrated in Fig. 5.

We assume that the detector dark count rate is $p_{\rm{dc}}=10^{-7}$ and misalignment error rate is $\varepsilon=2\%$. For a given total loss $1-\eta$, the probability of detectors clicking and not clicking without misalignment error are

[TABLE]

where $j\in\{0,1\}$ represents detector $D_{0}$ and $D_{1}$, $y\in\{0,1\}$ is Bob’s basis choice, ${\lvert\phi_{z}\rangle}_{S}$ and ${\lvert\phi_{z}\rangle}_{R}$ denote the signal and reference portion of the state ${\lvert\phi_{z}\rangle}$ respectively.

Let $T(\mathtt{\mathdblquotechar}b\mathtt{\mathdblquotechar},z,y)$ denotes the probability of getting the outcome $\mathtt{\mathdblquotechar}b\mathtt{\mathdblquotechar}$. We have that

[TABLE]

Considering the misalignment error $\varepsilon$, the probabilities of $B_{y}^{b}$ are

[TABLE]

Thus, the statistics of each POVM measurement on each coming states can be evaluated, as shown in Tab. 1. Accordingly, the probability of detecting a signal $p_{\rm{det}}$ for key basis and the corresponding bit error rate $e_{\rm{bit}}$ are then given by

[TABLE]

Subsequently, we maximize $e_{\rm{ph}}$ over the set of compatible probabilities using the first level of the hierarchy and the results of the numerical optimization with errors (blue curve) and without errors (rose curve) are shown in Fig. 6. In the absence of errors, the tolerable total loss is extended to more than 55 dB, which is extremely close to the collective beam-splitting attack bound (an upper bound on the secret key rate). This suggests that the six-coherent-state QKD protocol is pretty robust against the total loss in the absence of errors. Taking into account practical errors, the tolerable total loss reaches up to 38 dB, which is significantly higher than previous results Lo and Preskill (2007); Wang et al. (2019) (around 23, 25 dB respectively) assuming the same error model specified in Fig. 5. As compared with the protocol in Ref. Wang et al. (2019), additional two test states are included in our protocol to give better characterization of the quantum system between Alice and Bob. Thus, a tighter bound on Eve’s information could be obtained.

Moreover, through the optimization, we observe that the secret key rate is optimized when $\mu_{1}=\mu_{2}=\mu_{3}$ and $\theta_{1}=\theta_{2}=\pi/2$. This is expected since $\mu_{1}=\mu_{2}=\mu_{3}$ corresponds to larger overlaps between the six coherent states, which imply that it will be more challenging for Eve to distinguish them, meanwhile $\theta_{1}=\theta_{2}=\pi/2$ provides more characterization of the test basis ($B_{1}$), and thus, resulting in a higher secret key rate. Therefore, in practice, one has to only modulate the amplitude between two levels ($\mu_{1}$ and $\mu_{4}$) which makes our protocol highly practical and suitable for high-speed implementation.

For completeness, we also plot the secret key rate, obtained using decoy-state method, of the protocol in Ref. Boaron et al. (2018) that is based on time-bin encoding of phase-randomised coherent states. The asymptotic secret key rate is estimated using the formula given in Ref. Ma et al. (2005), without taking into account of the statistical corrections of finite-length keys. Considering the same simulation parameters (i.e., total loss , misalignment error and dark count rate), the plot of secret key rate against loss of the decoy-state QKD protocol is shown in Fig. 6. The comparison shows that secret key rate of our protocol is comparable to that of the one-decoy-state protocol in low loss regime. Specifically, the key rates differ by only one order of magnitude in the region when the loss is less than 25 dB. For further comparison, we also simulated the optimized secret key rates of BB84 protocol with 2 decoy states and infinite number of decoy states, and our protocol still shows appreciable performance in the short distance regime.

IV Conclusion

In conclusion, on the one hand, phase randomization is a critical assumption made in the analysis of most coherent state QKD protocols and any deviation from preparing perfectly phase-randomized coherent states may pose serious threats of a security breach. On the other hand, existing analysis on non-phase-randomized coherent states are overly pessimistic and yield secret key rates that are inferior to alternative protocols based on the decoy-state method. In this paper, we presented and analyzed the security of a six-coherent-state phase encoding QKD protocol based on non-phase-randomized coherent states. Our analysis requires fewer assumptions on both the quantum state preparation and measurement processes as it relies solely on the overlaps of the code states as well as the observed statistics. Simulating with realistic experimental model (dark count rate of $10^{-7}$ and misalignment error of $2\%$), our protocol can tolerate a total loss of up to 38 dB, which is much higher than previous works. Moreover, we observed that the secure key rates of our protocol are comparable with the BB84 decoy-state protocol in the low loss regime. In addition to the improved key rates, our protocol only requires the modulation of six relative phases and two amplitudes, which is easy to implement. Hence, we have shown that one could implement coherent state QKD without performing phase randomization and yield comparable key rates with other known protocols.

Acknowledgements.

We would like to thank Hugo Zbinden and Goh Koon Tong for the valuable comments and careful reading of the manuscript. This research is supported by the National Research Foundation (Singapore), the Ministry of Education (Singapore), the National University of Singapore, the Asian Office of Aerospace Research and Development, and the National Natural Science Foundation of China (Grant No.61572081 and No.61672110). Li Liu kindly acknowledges support from the China Scholarship Council.