Long-distance device-independent quantum key distribution

TL;DR

This paper explores extending the distance of device-independent quantum key distribution by using qubit amplifiers to overcome channel loss limitations, analyzing resource requirements for practical long-distance secure communication.

Contribution

It investigates the use of qubit amplifiers in photonic DIQKD with finite data, identifying key resource thresholds for feasible long-distance implementation.

Findings

Qubit amplifiers significantly increase achievable DIQKD distance.

Detection efficiency and entanglement quality are critical resources.

Finite data analysis provides realistic resource estimates.

Abstract

Besides being a beautiful idea, device-independent quantum key distribution (DIQKD) is probably the ultimate solution to defeat quantum hacking. To guarantee security, it requires, however, that the fair-sampling loophole is closed, which results in a very limited maximum achievable distance. To overcome this limitation, DIQKD must be furnished with fair-sampling devices like, for instance, qubit amplifiers. These devices can herald the arrival of a photon to the receiver and thus decouple channel loss from the selection of the measurement settings. Consequently, one can safely postselect the heralded events and discard the rest, which results in a significant enhancement of the achievable distance. In this work, we investigate photonic-based DIQKD assisted by two main types of qubit amplifiers in the finite data block size scenario, and study the resources -- particularly, the detection efficiency of the photodetectors and the quality of the entanglement sources -- that would be necessary to achieve long-distance DIQKD within a reasonable time frame of signal transmission.

Tables

Table 1. Table 1 : List containing the main protocol arguments.

Protocol arguments
$n_{\mathrm{SH}}$	Post-processing block size
$\gamma$	Probability of a test round
${\delta }_{\mathrm{est}}$	Confidence interval for the CHSH game winning rate
${ϵ}_{\mathrm{IR}}$	Error probability of information reconciliation
${ϵ}_{\mathrm{PA}}$	Error probability of privacy amplification
$l$	Length of the final keys $K_A$ and $K_B$

Table 2. Table 2 : List containing the main finite-key security parameters.

Finite-key security parameters
${ϵ}_{\sec }$	Secrecy parameter
${ϵ}_{\mathrm{cor}}$	Correctness parameter
${ϵ}_{\mathrm{rob}}$	Robustness parameter
${ϵ}_s$	Smoothing parameter of the min-entropy
${ϵ}_{\mathrm{rob}}^{\mathrm{PE}}$	Abort probability of parameter estimation
${ϵ}_{\mathrm{rob}}^{\mathrm{IR}}$	Abort probability of information reconciliation
${ϵ}_{\mathrm{rob}}^{\mathrm{EA}}$	Abort probability of entropy accumulation
${ϵ}_{\mathrm{EA}}$	Error probability of entropy accumulation bound

Table 3. Table 3 : Sets of security parameters ϵ sec subscript italic-ϵ sec \epsilon_{\rm sec} , ϵ cor subscript italic-ϵ cor \epsilon_{\rm cor} and ϵ rob subscript italic-ϵ rob \epsilon_{\rm rob} considered in the performance evaluation of DIQKD. The set S 1 subscript 𝑆 1 S_{1} provides a lower level of security than the set S 2 subscript 𝑆 2 S_{2} .

	${ϵ}_{\sec }$	${ϵ}_{\mathrm{cor}}$	${ϵ}_{\mathrm{rob}}$
$S_1$	${10}^{-5}$	${10}^{-10}$	${10}^{-2}$
$S_2$	${10}^{-9}$	${10}^{-15}$	${10}^{-3}$

Table 4. Table 4 : Average number of signals, ⟨ N ⟩ delimited-⟨⟩ 𝑁 \left\langle{N}\right\rangle , that Alice needs to send Bob to collect a data block size equal to n SH subscript 𝑛 SH n_{\rm SH} , when using ideal photon sources. The dark count rate of the photodetectors is set to p d = 10 − 7 subscript 𝑝 d superscript 10 7 p_{\rm d}=10^{-7} , and the detection and coupling efficiency is η c , d subscript 𝜂 c d \eta_{\rm c,d} . For each combination ( η c , d , n SH ) subscript 𝜂 c d subscript 𝑛 SH (\eta_{\rm c,d},n_{\rm SH}) , the considered value of Λ Λ \Lambda is approximately equal to the cutoff loss for which the secret key rate starts dropping down to zero in Fig.  4 . Also, the values of η c , d subscript 𝜂 c d \eta_{\rm c,d} and n SH subscript 𝑛 SH n_{\rm SH} correspond to the cases illustrated in Fig.  4 , and both sets of security settings, S 1 subscript 𝑆 1 S_{1} and S 2 subscript 𝑆 2 S_{2} , are considered.

$S_1$	${\eta }_{c,d}$	$n_{\mathrm{SH}}$	${\Lambda }_{\mathrm{cutoff}}$	$K_{\mathrm{cutoff}}$	$⟨N⟩$
ESR	$100\%$	${10}^7$	$48$ dB	$1.3\times {10}^{-7}$	$1.2\times {10}^{12}$
ESR	$96.5\%$	${10}^{11}$	$39$ dB	$4.2\times {10}^{-8}$	$1.8\times {10}^{15}$
PQA	$100\%$	${10}^7$	$48$ dB	$6.3\times {10}^{-8}$	$2.5\times {10}^{12}$
PQA	$96.5\%$	${10}^{11}$	$37$ dB	$2.7\times {10}^{-9}$	$3.2\times {10}^{16}$

Table 5. Table 5 : Maximum value of the channel loss, Λ Λ \Lambda , before either ⟨ N ⟩ ≥ 10 15 delimited-⟨⟩ 𝑁 superscript 10 15 \left\langle{N}\right\rangle\geq 10^{15} or the secret key rate K 𝐾 K starts dropping down to zero, depending on the pair ( η c , d , n SH ) subscript 𝜂 c d subscript 𝑛 SH (\eta_{\rm c,d},n_{\rm SH}) and on the qubit amplifier. The considered detection and coupling efficiencies, as well as the data block sizes, correspond to the finite-key rates illustrated in Fig.  7 with security settings S 1 subscript 𝑆 1 S_{1} and S 2 subscript 𝑆 2 S_{2} . As shown by the table, in the case of the PQA with η c , d = 100 % subscript 𝜂 c d percent 100 \eta_{\rm c,d}=100\% and n SH = 10 7 subscript 𝑛 SH superscript 10 7 n_{\rm SH}=10^{7} , the secret key rate drops down to zero before ⟨ N ⟩ delimited-⟨⟩ 𝑁 \left\langle{N}\right\rangle exceeds 10 15 superscript 10 15 10^{15} signals. To be precise, the cutoff for S 1 subscript 𝑆 1 S_{1} ( S 2 subscript 𝑆 2 S_{2} ) roughly occurs at Λ = 24 Λ 24 \Lambda=24 dB ( 17 17 17 dB), and the corresponding ⟨ N ⟩ delimited-⟨⟩ 𝑁 \left\langle{N}\right\rangle is still 1.7 × 10 13 1.7 superscript 10 13 1.7\times{10^{13}} ( 8.6 × 10 12 8.6 superscript 10 12 8.6\times{10^{12}} ).

$S_1$	${\eta }_{c,d}$	$n_{\mathrm{SH}}$	$\Lambda$	$K$	$⟨N⟩$
ESR	$100\%$	${10}^9$	$13$ dB	$5.7\times {10}^{-8}$	${10}^{15}$
ESR	$98.7\%$	${10}^{11}$	$1$ dB	$5.9\times {10}^{-7}$	${10}^{15}$
PQA	$100\%$	${10}^7$	$24$ dB	$1.1\times {10}^{-8}$	$1.7\times {10}^{13}$
PQA	$98.7\%$	${10}^9$	$4$ dB	$5.5\times {10}^{-8}$	${10}^{15}$

Equations

$$\mbox{$|\psi\rangle$}_{ab}=\sum_{n=0}^{\infty}\sqrt{p_{n}}\mbox{$|\phi_{n}\rangle$}_{ab},$$

$$\mbox{$|\phi_{n}\rangle$}_{ab}=\frac{1}{n!\sqrt{n+1}}(a_{\rm{h}}^{\dagger}b_{\rm{v}}^{\dagger}-a_{\rm{v}}^{\dagger}b_{\rm{h}}^{\dagger})^{n}\mbox{$|0\rangle$}_{ab}.$$

$$p_n=\frac{(n+1){\lambda }^n}{(1+\lambda {)}^{n+2}},$$

$$\mbox{$|\Psi\rangle$}_{ab}=\sum_{n=0}^{\infty}\sqrt{p_{n}}\mbox{$|n,n\rangle$}_{ab},$$

$$\rho_{\rm{single}}=\sum_{n=0}^{\infty}r_{n}\mbox{$|n\rangle$}_{b}\mbox{$\langle n|$},$$

$$\Pi_{k}=\left\{\begin{array}[]{ll}(1-p_{\rm{d}})\tilde{\Pi}_{0}&\mathrm{if\ }k=0,\\ (1-p_{\rm{d}})\tilde{\Pi}_{k}+p_{\rm{d}}\tilde{\Pi}_{k-1}&\mathrm{if\ }k\geq{1},\\ \end{array}\right.$$

$$\tilde{\Pi}_{k}=\sum_{j=k}^{\infty}\binom{j}{k}\eta_{\rm{d}}^{k}(1-\eta_{\rm{d}})^{j-k}\mbox{$|j\rangle$}\mbox{$\langle j|$},$$

$$\mbox{$|\phi\rangle$}_{bc}=(1-t)\mbox{$|\psi\rangle$}_{bb}+t\mbox{$|\varphi\rangle$}_{cc}-\sqrt{2t(1-t)}\mbox{$|\chi\rangle$}_{bc},$$

$$\displaystyle\mbox{$|\psi\rangle$}_{bb}$$

$$\displaystyle\mbox{$|\varphi\rangle$}_{cc}$$

$$\displaystyle\mbox{$|\chi\rangle$}_{bc}$$

$${\sigma }_z=\left(\begin{array}{cc}1& 0\\ 0& -1\end{array}\right)\mathrm{and}{\sigma }_{\mathrm{x}}=\left(\begin{array}{cc}0& 1\\ 1& 0\end{array}\right),$$

$$\omega_{\rm{CHSH}}(a,b,x,y)=\left\{\begin{array}[]{ll}1&\rm{if}\hskip 5.69046pta\oplus{b}={\it x}\cdot{\it y},\\ 0&\rm{otherwise,}\\ \end{array}\right.$$

$$[1-\mathrm{P}(\mathrm{abort})]||{\rho }_{K_{\mathrm{A}}\mathrm{E}}-{\rho }_{{\mathrm{U}}_l}\otimes {\rho }_{\mathrm{E}}|{|}_1\le {ϵ}_{\sec },$$

$${ϵ}_{\sec }\le {ϵ}_{\mathrm{PA}}+{ϵ}_{\mathrm{s}}+{ϵ}_{\mathrm{EA}},$$

$${ϵ}_{\mathrm{rob}}\le {ϵ}_{\mathrm{rob}}^{\mathrm{IR}}+{ϵ}_{\mathrm{rob}}^{\mathrm{PE}},$$

$${ϵ}_{\mathrm{rob}}^{\mathrm{PE}}\le {ϵ}_{\mathrm{rob}}^{\mathrm{EA}}+{ϵ}_{\mathrm{IR}},$$

$${ϵ}_{\mathrm{rob}}^{\mathrm{EA}}=\mathrm{P}\left(\omega {|}_{\mathrm{SH}}\gamma -\frac{{\mathrm{C}}_{\mathrm{SH}}}{{\mathrm{n}}_{\mathrm{SH}}}>{\delta }_{\mathrm{est}}\right).$$

$${\delta }_{\mathrm{est}}\ge \sqrt{\frac{1}{2n_{\mathrm{SH}}}\ln \frac{1}{{ϵ}_{\mathrm{rob}}^{\mathrm{EA}}}}.$$

$$l$$

$$K=\frac{l}{N},$$

$$K_{\infty }$$

$$⟨N⟩=\frac{n_{\mathrm{SH}}}{P_{\mathrm{SH}}}.$$

$$P_{\mathrm{SH}}^{\mathrm{ESR}}$$

$$\omega {|}_{\mathrm{SH}}^{\mathrm{ESR}}$$

$$Q{|}_{\mathrm{SH}}^{\mathrm{ESR}}$$

$$P_{\mathrm{SH}}^{\mathrm{PQA}}$$

$$\omega {|}_{\mathrm{SH}}^{\mathrm{PQA}}$$

$$Q{|}_{\mathrm{SH}}^{\mathrm{PQA}}$$

$$⟨N⟩{|}_{L=0}=\frac{2n_{\mathrm{SH}}}{{\eta }_{\mathrm{c},\mathrm{d}}^2},$$

$$⟨N⟩{|}_{L=0}$$

$$⟨N⟩{|}_{L\ge 0}$$

Full text

I Introduction

The use of quantum mechanics for cryptographic means was first proposed in the early 70’s by Stephen Wiesner, aiming to create unfalsifiable banknotes Wiesner . Inspired by this seminal work, Charles Bennett and Gilles Brassard introduced a protocol to securely distribute cryptographic keys Bennett . Nowadays, intense theoretical and experimental research Peev ; Ribordy ; Tamaki has turned this latter task—called quantum key distribution (QKD)—into a feasible commercial solution IdQuantique .

Despite such tremendous progress, a major flaw of QKD today is the existing big gap between the theory and the practice. This is so because security proofs of QKD typically rely on simple mathematical models to describe the behaviour of the different physical devices. As a result, any departure from these models might render real-life QKD implementations vulnerable to quantum hacking attacks hack1 ; Zhao ; Makarov ; Vadim ; Gerhardt ; Weier ; hack2 .

To overcome this problem, the ultimate solution probably is device-independent QKD (DIQKD) Mayers ; Scarani ; Masanes ; Vazirani ; Ekert ; Miller . Given that the users’ devices are honest honest1 ; HKLo , DIQKD can guarantee security without characterizing the internal functioning of the apparatuses, thereby ruling out all hacking attacks against the physical implementation. It is based on a feature of some entangled states known as nonlocality nonlocality , which guarantees that two distant parties (say, Alice and Bob) sharing an ideal nonlocal quantum state observe perfectly correlated outcomes when performing adequate quantum measurements on their shares. Moreover, these correlations are monogamous, i.e., the measurement outcomes are statistically independent of any pre-existing information held by a third party. This property can be verified with a two-party Bell test nonlocality ; Bell ; CHSH ; Bell_exp1 ; Bell_exp2 ; Bell_exp3 known as the Clauser-Horne-Shimony-Holt (CHSH) test, which basically consists of repeatedly playing a two-party nonlocal game Miller ; Rotem . The winning rate of the game indicates the amount of monogamous correlations shared between Alice and Bob.

The security of DIQKD has been rigorously established in different works, first against collective attacks Scarani in the asymptotic regime, then against coherent attacks Vazirani also in the asymptotic regime, and only recently in the practical scenario of finite data block sizes Rotem (see also Wehner ). The security proof in Rotem relies on the so-called entropy accumulation theorem Renner ; entropy_ac2 , which effectively allows to prove the security of the full protocol from the security of a single round of the protocol by using a worst-case scenario.

Security proofs require, however, that two fundamental loopholes are closed: the locality loophole nonlocality and the fair-sampling loophole nonlocality ; detection1 ; detection2 . The former is closed by enforcing a proper isolation of Alice’s and Bob’s devices. Closing the fair-sampling loophole is more tricky, specially if Alice and Bob wish to cover long distances. Indeed, if an adversary were able to correlate channel loss to Alice’s or Bob’s measurement settings, such an adversary could easily fake nonlocal correlations, and thus compromise the security of the distilled key. A simple solution is to assign a pre-established outcome value to each lost signal while running the CHSH test. The main drawback of this technique is however the limited achievable distance, because such mapping translates loss into errors. Indeed, with such an approach, even if the entanglement source could generate perfect Bell pairs and Alice and Bob could measure them with unit efficiency detectors, channel loss would limit the maximum DIQKD transmission distance to about only 3.5 km for a typical optical fiber.

