Differential phase encoded measurement-device-independent quantum key distribution

TL;DR

This paper introduces a novel measurement-device-independent quantum key distribution protocol using three orthogonal time-bin states, enhancing robustness against phase fluctuations and detector attacks, with proven security and promising key rates.

Contribution

It presents a new MDI-QKD scheme combining differential-phase-shift and MDI techniques, with security proof and performance analysis including finite key considerations.

Findings

Protocol is more robust against phase fluctuations.

Ensures protection against detector side-channel attacks.

Secure key rate compares favorably with existing protocols.

Abstract

We present a measurement-device-independent quantum key distribution (MDI-QKD) using single photons in a linear superposition of three orthogonal time-bin states, for generating the key. The orthogonal states correspond to three distinct paths in the delay line interferometers used by two (trusted) sources. The key information is decoded based on the measurement outcomes obtained by an untrusted third party Charles, who uses a beamsplitter to measure the phase difference between pulses traveling through different paths of the two delay lines. The proposed scheme combines the best of both differential-phase-shift (DPS) QKD and MDI-QKD. It is more robust against phase fluctuations, and also ensures protection against detector side-channel attacks. We prove unconditional security by demonstrating an equivalent protocol involving shared entanglement between the two trusted parties. We show that the secure key rate for our protocol compares well to existing protocols in the asymptotic regime. For the decoy-state variant of our protocol, we evaluate the secure key rate by using a phase-post-selection technique. Finally, we estimate the bit error rate and the phase error rate, in the finite key regime.

Equations

$$|\psi (\pm ,\pm )⟩=\frac{1}{\sqrt{3}}\left(|100{⟩}_a\pm |010{⟩}_a\pm |001{⟩}_a\right).$$

$${|\psi ({\varphi }_{a_1},{\varphi }_{a_2},{\varphi }_{b_1},{\varphi }_{b_2})⟩}_{\text{in}}$$

$${|\psi ⟩}_{\text{in}}=\frac{1}{3}[{|100,100⟩}_{ab}+e^{i{\varphi }_{a_1}}{|010,100⟩}_{ab}+e^{i{\varphi }_{a_2}}{|001,100⟩}_{ab}+e^{i{\varphi }_{b_1}}{|100,010⟩}_{ab}+e^{i{\varphi }_{b_2}}{|100,001⟩}_{ab}$$

$$+e^{i({\varphi }_{a_1}+{\varphi }_{b_1})}{|010,010⟩}_{ab}+e^{i({\varphi }_{a_1}+{\varphi }_{b_2})}{|010,001⟩}_{ab}+e^{i({\varphi }_{a_2}+{\varphi }_{b_1})}{|001,010⟩}_{ab}+e^{i({\varphi }_{a_2}+{\varphi }_{b_2})}{|001,001⟩}_{ab}].$$

$$R_{\mathrm{sift}}=\frac{2}{3}\times \frac{2}{3}=\frac{4}{9}.$$

$${|\psi ⟩}_{\text{a}}=\frac{1}{\sqrt{3}}\sum _{k=1}^3{a}_k^{†}|0⟩.$$

$${|{\psi }_{j_1{j}_2}⟩}_{\text{a}}$$

$${|\psi ⟩}_{\text{Alice}}=\frac{1}{2}\sum _{j_1,j_2\in \{0,1\}}{|j_1{j}_2⟩}_{A_1{A}_2}\otimes {|{\psi }_{j_1{j}_2}⟩}_{\text{a}}.$$

$${|\psi ⟩}_{\text{Bob}}=\frac{1}{2}\sum _{\widetilde{j_1},\widetilde{j_2}\in \{0,1\}}{|{\tilde{j}}_1{\tilde{j}}_2⟩}_{B_1{B}_2}\otimes {|{\psi }_{{\tilde{j}}_1{\tilde{j}}_2}⟩}_{\text{b}},$$

$$R\ge Y_{11}[1-fh(e_{\text{b}})-h(e_{\text{p}})].$$

$$e_{\text{p}}\le e_{\text{b}},$$

$$R\ge Q_{11}[1-h(e_{\text{p}})]+Q_{0{\mu }_b}^{{}^{\prime }}-I_{\text{ec}}.$$

$$I_{\text{ec}}=Q_{{\mu }_a{\mu }_b}fh(E_{{\mu }_a{\mu }_b}),$$

$$\displaystyle\bigg{[}\frac{m\pi}{N},\frac{(m+1)\pi}{N}\bigg{)}\cup\bigg{[}\frac{(m+N)\pi}{N},\frac{(m+N+1)\pi}{N}\bigg{)},$$

$$I_{\text{ec}}=\sum _m{Q}_{{\mu }_a{\mu }_b}^{m}fh(E_{{\mu }_a{\mu }_b}^m).$$

$$R\ge \frac{1}{N}{Q}_{11}[1-h(e_{\text{p}})]+Q_{0{\mu }_b}^{{}^{\prime }}-Q^{m}fh(E^m){|}_{m=0}.$$

$$\frac{1}{2}\parallel {\rho }_{KE}-{\tau }_K\otimes {\rho }_E{\parallel }_1\le \epsilon .$$

$$R=H(X\mid E)-H(X\mid Y),.$$

$$H(\tilde{X}\mid \tilde{E})=1-h(e_{\text{b}})-h(e_{\text{p}}),$$

$$r=H_{\xi }(X\mid E)-({\text{leak}}_{\text{EC}}+\Delta )/n,$$

$$\Delta =2{\log }_2\frac{1}{[2(\epsilon -\bar{\epsilon }-{\epsilon }_{\text{EC}})]}+7\sqrt{n{\log }_2(2/(\bar{\epsilon }-{\bar{\epsilon }}^{\prime }))}.$$

$$e_{\text{p}}\le e_{\text{b}}.$$

$$H_{\xi }(X\mid E)=1-h({\tilde{e}}_{\text{b}})-h({\tilde{e}}_{\text{p}}).$$

$$\xi =\sqrt{\frac{2\ln (1/{\bar{\epsilon }}^{\prime })+d\ln (m+1)}{m}}.$$

$${|\psi ⟩}_{\text{in}}$$

$${|\psi ⟩}_{\text{in}}=\frac{1}{\sqrt{6}}[$$

$${|\tilde{\psi }⟩}_{\text{in}}$$

$${|1,0⟩}_{ab}$$

$${|0,1⟩}_{ab}$$

$${|010,001⟩}_{ab}$$

$${|001,010⟩}_{ab}$$

$${|100,001⟩}_{ab}$$

Full text

MDI-QKD and DPS-QKD and finite-key

I Introduction

Quantum key distribution (QKD) is proven to be unconditionally secure in theory Mayers (2001); Lo and Chau (1999); Shor and Preskill (2000); Gottesman et al. (2004); Biham et al. (1996). However, QKD protocols may be rendered insecure in practice, because of the difference in the behavior of practical devices and the respective theoretical models used in security proofs. For example, the standard protocols and their security proofs fail to take into account side-channel attacks on the detectors Qi et al. (2007); Fung et al. (2007); Lamas-Linares and Kurtsiefer (2007); Zhao et al. (2008); Nauerth et al. (2009); Xu et al. (2010); Lydersen et al. (2010); Gerhardt et al. (2011); Weier et al. (2011); Ko et al. (2016), thereby compromising security.

Various solutions have been proposed to counteract side-channel attacks. One solution is to develop precise mathematical models of devices used in the QKD experiments and incorporate these models into new security proofs Fung et al. (2009); Marøy et al. (2010); Kang et al. (2020). However, the complex nature of devices makes this approach very challenging to realize in practice. The other solution is to develop counter measures against known side-channel attacks da Silva et al. (2012); Yuan et al. (2011), but the QKD system still remains vulnerable to unanticipated attacks. Device independent QKD (DI-QKD)Mayers and Yao (1998); Biham et al. (2006) is another viable candidate against side-channel attacks. The security of DI-QKD relies on the violations of Bell inequality. However, the requirement of a loophole-free Bell test, and an extremely low key rate at long distances, makes this unfeasible with current technology Gisin et al. (2010); Curty and Moroder (2011). Measurement-device-independent QKD (MDI-QKD) Lo et al. (2012); Braunstein and Pirandola (2012) was introduced as a practical solution to side-channel attacks on the measurement unit.

