Application of an Improved Version of McDiarmid Inequality in Finite-Key-Length Decoy-State Quantum Key Distribution

TL;DR

This paper introduces an improved McDiarmid inequality to directly estimate the secure key rate in finite-key decoy-state quantum key distribution, significantly enhancing the key rate bounds without changing experimental setups.

Contribution

It develops a novel, optimized version of McDiarmid inequality for quantum key distribution, enabling more accurate and higher bounds on secure key rates in practical scenarios.

Findings

Key rate at least doubled for 100 km quantum channels.

Method improves key rate across a wide range of raw key lengths.

Introduces advanced concentration inequalities to quantum physics problems.

Abstract

In practical decoy-state quantum key distribution, the raw key length is finite. Thus, deviation of the estimated single photon yield and single photon error rate from their respective true values due to finite sample size can seriously lower the provably secure key rate $R$. Current method to obtain a lower bound of $R$ follows an indirect path by first bounding the yields and error rates both conditioned on the type of decoy used. These bounds are then used to deduce the single photon yield and error rate, which in turn are used to calculate a lower bound of the key rate $R$. Here we report an improved version of McDiarmid inequality in statistics and show how use it to directly compute a lower bound of $R$ via the so-called centering sequence. A novelty in this work is the optimization of the bound through the freedom of choosing possible centering sequences. The provably secure key rate of realistic 100~km long quantum channel obtained by our method is at least twice that of the state-of-the-art procedure when the raw key length $\ell_\text{raw}$ is $\approx 10^5$ to $10^6$. In fact, our method can improve the key rate significantly over a wide range of raw key length from about $10^5$ to $10^{11}$. More importantly, it is achieved by pure theoretical analysis without altering the experimental setup or the post-processing method. In a boarder context, this work introduces powerful concentration inequality techniques in statistics to tackle physics problem beyond straightforward statistical data analysis especially when the data are correlated so that tools like the central limit theorem are not applicable.

Tables

Table 1. Table 1: Comparison between the state-of-the-art key rate R O ≡ R − 5 O × 10 − 5 superscript 𝑅 O subscript superscript 𝑅 O 5 superscript 10 5 R^{\text{O}}\equiv R^{\text{O}}_{-5}\times 10^{-5} in Ref.  Chau ( 2018a ) with the key rates in Eq. ( 27 ) (or more precisely R − 5 I ≡ max ⁡ ( 0 , R I × 10 − 5 ) subscript superscript 𝑅 I 5 0 superscript 𝑅 I superscript 10 5 R^{\text{I}}_{-5}\equiv\max(0,R^{\text{I}}\times 10^{-5}) ) for the dedicated quantum channel used in Refs.  Lim  et al. ( 2014 ); Chau ( 2018a ) via Method I. These rate are optimized using the method stated in the main text.