To enhance the distance, Alice and Bob need to use fair-sampling devices. These are devices that herald the arrival of a signal to the receiver, allowing a fair post-selection of the heralded events. Then, if Alice and Bob choose their measurement settings a posteriori, i.e., once their fair-sampling devices have declared the reception of a signal, they actually decouple channel loss from their measurement settings selection, thus paving the way for DIQKD over long distances.

A fair-sampling device particularly suited for DIQKD is a qubit amplifier Gisin ; Pitkanen ; Curty , which basically consists of a teleportation gate. That is, a successful heralding corresponds to the teleportation of the state of the arriving signal to a signal at the output port of the qubit amplifier. DIQKD supported by qubit amplifiers has been analysed in Gisin ; Pitkanen ; Curty ; Takeoka ; Acin2 in the asymptotic regime, i.e., by considering an infinite number of signals. In this work, we focus on the practical finite data block size scenario. More precisely, we study finite-key DIQKD with the two different types of qubit amplifier architectures introduced in Pitkanen and Curty . We pay particular attention to the effect that typical device imperfections (specially, the finite detection efficiency of the photodetectors and the multi-photon pulses emitted by practical entanglement light sources) have on the performance of the system. In doing so, we determine the resources needed to achieve long-distance implementations of DIQKD within a reasonable time frame of signal transmission.

The structure of the paper goes as follows. Sec. II introduces the mathematical models that we use to characterize the behaviour of the difference physical devices. Sec. III contains the description of the considered DIQKD protocol, and Sec. IV introduces its secret key rate formula for the finite-key regime. Then, in Sec. V we present the main contributions of this paper. Here, we evaluate the performance of the DIQKD scheme as a function of the data block size and various device imperfections for two different qubit amplifier architectures. Finally, Sec. VI summarizes the main conclusions. The paper includes a few appendices with complementary results and calculations.

II Toolbox

We begin by briefly introducing the mathematical models that we use in our analysis. They describe the main optical devices employed in a photonic implementation of a DIQKD setup, together with the behaviour of a typical lossy quantum channel.

II.1 Photonic sources

We will consider two types of light sources. The first one emits a coherent superposition of bipartite entangled states with the following form

[TABLE]

where $p_{n}$, with $\sum_{n=0}^{\infty}p_{n}=1$, stands for the probability of generating a $2n$-photon entangled state of the form

[TABLE]

In Eq. (2), \mbox{|0\rangle}_{ab} is the vacuum state and $a_{\rm{h}}^{\dagger}$ and $a_{\rm{v}}^{\dagger}$ ($b_{\rm{h}}^{\dagger}$ and $b_{\rm{v}}^{\dagger}$) denote, respectively, the creation operators of horizontally and vertically polarized photons at the spatial mode $a$ ($b$).

The case $p_{1}=1$ (and, thus, $p_{n}=0$ $\forall n\neq{}1$) in Eq. (1) corresponds to an ideal entanglement source generating singlet states, while the distribution

[TABLE]

corresponds to a type-II parametric down-conversion (PDC) source  PDC ; Xiongfeng . The parameter $\lambda$ in Eq. (3) is one half of the expected number of photon pairs generated by the source each given time, i.e., $\lambda=\frac{1}{2}\sum_{n=0}^{\infty}p_{n}n$.

The second type of light source that we will consider emits states of the form

[TABLE]

where the $2n$-photon state \mbox{|n,n\rangle}_{ab}=(a^{\dagger}b^{\dagger})^{n}/n!\mbox{|0\rangle}_{ab}, $a^{\dagger}$ ($b^{\dagger}$) being the creation operator in the idler (signal) mode. As an example, a triggered PDC source can generate states like Eq. (4) with $p_{n}=\mu^{n}(1+\mu)^{-n-1}$, $\mu$ being the mean number of photon pairs per pulse walls_book ; trig_pdc .

This latter source can be used, for instance, to simulate practical single-photon sources. For example, upon the successful detection of one photon in the idler mode $a$ of \mbox{|\Psi\rangle}_{ab}, the normalized quantum state in the signal mode can be written as

[TABLE]

for a certain probability distribution, $r_{n}$, which depends on the characteristics of the photodetector used to measure the idler mode. See Appendix A.2.1 for the value of $r_{n}$ in the case of triggered PDC sources.

II.2 Photodetectors

We shall consider that Alice and Bob have at their disposal photon-number-resolving (PNR) detectors, which are able to count the number of photons contained in each incoming optical pulse. In the relevant regime of low noise, they can be described by a positive operator valued measure (POVM) with the following elements:

[TABLE]

where the quantity $p_{\rm{d}}$ stands for the dark count rate of the photodetectors, which is, to a good approximation, independent of the incoming signals. On the other hand, the operators $\tilde{\Pi}_{k}$ that appear in Eq. (6), with $k\in\mathbb{N}$, are given by

[TABLE]

with $\eta_{\rm{d}}$ denoting the detection efficiency of the detectors, and where $|j\rangle$ stands for a Fock state with $j$ photons.

We remark that the mathematical model given by Eq. (6) assumes, for simplicity, that dark counts can only increment by one unit the number of photons observed in a given pulse. That is, if an optical pulse contains, say, $k$ photons, we assume that the measurement outcome is at most $k+1$ photons due to the dark counts, but not greater than this. This is a fair approximation given that $p_{\rm{d}}$ is sufficiently low, which indeed is typically the case in practice.

II.3 Heralded qubit amplifiers

As already discussed above, to achieve long-distance DIQKD, we will consider that Alice and Bob use heralded qubit amplifiers Gisin ; Pitkanen ; Curty to notify them the arrival of a photon before they select their measurement settings. That is, only after the qubit amplifier confirms that a photon has arrived, Alice (Bob) selects the measurement and measures the photon. If no successful heralding takes place, the optical pulse is simply discarded.

Typical qubit amplifiers consist in a teleportation gate teleportation . That is, a successful heralding occurs when the state of the arriving photon is teleported to a photon at the output port of the qubit amplifier. The general mechanism is depicted in Fig. 1(a), while Fig. 1(b) shows the standard linear-optics Bell state measurement (BSM) used by the qubit amplifiers introduced in Gisin ; Pitkanen ; Curty to teleport the input photon. More efficient BSMs exist efficient_BSM1 ; efficient_BSM2 and could be used here as well, although they require complicated entangled ancilla states.

Depending on the mechanism used to generate the bipartite entangled states, $\rho_{bc}$, illustrated in Fig. 1(a), one can distinguish two types of qubit amplifiers: polarization qubit amplifiers (PQAs) Gisin ; Pitkanen and entanglement swapping relays (ESRs) Curty .

PQAs, first introduced in Gisin based on the seminal work reported in Ralph , typically employ practical single-photon sources to generate $\rho_{bc}$. For instance, the PQA proposed in Pitkanen uses the linear-optics circuit shown in Fig. 1(c) for this purpose, where $\rho^{\rm{h}}_{\rm{single}}$ ($\rho^{\rm{v}}_{\rm{single}}$) represents the state of a single-photon pulse prepared in horizontal (vertical) polarization. In the ideal case of perfect single-photon sources and unit detection and coupling efficiencies, it is straightforward to show that the circuit given by Fig. 1(c) generates states \rho_{bc}=\mbox{|\phi\rangle}_{bc}\mbox{\langle\phi|} with

[TABLE]

where the parameter $t$ is the transmittance of the tunable beamsplitter (BS) illustrated in Fig. 1(c), and the states \mbox{|\psi\rangle}_{bb}, \mbox{|\varphi\rangle}_{cc}, and \mbox{|\chi\rangle}_{bc} have the form

[TABLE]

In Eq. (II.3), the states \mbox{|0\rangle}_{b}, \mbox{|0\rangle}_{c} and \mbox{|0\rangle}_{bc} denote the vacuum states of the corresponding modes. The expression for the output states of the PQA in the practical scenario with non-ideal sources and non-unit detector and coupling efficiencies can be found in Appendix A.2.

Let us continue assuming, for simplicity and for the moment, an ideal scenario where the BSM within the qubit amplifier uses perfect PNR detectors (i.e., $p_{\rm{d}}=0$ and $\eta_{\rm{d}}=1$ in Eqs. (6)-(7)) and lossless BSs and PBSs. Then, from Eq. (8), it can be shown that whenever a single-photon pulse prepared in, say, the pure state \mbox{|\varphi_{\rm in}\rangle}_{a}=({\alpha}a_{\rm{h}}^{\dagger}+{\beta}a_{\rm{v}}^{\dagger})\mbox{|0\rangle}_{a} (with $|\alpha|^{2}+|\beta|^{2}=1$) arrives at the input port $a$ of the qubit amplifier, a successful BSM occurs with probability $t(1-t)$. Also, in the case of a successful result, the state of the output photon at mode $c$ (after applying an appropriate unitary transformation) is equal to \mbox{|\varphi_{\rm out}\rangle}_{c}=({\alpha}c_{\rm{h}}^{\dagger}+{\beta}c_{\rm{v}}^{\dagger})\mbox{|0\rangle}_{c}. That is, the state \mbox{|\varphi_{\rm in}\rangle}_{a} of the input photon is successfully teleported to an output photon. On the other hand, if a vacuum pulse, \mbox{|\varphi_{\rm in}\rangle}_{a}=\mbox{|0\rangle}_{a}, arrives at the input port $a$ of the qubit amplifier, this state can never lead to a spurious heralding event, at least in the ideal scenario. This is so because, when the BSM uses perfect PNR detectors with no dark counts, the state \mbox{|0\rangle}_{a}\mbox{|\phi\rangle}_{bc}, with \mbox{|\phi\rangle}_{bc} given by Eq. (8), cannot produce two detection clicks associated to orthogonal polarizations if it is measured with the BSM shown in Fig. 1(b).

Finally, qubit amplifiers based on ESRs Curty directly prepare the state $\rho_{bc}$ with practical entanglement light sources like, for example, PDC sources. Indeed, in contrast to the arguments presented in Gisin ; Gisin2 , it was shown in Curty that when this type of qubit amplifier is used in DIQKD it can provide higher secret key rates than those achievable with the PQA introduced in Gisin when using PDC sources.

II.4 Optical couplers

In our analysis in Sec. V, we will consider a fiber-based implementation of DIQKD. Thus, we will model the coupling of the photons generated by the light sources into the optical fibers by means of a BS of transmittance $\eta_{\rm{c}}$. One input to the BS is the quantum signal, while the other input is a vacuum state. Similarly, one of the outputs of the BS is the optical fiber, while we assume that the other output is not accessible and represents the loss. For further details about this model we refer the reader to Appendix A.

II.5 Quantum channel

For simplicity, we will suppose that the quantum channel mainly introduces loss. That is, we shall disregard any noise effect due for example to polarization or phase misalignment.

The channel loss is modeled with a BS of transmittance $\eta_{\rm ch}=10^{-\Lambda/10}$, where the parameter $\Lambda$ (dB) is related to the transmission distance $L$ (km) by an attenuation coefficient $\alpha$ (dB/km) via the expression $\Lambda={\alpha}L$. The specific value of $\alpha$ depends on the considered channel. For instance, a typical value for $\alpha$ in the case of single-mode optical fibers in the telecom wavelength is $\alpha=0.2$ dB/km.

III DIQKD PROTOCOL

We consider the DIQKD protocol introduced in Rotem . It is based on a CHSH test CHSH , and is equivalent to a certain two-party nonlocal game known as the CHSH game.

Before presenting the steps of the protocol in detail, we introduce some notation first. Alice’s measurement setting in the $i$-th successfully heralded round of the protocol is denoted by $X_{i}\in\{0,1\}$, where $X_{i}=0$ and $X_{i}=1$ tag the measurements described by the two following Pauli operators

[TABLE]

respectively. On the other hand, Bob’s measurement setting in the $i$-th successfully heralded round of the protocol is denoted by $Y_{i}\in\{0,1,2\}$, where $Y_{i}=0$ tags the measurement $\sigma_{+}=(\sigma_{z}+\sigma_{x})/\sqrt{2}$, $Y_{i}=1$ indicates the measurement $\sigma_{-}=(\sigma_{z}-\sigma_{x})/\sqrt{2}$ and $Y_{i}=2$ refers to the measurement $\sigma_{z}$, with $\sigma_{z}$ and $\sigma_{x}$ again given by Eq. (10). Similarly, Alice’s (Bob’s) outcome in the $i$-th successfully heralded round is denoted by $A_{i}\in\{0,1\}$ ($B_{i}\in\{0,1\}$).

Next, we present the different steps of the protocol. A schematic is shown in Fig. 4. For simplicity and for the moment, we shall assume that only Bob holds a qubit amplifier to compensate channel loss, while Alice has the entanglement source, $\rho_{ab}$, in her lab. The case where both Alice and Bob hold a qubit amplifier and the entanglement source is located in the middle of the channel between them is analyzed in Appendix A.4.

**Protocol steps

**

1. Initialization. Bob sets the counter $i$ of successfully heralded rounds to 0.

While $i<{n_{\rm{SH}}}$ for a certain prefixed value ${n_{\rm{SH}}}$, steps $2$ and $3$ below are repeated.

2. Distribution. Alice prepares a bipartite entangled state, $\rho_{{ab}}$, and sends system $b$ to Bob through the quantum channel. If no successful heralding takes place at Bob’s qubit amplifier, the signal is discarded and step 2 is repeated. Otherwise, Bob updates the counter $i$ to $i+1$. Then, he randomly chooses a bit value $T_{i}\in{\left\{0,1\right\}}$ with probabilities ${\rm P}(T_{i}=0)=1-\gamma$ and ${\rm P}(T_{i}=1)=\gamma$, respectively, and sends it to Alice through an authenticated classical channel. We denote by $T=(T_{1},T_{2},...,T_{n_{\rm{SH}}})$ the string of all bit values $T_{i}$.

3. Measurement. If $T_{i}=0$, the $i$-th successfully heralded round is considered to be a key generation round, and Alice and Bob choose the settings $(X_{i},Y_{i})=(0,2)$. If $T_{i}=1$, such round is considered to be a test round (i.e., a CHSH game round), and they independently select $X_{i},Y_{i}\in{\left\{0,1\right\}}$ uniformly at random.

Alice and Bob record their measurement outcomes as $A_{i}$, ${B}_{i}\in\{0,1\}$, respectively. If, say, Alice (Bob) obtains an inconclusive result (i.e., no photon or multiple photons are observed in the detectors) she (he) deterministically assigns $A_{i}=1$ ($B_{i}=1$) to keep the fair-sampling loophole closed. Finally, Alice (Bob) publicly announces the measurement settings $X_{i}$ ($Y_{i}$). In what follows, we will denote by $X$ ($Y$) the bit string $X_{1},X_{2},...,X_{n_{\rm{SH}}}$ ($Y_{1},Y_{2},...,Y_{n_{\rm{SH}}}$) of Alice’s (Bob’s) measurement settings for the successfully heralded rounds. Similarly, $A$ ($B$) will denote the string of measurement outcomes $A_{1},A_{2},...,A_{n_{\rm{SH}}}$ ($B_{1},B_{2},...,B_{n_{\rm{SH}}}$).