In an MDI-QKD protocol, Alice and Bob encode their respective classical key bits into quantum states and send it to a potentially untrusted party, Charles. It is assumed that the measurement unit is under complete control of Charles, who carries out the measurement and announces the results. This is followed by sifting, error correction and privacy amplification, as carried out in standard QKD protocols. The first MDI-QKD scheme was designed for a polarization-based implementation of BB84 Lo et al. (2012). Various variants of the original polarization-based MDI protocol exist in the literature Wang et al. (2016, 2018); Zhu et al. (2016). MDI protocols employing time-bin Rubenok et al. (2013); Liu et al. (2013) and phase-based encodings Tamaki et al. (2012); Ferenczi (2013); Ma and Razavi (2012); Lin and Lutkenhaus (2018); Ma et al. (2018) also exist in the literature – see Xu et al. (2014) for a recent review. However, random phase and polarization fluctuations are a major hindrance in long distance implementations of polarization and phase-based MDI-QKD schemes.

Here, we propose a differential-phase-shifted MDI-QKD (DPS MDI-QKD) scheme, as a potential candidate for alleviating random phase fluctuations. Random polarization fluctuations that occur over milli-second timescales do not affect such a differential phase-based protocol. In a differential phase encoded QKD protocol, the classical key is encoded in the phase difference between successive optical pulses which are a few nano-seconds apart, thus making the protocol resilient to the effects of environmental phase fluctuations. There are a few variants of differential-phase-shifted keying proposed in the literature Inoue (2015). For example, the sender Alice could use a phase modulator in combination with a random number generator to apply a phase of either [math] or $\pi$, randomly, on a sequence of successive pulses generated by a weak coherent source (WCS) Inoue et al. (2003). Alternately, the phase modulation may be done on a single photon pulse converted into a superposition of three orthogonal states corresponding to three different time-bins, via a delay line interferometer Inoue et al. (2002).

Here, we make use of the $3$-pulse protocol, whose security is based on the fact that the eavesdropper has to distinguish between a set of four non-orthogonal quantum states. While the coherent-state DPS protocol is provably secure against individual attacks Waks et al. (2006), the single-photon based $3$-pulse protocol is shown to be unconditionally secure Wen et al. (2009). However, this security proof assumes infinitely long keys whereas experimental implementations are constrained by the finite computational power of Alice and Bob, resulting in keys of finite length.

Effect of the finiteness of the key size on security parameters was first studied in Inamori et al. (2007). Subsequently, the security of BB84 Tomamichel et al. (2012) and decoy state protocols Hayashi and Nakayama (2014); Lim et al. (2014); Wang et al. (2019) against collective attacks in the finite-key regime was established. Techniques used for the finite-key analysis of conventional QKD have also been applied to MDI-QKD, but for specific attacks Ma et al. (2012). More recently, a rigorous security proof of MDI-QKD against general attacks for a finite key length was demonstrated Curty et al. (2014).

In this paper, we present a MDI-QKD scheme which incorporates the advantages of differential phase encoding. We show unconditional security of our protocol by mapping it to an equivalent entanglement-based protocol. An upper bound for the phase error rate of our scheme, in terms of the bit error rate, is then used to carry out the asymptotic and finite-key analysis of our scheme. We demonstrate that our protocol generates secure keys over reasonable distances, even under system imperfections. We also propose a decoy-state variant of our protocol and use phase-post-selection technique to show that our scheme offers reasonable security, thereby making it an attractive choice for practical implementations that use a weak coherent source (WCS).

In Sec. II, we briefly review the $3$-pulse DPS-QKD protocol and its security aspects. We discuss our DPS-MDI protocol in Sec. III and show that it maps to an entanglement-based protocol. We obtain the secure key rate using an ideal single-photon source as well as a WCS for the protocol. Finally, we present the finite-key analysis of our scheme in Sec. IV. The details of the calculation of the secure key rates for our scheme, and the mapping of our protocol to an equivalent entanglement-based protocol are presented in Appendix  A and B, respectively. We explicitly calculate the phase error rate for our protocol in terms of the bit error rate in Appendix  C, and finally, calculate the parameters involved in the asymptotic key analysis in Appendix  D.

II Preliminaries

Starting with the original proposal to implement the B92 protocolBennett (1992), differential phase or distributed-phase protocols have been well studied in the QKD literature Inoue (2015). Such protocols are popular because they are relatively easy to implement (compared to polarization-based protocols) and are robust against phase fluctuations. Most phase-based schemes use weak coherent pulses for encoding the key. However, in this paper, we use the single-photon scheme proposed in Inoue et al. (2002). We shall henceforth refer to this scheme as the $3$-pulse DPS-QKD protocol and provide a brief description below.

II.1 $3$-pulse differential-phase-shift keying

In a $3$-pulse DPS-QKD protocol, the sender (Alice) throws a single photon into a superposition of three time-bins, corresponding to the three distinct paths of a delay line interferometer, and then uses a phase modulator to introduce a relative phase between successive time-bins, as shown schematically in Fig. 1. Alice encodes her random key bit $\{0,1\}$ as a random phase $\{0,\pi\}$ between successive pulses. The receiver (Bob) thus gets one of the four non-orthogonal quantum states given below, corresponding to the four possible phase-differences, i.e.,

[TABLE]

Here, $\ket{100}_{a}$, $\ket{010}_{a}$ or $\ket{001}_{a}$ indicate that the photon travelled with equal probability via paths 1, 2 or 3, respectively, in Alice’s set-up.

Bob’s decoding setup comprises of a delay line interferometer (DLI) and two single-photon detectors. The path lengths are chosen such that the longer arm of Bob’s DLI introduces a time delay $\Delta t$ which is exactly equal to the difference in time taken by the photon to traverse two successive arms of Alice’s 3-path delay line. Thus, Bob can detect the incoming photon in one of the four possible time-bins, which we label as $t_{1}$, $t_{2}$, $t_{3}$, $t_{4}$, each separated from its previous bin by a time of $\Delta t$. Detections at times $t_{1}$ and $t_{4}$ do not provide any phase information, whereas detections at times $t_{2}$ and $t_{3}$ provide information about the relative phases $\theta_{12}$ and $\theta_{23}$ respectively (see Fig. 1). Specifically, Bob decodes the key bit associated with a given time-slot as a [math], or $1$, if detector $D0$, or $D1$, clicks. By publicly announcing his detection times, Bob performs key-reconciliation with Alice and it is easy to see that the sifted key rate for this $3$-pulse protocol is $1/2$.

An alternate form of phase-encoded QKD is the pulse-train DPS-QKD Inoue et al. (2003), which is a variant of the original B92 protocol Bennett (1992). In the pulse-train protocol, Alice generates a train of coherent pulses and applies a phase of [math] or $\pi$ to the pulses randomly, to encode the key bits [math] or $1$, respectively. These phase modulated pulse trains are sent to Bob, who passes the incoming pulses through a DLI. Depending upon the phase difference between two successive pulses, constructive or destructive interference happens. An MDI-QKD protocol based on the coherent-state pulse-train DPS protocol was also proposed in  Ferenczi (2013).

We refer to Ranu et al. (2017) for a detailed analysis of the secure key rate for the $3$-pulse DPS protocol, assuming individual attacks. A simple comparison with the pulse-train DPS protocol Diamanti (2006) shows that the $3$-pulse variant offers better security against individual attacks, in the following sense: an eavesdropper introduces a higher error rate and also has a lower learning rate in the $3$-pulse protocol Ranu et al. (2017).