	$k=3$					$k=4$					$k=5$					$k=6$
$s_{𝚇}$	$R_{-5}^{\text{O}}$	$R_{-5}^{\text{A}}$	$R_{-5}^{\text{B}}$	$R_{-5}^{\text{C}}$	$R_{-5}^{\text{D}}$	$R_{-5}^{\text{O}}$	$R_{-5}^{\text{A}}$	$R_{-5}^{\text{B}}$	$R_{-5}^{\text{C}}$	$R_{-5}^{\text{D}}$	$R_{-5}^{\text{O}}$	$R_{-5}^{\text{A}}$	$R_{-5}^{\text{B}}$	$R_{-5}^{\text{C}}$	$R_{-5}^{\text{D}}$	$R_{-5}^{\text{O}}$	$R_{-5}^{\text{A}}$	$R_{-5}^{\text{B}}$	$R_{-5}^{\text{C}}$	$R_{-5}^{\text{D}}$
${10}^5$	$0.052$	$0.300$	$0.326$	$0.470$	$0.254$	$0.027$	$0.270$	$0.291$	$0.487$	$0.747$	$0.000$	$0.152$	$0.156$	$0.160$	$0.142$	$0.000$	$0.052$	$0.076$	$0.076$	$0.000$
${10}^6$	$0.294$	$0.743$	$0.789$	$0.835$	$0.637$	$0.194$	$0.727$	$0.763$	$0.829$	$1.41$	$0.100$	$0.660$	$0.694$	$0.516$	$0.484$	$0.055$	$0.404$	$0.434$	$0.407$	$0.966$
${10}^7$	$0.687$	$1.18$	$1.23$	$1.22$	$1.04$	$0.573$	$1.27$	$1.30$	$1.27$	$1.84$	$0.421$	$1.21$	$1.20$	$1.20$	$1.12$	$0.259$	$0.949$	$1.01$	$0.823$	$1.57$
${10}^8$	$1.11$	$1.43$	$1.48$	$1.45$	$1.64$	$1.04$	$1.60$	$1.63$	$1.59$	$2.18$	$0.929$	$1.66$	$1.68$	$1.63$	$1.81$	$0.624$	$1.32$	$1.34$	$1.33$	$2.00$
${10}^9$	$1.51$	$1.70$	$1.75$	$1.72$	$2.05$	$1.57$	$1.91$	$1.94$	$1.90$	$2.40$	$1.46$	$2.04$	$2.10$	$2.06$	$2.37$	$1.08$	$1.74$	$1.75$	$1.71$	$2.38$
${10}^{10}$	$1.87$	$1.98$	$2.02$	$1.99$	$2.32$	$1.97$	$2.20$	$2.22$	$2.19$	$2.58$	$1.94$	$2.40$	$2.42$	$2.40$	$2.72$	$1.72$	$2.16$	$2.18$	$2.14$	$2.63$
${10}^{11}$	$2.20$	$2.25$	$2.29$	$2.26$	$2.43$	$2.32$	$2.46$	$2.48$	$2.45$	$2.81$	$2.46$	$2.67$	$2.69$	$2.69$	$2.88$	$2.18$	$2.50$	$2.52$	$2.48$	$2.86$

Equations

$$Q_{\mathtt{B},{\mu }_n}=\sum _{m=0}^{+\infty }\frac{{\mu }_n^m{Y}_{\mathtt{B},m}\exp (-{\mu }_n)}{m!}$$

$$Q_{\mathtt{B},{\mu }_n}{E}_{\mathtt{B},{\mu }_n}=\sum _{m=0}^{+\infty }\frac{{\mu }_n^m{Y}_{\mathtt{B},m}{e}_{\mathtt{B},m}\exp (-{\mu }_n)}{m!}.$$

$$p_{\mathtt{X}}^2\left\{⟨\exp (-\mu )⟩Y_{\mathtt{X},0}+⟨\mu \exp (-\mu )⟩Y_{\mathtt{X},1}[1-H_2(e_p)]-{\Lambda }_{\text{EC}}-\frac{⟨Q_{\mathtt{X},\mu }⟩}{{\ell }_{\text{raw}}}\left[6{\log }_2\frac{\chi }{{ϵ}_{\text{sec}}}+{\log }_2\frac{2}{{ϵ}_{\text{cor}}}\right]\right\},$$

$${\Lambda }_{\text{EC}}=⟨Q_{\mathtt{X},\mu }{H}_2(E_{\mathtt{X},\mu })⟩$$

$$e_p\le e_{\mathtt{Z},1}+\bar{\gamma }\left(\frac{{ϵ}_{\text{sec}}}{\chi },e_{\mathtt{Z},1},\frac{s_{\mathtt{Z}}{Y}_{\mathtt{Z},1}⟨\mu \exp (-\mu )⟩}{⟨Q_{\mathtt{Z},\mu }⟩},\frac{s_{\mathtt{X}}{Y}_{\mathtt{X},1}⟨\mu \exp (-\mu )⟩}{⟨Q_{\mathtt{X},\mu }⟩}\right)$$

$$\bar{\gamma }(a,b,c,d)\equiv \sqrt{\frac{(c+d)(1-b)b}{cd}\ln \left[\frac{c+d}{2\pi cd(1-b)b{a}^2}\right]},$$

$$Y_{\mathtt{B},0}\ge \max \left(0,\sum _{n=1}^k{a}_{0n}{Q}_{\mathtt{B},{\mu }_n}\right)\equiv \max \left(0,\sum _{n=k_0}^k\frac{-Q_{\mathtt{B},{\mu }_n}\exp [{\mu }_n]{\hat{\prod }}_{i\ne n}{\mu }_i}{{\hat{\prod }}_{j\ne n}[{\mu }_n-{\mu }_j]}\right),$$