4. Information reconciliation. Alice and Bob use an error correction protocol to obtain from $A$ and $B$ two identical bit strings, $Z_{\rm{A}}$ and $Z_{\rm{B}}$, respectively. For this, Alice sends Bob $leak_{\rm{IR}}$ bits of syndrome information and Bob obtains an estimate, $Z_{\rm{B}}$, of $A$. Next, they perform an error verification step (using two-universal hash functions) that leaks at most $\lceil{\log_{2}{1/\epsilon_{\rm{IR}}}}\rceil$ bits of information to Eve, for a certain prefixed parameter $\epsilon_{\rm IR}$. If this last step is successful, it is guaranteed that Alice’s and Bob’s bit strings $Z_{\rm{A}}=A$ and $Z_{\rm{B}}$ satisfy ${\rm P}(Z_{\rm{A}}\neq{Z_{\rm{B}}})\leq{\epsilon_{\rm{IR}}}$. Otherwise, the protocol aborts.

5. Parameter estimation. Bob sets the parameter $C_{i}=\perp$ for the key generation rounds (i.e., when $T_{i}=0$) and $C_{i}=\omega_{\rm{CHSH}}(Z_{{\rm B}i},B_{i},X_{i},Y_{i})$ for the test rounds (i.e., when $T_{i}=1$), with $i=1,2,...,n_{\rm{SH}}$, and where $Z_{{\rm B}i}$ denotes the $i$-th bit of the string $Z_{\rm{B}}$ and the function $\omega_{\rm{CHSH}}$ is defined as

[TABLE]

with $\oplus$ denoting bit addition modulo $2$ and $\cdot$ denoting bit multiplication. The overall number of test rounds in which $C_{i}=1$ (and thus the parties win the CHSH game) is denoted by $C_{\rm{SH}}={\sum_{\left\{i:T_{i}=1\right\}}C_{i}}$. This quantity determines a lower bound on the number of secret bits that can be extracted from $Z_{\rm{A}}$ and $Z_{\rm{B}}$ using privacy amplification Rotem .

Bob aborts the protocol if the fraction of wins lies below a certain prefixed threshold value, i.e., when $C_{\rm{SH}}/{n_{\rm{SH}}}<\omega|_{\rm{SH}}\gamma-\delta_{\rm{est}}$, where $\omega|_{\rm{SH}}$ is the expected winning rate of the CHSH game in the test rounds for the considered channel model comment0 , $\gamma$ is again the probability that Bob uses a successfully heralded round as a test round, and $\delta_{\rm{est}}$ is the confidence interval that defines the abortion threshold. That is, $\delta_{\rm{est}}$ is the maximum difference between the expected and the actual winning rates of the CHSH game that Bob accepts without aborting.

6. Privacy amplification. Alice and Bob apply a privacy amplification protocol to their bit strings $Z_{\rm{A}}$ and $Z_{\rm{B}}$ to obtain the final keys, $K_{\rm A}$ and $K_{\rm B}$, of length $l$. This protocol uses a randomness extractor that succeeds except with error probability $\epsilon_{\rm{PA}}$.

The main protocol arguments are summarized in Table 1.

We remark that in the distribution step of the protocol, Alice and Bob need to store their signals until they choose their measurement settings and measure the signals in the third step of the protocol. For simplicity, below we will optimistically assume that, for this purpose, both of them hold noiseless and lossless quantum memories in their labs. Alternatively, they could also decide which rounds are key generation rounds and which ones are test rounds a posteriori by using the typical sifting step in QKD, though this approach results in a slightly less efficient solution. This is so because the data associated to Alice measuring $\sigma_{\rm x}$ and Bob measuring $\sigma_{z}$ is not used in the protocol.

Also, we note that in a photonic implementation of the DIQKD scheme, the measurements $X_{i}$ and $Y_{i}$ can be realized by means of a polarization modulator that rotates the polarization state of the incoming signals, together with a PBS that separates vertical and horizontal polarization modes, followed by two photodetectors. For example, the rotation angles of the polarization modulator associated to the measurements $\sigma_{z}$, $\sigma_{x}$, $\sigma_{+}$ and $\sigma_{-}$ are [math], $\pi/4$, $\pi/8$ and $-\pi/8$ radians, respectively. The observation of one single-photon in, say, horizontal (vertical) polarization is recorded by Alice as $A_{i}=0$ ($A_{i}=1$), and the same applies to Bob.

IV Security analysis

We use the security analysis introduced in Rotem , which is valid against coherent attacks. Prior to the execution of the protocol, Alice and Bob agree on three parameters that tag the security of the final keys, $K_{\rm A}$ and $K_{\rm B}$. These parameters are the secrecy parameter, $\epsilon_{\rm{sec}}$, the correctness parameter, $\epsilon_{\rm{cor}}$, and the robustness parameter, $\epsilon_{\rm{rob}}$.

In particular, a protocol is said to be $\epsilon_{\rm{sec}}$-secret, when implemented using a device D, if it satisfies

[TABLE]

where $\rm{P(abort)}$ is the abortion probability of the protocol, $||\rho||_{1}={\sqrt{\rho\rho^{\dagger}}}$ stands for the trace norm, E is a quantum register held by the eavesdropper that may be initially correlated with D, $\rho_{K_{\rm A}{\rm E}}$ is the output state of the DIQKD protocol describing Alice’s key string $K_{\rm A}$ and the quantum register E conditioned on not aborting, \rho_{{\rm U}_{l}}=\sum_{z}\frac{1}{2^{l}}\mbox{|z\rangle}_{\rm A}\mbox{\langle z|} is the uniform mixture of all possible values of a $l$-bit string $K_{\rm A}$, and $\rho_{{\rm U}_{l}}\otimes{\rho_{\rm{E}}}$ is the perfectly secret output state.

The parameter $\epsilon_{\rm{sec}}$ is upper bounded by

[TABLE]

where $\epsilon_{\rm{PA}}+\epsilon_{\rm{s}}$ is the total failure probability associated to the privacy amplification step, $\epsilon_{\rm{PA}}$ being an upper bound on the error probability of the randomness extractor and $\epsilon_{\rm{s}}$ being the smoothing parameter of the $\epsilon_{\rm{s}}$-smooth min-entropy Rotem . The term $\epsilon_{\rm{EA}}$ is the failure probability associated to the entropy accumulation theorem Renner , which only guarantees that a certain lower bound on the $\epsilon_{\rm{s}}$-smooth min-entropy holds with a probability larger than $1-\epsilon_{\rm{EA}}$.

The correctness parameter, $\epsilon_{\rm{cor}}$, quantifies the probability that the final keys, $K_{\rm A}$ and $K_{\rm B}$, are not equal. More precisely, a protocol is said to be $\epsilon_{\rm{cor}}$-correct if ${\rm P}[K_{\rm A}\neq K_{\rm B}]\leq{\epsilon_{\rm{cor}}}$. According to the protocol definition given in the previous section, we have that $\epsilon_{\rm{cor}}={\epsilon_{\rm{IR}}}$.

Finally, a protocol is said to be $\epsilon_{\rm{rob}}$-robust for a specific honest implementation (i.e., for a particular implementation where the eavesdropper does not intervene) if it aborts with a probability smaller than $\epsilon_{\rm{rob}}$. The protocol described above can only abort in two steps: the information reconciliation step, and the parameter estimation step. Therefore, we have that $\epsilon_{\rm{rob}}$ satisfies

[TABLE]

where $\epsilon_{\rm{rob}}^{\rm{IR}}$ ($\epsilon_{\rm{rob}}^{\rm{PE}}$) is the probability of aborting at the information reconciliation (parameter estimation) step for the considered honest implementation. Moreover, we have that the quantity $\epsilon_{\rm{rob}}^{\rm{PE}}$ verifies

[TABLE]

where $\epsilon_{\rm{rob}}^{\rm{EA}}$ is the probability of the fraction of CHSH wins, $C_{\rm{SH}}/{n_{\rm{SH}}}$, being lower than the threshold $\omega|_{\rm{SH}}\gamma-\delta_{\rm{est}}$. That is,

[TABLE]

Note that for fixed values of $\epsilon_{\rm{rob}}^{\rm{EA}}$ and $n_{\rm{SH}}$, the minimum value of $\delta_{\rm{est}}$, such that Eq. (15) holds, satisfies Hoeffding

[TABLE]

Also, we note that the parameter $\epsilon_{\rm{IR}}$ contributes to $\epsilon_{\rm{rob}}^{\rm{PE}}$ in Eq. (14) because, conditioned on not aborting the protocol in the error verification step, Bob performs the parameter estimation step by using his original bit string of outcomes, $B$, and his estimate, $Z_{\rm B}$, of Alice’s string, which is equal to $Z_{\rm A}$ except with probability $\epsilon_{\rm{IR}}$.

A list with the main parameters related to the security of the protocol is provided in Table 2.

Then, it turns out that, conditioned on not aborting, the DIQKD protocol presented in the previous section delivers $\epsilon_{\rm{cor}}$-correct and $\epsilon_{\rm{sec}}$-secret output keys, $K_{\rm A}$ and $K_{\rm B}$, whose length, $l$, is given by

[TABLE]

Here, the term $\eta_{\rm{opt}}$ represents a lower bound on the entropy generation rate of the CHSH game (see Appendix B for further details on $\eta_{\rm{opt}}$ and $leak_{\rm IR}$). Importantly, the conditional secret key rate, i.e., the number of secret key bits per successful heralding event, reads $K|_{\rm SH}=l/n_{\rm SH}$, and the secret key rate is defined as

[TABLE]

where $N$ is the total number of transmitted signals. Below, we will use the term “success rate” to refer to the number of successful heralding events per transmitted signal, i.e., $r_{\rm SH}=n_{\rm SH}/N$.

We remark that, in the limit where $n_{\rm SH}\to{\infty}$, Eq. (18) matches the asymptotic secret key rate against general attacks reported in Vazirani , which we will denote by $K_{\infty}$. To see this, note that the quantum communication phase of the protocol described in the previous section only ends when $n_{\rm SH}$ heralded events are observed. This means that the number of transmitted signals, $N$, is a negative binomial random variable. Let $\rm{Var}\left(N/n_{\rm SH}\right)$ be the variance of the related random variable $N/n_{\rm SH}$. Then, we have that $\lim_{n_{\rm SH}\rightarrow{\infty}}{\rm{Var}\left(N/n_{\rm SH}\right)}=\lim_{n_{\rm SH}\rightarrow{\infty}}{(1-{P_{\rm SH}})/({n_{\rm SH}}{P_{\rm SH}}^{2})}=0$. This means that $\lim_{n_{\rm SH}\rightarrow{\infty}}{N/n_{\rm SH}}=1/{P_{\rm SH}}$, where $P_{\rm{SH}}$ is the successful heralding probability of the qubit amplifier. By using this result, it is straightforward to show that $K_{\infty}$ satisfies

[TABLE]

which is the result provided in Vazirani . In this equation, $h(x)=-x\log_{2}{x}-(1-x)\log_{2}{(1-x)}$ is the binary entropy function, and $Q|_{\rm SH}$ represents the quantum bit error rate of the key generation rounds. In the asymptotic regime, the conditional secret key rate reduces to $K|_{\rm SH}=K_{\infty}/P_{\rm SH}$, while for the success rate we have $r_{\rm SH}=P_{\rm SH}$.

In the next section, we evaluate the effect that device imperfections—particularly, finite detection and coupling efficiencies and the multi-photon pulses emitted by practical sources—have on the performance of DIQKD in terms of the resulting secret key rate for various honest optical implementations.

V Evaluation

Here, we use the device models introduced in Sec. II to evaluate the performance of the DIQKD protocol presented in Sec. III, by using the security analysis given in the previous section. The goal is to determine the resources needed to implement DIQKD over long distances. All the relevant calculations to reproduce the results presented in this section are included in Appendix A.

For simplicity, in the simulations below we assume that the coupling efficiency of the light sources is equal to the detection efficiency of the photodetectors, i.e., we set $\eta_{\rm c}=\eta_{\rm d}=\eta_{\rm c,d}$. This decision is motivated because DIQKD requires very high values of $\eta_{\rm c,d}$, so the effect of this simplification is negligible, and it reduces the number of experimental parameters to consider. Also, unless otherwise stated, we fix the dark count rate of the photodetectors to $p_{\rm d}=10^{-7}$, which is a reasonable value with current technology det1 ; det2 .

Furthermore, for illustration purposes, we consider two examples of security parameter sets $(\epsilon_{\rm sec},\epsilon_{\rm cor},\epsilon_{\rm rob})$, which we denote by $S_{1}$ and $S_{2}$. These sets are given in Table 3.

Also, to simplify the numerics, we fix the value of the failure probability of the entropy accumulation theorem to $\epsilon_{\rm EA}=10^{-6}$ ($\epsilon_{\rm EA}=10^{-10}$) for the set $S_{1}$ ($S_{2}$). We remark, however, that according to our simulations the loss of generality that results from fixing the value of $\epsilon_{\rm EA}$ in advance is very small. The secret key rate is then maximized over the remaining parameters, which include the quantities $\epsilon_{\rm PA}$, $\epsilon_{\rm s}$, $\epsilon_{\rm rob}^{\rm IR}$, $\epsilon_{\rm rob}^{\rm EA}$, the value of the transmittance $t$ in the case of a PQA (see Fig. 3(c)), as well as the intensities of the different light sources.

In the absence of real experimental data, in our simulations we set the denominator of Eq. (18) to the expected number of transmitted signals until $n_{\rm SH}$ successful heralding detection events occur at the qubit amplifier, which is given by

[TABLE]

This also amounts to setting the success rate of the qubit amplifier to its expected value, i.e., $\left\langle{r_{\rm SH}}\right\rangle=P_{\rm SH}$.

Finally, in all the plots below we assume a threshold value for the secret key rate as low as $10^{-10}$. That is, whenever the resulting secret key rate is smaller than this threshold value, it is considered to be impractical and we neglect it, as this value is already probably too low to have any practical relevance.

V.1 Ideal sources

We start by analyzing the ideal scenario where Alice and Bob hold perfect photon sources. Obviously, this case provides the best possible performance, and thus it can be used as a reference about the minimum resources (say, e.g., the minimum value of the detection and coupling efficiency, $\eta_{\rm c,d}$, and the minimum block size, $n_{\rm SH}$) that are required to achieve a certain secret key rate.

More precisely, we consider here that the entanglement source, $\rho_{ab}$, at Alice’s lab generates perfect polarization Bell pairs, i.e., \rho_{ab}=\mbox{|\phi_{1}\rangle}_{ab}\mbox{\langle\phi_{1}|} with \mbox{|\phi_{1}\rangle}_{ab} given by Eq. (2). Also, in the case of a PQA, we set $\rho^{\rm{h}}_{\rm{single}}$ ($\rho^{\rm{v}}_{\rm{single}}$) to be a perfect single-photon source generating horizontally (vertically) polarized single photons. That is, \rho^{\rm{h}}_{\rm{single}}=\mbox{|1,0\rangle}\mbox{\langle 1,0|} (\rho^{\rm{v}}_{\rm{single}}=\mbox{|0,1\rangle}\mbox{\langle 0,1|}) with \mbox{|1,0\rangle}=a^{\dagger}_{\rm h}\mbox{|0\rangle} (\mbox{|0,1\rangle}=a^{\dagger}_{\rm v}\mbox{|0\rangle}), being $|0\rangle$ the vacuum state. Similarly, in the case of an ESR, we set {\rho}_{bc}=\mbox{|\phi_{1}\rangle}_{bc}\mbox{\langle\phi_{1}|}.

V.1.1 No channel loss

To begin with, we compare the achievable performance when using PQAs and ESRs in the absence of channel loss, i.e., we set the distance at $L=0$ km. This scenario allows us to determine the minimum value of $n_{\rm SH}$ as a function of $\eta_{\rm c,d}$.