Finally, we note that the $3$-pulse DPS-QKD protocol can be extended to an $n$-pulse protocol by increasing the number of possible paths that the single photon can take at the sender’s set-up. In fact, the single photon DPS protocol using $n$ such paths has been shown to be unconditionally secure against general attacks for any $n\geq 3$ Wen et al. (2009). Experimental realization of $n$ path DPS protocol would involve generating a photon in a superposition of $n$ paths/time-bins using passive beam splitters (or beam combiners). As we increase the number of paths/time-bins, the insertion loss of passive beam splitters reduces the sifted key rate by a factor of $n$. Scaling of $n$ in an experimental realization thus reduces the sifted key rate, in fact, the $n=3$ protocol is shown to achieve the optimal secure key rate per pulse Wen et al. (2009); Shaw et al. (2020). Note that, $n=3$ is the smallest $n$ that allows Alice and Bob to encode the key information in a non-orthogonal set of states using only two phase values, [math] and $\pi$.

III DPS-MDI-QKD

We now describe our MDI-QKD protocol based on the $3$-pulse phase encoding scheme, using an ideal single-photon source. Apart from the fact that this scheme offers better security against individual attacks, compared to other DPS protocols, there are other practical considerations that motivate our use of the $3$-path superposition in our protocol.

When Alice and Bob both use an ideal-single-photon source to implement a pulse-train protocol using two phase values ([math] and $\pi$) for encoding key bits, the phase-independent nature of Hong-Ou-Mandel interference Ou (2007) makes the key extraction difficult. 2. 2.

Using only two phase values ([math] and $\pi$) makes the states in a two-pulse protocol orthogonal, making them perfectly distinguishable Wen et al. (2009).

Hence, we need at least $3$-paths in the superposition to implement an MDI protocol using only a pair of phases ([math], $\pi$) for the encoding. An MDI protocol based on a two-path superposition, and four phase values $(0,\frac{\pi}{2},\pi,\frac{3\pi}{2})$ was proposed in Ma and Razavi (2012). This scheme yields a phase-encoded version of BB84, with a sifted key rate of 1/2, but it needs four different voltage levels for driving the phase modulator in order to encode the key information. Now, increasing the number of voltage levels in a high speed phase modulator driver circuit leads to an increase in amplitude fluctuations, consequently increasing the quantum bit error rate Korzh et al. (2013). Our proposed DPS MDI protocol reduces the complexity of the key encoding process by using only two phase values ([math], $\pi$), with a sifted key rate of 4/9, explained in section  III.1 below.

A simple schematic is shown in Fig. 2. As before, Alice and Bob generate single-photon pulses that pass through their respective DLIs, each creating the superposition state described in Eq. (1). Alice and Bob then encode the random key bits $\{0,1\}$ by assigning a relative phase difference of $\{0,\pi\}$ between two successive pulses, and send their encoded signal states to the measurement unit (Charles). Charles’ measurement set-up comprises of a beamsplitter and two single-photon detectors, labeled $D_{c}$ and $D_{d}$ as indicated in Fig. 2. For every photon detected by his setup, he notes which detector clicked ($D_{c}$ or $D_{d}$ or both), and the corresponding time-bin ($t_{1}$, $t_{2}$ or $t_{3}$) at which the click was observed. Based on this information, which is made public by Charles, Alice and Bob extract a sifted key.

III.1 Sifting and Reconciliation

We may use the form of the encoded $3$-pulse state in Eq. (1) to represent the input to the Charles’ measurement module as,

[TABLE]

As before, $1$ and [math] indicate the presence or absence of a photon in a particular path. Similarly, $\ket{100}_{a}$ is the $3$-pulse superposition state corresponding to the photon traversing path $1_{a}$ in Alice’s set-up, $\ket{010}_{b}$ is a $3$-pulse state corresponding to photon traversing path $2_{b}$ in Bob’s set-up, and likewise for other terms in Eq. (2). For the sake of brevity, we represent tensor products of the form $\ket{100}_{a}\otimes\ket{100}_{b}$ as $\ket{100,100}_{ab}$ in the rest of the paper. In DPS-MDI, Alice and Bob encode classical information as phase differences between first and second time-bins, and second and third time-bins. In our analysis, we assume the phase of the first time-bin as the reference phase, and apply a suitable phase ([math] or $\pi$ relative to the reference phase) on the second and third time-bins to encode the key information.

Corresponding to every pair of photons generated by the sources, there are three distinct time-bins ($t_{1},t_{2},t_{3}$) at which Charles’ detectors click, corresponding to paths $1_{a},2_{a},3_{a}$ and $1_{b},2_{b},3_{b}$ in Alice’s and Bob’s set-up respectively. We first rewrite Charles’ input state by grouping pairs of pulses that arrive in the same time-bin:

[TABLE]

Note that the pairs of photons that traverse through identical paths in Alice’s and Bob’s interferometer (such as $(1_{a},1_{b})$ or $(2_{a},2_{b})$ or $(3_{a},3_{b})$) do not contribute to the sifted key. Such a pair of photons would bunch together due to Hong-Ou-Mandel interference Ou (2007) and come out at the same port of the beamsplitter.

Using a beamsplitter transformation, we can write down the final two-photon state after the action of Charles’ beamsplitter. We refer to Appendix A for the details of the calculation, with the form of the final state after Charles’ measurement given in Eq. (28). We observe that depending on the values of the relative phases $\Delta\phi_{1}=\phi_{a_{1}}-\phi_{b_{1}}$ and $\Delta\phi_{2}=\phi_{a_{2}}-\phi_{b_{2}}$, and the path traversed by Alice’s and Bob’s photons, Charles may have the same or different detectors click at two different time-bins.

Finally, Alice and Bob perform key reconciliation once Charles announces his measurement outcomes. Based on which detector ($D_{c}$ or $D_{d}$) clicks and the time-bins ($t_{1}$, $t_{2}$ and $t_{3}$) corresponding to the clicks for each pair of signal states, Alice and Bob can generate the sifted key using either $\Delta\phi_{1}$ or $\Delta\phi_{2}$ as listed in Table I.

It follows immediately that the the sifted key rate of our protocol is,

[TABLE]

We discard the clicks that occur when photons from Alice and Bob fall on the beam splitter in the same time-bin. The terms $\ket{100,100}_{ab}$, $\ket{010,010}_{ab}$ and $\ket{001,001}_{ab}$ in Eq. (3) correspond to such a scenario. Photons arriving at the same time-bin causes Hong-Ou-Mandel interference which leads to two photons falling on the same detector in the same time-bin, thereby making key extraction difficult. Comparing Eqs. (3) and (24), we see that one-third of the incoming photons have to be discarded due to Hong-Ou-Mandel interference. This leads to the first factor of $\frac{2}{3}$. Next, we observe from the key reconciliation table that two-thirds of Charles’ measurements contribute to the raw key, thus leading to a sifted key rate of $\frac{4}{9}$. We note that the MDI protocol based on $3$-pulse encoding offers a lower key rate compared to the one based on coherent-state pulse-train encoding Ferenczi (2013). However, the use of single-photon sources in our protocol allows us to carry out a finite key analysis using the framework presented in  Scarani and Renner (2008). Our protocol is also immune against eavesdropping attacks which target multi-photon pulses.

III.2 An equivalent entanglement-based protocol

To analyse the security of DPS-MDI, we first map it to a protocol that involves shared entangled pairs between Alice and Bob. Such a mapping of a phase-encoded protocol to an entanglement-based protocol has been shown earlier Wen et al. (2009). Following a similar approach, we now show there exists an equivalent, entanglement-based protocol to our proposed DPS-MDI-QKD protocol. The equivalent description of DPS-MDI, in terms of entangled states, allows us to demonstrate the unconditional security of our protocol and also perform the key rate analyses.