$$Y_{\mathtt{B},1}\ge \max \left(0,\sum _{n=1}^k{a}_{1n}{Q}_{\mathtt{B},{\mu }_n}\right)\equiv \max \left(0,\sum _{n=3-k_0}^k\frac{-Q_{\mathtt{B},{\mu }_n}\exp [{\mu }_n]{\hat{S}}_n}{{\hat{\prod }}_{j\ne n}[{\mu }_n-{\mu }_j]}\right)$$

$$Y_{\mathtt{Z},1}{e}_{\mathtt{Z},1}\le \min \left(\frac{Y_{\mathtt{Z},1}}{2},\sum _{n=1}^k{a}_{2n}{Q}_{\mathtt{Z},{\mu }_n}{E}_{\mathtt{Z},{\mu }_n}\right)\equiv \min \left(\frac{Y_{\mathtt{Z},1}}{2},\sum _{n=k_0}^k\frac{Q_{\mathtt{Z},{\mu }_n}{E}_{\mathtt{Z},{\mu }_n}\exp [{\mu }_n]{\hat{S}}_n}{{\hat{\prod }}_{j\ne n}[{\mu }_n-{\mu }_j]}\right),$$

$$Y_{\mathtt{Z},1}{\bar{e}}_{\mathtt{Z},1}\equiv Y_{\mathtt{Z},1}(1-e_{\mathtt{Z},1})\ge \max \left(0,\sum _{n=1}^k{a}_{1n}{Q}_{\mathtt{Z},{\mu }_n}{\bar{E}}_{\mathtt{Z},{\mu }_n}\right)\equiv \max \left(0,\sum _{n=3-k_0}^k\frac{-Q_{\mathtt{Z},{\mu }_n}{\bar{E}}_{\mathtt{Z},{\mu }_n}\exp [{\mu }_n]{\hat{S}}_n}{{\hat{\prod }}_{j\ne n}[{\mu }_n-{\mu }_j]}\right)$$

$$Y_{\mathtt{Z},1}{e}_{\mathtt{Z},1}\ge \max \left(0,\sum _{n=1}^k{a}_{1n}{Q}_{\mathtt{Z},{\mu }_n}{E}_{\mathtt{Z},{\mu }_n}\right)\equiv \max \left(0,\sum _{n=3-k_0}^k\frac{-Q_{\mathtt{Z},{\mu }_n}{E}_{\mathtt{Z},{\mu }_n}\exp [{\mu }_n]{\hat{S}}_n}{{\prod }_{j\ne n}[{\mu }_n-{\mu }_j]}\right),$$

$$\sum _{n=1}^k{b}_n{Q}_{\mathtt{X},{\mu }_n}-p_{\mathtt{X}}^2\left\{{\Lambda }_{\text{EC}}+\frac{⟨Q_{\mathtt{X},\mu }⟩}{{\ell }_{\text{raw}}}\left[6{\log }_2\frac{\chi }{{ϵ}_{\text{sec}}}+{\log }_2\frac{2}{{ϵ}_{\text{cor}}}\right]\right\},$$

$$b_n=p_{\mathtt{X}}^2\left\{⟨\exp (-\mu )⟩a_{0n}+⟨\mu \exp (-\mu )⟩a_{1n}[1-H_2(e_p)]\right\}$$

$${\hat{r}}_m(w_1,\dots ,w_{m-1})$$

$$\equiv b_m(w_1,\dots ,w_{m-1})-a_m(w_1,\dots ,w_{m-1}).$$

$$\mathrm{Pr}(f_t(\mathbf{w})-E[f_t(\mathbf{W})]\ge \delta )\le \exp \left[\frac{-2{\delta }^2}{{\hat{r}}^2(w_1,\dots ,w_{t-1})}\right]$$

$$\mathrm{Pr}(f_t(\mathbf{w})-E[f_t(\mathbf{W})]\le -\delta )\le \exp \left[\frac{-2{\delta }^2}{{\hat{r}}^2(w_1,\dots ,w_{t-1})}\right]$$

$$\mathrm{Pr}(V_t-E[V_t]\ge \delta )$$

$$\le$$

$$=$$

$$\le$$

$$+\frac{(E[U_t\mid V_{t-1}]-a_t)e^{h{b}_t}}{b_t-a_t}\}]$$

$$\le$$

$$+\frac{(E[U_t\mid V_{t-1}]-a_t)e^{h{b}_t}}{b_t-a_t}\}$$

$$\le$$

$$+\frac{(E[U_t\mid V_{t-1}]-a_t)e^{h{b}_t}}{b_t-a_t}\}.$$

$$\frac{d^{2}g}{d{h}^2}=\frac{(b_t-a_t{)}^2(b-x)(x-a)e^{h(b_t+a_t)}}{{\left[(b-x)e^{h{a}_t}+(x-a)e^{h{b}_t}\right]}^2}\le \frac{(b_t-a_t{)}^2}{4}$$