As we will show below, it turns out that $\eta_{\rm c,d}$ is quite high even in this ideal scenario. This means that the probability that any of these two amplifiers provides a spurious success at Bob’s side due to the dark counts of the PNR detectors within the BSM is negligible compared to that of a genuine success triggered by a single photon from Alice. Therefore, for simplicity, in this subsection we set the dark count rate $p_{\rm d}$ equal to zero. With this approximation, it is straightforward to derive simple analytical expressions for the quantities $P_{\rm SH}$, $\omega|_{\rm SH}$ and $Q|_{\rm SH}$. In the case of an ESR, we obtain

[TABLE]

where the parameter $\xi={\eta_{\rm c,d}^{2}}$. Similarly, it can be shown that in the case of a PQA we have

[TABLE]

where the parameter $t$ corresponds to the transmittance of the BS within the amplifier. See Appendix A for details of the calculations to derive Eqs. (V.1.1) and (V.1.1).

From Eq. (V.1.1), it is evident that there is a trade-off on the coefficient $t$. The terms $\omega|_{\rm SH}^{\rm PQA}$ and $Q|_{\rm SH}^{\rm PQA}$ favor $t\approx 1$, and thus the conditional secret key rate $K|_{\rm SH}$, which depends on these parameters but not on $P_{\rm SH}^{\rm PQA}$, also favors $t\approx 1$. Indeed, in the limit $t\rightarrow 1$ we have that $\omega|_{\rm SH}^{\rm PQA}=\omega|_{\rm SH}^{\rm ESR}$ and $Q|_{\rm SH}^{\rm PQA}=Q|_{\rm SH}^{\rm ESR}$. On the other hand, the average success rate of the qubit amplifier, $P_{\rm SH}^{\rm PQA}$, is maximized when $t=1-(2\xi)^{-1}$, and it actually vanishes when $t=1$. This behaviour can be easily understood by examining the states \rho_{bc}=\mbox{|\phi\rangle}_{bc}\mbox{\langle\phi|} generated within the PQA and which are given by Eq. (8). By setting $t$ close to 1 we have that whenever a successful heralding takes place at the qubit amplifier, with a high probability this event is due to the entangled pair \mbox{|\chi\rangle}_{bc} (see Eq. (II.3)), and thus $K|_{\rm SH}$ is maximized. On the contrary, the lower the transmittance $t$ is, the more likely is that a successful heralding comes from the spurious term \mbox{|\psi\rangle}_{bb} and, consequently, $K|_{\rm SH}$ is minimized. This might happen when only one photon from \mbox{|\psi\rangle}_{bb} is detected due to the finite detection efficiency of the detectors, and the remaining necessary detection is caused by a single photon coming from Alice. In our simulations, we numerically optimize the value of $t$ so that the overall secret key rate $K$ is maximized.

Also, we remark that from Eqs. (19)-(V.1.1)-(V.1.1) it is easy to show that a positive secret key rate requires a very high value of $\xi\gtrapprox{92.3\%}$ (or, equivalently, $\eta_{\rm c,d}=\sqrt{\xi}\gtrapprox{96.1\%}$) for both types of qubit amplifiers. Similarly, from Eqs. (V.1.1) and (V.1.1), it can be shown that, irrespectively of the value of $t$, whenever $\xi\geq 50\%$ we have that $P_{\rm SH}^{\rm ESR}>{P_{\rm SH}^{\rm PQA}}$, $\omega|_{\rm SH}^{\rm ESR}\geq{\omega|_{\rm SH}^{\rm PQA}}$ and $Q|_{\rm SH}^{\rm ESR}\leq{Q|_{\rm SH}^{\rm PQA}}$. That is, an ESR-based qubit amplifier always outperforms a PQA in the absence of channel loss, if perfect sources are assumed.

In Fig. 3(a) we plot the minimum block size, $n_{\rm SH}$, and the minimum detection efficiency, $\eta_{\rm c,d}$, that are needed to obtain a secret key rate above the threshold value of $10^{-10}$ at $L=0$ km. We denote this secret key rate by $K|_{L=0}$, and the minimum block size is denoted by $n_{\rm SH}^{*}|_{L=0}$. The value of $n_{\rm SH}^{*}|_{L=0}$ is obtained for each value of $\eta_{\rm c,d}$ via exhaustive numerical search over all the free parameters contained in the finite-key rate formula given by Eq. (18). The solid (dashed) bluish (reddish) lines correspond to the ESR (PQA) architecture, and in each case the lower (upper) line uses the set of security requirements $S_{1}$ ($S_{2}$); see Table 3. Remarkably, despite the security parameters of $S_{2}$ being significantly more demanding than those of $S_{1}$, it turns out that the set $S_{2}$ does not require much larger block sizes than $S_{1}$.

Also, Fig. 3(a) indicates that both qubit amplifiers require a similar minimum block size, $n_{\rm SH}^{*}|_{L=0}$, to deliver a secret key rate above the threshold value. Indeed, it is easy to show that if the threshold value for the secret key rate were zero (instead of $10^{-10}$) then the value of $n_{\rm SH}^{*}|_{L=0}$ would be equal for both qubit amplifiers. However, since we use a threshold value greater than zero implies that $n_{\rm SH}^{*}|_{L=0}$ is always slightly lower for the ESR than for the PQA. This is so because, even though the latter can mimic the conditional secret key rate of the former for any efficiency $\eta_{\rm c,d}$, the ESR has a higher success probability $P_{\rm SH}^{\rm ESR}$, thus leading to a higher overall secret key rate. Nevertheless, this effect cannot be fully appreciated with the resolution of Fig. 3(a).

Finally, the dotted black vertical line illustrated in Fig. 3(a) corresponds to the (asymptotic) minimum efficiency, $\eta_{\rm c,d}\approx{96.1\%}$, required to obtain $K_{\infty}|_{L=0}\geq{10^{-10}}$. That is, no secret key rate above such threshold value is possible when $\eta_{\rm c,d}\lessapprox{96.1\%}$, no matter how much we increase the block size.

In what follows, we will refer to the lines in Fig. 3(a) as the critical lines, since every pair $(\eta_{\rm c,d},n_{\rm SH})$ lying below these lines delivers a negligible secret key rate with the corresponding security requirements.

Fig. 3(b) shows the zero-distance secret key rate, $K|_{L=0}$, as a function of the detection and coupling efficiency, $\eta_{\rm c,d}$, for different values of the block size, $n_{\rm SH}$. As already discussed above, the ESR architecture always leads to larger secret key rates for all values of $\eta_{\rm c,d}$, while the minimum efficiencies required to have a secret key rate larger than the threshold value are roughly equal for both qubit amplifiers. Again, the small mismatch between the minimum efficiencies required by both amplifiers occurs because the selected threshold is greater than zero. Otherwise, the minimum efficiencies would match. For illustrative purposes, Fig. 3(b) considers four different block sizes: $n_{\rm SH}\rightarrow{\infty}$, $n_{\rm SH}=10^{11}$, $n_{\rm SH}=10^{9}$ and $n_{\rm SH}=10^{7}$. As already shown in Fig. 3(a), the smaller the block size is, the larger the value of the minimum efficiency $\eta_{\rm c,d}$ that is required. For instance, for a block size as large as, say, $n_{\rm SH}=10^{11}$, and if one considers the weaker set of security requirements $S_{1}$, the minimum efficiency is at least $\eta_{\rm c,d}\approx{96.4\%}$. Also, for any given value of $n_{\rm SH}$, the greater the detection efficiency considered (with respect to its minimum value), the closer the resulting secret key rates corresponding to the security settings $S_{1}$ and $S_{2}$ become. This is so because, in this situation, the effect of finite statistics is less prominent. Note that in the limit given by the asymptotic regime, the secret key rate $K_{\infty}$ does not depend on the security sets $S_{1}$ and $S_{2}$, but these sets are only relevant in the finite-key regime.

V.1.2 Channel loss

In this subsection, we consider the effect of channel loss, which is parametrized by the quantity $\Lambda={\alpha}L$ measured in dB (see Sec. II.5). Also, we set here the dark count rate of the detectors to $p_{\rm d}=10^{-7}$, as the effect of dark counts becomes relevant in this scenario.

Fig. 4 plots the secret key rate $K$ as a function of $\Lambda$ for various values of $\eta_{\rm c,d}$ and $n_{\rm SH}$, and for the two considered qubit amplifier architectures. More precisely, we use two values for $\eta_{\rm c,d}$: the ideal one, i.e., $\eta_{\rm c,d}=100\%$, and one close to the threshold value of $96.1\%$ discussed above, say, $\eta_{\rm c,d}=96.5\%$. Moreover, for each of these values of the efficiency $\eta_{\rm c,d}$, we plot three different secret key rates: the asymptotic one $K_{\infty}$, and two finite-key rates, one for the security settings $S_{1}$ and another one for the security settings $S_{2}$. In both finite-key cases, we use a common block size $n_{\rm SH}$ close to the critical value obtained from Fig. 3.(a). Specifically, we set $n_{\rm SH}=10^{7}$ when $\eta_{\rm c,d}=100\%$, and $n_{\rm SH}=10^{11}$ when $\eta_{\rm c,d}=96.5\%$. In doing so, and for the considered security analysis, we are simultaneously providing upper bounds (given by $K_{\infty}$) and lower bounds (given by the finite-key rates) to the finite-key performance that could be achieved with the chosen detection and coupling efficiencies, and the security requirements. By increasing the value of $n_{\rm SH}$, the finite-key rates approach the asymptotic scenario. Also, $K_{\infty}$ with $\eta_{\rm c,d}=100\%$ provides a clear upper bound for the achievable secret key rate with the security analysis introduced in Sec. IV.

Figs. 4.(a) and (b) further show, as expected, that in the case of ideal sources the ESR architecture outperforms the PQA architecture also in the presence of channel loss.

As a final remark, we note that if Bob did not use a qubit amplifier, then the maximum possible value of $\Lambda$ would be very limited. Indeed, it can be shown that in the case of ideal sources, and even if one sets $\eta_{\rm c,d}=100\%$ and $n_{\rm SH}\to\infty$, the maximum value of $\Lambda$ is as low as $\Lambda\lessapprox 0.7$ dB. See Appendix A.3 for further details.

V.1.3 Time constraints

In the discussion so far, we have not considered the duration of a DIQKD session, which is another crucial experimental parameter. Indeed, this parameter imposes strong restrictions on the loss that DIQKD can tolerate. We study it in this section.

In the protocol described in Sec. III, we have that the post-processing block size, $n_{\rm SH}$, is fixed a priori. This means, in particular, that the number of transmitted signals, $N$, which is needed to achieve $n_{\rm SH}$ successful heralding events, and thus the duration of the distribution step of the protocol, which we shall denote by $\tau$, are random variables. Their mean values are given by Eq. (20) and $\left\langle{\tau}\right\rangle={\nu}\left\langle{N}\right\rangle$, respectively, where $\nu$ represents the clock rate of system.

From Eq. (20) we have that, for given $n_{\rm SH}$, the value of $\left\langle N\right\rangle$ increases when the success probability of the qubit amplifier decreases, for instance, due to channel and/or detection loss. Indeed, according to Eqs. (V.1.1)-(V.1.1) we find that $\left\langle N\right\rangle$ at $L=0$ km, which we will denote by $\left\langle{N}\right\rangle|_{L=0}$, is, in the case of an ESR, equal to

[TABLE]

while in the case of a PQA it satisfies

[TABLE]

This is illustrated in Fig. 5, which shows $\left\langle{N}\right\rangle|_{L=0}$ as a function of $\eta_{\rm c,d}$ when $n_{\rm SH}=\{10^{7},10^{9},10^{11}\}$. From Fig. 5 we find that the value of $\left\langle{N}\right\rangle|_{L=0}$ associated to the PQA presents a much steeper slope than that of the ESR architecture when $\eta_{\rm c,d}$ decreases. This is because the optimal transmittance $t$ of the PQA approaches $1$ in that regime.

In the scenario where $L>0$ km, the success probability of the qubit amplifier decreases exponentially with the channel loss. In particular, we find that the value of $\left\langle{N}\right\rangle|_{L\geq 0}$ in this case is given by

[TABLE]

for the ESR architecture, and

[TABLE]

for the PQA. In these two equations, for simplicity, the success probability $P_{\rm SH}$ is computed to the first order in $p_{\rm d}$.

Table 4 provides the value of $\left\langle{N}\right\rangle|_{L\geq 0}$ for a couple of detection and coupling efficiencies $\eta_{\rm c,d}$ and data block sizes $n_{\rm SH}$. This table shows that the average number of signals that has to be transmitted increases significantly with $\Lambda$, both for the ESR and the PQA.

Indeed, if one considers, for example, that the clock rate of the system is, say, $10$ GHz, we find that when $\eta_{\rm c,d}=96.5\%$ it would take about $2.1$ ($37.0$) days to establish a secret key of length $7.56\times{10^{7}}$ ($8.64\times{10^{7}}$) bits—out of a block size $n_{\rm SH}=10^{11}$—over a channel loss of 39 dB (37 dB) when using the ESR (PQA) architecture and the security settings given by $S_{1}$. Of course, the result improves when $\eta_{\rm c,d}$ increases. For instance, if $\eta_{\rm c,d}=100\%$ then it would take of the order of $120$ ($250$) seconds to establish a secret key of length $1.56\times{10^{5}}$ ($1.58\times{10^{5}}$)—out of a block size $n_{\rm SH}=10^{7}$—over 48 dB when using the ESR (PQA) architecture and the security settings given by $S_{1}$.

V.2 PDC sources

In this subsection we consider now the more practical case where Alice and Bob use PDC sources instead of ideal sources.

That is, here we suppose that the quantum state, $\rho_{ab}$, emitted by Alice’s entanglement source in Fig. 2 is given by Eq. (1) with the statistics $p_{n}$ given by Eq. (3). The quantum state $\rho_{bc}$ generated by the entanglement source within the qubit amplifier depends on the architecture considered. In the case of a PQA, we will assume that the single-photon states, $\rho^{\rm h}_{\rm single}$ and $\rho^{\rm v}_{\rm single}$, have the form given by Eq. (5) with the statistics $r_{n}$ given by Eq. (60), i.e., they are generated with a triggered single-photon PDC source in combination with PNR detectors. In the case of a ESR architecture, we will asume that the state $\rho_{bc}$ is directly generated with a PDC source, i.e., it has the form given by Eq. (1) with $p_{n}$ given by Eq. (3).

To simplify the numerics, in our simulations below we consider a contribution of up to three photon pairs per source. That is, we set $p_{n}=0$ in Eq. (1) for all $n\geq{4}$ and we choose $p_{3}=1-p_{0}-p_{1}-p_{2}$. Likewise, we do the same with the statistics $r_{n}$ in Eq. (5). This is a reasonable approximation when the optimal intensities of the light sources are sufficiently small, which, indeed, is what we expect and observe in our simulations. A full mode analysis for this scenario is included in Appendix A, which in principle could be use to evaluate the contribution of up to any desired number of photon pairs per source.

V.2.1 No channel loss

Like in the case of ideal sources, we start our analysis by evaluating the critical lines corresponding to the security setting sets $S_{1}$ and $S_{2}$ when the channel loss and the dark count rate of the detectors is set to zero.

The results are illustrated in Fig. 6(a), which shows the minimum data block size, $n^{*}_{\rm SH}|_{L=0}$, and the minimum detection and coupling efficiency, $\eta_{\rm c,d}$, that are needed to obtain $K|_{L=0}\geq{10^{-10}}$. By definition, any combination of $\eta_{\rm c,d}$ and $n_{\rm SH}$ lying below the critical lines illustrated in the figure leads to a minuscule (if not zero) secret key rate below $10^{-10}$. The blue (red) solid lines correspond to the ESR (PQA) architecture, and in each case the lower (upper) line uses the security requirements $S_{1}$ ($S_{2}$). Fig. 6(a) shows clearly that the ESR architecture demands much larger data block sizes and detection and coupling efficiencies than the PQA architecture in this case. This can be understood if one compares $P_{\rm SH}$ and $K|_{\rm SH}$ separately for both qubit amplifiers: while the ESR has a considerably larger success probability in the relevant efficiency regime, its conditional secret key rate is lower. This suggests that the PQA performs better at filtering genuine entanglement, and thus it is more robust to efficiency decrease and statistical fluctuations (partly due to the availability of an extra tunable parameter $t$). Also, as already observed in the case of ideal sources, we note that using the security set $S_{2}$ (instead of that given by $S_{1}$) does not affect much the minimum data block size, despite the significant difference that exists between both sets in terms of security requirements (see Table 3).