We first represent Alice’s single-photon pulse in a linear superposition of three orthogonal states,

[TABLE]

Here, $a_{k}^{\dagger}$ denotes the creation operator for the photon in the $k^{\rm th}$ time-bin. Alice uses a quantum random number generator to generate a random $2$-bit integer $j$, written in binary notation as $(j_{1}j_{2})_{2}$. She encodes this random integer in the single-photon pulse, such that the encoded state is written as,

[TABLE]

Alice prepares and stores $2$ qubits corresponding to each encoded block in her quantum memory. She prepares $\ket{j_{1}}$ in $\ket{0}$ ($\ket{1}$) state when she applies a phase of [math] ($\pi$) to her second time-bin. Similarly, she prepares $\ket{j_{2}}$ in $\ket{0}$ ($\ket{1}$) state when she applies a phase of [math] ($\pi$) to her third time-bin. In this way, she entangles her two qubits to the encoded single-photon state as

[TABLE]

Bob also carries out a similar encoding procedure to get his own register of qubits entangled with his encoding blocks. Along the lines of Eqs. (6) and (7), Bob’s state is written as,

[TABLE]

where $\tilde{j_{1}}$ or $\tilde{j_{1}}$ are the random integers used by Bob to encode his single-photon pulse.

Alice and Bob send their encoded states across to Charles. He first applies a quantum non-demolition (QND) measurement to find the number of photons in a given state and throws away the ones which have more than one photon in the same time-bin. He sends the rest through his beamsplitter. He then publicly announces the time-bin (say $k=1,2,\,\text{or}\,3$), as well as the detector ($D_{c}$ or $D_{d}$), at which the photon was detected. As explained in Table I, based upon Charles’ measurement outcome, Alice and Bob use either $\Delta\phi_{1}$ or $\Delta\phi_{2}$ to extract the key.

When their shared key is established using $\Delta\phi_{i}$, Alice and Bob retain their corresponding ancilla qubits ($A_{i}$ and $B_{i}$, respectively) and discard the other ancilla qubit. As shown in Appendix B, for those time slots when they do not need to carry-out a bit flip operation, they share a perfectly correlated entangled state $\frac{1}{\sqrt{2}}[\ket{00}_{A_{i}B_{i}}-\ket{11}_{A_{i}B_{i}}]$. On the other hand, corresponding to those time slots when they execute a bit-flip to extract the shared key, they share the anti-correlated Bell state $\frac{1}{\sqrt{2}}[\ket{01}_{A_{i}B_{i}}-\ket{10}_{A_{i}B_{i}}]$. Thus, Charles measurement and filtering effectively implements a Bell state measurement, thereby entangling Alice’s and Bob’s ancilla qubits. A detailed discussion of the joint state after Charles’ measurement and key-reconciliation can be found in Appendix B.

III.3 Asymptotic Secure Key Rate

Alice and Bob perform classical post-processing on the sifted key to extract the final secure key from it. The first step of this post-processing is to estimate the error rate in the sifted key, which involves Alice and Bob exposing a fraction of their sifted key bits to calculate the error rate. They abort the protocol and start again from the beginning (i.e signal transmission to Charles) if their calculated error rate exceeds a pre-defined threshold. They define this threshold error rate by taking into account the error introduced in the key, both due to the system imperfections as well as any potential eavesdropping.

When the estimated error rate lies below the threshold error rate, they carry out the second step of post-processing, i.e., error correction. Alice and Bob apply a suitable error correction scheme on their sifted key to correct all the erroneous bits. The error estimation and correction happens over a classical channel, and we must assume that Eve is privy to all the information exchanged between Alice and Bob. Therefore, the final step of post-processing is privacy amplification, which aims to reduce Eve’s knowledge about the key well below an acceptable level. This is done by discarding a fraction of the error-free key. Alice and Bob typically use a hash function to carry out privacy amplification.

Using the sifted key rate obtained in Eq. (4) and following the analysis in Shor and Preskill (2000); Lo et al. (2012), we obtain the following asymptotic secure key rate for our MDI-DPS protocol,

[TABLE]

Here, $Y_{11}$ is the probability of a successful Bell state measurement (BSM) when Alice and Bob transmit single photons. As per our mapping of DPS-MDI to an equivalent entangled-based protocol, a successful BSM corresponds to the cases tabulated in Table I where Charles’ measurement outcomes contribute to the sifted key. $e_{\text{b}}$ is the quantum bit-error rate (QBER), $e_{\text{p}}$ is the phase error rate, $f$ represents the inefficiency of the error correction scheme employed by Alice and Bob, and $h(x)$ is the binary entropy function.

We bound the phase error rate of our protocol in terms of the bit error rate in Appendix  C as,

[TABLE]

and use this bound for all of the simulation results. We also explicitly calculate the parameters given in Eq. (9) for our protocol in Appendix D. We have taken phase misalignment, dark counts and different channel losses for the two channels into consideration while obtaining these parameters.

We compare the asymptotic key rate of DPS-MDI with two other protocols - phase-encoded MDI protocol  Ma and Razavi (2012) and DPS QKD Wen et al. (2009). From Fig. 3, we observe that DPS-MDI offers a secure channel length which is nearly twice of the channel length of DPS QKD - a trademark of MDI protocols when compared with non-MDI protocols. We also see that our DPS-MDI protocol offers performance comparable to an existing phase-encoded MDI protocol in terms of secure channel length and key rate. The slightly higher key rate in Ma and Razavi (2012) is attributed to its higher sifted key rate of $\frac{1}{2}$ compared to DPS-MDI’s rate of $\frac{4}{9}$.

We have obtained the non-MDI DPS QKD plot in Fig. 3 by using the key rate equation derived in Wen et al. (2009). We would like to point out the difference in the secure channel length for n=3 DPS QKD obtained in Wen et al. (2009) and our simulation. The difference arises because we have used $3\times 10^{-6}$ as the dark count probability in our simulation, which is $1000$ times higher than the dark count probability used in Wen et al. (2009). Also, Wen et al. (2009) assumes an ideal error correction step in their classical post-processing, while our simulations assume a non-ideal error correction step. We capture the inefficiency of error correction in our protocol using the parameter $f$ (Eq.  9).

In experimental implementations, weak coherent sources (WCS) are typically used to generate pulses with mean photon number ($\mu$) of less than one so that the probability of generation of multi-photon pulses is significantly less than that of single-photon pulses. However, a WCS could still generate multi-photon pulses, and leak information to Eve. Hence, we use the decoy-state method to establish the security of our DPS-MDI protocol. The original decoy-state based QKD protocols have been proposed for BB84 schemes and secure key rates obtained in  Lo et al. (2005); Ma et al. (2005). Decoy state analysis for MDI-BB84 was done in  Lo et al. (2012). In our case, we follow the approach in  Lo et al. (2012) along with the improved phase-post-selection technique employed in  Ma and Razavi (2012) to obtain the key rate as,

[TABLE]

Here, $I_{\text{ec}}$ is the cost of error correction written as

[TABLE]

where $Q_{\mu_{a}\mu_{b}}(E_{\mu_{a}\mu_{b}})$ is the overall gain (QBER) when Alice and Bob use a WCS with mean photon numbers $\mu_{a}$ and $\mu_{b}$, respectively. $Q_{11}(e_{\text{p}})$ is the gain (phase error rate) when both the sources generate single-photon states, and $Q^{{}^{\prime}}_{0\mu_{b}}=e^{-\mu_{a}}Q_{0\mu_{b}}$ is the probability that there is no photon from Alice’s side and a successful BSM occurs. We refer to Appendix  D for formal definitions and a detailed evaluation of these parameters.

Our decoy-state analysis assumes a fully phase-randomized coherent source. The intrinsic QBER shoots up due to phase randomization of the coherent source. The overall phase of $[0,2\pi)$ can be sliced into N distinct slices as,

[TABLE]

where $m$ ranges from 0 to $N-1$. Instead of carrying out phase randomization over the entire interval $[0,2\pi)$, Alice and Bob randomly select one slice out of $N$, and then randomize the phase. Hence, an additional step of revealing the selected slice gets added in the decoy state version of our protocol. Alice and Bob keep the bits when both of them have selected the same phase slice. Fig.  4 shows that dividing the interval $[0,2\pi)$ into slices reduces the intrinsic QBER from $34\%$ to around $1\%$ for $N=16$.