$$\mathrm{Pr}(f_t(\mathbf{w})-E[f_t(\mathbf{W})]\ge \delta )=\mathrm{Pr}(V_t-E[V_t]\ge \delta )$$

$$\le \exp \left[-\delta h+\frac{h^2{\sum }_{m=1}^t(b_m-a_m{)}^2}{8}\right]=\exp \left(\frac{h^2{\hat{r}}^2}{8}-\delta h\right)$$

$$y+\sum _{i=1}^t{W}_{P(i)}>\mathrm{ess}\sup \mathcal{W}-\mathrm{ess}\inf \mathcal{W}\ge 0.$$

$$f_m(\mathbf{W})=\frac{(t-m)x+{\sum }_{i=1}^m{W}_{P(i)}}{y+(t-m)x+{\sum }_{i=1}^m{W}_{P(i)}}$$

$$x\le \underset{m=1}{\overset{t}{\min }}\frac{2{\sum }_{j=1}^k{M}_j{\alpha }_j-\sup {\sum }_{i=1}^{m-1}{W}_{P(i)}+y-\delta }{2M-t-m+1}$$

$${\hat{r}}^2=\sum _{m=1}^t{\left\{\frac{y\mathrm{Width}(\mathcal{W})}{[y+(t-m)x+\mathrm{ess}\sup \mathcal{W}+{\sum }_{i=1}^{m-1}{w}_{P(i)}][y+(t-m)x+\mathrm{ess}\inf \mathcal{W}+{\sum }_{i=1}^{m-1}{w}_{P(i)}]}\right\}}^2,$$

$$E\left[U_m\mid \sum _{i=1}^{m-1}{W}_i=(m-1)w=\sum _{j=1}^k{m}_j{\alpha }_j\right]$$

$$=$$

$$\equiv$$

$$E\left[U_m\mid \sum _{i=1}^{m-1}{W}_i=(m-1)w=\sum _{j=1}^k{m}_j{\alpha }_j\right]$$

$$⟼$$

$$=$$

Full text

I Introduction

Quantum key distribution (QKD) enables two trusted parties Alice and Bob to share a provably secure secret key by preparing and measuring quantum states that are transmitted through a noisy channel controlled by an eavesdropper Eve. One of the major challenges to make QKD practical is to increase the number of secure bits generated per second Diamanti et al. (2016). That is why most QKD experiments to date use photons as the quantum information carriers; and these photons come from phase randomize Poissonian distributed sources instead of the much less efficient single photon sources. In addition, decoy state method is used to combat Eve’s photon-number-splitting attack on multiple photon events emitted from the Poissonian sources Wang (2005); Lo et al. (2005). From the theoretical point of view, a more convenient figure of merit is the key rate, namely, the number of provably secure secret bits per average number of photon pulses prepared by Alice. This is because key rate measures the intrinsic performance of a QKD protocol (in other words, the software issue) without taking the frequency of the pulse (which is a hardware issue) into account. This is analogous to the use of time complexity measure rather than the actual runtime to gauge the performance of an algorithm in theoretical computer science.

Surely, provably secure lower bound of key rate $R$ (which we simply call the key rate from now on) of a QKD scheme depends on various photon yields as well as error rates of those detected photons to be precisely defined in Eqs. (1) and (2) below. The problem is that Alice and Bob can only transmit a finite number of photons in practice. Consequently, the yield and error rates estimated by any sampling technique may differ from their actual values. If Alice and Bob ignore these deviations, the actual number of bits of secret key they get could be smaller than that computed by the key rate $R$, posing a security threat.