The dotted blue (red) vertical line shown in Fig. 6(a) corresponds to the (asymptotic) minimum efficiency, $\eta_{\rm c,d}\approx{98.3\%}$ ($\eta_{\rm c,d}\approx{96.7\%}$), that is necessary to obtain a secret key rate above the threshold value with the ESR-based qubit amplifier (PQA) when the block size $n_{\rm SH}$ tends to infinity. As expected, these values are much higher than those required for the case of ideal sources, specially for the ESR. These results are also in accordance with the results reported in Curty , as that work also considers a similar setup and device models like here, though the analysis of Curty is restricted to the asymptotic key rate scenario. From Fig. 6(a) we observe that when $n_{\rm SH}$ decreases, the minimum value of $\eta_{\rm c,d}$ increases even further as expected. For example, if $n_{\rm SH}=10^{11}$ and we focus on, say, the weaker set of security requirements, $S_{1}$, we find that the minimum values of $\eta_{\rm c,d}$ are about $98.6\%$ and $97\%$ for the ESR and PQA, respectively.

Fig. 6(b) illustrates the zero-distance secret key rate, $K|_{L=0}$, as a function of $\eta_{\rm c,d}$ for varios values of the block size $n_{\rm SH}$. This figure shows that, in the absence of channel loss, an ESR-based qubit amplifier outperforms a PQA in the regime of very high detection and coupling efficiencies, while in principle the PQA can tolerate slightly lower values of $\eta_{\rm c,d}$, as we have already seen in Fig. 6(a). In any case, the minimum value of $\eta_{\rm c,d}$, specially for the ESR, seems to be already probably too high to have practical relevance. The main reasons for this behaviour are twofold. First, the vacuum and multiple photon pairs emitted by the light sources significantly reduce the probability to have a successful heralding event in the amplifier. And, second, multiple photon pairs are also responsable for spurious heralding events which increase (decrease) $Q|_{\rm SH}$ ($\omega|_{\rm SH}$) and thus decrease the resulting $R$. The higher $\eta_{\rm c,d}$ is, the higher is the number of multiple photon pairs which can be filtered out by Alice and Bob’s PNR detectors and, therefore, the better the resulting performance. As already mentioned above, in our simulations we optimize over the intensities of the different light sources and, as expected, the optimal intensities decrease when $\eta_{\rm c,d}$ decreases in order to reduce the number of multiple photon pairs generated.

V.2.2 Channel loss

Next, we consider the effect of the channel loss and, as in Sec. V.1.2, we set $p_{\rm d}=10^{-7}$.

The results are illustrated in Fig. 7, which shows the secret key rate $K$ as a function of $\Lambda$ for various values of $\eta_{\rm c,d}$ and $n_{\rm SH}$. More precisely, Figs. 7(a) and 7(b) are respectively devoted to the ESR-architecture and to the PQA-architecture. For each case, we assume two values of $\eta_{\rm c,d}$: the ideal one $\eta_{\rm c,d}=100\%$, and another one close to the threshold value of the ESR, say, $\eta_{\rm c,d}=98.7\%$. Regarding the block size $n_{\rm SH}$, we set it to a value near the critical line in each case. That is, we consider the pairs $(\eta_{\rm c,d},n_{\rm SH})\in\{(100\%,10^{9}),(98.7\%,10^{11})\}$ for the ESR, and $(\eta_{\rm c,d},n_{\rm SH})\in\{(100\%,10^{7}),(98.7\%,10^{9})\}$ for the PQA. Also, Fig. 7 includes the results for the sets $S_{1}$ and $S_{2}$ of security requirements, as well as the asymptotic curves corresponding to $K_{\infty}$. These latter curves serve as upper bounds to the attainable finite-key rates for each $\eta_{\rm c,d}$.

Generally speaking, we observe that, in the presence of channel loss, the performance of DIQKD with PDC sources is again significantly worse than that achievable with ideal sources. The reason for this, as already explained above, is due to the presence of vacuum and multiple photon pairs, which require that the intensities of the sources are quite low to palliate their negative effect. Indeed, in the case of an ESR, we find that even when $n_{\rm SH}=10^{11}$, the detection and coupling efficiency is as high as $98.7\%$, and the weaker set of security requirements is considered ($S_{1}$), the resulting secret key rate is already as low as $K\approx{10^{-10}}$ for a channel loss of only $9$ dB. Similarly, for the same value of $\eta_{\rm c,d}$ and a block size $n_{\rm SH}=10^{9}$, we find that the PQA can only tolerate about $14$ dB channel loss. In this regard, we remark that setting $n_{\rm SH}$ to a different value for each qubit amplifier does not necessarily lead to an unfair comparison between them, as the average number of signals, $\left\langle{N}\right\rangle$, required to gather a particular block size is different in both cases. This is discussed in more detail in the following subsection.

Finally, from Fig. 7 we observe again that increasing the security requirements from $S_{1}$ to $S_{2}$ does not affect the system performance significantly. Also, we note that if Bob did not use a qubit amplifier, the maximum possible value of $\Lambda$ in this scenario would be as low as $\Lambda\lessapprox 0.4$ dB, even if one sets $\eta_{\rm c,d}=100\%$ and $n_{\rm SH}\to\infty$. See Appendix A.3 for further details.

V.2.3 Time constraints

To conclude this part, we now consider the duration of a DIQKD session with PDC sources. As we show below, in this case the time requirements are much more demanding than in the scenario with ideal sources. As discussed above, this happens because the optimal intensity of Alice’s source, $\rho_{ab}$, is quite low in the high loss regime. As a result, the average number, $\left\langle{N}\right\rangle$, of signals that Alice has to send Bob to achieve $n_{\rm SH}$ successful heralding events turns out to be quite high.

This is illustrated in Fig. 8, which shows the value of $\left\langle{N}\right\rangle$ as a function of $\eta_{\rm c,d}$ at $L=0$ km. As in Fig. 5, dark counts are disregarded here because their effect is negligible. Also, we consider both sets of security requirements ($S_{1}$ and $S_{2}$) and two different block sizes for each qubit amplifier: $n_{\rm SH}=10^{11}$ and $n_{\rm SH}=10^{9}$. We note that the case $\left\langle{N}\right\rangle|_{L=0}\geq 10^{15}$ leads to DIQKD sessions that would take longer than one day even with $10$ GHz PDC sources. Actually, if the conditions $\left\langle{N}\right\rangle|_{L=0}<10^{15}$ (see Fig. 8) and $K\geq{10^{-10}}$ (see Fig. 6) are imposed, one finds that the detection efficiency must satisfy $\eta_{\rm c,d}\gtrapprox{98\%}$, irrespectively of the qubit amplifier and the data block size. This means that the examples shown in Fig. 6 for the PQA where $K\geq{10^{-10}}$ is possible for $\eta_{\rm c,d}<98\%$, are probably not too practical, as they require too long DIQKD sessions.

Obviously, if one considers the case of nonzero channel loss, the time constraints become sharper. This is illustrated in Table 5, which shows the maximum value of the channel loss, $\Lambda$, for which $\left\langle{N}\right\rangle\leq 10^{15}$ for various pairs $(\eta_{\rm c,d},n_{\rm SH})$ previously evaluated in Fig. 7. For instance, when $\eta_{\rm c,d}=98.7\%$, and assuming the ESR (PQA) architecture, the maximum $\Lambda$ decreases from $9$ ($14$) dB as shown in Fig. 7 to roughly $1$ ($4$) dB for $n_{\rm SH}=10^{11}$ ($10^{9}$).

Indeed, in Appendix A.4 we show that, due to similar time constraints, locating the entanglement source $\rho_{ab}$ in the middle of the channel between Alice and Bob, and furnishing both Alice and Bob with a qubit amplifier, does not seem to improve the performance that can be obtained when Alice holds the source and only Bob holds a qubit amplifier, at least in the case of PDC sources.

V.3 Generic sources

Finally, in this section we further investigate the effect that vacuum pulses and multiple photon pairs, generated by practical entanglement sources, has on the performance of DIQKD. For concreteness, we focus on the ESR architecture and we consider entanglement sources generating signals of the form given by Eqs. (1) and (2). Also, for simplicity, we set $p_{n}=0$ for $n\geq{3}$ with $p_{2}=1-p_{0}-p_{1}$, the underlying assumption being that the effect of multiple photon pairs is properly encompassed by the effect of double photon pairs, which is supported by our numerical simulations. In doing so, we can characterize the photon-number statistics of the entanglement sources by means of only two parameters: the probability $p_{0}$ of emitting vacuum, and the ratio $q={p_{2}/p_{1}}$ between the probability of emitting a double photon pair and that of emitting a single photon pair.

Of course, if one considers a practical entanglement source, the photon-number statistics $p_{n}$ cannot be controlled separately, but they typically depend on an intensity parameter. For instance, in the case of PDC sources, we have that $p_{n}$ is fixed for all $n$ once we set the value of the probability $p_{0}$ (or, equivalently, the value of $\lambda$). In this type of sources, by using Eq. (3), we have that $q={p_{2}/p_{1}}=(1-p_{0}-p_{1})/p_{1}=(p_{0}^{-1/2}-1)(p_{0}^{-1/2}+2)/2={}q_{\rm PDC}$. The case of ideal sources, on the other hand, corresponds to $p_{0}=p_{2}=0$ and thus $q=0$. Since both scenarios have already been evaluated above, and the case $q>q_{\rm PDC}$ delivers worse results than those evaluated in Sec. V.2, below we consider combinations of $(p_{0},q)$ that satisfy $0\leq{}q<q_{\rm PDC}$ for the corresponding $p_{0}>0$. In doing so, we investigate an intermediate scenario between the photon number statistics of ideal sources and those of PDC sources.

We remark, however, that Appendix A includes a full mode analysis, both for the ESR and PQA architectures, which allows the evaluation of any desired photon number distribution for the different light sources, including the contribution of up to any wanted number of photon pairs per source. That is, such analysis could be used to investigate any generic source of the form given by Eqs. (1) and (2).

The results for the simplified scenario discussed above are illustrated in Fig. 9, which shows the secret key rate as a function of the channel loss $\Lambda$ for $n_{\rm SH}=10^{9}$ and the security requirements given by $S_{1}$. To simplify the comparison between this case and the one based on PDC sources, we use the values of $\eta_{\rm c,d}$ employed in Fig. 7, i.e., $\eta_{\rm c,d}\in\{100\%,98.7\%\}$. Moreover, for each value of $\eta_{\rm c,d}$, we plot three different cases. The first (second) case, assumes that the entanglement source $\rho_{bc}$ ($\rho_{ab}$) is an ideal entanglement source, while $\rho_{ab}$ ($\rho_{bc}$) is characterized by the parameters $(p_{0},q)$. The third case considers that both $\rho_{bc}$ and $\rho_{ab}$ are characterized by the parameters $(p_{0},q)$, which, for simplicity, we assume are the same for both sources, though, in general, the optimal intensity for each source will depend of the value of the channel loss. In each figure, we evaluate two possible values for $p_{0}$: $p_{0}=0.5$ (solid lines) and $p_{0}=0.9$ (dotted lines). Also, we consider four different values for the parameter $q\in\mathcal{Q}=\{0,10^{-2},10^{-1.5},10^{-1}\}$.

In all the plots within Fig. 9, if one compares the solid lines with the dotted lines, we observe that reducing the value of the probability $p_{0}$ for a fixed value of $q$ basically leads to a rigid increase of the secret key rate. This is so because vacuum signals rarely lead to false heralding flags in the qubit amplifier: if $\rho_{ab}$ ($\rho_{bc}$) emits a vacuum state, it is necessary that either $\rho_{bc}$ ($\rho_{ab}$) emits more than one photon pair or that at least one dark count takes place at the detectors within the qubit amplifier in order to have a (spurious) successful heralding event. As a consequence, to a good extent, $p_{0}$ affects mainly the pre-factor $P_{\rm SH}$, but not the conditional secret key rate, $K|_{\rm SH}$. The greater the value of $p_{0}$, the smaller the value of $P_{\rm SH}$, and thus the rigid decrease of the secret key rate.

On the other hand, for a fixed value of $p_{0}$, increasing $q$ significantly affects $K|_{\rm SH}$, so that multiple photon pairs are responsible for the changing slope of the secret key rate as well as for the position of the cutoff point where the secret key rate starts dropping down to zero, as shown in Fig. 9. This is so because multiple photon pairs lead to spurious heralding events that limit the utility of the qubit amplifier, and, as expected, this effect is amplified when the detection and coupling efficiency $\eta_{\rm c,d}$ decreases. In this regard, we also note that the performance of DIQKD seems to be more robust to the presence of multiple photon pairs in $\rho_{ab}$ than in $\rho_{bc}$. The reason goes as follows. Multi-photons arising from $\rho_{ab}$ need to undergo a lossy channel, but multi-photons from $\rho_{bc}$ do not. Therefore, the latter are more likely to trigger a spurious success at the qubit amplifier when the input from the channel is a vacuum signal. Actually, from Fig. 9 we observe that the curves with an ideal source $\rho_{bc}$, and $\rho_{ab}$ characterized with $q=10^{-2}$ or $10^{-1.5}$ are relatively close to the curve corresponding to $q=0$. This suggests that the cutoff points of these curves (at the high loss regime) are probably mainly due to the dark counts of the detectors at the qubit amplifier, as in the case $q=0$, rather than due to the presence of multiple photon pairs in $\rho_{ab}$. On the contrary, all the curves with an ideal source $\rho_{ab}$, and $\rho_{bc}$ characterized with a nonzero $q$, show an early cutoff point induced by the multiple photon pairs in $\rho_{bc}$.

Furthermore, we note that the cutoff points match for $p_{0}=0.5$ and $p_{0}=0.9$ if they are caused by the presence of multiple photon pairs, but they do not match if they are caused by the dark counts of the detectors. This is so because, in the former case, the cutoff point is roughly determined by the double-to-single photon pair ratio (i.e., by the parameter $q$), while in the latter case it is determined by the dark count to single photon pair ratio, which is different for each curve. Either way, Fig. 9 suggests that the noise induced by multiple photon pairs generated by the sources, particularly those generated by the sources within the qubit amplifier, seems to be the major challenge to achieve long-distance DIQKD with the considered setup.