However, this phase-post-selection technique also changes the cost of error correction mentioned in Eq.  (12) to

[TABLE]

From our numerical simulations, we observe that the key rate becomes negative upon using Eq. (14) in conjugation with Eq. (11). Hence, we assume that the gain and error rate of the single-photon states are evenly distributed over all the slices, thereby modifying the decoy MDI key rate equation to

[TABLE]

We refer to Appendix  D for a detailed analysis of the effect of this phase-post-selection technique on the overall gain and QBER. We compare the key rate of our decoy-state DPS-MDI with  Ma and Razavi (2012) (see Fig. 5), where we used the parameters from  Lo et al. (2012) for our simulations. The quantum efficiency of the detectors was taken to be 14.5% with a misalignment error of 1.5%. $N$ and $f$ are taken to be 16 and 1.16 respectively. We assume a dark count rate of $3\times 10^{-6}$ for the detector and an attenuation of 0.2 dB/km in the fiber channel.

III.4 Practical implementation

As described above, Alice and Bob can share a secure key using the setup shown in Fig. 2. However, a practical implementation of the proposed scheme requires certain modifications to the set-up (see Fig. 6).

Key generation requires detection of two time-synchronized photons by a single detector. In practice, this would be constrained by the finite dead-time of a single-photon detector. Hence, an acousto-optic deflector (AOD) is used to route the photon in each time-bin to different single-photon detectors. This results in a slight modification to the key-reconciliation step, namely, Charles now announces which pair of detectors clicked in each time-bin. 2. 2.

Alice and Bob need a common phase reference, since they use independent laser sources for generating their single-photon pulses. The optical phase-locked loop (OPLL) technique Kahn et al. (1989); Kazovsky (1985), commonly used in coherent detections, can be used to phase lock the sources used by Alice and Bob. The OPLL has a simple setup and requires only off-the-shelf components Ferrero and Camatel (2008).

IV Finite key analysis of DPS-MDI-QKD

Finiteness of the key size constitutes a major chink in the security proofs of practical QKD protocols. Most of the theoretical proofs provide a bound on the secure key rate by assuming the key size as infinite. However, practical implementations cannot run forever. This gap in theory and practice is bridged by providing security bounds for a finite number of signal exchanges between Alice and Bob.

A perfect key is a uniformly distributed bit string, having no dependence on an adversary’s knowledge. Practical keys deviate from this ideal scenario, and this deviation is captured by a parameter $\varepsilon$, interpreted as the maximum probability of a practical key differing from a completely random bit string. Following Renner and Konig (2005); Ben-Or et al. (2005), we say that a key $K$ is $\varepsilon$-secure with respect to an eavesdropper $E$ if,

[TABLE]

Here, $\rho_{KE}$ is the joint state of the ‘key system’ $K$ and the adversary $E$, $\rho_{E}$ is the state held by the adversary, and $\tau_{K}$ is the completely mixed state on $K$.

In the asymptotic case, for any QKD protocol where Alice and Bob share entangled pairs, the secure key rate ($R$) can be bounded under the assumption of collective attacks as Mayers (2001); Shor and Preskill (2000); Devetak (2005),

[TABLE]

Here $X$ and $Y$ represent Alice and Bob’s key systems respectively, $E$ represents the eavesdropper, and $H(.\mid.)$ is the conditional von Neumann entropy. Intuitively, Eq. (17) follows from the fact that the secure key rate is equal to Eve’s uncertainty about the raw key $X$ minus Bob’s uncertainty. For our DPS-MDI protocol, the conditional entropy $H(X\mid E)$ can be expressed as Renner (2008),

[TABLE]

where $e_{\text{b}}$ is the bit error rate, and $e_{\text{p}}$ denotes the phase error rate.

We follow the finite-key analysis presented in Scarani and Renner (2008); Renner (2008), involving a generalization of von Neumann entropy, called the smooth entropy. The objective of this smoothening of the regular entropic functions is to take into account the fluctuations arising from the finite signal size. As in the asymptotic case, Alice and Bob are assumed to share entangled pairs, which holds for our proposed scheme, as outlined in Sec. III.2 above. The generalized form of Eq. (17) in the finite-key regime can be expressed as Scarani and Renner (2008),

[TABLE]

where $H_{\xi}(X\mid E)$ is the conditional smooth-min entropy, $\text{leak}_{\text{EC}}$ is the number of bits needed to be shared over a classical channel for error correction and

[TABLE]

Here, $\varepsilon_{\text{EC}}$ is the error probability, defined as the probability that Bob ends up with a wrong bit string after the error correction stage. $\bar{\varepsilon}$ and $\bar{\varepsilon}^{\prime}$ are the smoothening parameters as mentioned in Lemma $2$ of Scarani and Renner (2008).

We calculate $H_{\xi}(X\mid E)$ for our protocol using the asymptotic value of $H(X\mid E)$ and bound the phase error rate in terms of the bit error rate. We have shown in Appendix  C that the phase error rate of our protocol is bounded by the bit error rate as,

[TABLE]

In the finite-key regime Eq. (18) translates to,

[TABLE]

Finally, the bit error rate in the finite-key regime is expressed as $\tilde{e}_{\text{b}}=e_{\text{b}}+\xi\;(n,d=9)$, where $n$ is the number of raw key bits. Similarly, the phase error rate is given as $\tilde{e}_{\text{p}}=e_{\text{p}}+\xi\;(m,d=9)$, where $m$ is the number of bits used in parameter estimation and $d$ is the number of possible POVM outcomes. $d=9$ for our protocol as there are eight scenarios at the detection unit (see Table I) which contribute to the key generation. The ninth POVM corresponds to the case when BSM fails. $\xi$ is a non-negative parameter, (Lemma 3 of Scarani and Renner (2008)) given by,

[TABLE]

Using Eqs. (20), (22), and (23) we estimate the sifted key rate described in Eq. (19). The performance of a practical error correcting code as analyzed in Scarani and Renner (2008) gives $\text{leak}_{\text{EC}}/n=1.2h(e_{b})$, where, $e_{b}$ is the quantum bit error rate. This helps in estimating the second term of Eq. (19). ($N,\varepsilon,\text{leak}_{\text{EC}},\varepsilon_{\text{EC}}$) are protocol dependent parameters, whereas $n,m,\bar{\varepsilon}$ and $\bar{\varepsilon}^{\prime}$ are selected so as to maximize the key rate per signal, $r=(n/N)r^{\prime}$ under the constraints $n+m\leq N$ and $\varepsilon-\varepsilon_{\text{EC}}>\bar{\varepsilon}>\bar{\varepsilon}^{\prime}\geq 0$.

Fig. 7 shows the variation in key rate with the number of exchanged signals for our DPS-MDI protocol. We have used $\varepsilon=10^{-5}$ and $\varepsilon_{\text{EC}}=10^{-10}$ to generate the plots for different values of $e_{b}$. As expected, the key rate per signal ($r$) approaches the sifted key rate of $\frac{4}{9}$ in the asymptotic limit. This is a reflection of the fact that only $\frac{4}{9}$ of the raw key bits can be used for key generation and the rest is used for parameter estimation.

V Conclusions

In this paper, we have presented a $3$-path superposition based DPS-MDI-QKD protocol. We have shown the necessity and advantages of having the 3-path superposition. The proposed protocol has been mapped to an entanglement-based protocol, thereby establishing its unconditional security. We have carried out a security analysis of our scheme in the asymptotic regime assuming system imperfections.

We have shown that our protocol generates secure keys even when the ideal single-photon source is replaced with a weak coherent source (WCS). The security of the WCS-based scheme is established using decoy states and a suitable phase-post-selection technique. Finally, we have determined an upper-bound for the phase error rate of our protocol in terms of the bit error rate. This allows us to carry out the key analysis of the protocol in both asymptotic as well as finite-key regimes. We have further simulated the variation in key rate with the number of exchanged signals of our protocol.

An interesting direction for future work is the finite-key analysis of the 3-path DPS-MDI using a weak coherent source. Such a coherent-state DPS-MDI protocol will also be free from the issues arising due to the probabilistic nature of photon generation in single-photon sources. Another interesting problem that can be addressed in the future works is the tightening of the bound used in obtaining the secure key rates of our protocol.

Acknowledgements.