Various key rate formulae which take the above finite-size statistical fluctuations into account for a few (decoy-state-based) QKD schemes had been reported in literature. For instance, Lim et al. Lim et al. (2014) computed the key rates of a certain implementation of the BB84 QKD scheme Bennett and Brassard (1984) using three types of decoy; recently, Chau Chau (2018a) extended it to the case of using more than three types of decoys. Hayashi and Nakayama investigated the key rate for the BB84 scheme Hayashi and Nakayama (2014). Brádler et al. showed the key rate for a qudit-based QKD scheme using up to three mutually unbiased preparation and measurement bases Brádler et al. (2016). And Wang et al. proved that errors and fluctuations in the decoy photon intensities only have minor errors on the final key rate Wang et al. (2008). In brief, the provably secure key rate of a QKD scheme so far is found using the following three-step strategy. First, the yields $Q_{{\mathtt{B}},\mu_{n}}$ and error rates $E_{{\mathtt{B}},\mu_{n}}$ conditioned on the preparation and measurement basis ${\mathtt{B}}$ as well as the photon intensity parameter $\mu_{n}$ used are determined by comparing the relevant Bob’s measurement outcomes, if any, with Alice’s preparation states. The second step is to deduce yields and error rates conditioned on the number of photons emitted by the source. For a phase randomized Poissonian photon source,

[TABLE]

and

[TABLE]

Here, $\mu_{1}>\mu_{2}>\cdots>\mu_{k}\geq 0$ are the photon intensities used in the decoy method with $k\geq 2$. Moreover, $Y_{{\mathtt{B}},m}$ is the probability of photon detection by Bob given that the photon pulse sent by Alice contains $m$ photons and $e_{{\mathtt{B}},m}$ is the bit error rate for $m$ photon emission events prepared in the ${\mathtt{B}}$ basis Wang (2005); Lo et al. (2005); Ma et al. (2005). The key rate $R$ depends on $Y_{{\mathtt{B}},0}$, $Y_{{\mathtt{B}},1}$ and $e_{{\mathtt{B}},1}$ Lim et al. (2014); Wang (2005); Lo et al. (2005); Ma et al. (2005). Nevertheless, the later quantities cannot be determined precisely because Eqs. (1) and (2) are under-determined systems of equations given $Q_{{\mathtt{B}},\mu_{n}}$’s and $E_{{\mathtt{B}},\mu_{n}}$’s provided that the number of photon intensities used $k$ is finite. To make things worse, in the finite-raw-key-length (FRKL) situation, the measured values of $Q_{{\mathtt{B}},\mu_{n}}$’s and $E_{{\mathtt{B}},\mu_{n}}$’s deviate from their true values due to finite sampling. Fortunately, effective lower bounds of $Y_{{\mathtt{B}},0}$ and $Y_{{\mathtt{B}},1}$ as well as upper bound of $e_{{\mathtt{B}},1}$ are available Lim et al. (2014); Wang (2005); Lo et al. (2005); Ma et al. (2005); Hayashi (2007); Chau (2018a). In the FRKL situation, these bounds can be deduced with the help of Hoeffding’s inequality Hoeffding (1963). (See, for example, Refs. Lim et al. (2014); Chau (2018a) for details. Note that here we cannot assume the measurement outcomes are statistically independent and thus use more familiar tools such as central limit theorem because Eve may launch a coherent attack to all the photon pulses. In fact, we do not even know what kind of statistical distributions do $Q_{{\mathtt{B}},\mu_{n}}$’s and $E_{{\mathtt{B}},\mu_{n}}$’s follow.) The third step is to deduce $R$ from these bounds Lim et al. (2014); Wang (2005); Lo et al. (2005); Ma et al. (2005); Brádler et al. (2016).

Computing lower bound of $R$ using this indirect strategy is not satisfactory in the FRKL situation because it is unlikely for each of the finite-size fluctuations in $Q_{{\mathtt{B}},\mu_{n}}$’s and $E_{{\mathtt{B}},\mu_{n}}$’s to decrease the value of the provably secure key rate. In fact, for a given security parameter, the worst case bounds on $Y_{{\mathtt{B}},0}$ and $Y_{{\mathtt{B}},1}$ cannot be not attained simultaneously if the raw key length is finite. (This is evident, say, from the bounds of $Y_{{\mathtt{B}},0}$ and $Y_{{\mathtt{B}},1}$ given by Inequalities (2) and (3) in Ref. Lim et al. (2014) or Inequalities (12a) and (12b) in Ref. Chau (2018a). Note that there is a typo in Inequality (12b) — the $Q_{{\mathtt{B}},\mu_{i}}^{\llangle k_{0}-i\rrangle}$ there should be $Q_{{\mathtt{B}},\mu_{i}}^{\llangle k_{0}-i+1\rrangle}$. In all cases, the finite-size statistical fluctuation that leads to the saturation of lower bound for $Y_{{\mathtt{B}},0}$ does not cause the saturation of the lower bound for $Y_{{\mathtt{B}},1}$ and vice versa.)