This effect is investigated further in Fig. 10, where we plot an upper bound on the maximum value of the parameter $q$, which we denote by $q_{\rm max}$, to achieve $K\geq{0}$ with $\left\langle{N}\right\rangle\leq 10^{15}$, as a function of the channel loss $\Lambda$. For this, we assume that the source $\rho_{ab}$ is an ideal source and we parametrize the source $\rho_{bc}$ with the quantity $q$. Note that since here we use the condition that the secret key rate is strictly greater than zero, we can set the parameter $p_{0}$ corresponding to $\rho_{bc}$ to zero. This is so because setting $p_{0}>0$ simply translates into a rigid decrease of the secret key rate, thus not affecting the value of $q_{\rm max}$. That is, we define $q_{\rm max}=\min_{p_{1}}\left\{(1-p_{1})/p_{1}|K\geq{0}\right\}$. In addition, and in order to investigate the limitations imposed by the noise due to multiple photon pairs alone, we set $p_{\rm d}=0$. In this scenario, Fig. 10 suggests that, irrespectively of the block size $n_{\rm SH}$, the value of the detector efficiency $\eta_{\rm c,d}$ and the security settings, the double-to-single photon pair ratio $q$ severely restricts the maximum distance that is achievable with DIQKD. Moreover, note that in a realistic situation with a non-ideal $\rho_{ab}$, $q_{\rm max}$ would be lower than the value shown in Fig. 10. The vertical cutoffs in the graphs indicate the points where $\left\langle{N}\right\rangle\approx{10^{15}}$, as this value is already probably too large for a QKD session today. Since $q_{max}$ is very small at the cutoff points, the corresponding values of $\Lambda$ are very close (indistinguishable to our numerical precision) to those of the case $q=0$, which are given by

[TABLE]

for the different pairs $(\eta_{\rm c,d},n_{\rm SH})$. This expression is directly obtained from Eq. (25) assuming $p_{\rm d}=0$.

As a final remark, note that one might achieve a source whose parameter $q<q_{\rm max}$ for a given distance by simply decreasing the intensity of the source. Indeed, this is the case, for example, of PDC sources, where one can reduce $\lambda$ and thus $q$ at the price of significantly increasing the probability $p_{0}$ of emitting vacuum. While this might provide a positive key rate according to Fig. 10 (by assuming still that $\rho_{ab}$ is an ideal source), the resulting secret key rate might be probably too low to be practical because the probability of having a successful heralding event would be very low. The situation gets worse in the presence of dark counts.

VI Conclusions

Device independence is a desirable feature for quantum key distribution (QKD) to ultimately defeat quantum hacking. However, it comes at a high price, in terms of achievable performance and required resources. Indeed, long distance device-independent QKD (DIQKD) requires the use of fair-sampling devices, like for instance qubit amplifiers, which can herald the arrival of a photon and thus decouple channel loss from the measurement settings selection.

In this work, we have investigated all-photonic DIQKD assisted by two general types of qubit amplifiers—entanglement swapping relays and polarization qubit amplifiers—in the finite-key regime. In doing so, we have quantified some crucial experimental parameters that are essential to achieve DIQKD over practical distances and within a reasonable time frame of signal transmission. This includes, for example, the minimum value of the detection efficiency of the photodetectors and the quality of the entanglement light sources, in terms of their vacuum and multi-photon contributions. In this regard, we have shown that, even if perfect entanglement sources and photon-number-resolving detectors were available, the ability to achieve large enough violations of a loophole-free CHSH test, within a DIQKD session of a reasonable time duration, already imposes very strong restrictions on the minimum detection efficiency ($\gtrsim 96,5\%$), which further increases quickly with the length of the transmission link. Similarly, we have shown that multi-photon pulses emitted by practical entanglement sources have a severe effect on the performance of DIQKD assisted by qubit amplifiers, as multiple photon pairs lead to spurious heading successes that strongly decrease the conditional secret key rate.

Altogether, our results suggest that the possibility of implementing DIQKD over long distances is probably quite far-off, as it seems to require a significant improvement of our current experimental capabilities.

Acknowledgements

We thank Rotem Arnon-Friedman for very useful discussions related to the security analysis in Rotem . We thank the Spanish Ministry of Economy and Competitiveness (MINECO), the Fondo Europeo de Desarrollo Regional (FEDER) through grants TEC2014-54898-R and TEC2017-88243-R, and the European Union’s Horizon 2020 research and innovation programme under the Marie Skłodowska-Curie grant agreement No 675662 (project QCALL) for financial support. VZ gratefully acknowledges support from a FPU scholarship from the Spanish Ministry of Education.

Appendix A Honest implementations

Here, we present the main calculations needed to reproduce our simulation results. For this, we use the mathematical models introduced in the main text. As already mentioned in Sec. II, we model channel, coupling and detection loss with a beamsplitter (BS), whose unitary transformation is of the form

[TABLE]

where the input mode $a$ is the quantum signal, the input mode $b$ is a vacuum state, the output mode $c$ is the optical fiber, and the output mode $d$ represents loss. In Eq. (A), the subscript “h, v” indicates again horizontal and vertical polarization respectively. That is, the BS transformation given by Eq. (A) applies to both polarizations.

Similarly, polarization modulators are simply described by a rotation that transforms the input modes $a_{\rm h}^{\dagger}$ and $a_{\rm v}^{\dagger}$ as follows

[TABLE]

where $b_{\rm h}^{\dagger}$ and $b_{\rm v}^{\dagger}$ denote the output modes. The case $\theta=\pi/4$ corresponds to the Hadamard transformation.

A.1 Entanglement swapping relay

Here, we calculate the parameters $P_{\rm SH}$, $Q|_{\rm SH}$ and $\omega|_{\rm SH}$ for an honest implementation of the DIQKD protocol assisted by an ESR at Bob’s side. A schematic of the mathematical model that describes the optical setup is given in Fig. (11). This figure includes all the parameters and the relevant notation that shall be used in what follows.

A.1.1 Click pattern distribution

Since all photodetectors are described with a POVM whose elements are diagonal in the Fock basis (see Eq. (7)), for convenience we will consider that Alice’s source emits mixed states of the form

[TABLE]

instead of pure states \mbox{|\psi\rangle}_{ab}=\sum_{n=0}^{\infty}\sqrt{p_{n}}\mbox{|\phi_{n}\rangle}_{ab} (see Eq. (2) for the explicit expression of \mbox{|\phi_{n}\rangle}_{ab}). Both states deliver exactly the same output statistics when measured in the Fock basis, and thus we can use the state $\sigma_{ab}$ for the calculations below.

Similarly, we will consider that the state emitted by the entanglement source within the qubit amplifier is of the form

[TABLE]

where the apostrophe in ${p^{\prime}_{n}}$ indicates that the statistics of $\sigma_{cd}$ are generally different from those of $\sigma_{ab}$. For instance, $\sigma_{ab}$ and $\sigma_{cd}$ could originate from PDC sources with different intensity parameters.

The starting point for our calculations is then the quantum state

[TABLE]

Prior to the interference in the linear optics BSM, the states $\sigma_{ab}$ and $\sigma_{cd}$ evolve separately. In particular, let us focus on the evolution of $\sigma_{ab}$ first. We have that the states \mbox{|\phi_{n}\rangle}_{ab} can be written as

[TABLE]

Here and in what follows, we shall simply use $|0\rangle$ to denote the vacuum state in all spatial modes. Since all detectors are assumed to have the same detection efficiency, $\eta_{\rm d}$, we model them by means of a BS of transmittance $\eta_{\rm d}$ together with lossless PNR detectors, whose POVM elements are simply given by projectors onto Fock states: \Pi_{j}=\mbox{|j\rangle}\mbox{\langle j|}, $j\in{\mathbb{N}}$. The effect of dark counts is incorporated a posteriori. This model is equivalent to that given by Eq. (6). Moreover, we combine the effect of finite detection efficiency and coupling efficiency (as well as channel loss) in one BS of transmittance $\zeta_{\rm c,d}={\eta_{\rm c}\eta_{\rm d}}$ ($\zeta_{\rm c,ch,d}={\eta_{\rm c}\eta_{\rm ch}}\eta_{\rm d}$, where $\eta_{\rm ch}=10^{-\Lambda/10}$ is the transmission efficiency of the fiber link connecting Alice’s and Bob’s labs, which depends on the channel loss $\Lambda$). In doing so, we find that the quantum states \mbox{|\phi_{n}\rangle}_{ab} evolve to

[TABLE]

where the different modes are illustrated in Fig. (11). In Eq. (34) we define $T_{\rm c,d}={\zeta_{\rm c,d}}^{1/2}$, $T_{\rm c,ch,d}={\zeta_{\rm c,ch,d}}^{1/2}$, $R_{\rm c,d}=(1-\zeta_{\rm c,d})^{1/2}$ and $R_{\rm c,ch,d}=(1-\zeta_{\rm c,ch,d})^{1/2}$ for readability.

Similarly, the state $\sigma_{cd}$ within the ESR undergoes a similar transformation, so that the pure states \mbox{|\phi_{n^{\prime}}\rangle}_{cd} evolve to \mbox{|\phi_{n^{\prime}}\rangle}_{c_{1}d_{1};p_{1}q_{1}}, whose form is identical to that of \mbox{|\phi_{n}\rangle}_{a_{1}b_{1};f_{1}g_{1}} but taking $T_{\rm c,ch,d}\to{T_{\rm c,d}}$ and $R_{\rm c,ch,d}\to{R_{\rm c,d}}$, and now obviously referred to the modes $c_{1},d_{1},p_{1}$ and $q_{1}$ (instead of $a_{1},b_{1},f_{1}$ and $g_{1}$).

Putting it all together, the overall quantum state prior to the interference in the ESR is given by

[TABLE]

where the pure states \mbox{|\phi_{n}\rangle}_{a_{1}b_{1};f_{1}g_{1}}\otimes{\mbox{|\phi_{n^{\prime}}\rangle}_{c_{1}d_{1};p_{1}q_{1}}} are written as

[TABLE]

Next, modes $b_{1}$ and $c_{1}$ interfere at a 50:50 BS within the ESR. The corresponding transformation is given by

[TABLE]

If we define the sum variables $s=h+u$ and $o=r+v$, and we use the fact that a rectangle $\{0\leq{a}\leq{A},0\leq{b}\leq{B}\}$ can be equivalently characterized by $\{0\leq{s}\leq{A+B},\max(0,s-A)\leq{b}\leq{\min(s,B)}\}$, we have that the RHS of Eq. (A.1.1) can be written as

[TABLE]

This means that the state \mbox{|\phi_{n}\rangle}_{a_{1}b_{1};f_{1}g_{1}}\otimes{\mbox{|\phi_{n^{\prime}}\rangle}_{c_{1}d_{1};p_{1}q_{1}}} is transformed into \mbox{|\phi_{n,n^{\prime}}\rangle}_{a_{1}b_{2}c_{2}d_{1};f_{1}g_{1}p_{1}q_{1}} given by

[TABLE]

Now, we incorporate Alice’s and Bob’s measurement settings by transforming the operators of the affected modes, $a_{1}$ and $d_{1}$, with rotation angles $\theta_{\rm{A}}$ and $\theta_{\rm{B}}$, respectively. We denote the corresponding output pure state by \mbox{|\phi_{n,n^{\prime}}\rangle}_{a_{2}b_{2}c_{2}d_{2};f_{1}g_{1}p_{1}q_{1}}^{\theta_{\rm A},\theta_{\rm B}}, and it is given by

[TABLE]

That is, Eq. (A.1.1) describes the quantum state immediately prior to the detectors, conditioned on the photon pair numbers $n$ and $n^{\prime}$.

Importantly, as the detection efficiencies of all detectors were already accounted for in the effective BS models, projective measurements onto Fock states must be considered now, as explained above. More precisely, we are interested in the conditional probability, ${{\rm{P}}\left(\vec{\alpha}|n,n^{\prime}\right)}_{\theta_{\rm A},\theta_{\rm B}}$, of observing a detection pattern $\vec{\alpha}$ given the quantum state \mbox{|\phi_{n,n^{\prime}}\rangle}_{a_{2}b_{2}c_{2}d_{2};f_{1}g_{1}p_{1}q_{1}}^{\theta_{\rm A},\theta_{\rm B}}. Here, we introduced the vector notation $\vec{\alpha}=(\alpha,\beta,\gamma,\delta,\mu,\nu,\tau,\lambda)$, where each element of the vector denotes the number of photons in a certain output mode: $\alpha$ refers to mode $a_{2,\rm{h}}$, $\beta$ to mode $a_{2,\rm{v}}$, $\gamma$ to mode $d_{2,\rm{h}}$, $\delta$ to mode $d_{2,\rm{v}}$, $\mu$ to mode $c_{2,\rm{h}}$, $\nu$ to mode $c_{2,\rm{v}}$, $\tau$ to mode $b_{2,\rm{h}}$ and $\lambda$ to mode $b_{2,\rm{v}}$. With this notation, and if we disregard for the moment the effect of dark counts, we have that ${{\rm{P}}\left(\vec{\alpha}|n,n^{\prime}\right)}_{\theta_{\rm A},\theta_{\rm B}}$ is given by

[TABLE]

where the unnormalized state \mbox{|\tilde{\phi}_{n,n^{\prime}}\rangle}_{\vec{\alpha};f_{1}g_{1}p_{1}q_{1}}^{\theta_{\rm A},\theta_{\rm B}} has the form

[TABLE]

being \mbox{|\vec{\alpha}\rangle}=\mbox{|\alpha,\beta,\gamma,\delta,\mu,\nu,\tau,\lambda\rangle}.

To compute \mbox{|\tilde{\phi}_{n,n^{\prime}}\rangle}_{\vec{\alpha};f_{1}g_{1}p_{1}q_{1}}^{\theta_{\rm A},\theta_{\rm B}}, we make use of the following orthogonality relation:

[TABLE]

where $\delta_{i}^{j}$ stands for the Kronecker’s delta symbol, i.e., $\delta_{i}^{j}=1$ only if $i=j$, otherwise it is zero. Also, we recall that for finite range sums, $\sum_{a=A_{1}}^{A_{2}}f(a)\delta_{x}^{a}=f(x)\Theta_{x-A_{1}}\Theta_{A_{2}-x}$, where $\Theta_{j}$ is the “discrete” Heaviside function 111For all $j\in\mathbb{Z}$, $\Theta_{j}=1$ if $j\geq{0}$ and $\Theta_{j}=0$ otherwise.. Then, in order to incorporate the effect of the different $\Theta$’s, one must modify the affected index ranges accordingly. This yields

[TABLE]

where some overall constant terms were factored from the sums.

Then, by applying Eq. (41) on the state given by Eq. (A.1.1), we obtain

[TABLE]

where we have defined

[TABLE]

Of course, the condition $\sum_{\vec{\alpha}}{{\rm{P}}\left(\vec{\alpha}|n,n^{\prime}\right)}_{\theta_{\rm A},\theta_{\rm B}}=1$ holds, and only those click patterns $\vec{\alpha}$ such that $\alpha+\beta\leq{n}$, $\gamma+\delta\leq{n^{\prime}}$ and $\mu+\nu+\tau+\lambda\leq{n+n^{\prime}}$ give a non vanishing contribution due to the absence of noise, which we take into account next.

In particular, if one considers the noise model introduced in the main text, we find that the resulting distribution in the noisy scenario is given by

[TABLE]

where $\Gamma_{\vec{\alpha}}={\left\{\vec{\sigma}:|\vec{\alpha}|=|\vec{\sigma}|+1\right\}}$, $|\vec{\alpha}|$ being the overall number of photons corresponding to the pattern $\vec{\alpha}$, i.e., $|\vec{\alpha}|=\alpha+\beta+\gamma+\delta+\mu+\nu+\tau+\lambda$. As a consequence, and up to first order in $p_{\rm d}$, we have that ${\tilde{\rm{P}}\left(\vec{\alpha}|n,n^{\prime}\right)}_{\theta_{\rm A},\theta_{\rm B}}$ vanishes for any pattern $\vec{\alpha}$ that does not fulfill $\alpha+\beta\leq{n+1}$, $\gamma+\delta\leq{n^{\prime}+1}$, $\mu+\nu+\tau+\lambda\leq{n+n^{\prime}+1}$ and $\alpha+\beta+\gamma+\delta+\mu+\nu+\tau+\lambda\leq{2(n+n^{\prime})+1}$.