We acknowledge the financial support by MHRD through MHRD Sanction No. F.NO. 35-8/2017-TS.1 under the Uchchatar Avishkar Yojana, with partial support from QNu Labs.

Conflict of interest

The authors declare that they have no conflict of interest.

Appendix A Analysis of DPS-MDI-QKD protocol

We start with the form of the input to Charles’ beamsplitter given in Eq. (3):

[TABLE]

We leave out the states that correspond to photons traversing identical paths in Alice’s and Bob’s set-up, since they do not contribute to the sifted key, and consider the (normalized) state,

[TABLE]

Writing $\phi_{a_{1}}-\phi_{b_{1}}=\Delta\phi_{1}$ and $\phi_{a_{2}}-\phi_{b_{2}}=\Delta\phi_{2}$ as the phase differences between corresponding pulses from Alice and Bob, the input to Charles’ beamsplitter is written as,

[TABLE]

Fig. 8 shows a typical $50:50$ beamsplitter. The action of the beamsplitter with input ports $a,b$ and output ports $c,d$, when there is a photon incident on only one of the two ports is given by,

[TABLE]

Using Eq. 26, we find that the beamsplitter transforms the terms present in the joint input state of Alice and Bob (Eq. 25) as shown below,

[TABLE]

Using Eq. (25) and Eq. (27), we get

[TABLE]

The output after the beamsplitter depends upon the random phase applied by Alice and Bob to their respective time-bins. We write down the four different final states realized, corresponding to the four possible values of $(\Delta\phi_{1},\Delta\phi_{2})$. To help understand the key-reconciliation step, we have rewritten the final state by grouping together the states at each output port ($c$ or $d$), corresponding to the three different time-bins ($t_{1}$, $t_{2}$ or $t_{3}$).

Case 1: When $\Delta\phi_{1}=\Delta\phi_{2}=0$, the two-photon state after the beamsplitter is,

[TABLE]

Case 2: When $\Delta\phi_{1}=\Delta\phi_{2}=\pi$, the output state of the beamsplitter is,

[TABLE]

Case 3: When $\Delta\phi_{1}=0$ and $\Delta\phi_{2}=\pi$, the output state is,

[TABLE]

Case 4: When $\Delta\phi_{1}=\pi$ and $\Delta\phi_{2}=0$, the output state is,

[TABLE]

We now formulate the key reconciliation scheme (see Table I) based on Eqs. (29)- (32), while noting that detector $D_{c}$ detects the photons from port $c$ of the beamsplitter and correspondingly detector $D_{d}$ clicks when photons exits from port $d$.

Consider the two examples when Alice and Bob use $\Delta\phi_{1}$ to extract the key.

When Charles announces the clicking of $D_{c}$ in time-bins $t_{1}$ and $t_{2}$, this would indicate that $\Delta\phi_{1}$ and $\Delta\phi_{2}$ have taken values corresponding to Case 1 or Case 3 above, corresponding to $\Delta\phi_{1}=0$ and $\Delta\phi_{2}=0$ or $\pi$. Alice and Bob therefore use only $\Delta\phi_{1}$ to extract the key. 2. 2.

When Charles announces the clicking of $D_{c}$ at $t_{1}$ and $D_{d}$ at $t_{2}$, Alice and Bob again use $\Delta\phi_{1}$ to extract the key. However, they also need a bit flip operation to get the same key bits. Note that in this example also, $\Delta\phi_{1}=0$ and $\Delta\phi_{2}=0$ or $\pi$.

A similar reasoning can be used to complete the key reconciliation scheme as described in Table 1.

Appendix B DPS-MDI as an entanglement-based protocol

We start with Eqs. (7) and (8), to write the joint state of Alice and Bob after their encoding procedure. Recall that $A$ and $B$ indicate Alice and Bob’s signal states, whereas $A_{i}$ and $B_{i}$ indicate the $i^{\rm th}$ pair of ancilla qubit in respective (ideal) quantum memories. The joint state thus reads as,

[TABLE]

The state $|\Psi_{j_{1}j_{2}\tilde{j}_{1}\tilde{j}_{2}}\rangle_{ab}$, which eventually becomes the input to Charles’ beamsplitter, has the following form:

[TABLE]

Here, $\ket{0,0}_{ab}=\ket{0}_{a}\otimes\ket{0}_{b}$, and denotes the vaccum at the input ports of the beamsplitter. $a_{i}^{\dagger}$ and $b_{i}^{\dagger}$ are the creation operators corresponding to a photon traversing through the $i^{\rm th}$ arm in Alice and Bob’s delay lines respectively. As indicated above, there is no entanglement yet between Alice and Bob’s states; rather, each encoded state is entangled with their respective quantum memories.

To obtain the output state after measurement and key reconciliation, we first do a post-selection and discard input states which have photons arriving at the same time-bin from both Alice and Bob. As described in section III, such photons do not contribute to the final key, due to Hong-Ou-Mandel interference. Hence, we drop terms of the form $a_{i}^{\dagger}b_{i}^{\dagger}$ in Eq. (34). When the photons arrive at different times, as represented by terms of the form $a_{i}^{\dagger}b_{j}^{\dagger}$ for $i\neq j$, they transform as,

[TABLE]

We may thus write down the final state after the action of the beamsplitter and post-selection as,

[TABLE]

The complete state, including the registers $A_{1},A_{2}$ and $B_{1},B_{2}$, is of the form,

[TABLE]

As discussed in section  III.2 , Alice and Bob extract information about their relative phases $\Delta\phi_{1}=\phi_{a_{1}}-\phi_{b_{1}}$ and $\Delta\phi_{2}=\phi_{a_{2}}-\phi_{b_{2}}$ based on Charles’ measurement outcomes, and hence obtain the shared key. Expressing all the phases in terms of the binary variables $(j_{1},j_{2})$ and $(\tilde{j}_{1},\tilde{j}_{2})$, which characterize Alice and Bob’s qubit registers respectively, we have,

[TABLE]

Thus the relative phases are given by,

[TABLE]

It is now easy to show that the joint state of Alice and Bob’s registers collapses to an entangled state after Charles’ measurement and the reconciliation process described in Table $1$. In particular, when Alice and Bob use the phases $\phi_{a_{i}},\phi_{b_{i}}$ to generate their secret key bits without a bit flip operation, they end up with the perfectly correlated Bell state $\frac{1}{\sqrt{2}}[\ket{00}_{A_{i}B_{i}}-\ket{11}_{A_{i}B_{i}}]$. In those cases where they need to perform a bit flip operation, they end up sharing the anti-correlated entangled state $\frac{1}{\sqrt{2}}[\ket{10}_{A_{i}B_{i}}-\ket{01}_{A_{i}B_{i}}]$.

For example, when Charles announces that the detector $c$ has clicked in both $t_{1}$ and $t_{2}$ bins, Eq. (36) collapses to the post-measurement state,

[TABLE]

where we have represented $\ket{j_{1}}_{A_{1}}\ket{\tilde{j_{1}}}_{B_{1}}\ket{j_{2}}_{A_{2}}\ket{\tilde{j_{2}}}_{B_{2}}$ as $\ket{j_{1}\tilde{j}_{1}j_{2}\tilde{j}_{2}}_{A_{1}B_{1}A_{2}B_{2}}$. We see that in Eq. (37), the first ancilla registers ($A_{1}$ and $B_{1}$) of both Alice and Bob always have same bit value. Hence, Alice and Bob share the perfectly correlated Bell state, as shown explicitly below,

[TABLE]

When Charles announces that the detector $c$ clicked at $t_{1}$ and $d$ at $t_{2}$, the state presented in Eq. (36) collapses to,

[TABLE]

As seen from Eq. (39), the first ancilla registers ($A_{1}$ and $B_{1}$) of Alice and Bob are now always opposite in the bit value. This implies they share an anti-correlated entangled state. Hence, they require a bit flip operation after Charles announcement so as to ensure that both of them end up with similar key bits. We can extend similar lines of reasoning to the other entries of Table $1$ to show that Alice and Bob indeed share maximally entangled states.