It is more effective if one could directly investigate the influence of finite-key-length on the key rate. To do so, one has to go beyond the use of Hoeffding’s inequality to bound the statistical fluctuation, which only works for equally weighted sum of random variables that are either statistical independent or drawn from a finite population without replacement Hoeffding (1963). Here we use the computation of the key rate of a specific BB84 QKD protocol Bennett and Brassard (1984) that generates the raw key solely from ${\mathtt{X}}$ basis measurement results as an example to illustrate how to directly tackle statistical fluctuation in the FRKL situation by means of McDiarmid-type inequality McDiarmid (1989) in statistics. The technique used here can be easily adapted to compute the key rates of other QKD schemes using finite-dimensional qudits in the FRKL situation. Our work here is based on an earlier preprint by one of the us Chau (2018b). Here we greatly extend and improve the original proposal by first proving a new and slightly extended McDiarmid-type of inequality on so-called centering sequences. (See Definition 1 for the precise definition of a centering sequence.) Then we apply it through four different methods, each giving a separate provably secure key rate. We also optimize the provably secure key rate $R$ by exploiting our freedom to pick the centering sequences. To our knowledge, this is the first time such an optimization is performed. In contrast, this type of optimization is not possible in previous approach that makes use of a less general inequality known as Hoeffding’s inequality. It turns out that each method works best in different situations; and the best provably secure key rate among the four methods in realistic practical situation is at least about 10% better than the state-of-the-art method before Ref. Chau (2018b). Moreover, for raw key length $\ell_{\text{raw}}\approx 10^{5}$ to $10^{7}$, this work almost double the secure key rate of the original proposal in Ref. Chau (2018b) when four different photon intensities are used. From a broader perspective, the technique we introduce here is also applicable to bound the conclusion of a general physics experiment in the form of a real number due to finite-size statistical fluctuations of more than one type of measurement outcomes that are possibly statistically dependent.

II The QKD Scheme By Chau In Ref. Chau (2018a) And The Assumptions Of

The Security Proof

To illustrate how McDiarmid-type of inequality can be used to give a better key rate, we consider the QKD Scheme studied by Chau whose details can be found in Ref. Chau (2018a). Note that this scheme is a slight variation of the one studied by Lim et al. in Ref. Lim et al. (2014). The only difference is that they use three different photon intensities while we consider the slightly more general case of using $k\geq 2$ different photon intensities. In essence, the Scheme in Ref. Chau (2018a) is a decoy-state BB84 scheme with one-way classical communication using the ${\mathtt{X}}$-basis measurement results as the raw key and the ${\mathtt{Z}}$-basis measurement results for phase error estimation.

We assume that the light source is Poissonian distributed with intensities $\mu_{1}>\mu_{2}>\dots>\mu_{k}\geq 0$ with $k\geq 2$. Using the result in Ref. Wang et al. (2008), we simply our discussion by assuming that these photon intensities are accurately determined and fixed throughout the experiment. This is fine because fluctuation of photon intensity of a laser source is negligible in practice. Since our aim is to demonstrate our technique of using McDiarmid-type inequality in the simplest possible QKD implementation, we do not consider twin-field Lucamarini et al. (2018) or measurement device independent Lo et al. (2012) setups although adaptation to these situations is straightforward though tedious. The measurement is performed using threshold photon detectors with random bit assignment in the event of multiple detector click. Last but not least, we assume both Alice and Bob have access to their own private perfect random number generators when choosing their preparation and measurement bases.