Alice’s and Bob’s outcomes are expected to be anti-correlated, as the entanglement sources we are considering emit singlet states. Therefore, we flip say Alice’s outcomes in such a way that, whenever Alice and Bob select the same measurement settings, their outcomes are correlated. For this, we define the distribution

[TABLE]

That is to say, ${\tilde{\rm{p}}\left(\alpha,\beta,\gamma,\delta,\mu,\nu,\tau,\lambda|n,n^{\prime}\right)}_{\theta_{\rm A},\theta_{\rm B}}={\tilde{\rm{P}}\left(\beta,\alpha,\gamma,\delta,\mu,\nu,\tau,\lambda|n,n^{\prime}\right)}_{\theta_{\rm A},\theta_{\rm B}}$.

Finally, it only remains to take into account the deterministic assignment performed by Alice and Bob whenever they observe an inconclusive event, required to have a distribution with binary outcomes on both sides. To be precise, the assignments read

[TABLE]

In this way, every possible event $(\alpha,\beta,\gamma,\delta)$ regarding Alice’s and Bob’s detector outcomes is mapped to an element of the set of binary strings $\left\{(0,0),(0,1),(1,0),(1,1)\right\}$.

Importantly, we remark that such a post-processing is not performed on the outcomes of the photodetectors inside the qubit amplifier, but only on the outcomes observed by the parties. In summary, the distribution we are finally interested in is that of the “post-processed click pattern” $A_{\vec{\alpha}}={(A_{\rm A},A_{\rm B},\mu,\nu,\tau,\lambda)}$, which we shall denote by $\mathbf{P}(A_{\vec{\alpha}}|n,n^{\prime})_{\theta_{\rm A},\theta_{\rm B}}$. From Eqs. (49), it is obvious that

[TABLE]

A.1.2 Parameters $P_{\rm SH}$, $Q|_{\rm SH}$ and $\omega|_{\rm SH}$

To obtain the value of these parameters we have to take into account that there are four different click patterns in the ESR which are considered to be successful heralding events, as explained in the main text. These are $(\mu,\nu,\tau,\lambda)=\{(1,1,0,0),(0,1,1,0),(1,0,0,1),(0,0,1,1)\}$. Due to the symmetries of the channel model, we can consider only one of these successful heralding events, say $\Omega={\left\{(\mu,\nu,\tau,\lambda)=(1,1,0,0)\right\}}$, and the next holds: $P_{\rm{SH}}=4P_{\Omega}$, $\omega|_{\rm{SH}}=\omega|_{\Omega}$ and $Q|_{\rm{SH}}=Q|_{\Omega}$. As a consequence, we can restrict ourselves to the calculation of $P_{\Omega}$, $Q|_{\Omega}$ and $\omega|_{\Omega}$.

To begin with, we have that the probability $P_{\Omega}$ is simply given by

[TABLE]

where $A_{\rm A},A_{\rm B}\in\{0,1\}$. Obviously, since we are summing over all possible measurement outcomes for Alice and Bob in Eq. (A.1.2), $P_{\Omega}$ does not depend on the rotation angles $\theta_{\rm{A}}$ and $\theta_{\rm B}$. Therefore, one can simply set them both to zero for the numerical calculations.

Secondly, the conditional QBER is given by

[TABLE]

We remark that this quantity is referred to the events in which both parties select the Z-basis, so that $\theta_{\rm{A}}=\theta_{\rm{B}}=0$.

Finally, the conditional winning probability at the CHSH game, $\omega|_{\Omega}$, can be defined in terms of the conditional CHSH violation, $S|_{\Omega}$, via

[TABLE]

where 222Actually, the summand that carries the minus sign in the definition of $S|_{\Omega}$ depends on the successful heralding event considered. Indeed, two out of the four successful heralding events require the definition of $S|_{\Omega}$ given by Eq. (54), while the other two require the minus sign to be carried by the third summand in Eq. (54). This is so because the quantum measurements that lead to a maximum violation of the CHSH inequality are different for each Bell pair, and one can equivalently account for this fact by changing the definition of $S|_{\Omega}$ depending on the Bell pair.

[TABLE]

and the parameters $E_{\theta_{\rm A},\theta_{\rm B}}|_{\Omega}$ are given by

[TABLE]

We note that in the second equality of Eq. (55), we simply used Eq. (A.1.2) and the law of total probability, conditioning on the photon numbers $n$ and $n^{\prime}$.

A.2 Polarizing qubit amplifier

In this Appendix we now consider a PQA-based implementation of the DIQKD protocol. A schematic of the mathematical model that describes the optical setup is illustrated in Fig. (12).

In contrast to the ESR-based implementation, Alice and Bob only keep those detection events for which, first, both triggered single-photon sources at Bob’s lab record one photon in their idler mode, and second, a successful BSM occurs. For this reason, we need to calculate the trigger probability $P_{\rm trigger}$ at the idler mode of a source of this kind, and the conditional quantum state $\rho_{\rm single}$ at its signal mode, given that a trigger occurred. This is what we do next.

A.2.1 Triggered single-photon sources

As described in the main text, we shall consider triggered single-photon sources generated by measuring the idler mode of an entanglement state of the form \mbox{|\Psi\rangle}=\sum_{n=0}^{\infty}\sqrt{p_{n}}\mbox{|n,n\rangle}.

We have that $P_{\rm trigger}$ can be written as

[TABLE]

where $P_{{\rm trigger}|0\rm{d}}$ ($P_{{\rm trigger}|1\rm{d}}$) denotes de trigger probability given that there is no dark count (one single dark count) in the detector. These conditional probabilities can be written as

[TABLE]

where $P_{{\rm trigger}|n,0\rm{d}}=n\zeta_{\rm c,d}(1-\zeta_{\rm c,d})^{n-1}$ and $P_{{\rm trigger}|n,1\rm{d}}=(1-\zeta_{\rm c,d})^{n}$. Here, like in Appendix A.1, $\zeta_{\rm c,d}={\eta_{\rm c}\eta_{\rm d}}$ with $\eta_{\rm c}$ and $\eta_{\rm d}$ being, respectively, the coupling and the detection efficiencies.

Similarly, the conditional quantum state at the signal mode given that a trigger occurred has the form \rho_{\rm single}=\sum_{n=0}^{\infty}r_{n}\mbox{|n\rangle}\mbox{\langle n|}, where the probability distribution $r_{n}$ can be written as:

[TABLE]

For example, in the case of a triggered PDC source with $p_{n}=\mu^{n}(1+\mu)^{-n-1}$ we find that $P_{{\rm trigger}|0\rm{d}}=\mu\zeta_{\rm c,d}(1+\mu\zeta_{\rm c,d})^{-2}$, and $P_{{\rm trigger}|1\rm{d}}=(1+\mu\zeta_{\rm c,d})^{-1}$. Hence,

[TABLE]

Also, we obtain

[TABLE]

In what follows, we will use the notation $\rho_{\rm single}^{\rm h}$ and $\rho_{\rm single}^{\rm v}$ in order to specify the polarization state of the generated photons.

A.2.2 Click pattern distribution

Our starting point is the state of the whole system conditioned on the trigger of both triggered single-photon sources at Bob’s PQA,

[TABLE]

where \mbox{|n_{1},n_{2}\rangle}_{d}={d_{\rm h}^{\dagger}}^{n_{1}}{d_{\rm v}^{\dagger}}^{n_{2}}/\sqrt{n_{1}!n_{2}!}\mbox{|0\rangle}.

Next, we have that the quantum states \mbox{|\phi_{n}\rangle}_{ab} undergo exactly the same transformation as in the case of the ESR-based setup (see Fig. (11)), leading to the states \mbox{|\phi_{n}\rangle}_{a_{1}b_{1};f_{1}g_{1}} given by Eq. (34) right before the interference at the BSM.

On the other hand, the states \mbox{|n_{1},n_{2}\rangle}_{d} evolve to

[TABLE]

where $T_{\rm c,d}={\zeta_{\rm c,d}}^{1/2}$ and $R_{\rm c,d}=(1-\zeta_{\rm c,d})^{1/2}$ as in Appendix A.1. Here, like in the ESR-based setup, we have modeled the effect of coupling and detection loss by means of a BS with transmittance $\zeta_{\rm c,d}=\eta_{\rm c}\eta_{\rm d}$. This means that for the remaining calculations we consider lossless PNR detectors.

Next, the quantum signals coming from both single-photon sources enter a BS of transmittance $t$. This BS transforms the quantum states \mbox{|\psi_{n_{1}},\psi_{n_{2}}\rangle}_{d_{1};p_{1}q_{1}} into

[TABLE]

where $T_{\rm t}=t^{1/2}$.

Afterwards, we have that two Hadamard gates rotate the outgoing signals at each output port of the beamsplitter. These Hadamard gates transform the operator ${d_{2,\rm{h}}^{\dagger}}^{z}{d_{2,\rm{v}}^{\dagger}}^{w}{c_{1,\rm{h}}^{\dagger}}^{x-z}{c_{1,\rm{v}}^{\dagger}}^{y-w}$ as

[TABLE]

By using the same change of variables that we applied to Eq. (A.1.1), we have that Eq. (A.2.2) can be rewritten as

[TABLE]

By combining Eqs. (63) and (A.2.2), we obtain the quantum states that emerge from the PQA for the teleportation

[TABLE]

Then, by putting it all together, we have that the overall quantum state prior to the BSM is given by

[TABLE]

where the pure states \mbox{|\phi_{n}\rangle}_{a_{1}b_{1};f_{1}g_{1}}\otimes\mbox{|\psi_{n_{1},n_{2}}\rangle}_{c_{2}d_{3};p_{1}q_{1}} can be written as

[TABLE]

Next, modes $b_{1}$ and $c_{2}$ interfere at the 50:50 BS within the PQA. This BS transforms the state \mbox{|\phi_{n}\rangle}_{a_{1}b_{1};f_{1}g_{1}}\otimes\mbox{|\psi_{n_{1},n_{2}}\rangle}_{c_{2}d_{3};p_{1}q_{1}} into the state \mbox{|\phi_{n,n_{1},n_{2}}\rangle}_{a_{1}b_{2}c_{3}d_{3};f_{1}g_{1}p_{1}q_{1}} given by

[TABLE]

As in the case of the ESR-based setup, Alice’s and Bob’s measurement settings can be incorporated at this stage by rotating the pairs of operators $(a_{1,\rm{h}}^{\dagger},a_{1,\rm{v}}^{\dagger})$ and $(d_{3,\rm{h}}^{\dagger},d_{3,\rm{v}}^{\dagger})$ with angles $\theta_{\rm{A}}$ and $\theta_{\rm{B}}$, respectively. We denote the resulting pure state by \mbox{|\phi_{n,n_{1},n_{2}}\rangle}_{a_{2}b_{2}c_{3}d_{4};f_{1}g_{1}p_{1}q_{1}}^{\theta_{\rm A},\theta_{\rm B}}, and it is given by

[TABLE]

Then, in an identical way as in the ESR-based setup, the probability ${{\rm{P}}\left(\vec{\alpha}|n,n_{1},n_{2}\right)}_{\theta_{\rm A},\theta_{\rm B}}$ that a specific click pattern $\vec{\alpha}=(\alpha,\beta,\gamma,\delta,\mu,\nu,\tau,\lambda)$ occurs with the state written in Eq. (A.2.2) is given by

[TABLE]

where the unnormalized state \mbox{|\tilde{\phi}{n,n{1},n_{2}}\rangle}_{\vec{\alpha};f_{1}g_{1}p_{1}q_{1}}^{\theta_{\rm A},\theta_{\rm B}} has the form

[TABLE]

being \mbox{|\vec{\alpha}\rangle}=\mbox{|\alpha,\beta,\gamma,\delta,\mu,\nu,\tau,\lambda\rangle}.

After addressing the relevant orthogonality relation, given by

[TABLE]

one finds that the state \mbox{|\tilde{\phi}{n,n{1},n_{2}}\rangle}_{\vec{\alpha};f_{1}g_{1}p_{1}q_{1}}^{\theta_{\rm A},\theta_{\rm B}} can be written as

[TABLE]

Finally, by taking the squared norm of the previous state as decribed in Eq. (71), we obtain that

[TABLE]

where

[TABLE]

The normalization condition $\sum_{\vec{\alpha}}{{\rm{P}}\left(\vec{\alpha}|n,n_{1},n_{2}\right)}_{\theta_{\rm A},\theta_{\rm B}}=1$ holds for any set of physical parameters $\theta_{\rm A}$, $\theta_{\rm B}$, $\zeta_{\rm c,d}$, $\zeta_{\rm c,ch,d}$ and $t$, and only those click patterns $\vec{\alpha}$ such that $\alpha+\beta\leq{n}$, $\gamma+\delta\leq{n_{1}+n_{2}}$ and $\gamma+\delta+\mu+\nu+\tau+\lambda\leq{n+n_{1}+n_{2}}$ have a nonzero probability to happen due to the fact that for the moment we have disregarded dark counts.

As a final step, we need to define the click pattern distribution in the noisy scenario, ${\tilde{\rm{p}}\left(\vec{\alpha}|n,n_{1},n_{2}\right)}_{\theta_{\rm A},\theta_{\rm B}}$, as well as the post-processed click pattern distribution, $\mathbf{P}(A_{\vec{\alpha}}|n,n_{1},n_{2})_{\theta_{\rm A},\theta_{\rm B}}$ (with $A_{\vec{\alpha}}={(A_{\rm A},A_{\rm B},\mu,\nu,\tau,\lambda)}$). This is exactly analogous to what we did for the ESR-based setup in Appendix A.1.1, and we omit the details here for simplicity. The only difference is that no permutation step $\alpha\leftrightarrow\beta$ is performed in this case. This is so because, conditioned on a successful heralding event, Alice’s and Bob’s outcomes are expected to be directly correlated in this case.

A.2.3 Parameters $P_{\rm SH}$, $Q|_{\rm SH}$ and $\omega|_{\rm SH}$

To determine $P_{\rm SH}$, we note that any given detection event is discarded unless a trigger is observed at the idler mode of both single photon sources and, at the same time, a success occurs at the PQA. Therefore, and due to the symmetries of the channel model under consideration, we can define, say the event $\Omega={\left\{(\mu,\nu,\tau,\lambda)=(1,1,0,0)\right\}}$ (as we did in Appendix A.1.2) and thus the overall success probability is given by

[TABLE]

where the conditional probability $P_{\Omega|\rm double\hskip 1.42271pttrigger}$ has the form

[TABLE]

with $A_{\rm A},A_{\rm B}\in\{0,1\}$. On the other hand, we have that the conditional QBER reads

[TABLE]

Similarly, the conditional winning probability reads $\omega|_{\Omega,\rm double\hskip 1.42271pttrigger}=S|_{\Omega,\rm double\hskip 1.42271pttrigger}/8+1/2$, where

[TABLE]

and the quantities $E_{\theta_{\rm A},\theta_{\rm B}}|_{\Omega}$ are given by

[TABLE]

Note that in Eq. (80) the summand that carries the minus sign is different from that of Eq. (54). As already explained in Appendix A.1.2, the definition of the conditional CHSH violation depends on the particular Bell pair shared by the parties after a successful BSM 333Again, also here two successful heralding events require the given definition of $S|_{\Omega,\rm double\hskip 1.42271pttrigger}$, while the other two require the minus sign to be carried by the fourth summand in Eq. (80)..

A.3 DIQKD without heralding mechanism

In this Appendix, we calculate the maximum channel loss that a photonic DIQKD implementation can tolerate in the absence of an heralding mechanism. For that purpose, we consider the setup where Bob does not hold a qubit amplifier in his lab, as shown by Fig. 13. Also, since we are interested in the maximum achievable distance, we further assume perfect coupling and detection efficiencies, i.e., $\eta_{\rm c}=\eta_{\rm d}=1$, and no detector noise, i.e., $p_{\rm d}=0$. In this way, channel loss is the only source of loss that we contemplate, modeled by a transmission efficiency $\eta_{\rm ch}=10^{-\Lambda/10}$ as usual.