Appendix C Bounding of phase error rate in terms of bit error rate

In Appendix  B, we show that Charles measurement entangles Alice’s and Bob’s ancilla qubits. However, the EPR pairs shared by Alice and Bob become corrupt due to channel noise and eavesdropping. Alice and Bob extract a small number of perfect EPR pairs from the corrupted EPR pairs using a suitable entanglement distillation protocol based on Calderbank-Shor-Steane (CSS) codes, provided the channel is not too noisy  Shor and Preskill (2000). Alice and Bob determine the bit and the phase error rates. They continue with the entanglement distillation protocol if the error rates are nominal, else they abort the protocol. The bit error rates can be easily estimated by sharing a certain fraction of the raw key generated during the experiment. However, phase errors cannot be determined experimentally, and hence, need to be estimated indirectly using experimentally observed quantities. We upper bound the phase error rate for our scheme in terms of the bit error rate in this section.

We begin with $\ket{\psi}^{(l)}_{\text{out}}$, which is the state after Charles announces his measurement result for the $l^{\text{th}}$ time slot, and is related to the joint input state of Alice and Bob $\ket{\psi}^{(l)}_{\text{in}}$ as,

[TABLE]

Here, $M^{(l)}$ is the beamsplitter operator acting on the $l^{\text{th}}$ time slot, $F^{(l)}$ is the filtering operator and $E^{(l)}$ is a $3\times 3$“noise” matrix representing the effects of noise and Eve’s most general attack in $l^{\text{th}}$ time slot. We assume that the noise and Eve affect the link connecting Alice to Charles and Bob to Charles independently. Hence, we decompose the overall noise matrix $E^{(l)}$ as $E_{a}^{(l)}\otimes E_{b}^{(l)}$. Both $E_{a}^{(l)}$ and $E_{b}^{(l)}$ are $3\times 3$ matrices with matrix elements $(a)_{ij}$ and $(b)_{ij}$ respectively. $|a_{ij}|^{2}$ gives the probability of time-bin $i$ getting affected given that the noise/Eve acts on time-bin $j$. We would like to clarify the terms “time-bin” and “time-slot” used here. We use the time-slot label to mark every single-photon state (in the ideal scenario) or weak coherent pulse (in a typical experiment) generated by the source, whether Alice or Bob. Each pulse labelled by a time-slot is eventually measured at one of three time-bins ($i/j=1,2,3$) by Charlie, depending on which path the photon traversed in the DLI at the source. The form of these matrices depends upon the type of noise in the channel. The matrix structure is dependent upon the eavesdropper’s attack too. Hereafter, in the interest of brevity, we drop the superscript (l).

For example, we can study a channel noise (or an attack) which flips the key bits. The key is encoded in the phase difference of the corresponding time-bins of Alice and Bob in our protocol. Hence, Eve would need to flip the phase of Alice’s time-bins or Bob’s time-bins. So different noise matrices that can lead to such an attack are

[TABLE]

Another example is of an attack where Eve just monitors the presence of a photon in the second time-bin of Alice’s signal. We can write Alice’s state as

[TABLE]

When Eve discovers no photon in the second time-bin, the state shown in Eq. (42) collapses to

[TABLE]

One such noise matrix that achieves this attack is

[TABLE]

From the above examples we conclude that the elements of these noise matrices can be predicted only when we know the nature of Eve’s attack and the noise in the channel. Hence, by assuming a general form for these matrices, we can find the bit and phase error rates in our protocol for any general eavesdropping strategy.

Alice and Bob measure their EPR pairs in the $Z$ ($X$) basis, which acts as a stabilizer for the bit (phase) error. Thus, the probability of obtaining a bit error in the $l^{\text{th}}$ time-slot is,

[TABLE]

Similarly, the probability of obtaining a phase error in the $l^{\text{th}}$ time-slot can be expressed as,

[TABLE]

Using Eq. (40), we re-write the bit error rate as,

[TABLE]

Here, $F_{1}$ and $F_{2}$ are the filtering operators corresponding to the instances where Charles measurement and its public announcement effectively results in entangling the first and second ancilla qubits of Alice and Bob, respectively.

C.1 Decomposing $M^{(l)\dagger}F^{(l)\dagger}_{1}F^{(l)}_{1}M^{(l)}$

$\ket{100}$, $\ket{010}$ and $\ket{001}$ form an orthonormal basis for Alice’s and Bob’s system, where e.g. $\ket{100}$ represents a photon in the first time-bin. Using Eq. (27), for each time slot ($l$), we write,

[TABLE]

$F_{1}$ acts as identity for the measurement results which contribute towards the key. Hence, it can be expressed as,

[TABLE]

Using Eq. (LABEL:eq:BS_unitary) and Eq. (49), we get

[TABLE]

We express Eq. (50) in the basis of $A\otimes B$. In a concise notation, we use $\ket{a_{i}b_{i}}$ to denote the basis of the system $A\otimes B$, where e.g. $\ket{a_{1}b_{1}}$ equals $\ket{100}_{a}\otimes\ket{100}_{b}$. Using a completeness relation, we can write Eq. (50) as,

[TABLE]

By defining a suitable $F_{2}$, we can write

[TABLE]

C.2 Bit error rate (BER)

First, we evaluate one component of the bit error rate - $\langle\psi_{\text{in}}|E^{\dagger}\ket{a_{1}b_{2}}\bra{a_{1}b_{2}}E\otimes Z_{A_{1}B_{1}}\otimes I_{A_{2}B_{2}}|\psi_{\text{in}}\rangle$. We assume that Eve acts independently on the channels connecting Alice to Charles and Bob to Charles. Hence, we can write $E=E_{a}\otimes E_{b}$. Using Eq. (33) and Eq. (34), we express $\langle\psi_{\text{in}}|E^{\dagger}\ket{a_{1}b_{2}}\bra{a_{1}b_{2}}E\otimes Z_{A_{1}B_{1}}\otimes I_{A_{2}B_{2}}|\psi_{\text{in}}\rangle$ as,

[TABLE]

where, $\ket{j}=\ket{j_{1}\tilde{j_{1}}j_{2}\tilde{j_{2}}}$ is the state of the joint quantum memory of Alice and Bob. We define the $(a_{ij})^{\text{th}}$ matrix elements of $E_{a}$ as $\bra{a_{i}}E_{a}\ket{a_{j}}$ and the $(b_{ij})^{\text{th}}$ element of $E_{b}$ as $\bra{b_{i}}E_{a}\ket{b_{j}}$. Hence, we write Eq. (53) as,

[TABLE]

Eq. (54) can be factorised as,

[TABLE]

which further simplifies to,

[TABLE]

Now, we evaluate the remaining terms of Eq. (47) and obtain the total BER in each time slot as,

[TABLE]

C.3 Phase error rate

We begin by calculating one component of the phase error rate in the $l^{\text{th}}$ time slot, $\langle\psi_{\text{in}}|E^{\dagger}\ket{a_{1}b_{2}}\bra{a_{1}b_{2}}E\otimes X_{A_{1}B_{1}}\otimes I_{A_{2}B_{2}}|\psi_{\text{in}}\rangle$ in this section. Similar to Eq.(55), we can factorize the phase error rate as,

[TABLE]

We use the fact that $X$ flips the qubit $\ket{j}$, write $(-1)^{j+1}$ as $-(-1)^{j}$, and get the expanded value of Eq. (58) as,

[TABLE]

We can also write Eq. (58) as,

[TABLE]

The above equation, when summed over all the possible values of $\ket{j}=\ket{j_{1}\tilde{j}_{1}j_{2}\tilde{j}_{2}}$ gives

[TABLE]

Calculating the remaining three terms (cf. Eqs. (46), (51) and  (52)) along the lines of Eq. (58) and Eq. (59), we get the total phase error rate as,

[TABLE]

Along the lines of Eq. (61), we can express the phase error rate in terms of bit error rate as,

[TABLE]

From Eq. (63) , we can bound the phase error in each time slot as,

[TABLE]

Appendix D Asymptotic key analysis of DPS-MDI

D.1 DPS-MDI key rate with single-photon states

We calculate the asymptotic key rate of the single-photon source based DPS-MDI, while taking into account the effects of channel loss, background counts, and misalignment errors. We model Alice’s and Bob’s lossy channels as beamsplitters with transmissivity $\eta_{a}$ and $\eta_{b}$, respectively. After passing through the lossy channels, the joint input state of Alice and Bob (Eq. (2)) appears as a mixed state to Charles, before he carries out the beamsplitter measurement :

[TABLE]

where,

[TABLE]

Here, $\ket{\psi_{11}}$ corresponds to the scenario when photons from both Alice and Bob reach the measurement unit. $\ket{\psi_{10}}$ ($\ket{\psi_{01}}$) is the joint input state of Alice and Bob when Bob’s (Alice’s) photon gets lost in the channel, and only Alice’s (Bob’s) photon reaches Charles. $\ket{\psi_{00}}$ represents the case when both Alice as well as Bob’s photons get lost in the channel.