III Finite-Size Decoy-State Key Rate

Recall that the error rate for this particular variation of the decoy-state BB84 QKD scheme using one-way classical communication is lower-bounded by Lim et al. (2014); Chau (2018a)

[TABLE]

where $p_{\mathtt{X}}$ denotes the probability that Alice (Bob) uses ${\mathtt{X}}$ as the preparation (measurement) basis, $\langle f(\mu)\rangle\equiv\sum_{n=1}^{k}p_{\mu_{n}}f(\mu_{n})$ with $p_{\mu_{n}}$ being the probability for Alice to use photon intensity parameter $\mu_{n}$. Furthermore, $H_{2}(x)\equiv-x\log_{2}x-(1-x)\log_{2}(1-x)$ is the binary entropy function, $e_{p}$ is the phase error rate of the single photon events in the raw key, and $\Lambda_{\text{EC}}$ is the actual number of bits of information that leaks to Eve as Alice and Bob perform error correction on their raw bits. It is given by

[TABLE]

if they use the most efficient (classical) error correcting code to do the job. In addition, $\ell_{\text{raw}}$ is the raw sifted key length measured in bits, $\epsilon_{\text{cor}}$ is the upper bound of the chance that the final secret keys shared between Alice and Bob are different, and $\epsilon_{\text{sec}}=(1-p_{\text{abort}})\|\rho_{\text{AE}}-U_{\text{A}}\otimes\rho_{\text{E}}\|_{1}/2$. Here $p_{\text{abort}}$ is the chance that the scheme aborts without generating a key, $\rho_{\text{AE}}$ is the classical-quantum state describing the joint state of Alice and Eve, $U_{\text{A}}$ is the uniform mixture of all the possible raw keys created by Alice, $\rho_{\text{E}}$ is the reduced density matrix of Eve, and $\|\cdot\|_{1}$ is the trace norm Renner (2005); Kraus et al. (2005); Renner et al. (2005). Thus, Eve’s information on the final key is at most $\epsilon_{\text{sec}}$. Last but not least, $\chi$ is a QKD scheme specific factor which depends on the detailed security analysis used. In general, $\chi$ may also depend on other factors used in the QKD scheme such as the number of photon intensities $k$ Lim et al. (2014); Chau (2018a).

For BB84, $e_{p}\to e_{{\mathtt{Z}},1}$ as $\ell_{\text{raw}}\to+\infty$. More importantly, the best known bound on the difference between $e_{p}$ and $e_{{\mathtt{Z}},1}$ due to finite sample size correction using properties of the hypergeometric distribution reported in given by Chau (2018a); Fung et al. (2010)

[TABLE]

with probability at least $1-\epsilon_{\text{sec}}/\chi$, where

[TABLE]

and $s_{\mathtt{B}}$ is the number of bits that are prepared and measured in ${\mathtt{B}}$ basis. Clearly, $s_{\mathtt{X}}=\ell_{\text{raw}}$ and $s_{\mathtt{Z}}\approx(1-p_{\mathtt{X}})^{2}s_{\mathtt{X}}\langle Q_{{\mathtt{Z}},\mu}\rangle/(p_{\mathtt{X}}^{2}\langle Q_{{\mathtt{X}},\mu}\rangle)$. (Note that $\bar{\gamma}$ becomes complex if $a,c,d$ are too large. This is because in this case no $e_{p}\geq e_{{\mathtt{Z}},1}$ exists with failure probability $a$. We carefully picked parameters here so that $\bar{\gamma}$ is real.)

In the infinite-key-length limit, statistical fluctuations of $Q_{{\mathtt{B}},\mu_{n}}$ and $E_{{\mathtt{B}},\mu_{n}}$ can be ignored. Then based on the analysis in Ref. Chau (2018a) with typos corrected, one has

[TABLE]

where $\bar{E}_{{\mathtt{Z}},\mu_{n}}=1-E_{{\mathtt{Z}},\mu_{n}}$.

Substituting Inequalities (5) and (7) into Expression (3) gives the following lower bound of the key rate

[TABLE]

where

[TABLE]

provided that $Y_{{\mathtt{X}},0},Y_{{\mathtt{X}},1}>0$. (The cases of $Y_{{\mathtt{X}},0}$ or $Y_{{\mathtt{X}},1}=0$ can be dealt with in the same way by changing the definition of $b_{n}$ accordingly. But these cases are not interesting for they likely imply $R=0$ in realistic channels.)

Note that the worst case key rate corresponds to the situation that the spin flip and phase shift errors in the raw key are uncorrelated so that Alice and Bob cannot use the correlation information to increase the efficiency of entanglement distillation. Thus, we may separately consider statistical fluctuations in $Q_{{\mathtt{X}},\mu_{n}}$’s and $e_{{\mathtt{Z}},1}$ in the FRKL situation.