In the case of a perfect entanglement source, \rho_{ab}=\mbox{|\phi_{1}\rangle}_{ab}\mbox{\langle\phi_{1}|} (see Eq. (2)) we have that the parameters of the honest implementation are simply given by $Q=(1-\eta_{\rm ch})/2$ and $\omega=(\sqrt{2}\eta_{\rm ch}+2)/4$, so that the maximum tolerated channel loss is given by $\Lambda_{\rm max}=\max\{\Lambda\in\mathbb{R}^{+}|K_{\infty}\geq{0}\}\approx{0.7}\rm dB$, where $K_{\infty}$ is the asymptotic secret key rate in the absence of a qubit amplifier,

[TABLE]

If we assume, for instance, an attenuation coefficient of, say, $\alpha=0.2$ dB/km, which corresponds to the typical value for single-mode fibers in the telecom wavelength, then $\Lambda_{\rm max}=0.7$ dB means that the maximum achievable distance between the parties in the DIQKD link is $L_{\rm max}=3.5$ km.

Let us now consider the case where $\rho_{ab}$ is a more general entanglement source, \rho_{ab}=\mbox{|\psi\rangle}_{ab}\mbox{\langle\psi|}, with \mbox{|\psi\rangle}_{ab} given by Eq. (1) and some arbitrary photon number statistics $p_{n}$. Then, by using the same techniques employed in Appendix A.1 and in Appendix A.2, it is possible to derive the click pattern distribution ${{\rm{P}}\left(\alpha,\beta,\gamma,\delta|n\right)}_{\theta_{\rm A},\theta_{\rm B}}$ that matches the setup of Fig. (13), conditioned on the number of photon pairs $n$ emitted by the source. Precisely, one finds

[TABLE]

where

[TABLE]

with the parameter $\Upsilon(n,j,l,h,H,s,S,\alpha,\beta,\gamma,\delta,\Delta)$ being of the form

[TABLE]

Then, summing over $n$ and taking into account the $\delta_{\alpha+\beta}^{n}$ factor, we obtain that the overall distribution reads

[TABLE]

As in Appendix (A.1.1), a permutation step is required to enforce correlation between Alice’s and Bob’s outcomes. Therefore, we define

[TABLE]

Given ${\tilde{\rm{p}}\left(\alpha,\beta,\gamma,\delta\right)}_{\theta_{\rm A},\theta_{\rm B}}$, one can readily define the post-processed click pattern distribution $\mathbf{P}(A_{\rm A},A_{\rm B})_{\theta_{\rm A},\theta_{\rm B}}$ by simply summing over all click patterns $(\alpha,\beta,\gamma,\delta)$ that are mapped to a specific pair of deterministic assignments, $(A_{\rm A},A_{\rm B})$, as we are assuming here that $p_{\rm d}=0$. Once this is done, it is straightforward to define the parameters of the honest implementation.

In particular, we have that

[TABLE]

On the other hand, $\omega=S/8+1/2$, where in this case the CHSH violation reads $S=E_{0,-\frac{\pi}{8}}+E_{0,\frac{\pi}{8}}-E_{\frac{\pi}{4},-\frac{\pi}{8}}+E_{\frac{\pi}{4},\frac{\pi}{8}}$ and

[TABLE]

In doing so, one can numerically compute the maximum tolerated channel loss for any given photon-number statistics $p_{n}$. For instance, in the case of PDC sources, the statistics read $p_{n}=(n+1){\lambda^{n}}(1+\lambda)^{-n-2}$, so that $\Lambda_{\rm max}=\max\{\Lambda\in\mathbb{R}^{+}|K_{\infty}\geq{0}\}$. In this scenario, however, the definition of $K_{\infty}$ includes a maximization over the free parameter $\lambda$ characterizing the intensity of the PDC source, i.e.,

[TABLE]

In this way, we find $\Lambda_{\rm max}\approx{0.4}$ dB, which results in a maximum transmission distance $L_{\rm max}\approx{2}$ km for an attenuation coefficient $\alpha=0.2$ dB/km.

A.4 DIQKD with two qubit amplifiers

Finally, in this Appendix we consider a different setup from that presented in Fig. 2, i.e., we now assume that the entanglement source $\rho_{ab}$ is located in the middle of the channel, equidistant from Alice’s and Bob’s labs. Also, we suppose that both parties hold an ESR-based qubit amplifier to palliate the effect of the channel loss (the case with two PQAs is briefly discussed afterwards also below). The goal is to investigate whether or not such setup could increase the maximum transmission distance before the secret key rate sharply drops to zero.

Intuitively speaking, the cutoff point where the secret key rate drops down to zero happens at the range of distances for which a significant fraction of the successful heralding events at the qubit amplifier are triggered by the dark counts of the detectors. In this scenario, the conditional quantum state shared by Alice and Bob after a successful heralding takes place is a separable state, thus leading to a vanishing conditional secret key rate.

In the setup with a central source $\rho_{ab}$ and two qubit amplifiers, the input signal to each qubit amplifier has only traveled a half of the overall transmission distance, so the probability of still carrying a photon that hits a detector within the amplifier may still be large compared to that of a dark count, and this could lead to an enhancement of the transmission distance. Of course, one also expects that the overall secret key rate decreases, as the probability to have a simultaneous successful heralding event at both qubit amplifiers is lower than that of a single success in a unique qubit amplifier, as required in the setup given by Fig. 2. Nevertheless, it takes longer distances for the conditional secret key rate to sharply drop down to zero, since it comes from an entangled state with a higher probability than in the setup of Fig. 2. As a result, the cutoff point is shifted to further distances.

For instance, in the case where $\rho_{ab}$ is an ideal entanglement source, the setup with two qubit amplifiers roughly doubles the maximum distance without significantly affecting the secret key rate. This is illustrated by the bluish lines in Fig. 14, where we compare the secret key rate with one and two qubit amplifiers as a function of the channel loss. Here, as in the previous examples, we set the dark count rate to $p_{\rm d}=10^{-7}$. Also, we assume the security settings given by the set $S_{1}$, and we evaluate the same two examples used in Sec. V. From Fig. 14 we have that, if ideal entanglement sources were available, it would actually be beneficial to use two ESRs for long-distance transmissions. Similar conclusions would be obtained if two PQAs were used instead.

However, this might not be the case if one considers practical light sources with a nonzero probability of emitting multi-photon pulses. For example, in the case of PDC sources, it turns out that the use of two qubit amplifiers does not seem to improve the performance of the system in a practical regime. This is exemplified by the yellowish lines in Fig. 14, which again correspond to the same examples as in Sec. V with the security settings $S_{1}$. Precisely, Fig. 14(a) shows that no advantage is obtained with two qubit amplifiers in a practical key rate regime in this scenario. Arguably, one would expect to see an advantage by considering lower detection and coupling efficiencies or higher dark count rates, as in both situations the cutoff point where the key rate sharply drops to zero is shifted to lower distances. Nevertheless, these two scenarios are notably restricted by time considerations. To see this, in Fig. 14(b) we plot the average number of transmitted signals $\left\langle{N}\right\rangle$ required to achieve the secret key rates of Fig. 14(a), comparing again the cases of one and two ESRs. As expected, using two qubit amplifiers instead of one demands longer DIQKD sessions in order to harvest a specific block size, due to the requirement of having simultaneous successful heralding events. In fact, even for $\eta_{\rm c,d}=100\%$ and $n_{\rm SH}=10^{9}$, the necessary value of $\left\langle{N}\right\rangle$ is larger than $10^{15}$ for a channel loss as low as $\Lambda\approx{4}$ dB, and any lower value of the detection and coupling efficiencies would result in smaller values of $\Lambda$. This being the case, even if one considers higher values of the dark count rate $p_{\rm d}$, no advantage is expected from the setup with two qubit amplifiers within such a short channel loss interval (before the duration of the DIQKD session becomes impractical).

Indeed, if one considers two PQAs instead of two ESRs and compares again this setup with the one that uses a single PQA, the time constraint with PDC sources becomes even more strict, as each PQA additionally includes two triggered single-photon sources that must yield a success in their idler mode in order not to dismiss a detection event. That is, a setup with two PQAs requires the trigger of four single-photon sources and two simultaneous successful BSMs afterwards. As a result, this overall decrease of the success probability (which is particularly relevant for PDC sources) translates into larger values of $\left\langle{N}\right\rangle$ which seem to render this solution impractical.

In short, the potential advantage of using two qubit amplifiers to enhance further the distance covered with DIQKD strongly depends on the photon-number statistics of the entanglement sources under consideration. In this sense, although Fig. (14) is restricted to ideal sources and PDC sources, we include below all the necessary calculations to evaluate the case of general photon-number statistics, maintaining the form of the states given in Eqs. (1) and (2). In this regard, we remark that the results are similar to those illustrated in Sec. V.3, i.e., by reducing the probability to emit multiple photon pulses with respect to that of PDC sources, one could approach the behaviour of ideal sources shown in Fig. (14).

A.4.1 Click pattern distribution

A schematic of the DIQKD setup with a central source and assisted by two ESR-based qubit amplifiers is shown in Fig. 15. Using the same techniques employed in Appendixes A.1 and A.2, it is possible to derive the click pattern distribution that matches the setup of Fig. 15, conditioned on the numbers of photon pairs $n_{1}$, $n_{2}$ and $n_{3}$ emitted by the entanglement sources $\sigma_{ab}$, $\sigma_{ef}$ and $\sigma_{cd}$, respectively. Precisely, let us define the click pattern (in vector notation) as $\vec{\alpha}=(\alpha,\beta,\gamma,\delta,\mu_{\rm A},\nu_{\rm A},\tau_{\rm A},\lambda_{\rm A},\mu_{\rm B},\nu_{\rm B},\tau_{\rm B},\lambda_{\rm B})$, where $\mu_{\rm A}$, $\nu_{\rm A}$, $\tau_{\rm A}$ and $\lambda_{\rm A}$ ($\mu_{\rm B}$, $\nu_{\rm B}$, $\tau_{\rm B}$ and $\lambda_{\rm B}$) are the numbers of photons recorded within Alice’s (Bob’s) ESR in any given detection event, while $\alpha$ and $\beta$ ($\gamma$ and $\delta$) denote again the numbers of photons she (he) observes with the detectors in her (his) lab when performing a measurement with rotation angle $\theta_{\rm A}$ ($\theta_{\rm B}$). In particular, one finds that ${{\rm{P}}\left(\vec{\alpha}|n_{1},n_{2},n_{3}\right)}_{\theta_{\rm A},\theta_{\rm B}}$ reads

[TABLE]

with

[TABLE]

The normalization condition $\sum_{\vec{\alpha}}{{\rm{P}}\left(\vec{\alpha}|n_{1},n_{2},n_{3}\right)}_{\theta_{\rm A},\theta_{\rm B}}=1$ holds for any set of physical parameters $\theta_{\rm A}$, $\theta_{\rm B}$, $\zeta_{\rm c,d}$, and $\zeta_{\rm c,ch,d}$, and only those click patterns $\vec{\alpha}$ such that $\alpha+\beta\leq{n_{2}}$, $\gamma+\delta\leq{n_{3}}$, $\mu_{\rm A}+\nu_{\rm A}+\tau_{\rm A}+\lambda_{\rm A}\leq{n_{1}+n_{2}}$ and $\mu_{\rm B}+\nu_{\rm B}+\tau_{\rm B}+\lambda_{\rm B}\leq{n_{1}+n_{3}}$ have a nonzero probability to happen, since we have disregarded dark counts so far. If we incorporate now the noise model introduced in the main text, the click pattern distribution in the noisy scenario becomes

[TABLE]

where, again, $\Gamma_{\vec{\alpha}}={\left\{\vec{\sigma}:|\vec{\alpha}|=|\vec{\sigma}|+1\right\}}$ and, for an arbitrary $\vec{\alpha}$, $|\vec{\alpha}|=\alpha+\beta+\gamma+\delta+\mu_{\rm A}+\nu_{\rm A}+\tau_{\rm A}+\lambda_{\rm A}+\mu_{\rm B}+\nu_{\rm B}+\tau_{\rm B}+\lambda_{\rm B}$. Coming next, by defining

[TABLE]

we flip Alice’s outcomes to enforce direct correlation with Bob’s, and by summing over all click patterns $\vec{\alpha}$ that are mapped to the pair of deterministic assignments $(A_{\rm A},A_{\rm B})$, we finally obtain the post-processed click pattern distribution, $\mathbf{P}(A_{\vec{\alpha}}|n_{1},n_{2},n_{3})_{\theta_{\rm A},\theta_{\rm B}}$. In accordance with Appendixes A.1.1 and A.2.2, $A_{\vec{\alpha}}$ is defined as $A_{\vec{\alpha}}={(A_{\rm A},A_{\rm B},\mu_{\rm A},\nu_{\rm A},\tau_{\rm A},\lambda_{\rm A},\mu_{\rm B},\nu_{\rm B},\tau_{\rm B},\lambda_{\rm B})}$. Note that if we sum over all possible photon numbers $n_{1}$, $n_{2}$ and $n_{3}$ and assume arbitrary statistics for the entanglement sources, say $p_{n_{1}}$, $p^{\prime}_{n_{2}}$ and $p^{\prime\prime}_{n_{3}}$, we obtain the overall distribution

[TABLE]

A.4.2 Parameters $P_{\rm SH}$, $Q|_{\rm SH}$ and $\omega|_{\rm SH}$

In contrast to the setup with a single qubit amplifier, two BSMs are performed in the current scenario, one per ESR (see Fig. (15)). Therefore, given that four different click patterns are considered to be successful heralding events in each qubit amplifier, there exist sixteen events that are not discarded by either Alice or Bob, corresponding to those cases for which both $(\mu_{\rm A},\nu_{\rm A},\tau_{\rm A},\lambda_{\rm A})$ and $(\mu_{\rm B},\nu_{\rm B},\tau_{\rm B},\lambda_{\rm B})$ belong to the set $\{(1,1,0,0),(0,1,1,0),(1,0,0,1),(0,0,1,1)\}$. Let $\Omega$ be one of them, say,

[TABLE]

Then, due to the symmetries of the channel model, it turns out that $P_{\rm{SH}}=16P_{\Omega}$, $\omega|_{\rm{SH}}=\omega|_{\Omega}$ and $Q|_{\rm{SH}}=Q|_{\Omega}$. As in Appendix A.1.2, $P_{\Omega}$ can be computed as

[TABLE]

with $A_{\rm A},A_{\rm B}\in\{0,1\}$. Analogously,

[TABLE]

and $\omega|_{\Omega}=S|_{\Omega}/8+1/2$ with the conditional CHSH violation given by

[TABLE]

being

[TABLE]

Note that, with our choice of $\Omega$, it is the third summand that carries the minus sign in Eq. (99).

Appendix B Entropy rate function and error correction leakage

In this Appendix we provide the explicit expressions for the functions $\eta_{\rm{opt}}$ and $leak_{\rm{IR}}$ which appear in the secret key length formula given by Eq. (17). In particular, we have that Rotem

[TABLE]

where the function $\eta(p,p_{\rm{t}},n_{\rm{SH}},\gamma,\epsilon_{1},\epsilon_{2})$ has the form

[TABLE]

In this equation, the function $f_{\rm{min}}(p,p_{\rm{t}})$ is given by

[TABLE]

and the function $g(p)$ has the form

[TABLE]

where the winning probability $p$ lies in the interval $0\leq{p}\leq(2+\sqrt{2})/4$, and $h(x)$ is the binary entropy function introduced in the main text.

The function $leak_{\rm{IR}}$, on the other hand, can be written as

[TABLE]

where $\epsilon_{\rm{rob}}^{\rm{IR}}=\epsilon^{\prime}_{\rm{IR}}+\epsilon_{\rm{IR}}$.