As per Eq. (27), the beamsplitter transforms $\ket{\psi_{11}}$ into

[TABLE]

Similarly, the action of beamspitter on $\ket{\psi_{10}}$, $\ket{\psi_{01}}$ and $\ket{\psi_{00}}$ are

[TABLE]

Table I shows the instances corresponding to the successful measurement events. These outcomes correspond to successful BSMs as we have mapped the DPS-MDI to an equivalent entanglement-based protocol. The yield ($Y_{11}$) for our protocol is defined as the probability of a successful measurement provided both Alice and Bob send single-photon states. Using Eqs. (D.1)- (70), we determine the probability of a successful measurement for all the cases shown in Table I as,

[TABLE]

where, $p_{\text{dark}}$ is the dark count probability, and ${Y}_{11}^{c(t_{1},t_{2})}$ represents the probability that detector $c$ clicks in time-bins $1$ and $2$, given that both Alice and Bob send single-photon states. We use this notation to express the probability of a successful BSM for the other cases tabulated in Table I.

[TABLE]

Hence, the yield ($Y_{11}$) is expressed as follows:

[TABLE]

There are different scenarios that lead to errors in the DPS-MDI protocol. For example, an error occurs when the detector $c$ clicks in time-bins $1$ and $2$, but $\Delta\phi_{1}=\pi$. In general, an error arises when clicks corresponding to a successful partial BSM occur due to background noise, but $\Delta\phi_{i}$ (i=1, 2) is flipped (see Table I). Dark counts of the single-photon detectors primarily contribute to this background noise. Thus, the error rate due to background noise is given by

[TABLE]

We assume that the phase misalignment error is same for both $\Delta\phi_{1}$ and $\Delta\phi_{2}$, and denote this deviation of $\Delta\phi_{1}$ and $\Delta\phi_{2}$ by $\Delta_{\phi}$. Phase misalignment error arises due to the non-ideal nature of optical phase-locked loop and phase modulators used in the setup. Hence, considering phase misalignment errors, the total error rate is given by,

[TABLE]

where $e_{d}$ is the variance of $\Delta_{\phi}$.

D.2 DPS-MDI with decoy states

Here, we calculate the parameters defined in Eq. (11). We assume an infinite number of decoy states to get an accurate estimate of these parameters. Phase randomization is integral to decoy-state analysis. A coherent state is seen as a mixture of Fock states upon phase randomization. This prevents Eve from getting information from multi-photon pulses coming from WCS. Hence, Alice and Bob prepare phase randomized weak coherent states with intensities $\mu_{a}$ and $\mu_{b}$, respectively, of the form,

[TABLE]

Here, $\theta_{a}$ and $\theta_{b}$ ($\in[0,2\pi]$) are the overall randomized phases. Alice and Bob pass their coherent states through their respective delay lines. The construction of the delay line is such that a photon has an equal probability of traversing through each path of the delay line. This implies that when a coherent state $\ket{\sqrt{\mu}}$ with mean photon number $\mu$ passes through a 3-path delay line, each path has a coherent state $\ket{\sqrt{\frac{\mu_{a}}{3}}}$ with mean photon number $\frac{\mu}{3}$ traversing through it. Hence, the joint state after the coherent state passing through the delay line and the phase modulator is given as,

[TABLE]

Here, $\ket{\mu}_{a_{1}}$ represents a coherent state traversing through path 1 of Alice’s delay line (see Fig. 2). We model the lossy channels as beamsplitters and express the joint state arriving at Chales’s beamsplitter as,

[TABLE]

Coherent states can also be expressed as,

[TABLE]

where $D(\sqrt{\mu})$ is the displacement operator, and is given as,

[TABLE]

Here, $a$ and $a^{\dagger}$ are annihilation and creation operators, respectively. The beamsplitter transforms $a^{\dagger}$ at the input mode as per Eq. (27). The output state of beamsplitter, when the input is Eq. (78) is,

[TABLE]

Here, $\ket{\sqrt{\mu}}_{c_{1}}$ denotes a coherent state of mean photon number $\mu$ hitting the detector $c$ in time-bin $t_{1}$.

Hence, the probability of a detector clicking in a time-bin is given by,

[TABLE]

We simplify Eq. (D.2) by defining following relations:

[TABLE]

Here, $\mu^{\prime}$ is the average number of photons reaching the measurement unit. $\Delta_{\theta}$ denotes the phase difference between the overall random phase applied by Alice and Bob. Using Eq. (83), we simplify Eq. (D.2) as

[TABLE]

$Q_{\mu_{a}\mu_{b}}$ is the overall gain when Alice and Bob, respectively, use an average photon number of $\mu_{a}$ and $\mu_{b}$, and a successful measurement occurs. We can express $Q_{\mu_{a}\mu_{b}}$ for our protocol as,

[TABLE]

We substitute Eq. (83) in Eq. (85), and obtain the overall gain for a given realization of $\theta_{a}$, $\theta_{b}$ as,

[TABLE]

We should average the overall gain obtained in Eq. (86) over the random phases $\theta_{a}$ and $\theta_{b}$. Integrating over $\Delta_{\theta}$ for Eq. (86) gives the overall gain as,

[TABLE]

Here, $I_{0}(x)$ is the modified Bessel function of the first kind. Next, we evaluate the gain of the single-photon states ($Q_{11}$) for our protocol. $Q_{11}$ is the probability of a successful BSM, given that both Alice and Bob use weak coherent states with intensities $\mu_{a}$ and $\mu_{b}$ respectively, and send single-photon pulses. We use the Poisson distribution of photon numbers in a coherent state to obtain $Q_{11}$ as,

[TABLE]

where $Y_{11}$ is obtained through Eq. (73).

The error rate in the sifted key is quantified by the overall QBER ($E_{\mu_{a}\mu_{b}}$). Error occurs in our protocol when correct set of detectors click in the right time-bins (see Table I) due to dark counts even when Alice and Bob have applied wrong $\Delta_{\phi_{i}}$ (i=1, 2). For example, clicking of detectors $c$ and $d$ when $\Delta_{\phi_{1}}=\pi$ leads to error. Hence, the overall QBER can be expressed as,

[TABLE]

Substituting Eq. (83) in Eq. (89),

[TABLE]

Averaging over $\Delta_{\theta}$ in Eq. 90, we get

[TABLE]

D.3 Phase randomization with post selection

As evident from Fig. 4, phase randomization leads to a high intrinsic QBER. To reduce the QBER, Alice and Bob divide the overall phase into different splices as per Eq. (13). They announce the segment that they used for phase randomization while sifting. This improved data processing Ma and Lutkenhaus (2012) reduces the cost of error correction (cf. Eq. (12)).

[TABLE]

We assume that Alice picks up one slice out of $N$ slices randomly and Bob always select the first phase slice. Hence, for estimation the overall gain Eq. (86) needs to be averaged over $\Delta_{\theta}$ from $\frac{m\pi}{N}$ to $\frac{(m+1)\pi}{N}$, i.e.,

[TABLE]

Similarly, we can write the QBER as

[TABLE]

Finally, we perform a numerical integration to evaluate the QBER.