IV An Improved Version Of McDiarmid Inequality

We now prove an improved version of a deep mathematical statistics result before applying it to improve the key rate $R$. Our inslight is that statistical fluctuations in $Q_{{\mathtt{X}},\mu_{n}}$’s and $e_{{\mathtt{Z}},1}$ can be bounded using McDiarmid-type inequality. Actually, the first inequality of this type was proven for the case of statistically independent random variables using martingale technique in Ref. McDiarmid (1989). The inequality we need here is a straightforward extension of Theorem 6.7 in Ref. McDiarmid (1989) and Theorem 2.3 in Ref. McDiarmid (1997) for statistically dependent random variables. (See also a closely related version in Ref. McDiarmid (1998).)

We first introduce the concept of a centering sequence McDiarmid (1997). The definition below is written in a more apparent manner to physicists.

Definition 1**.**

Let ${\mathbf{W}}=(W_{1},W_{2},\ldots,W_{t})$ be a random real vector whose components $W_{i}$’s are possibly statistically dependent random variables each taking values in the set ${\mathcal{W}}_{i}$. Let $f_{m}$ be a real-valued bounded function of ${\mathbf{W}}$. Set $V_{m}=\left.f_{m}({\mathbf{W}})\right|_{B_{m}}$ where $B_{m}$ denotes the conditions $W_{j}=w_{j}$ for $j=1,2,\ldots,m-1$. Then, the sequence of random variable $\{V_{m}\}_{m=1}^{t}$ is said to be centering if $E[U_{m}\mid V_{m-1}=v]\equiv E[V_{m}-V_{m-1}\mid V_{m-1}=v]$ is a decreasing functions of $v$ for all $m=1,2,\ldots,t$. (Here we use the convention that $V_{0}=0$ and assume that all conditional expectation values $E[\cdot\mid\cdot]$ exist.)

Note that centering property implicitly depends on the distribution of ${\mathbf{W}}$ through the conditional expectation value of $U_{m}$. Moreover, $\{V_{m}\}$ is centering if $\{V_{m}\}$ is a martingale.

Theorem 1**.**

Using notations in Definition 1, for a fixed $i=1,2,\ldots,t$, let $w_{m}\in{\mathcal{W}}_{m}$ and set

[TABLE]

Here the symbols $\operatorname{ess}\sup$ and $\operatorname{ess}\inf$ denote the essential supremum and infimum, respectively. Further set $\hat{r}^{2}\equiv\hat{r}^{2}(w_{1},\ldots,w_{t-1})=\sum_{m=1}^{t}\hat{r}_{m}^{2}$. Then $f_{t}({\mathbf{w}})\equiv f_{t}(w_{1},w_{2},\ldots,w_{t})$ obeys

[TABLE]

for any $\delta>0$, where $\Pr(\cdot)$ denotes the occurrence probability of the argument.

Remark 1**.**

This version of McDiarmid inequality is slightly stronger than the one reported in Ref. McDiarmid (1989) as we also utilize information of ${\mathbf{w}}$ in obtaining $\hat{r}$ whereas the original version in Ref. McDiarmid (1989) made use of the worst case ${\mathbf{w}}$. The proof of this theorem is based on that of Theorem 2.2 in Ref. McDiarmid (1997).

Proof.

Note that for any $h,\delta>0$,

[TABLE]

To proceed, we consider the function $g(h)=-hx+\ln\{[(b_{t}-x)e^{ha_{t}}+(x-a_{t})e^{hb_{t}}]/(b_{t}-a_{t})\}$ for $x\in[a_{t},b_{t}]$. It is straightforward to check that $g(0)=\left.dg/dh\right|_{h=0}=0$. Moreover,

[TABLE]

with the equality holds whenever $(b-x)e^{ha_{t}}=(x-a)e^{hb_{t}}$. Therefore, Taylor’s theorem gives $g(h)\leq h^{2}(b_{t}-a_{t})^{2}/8$ for all $h\geq 0$. Applying this inequality with $x=E[U_{t}\mid V_{t-1}]$ to Inequality (12), we have

[TABLE]

for any $h>0$. The R.H.S. of Inequality (14) is minimized by setting $h=4\delta/\hat{r}^{2}$; and with this $h$, Inequality (14) becomes Inequality (11a).

Finally, by applying the same argument to $-f_{m}$’s instead of $f_{m}$’s, we get Inequality (11b). This completes our proof. ∎

Corollary 1**.**

Let ${\mathbf{W}}=(W_{1},\ldots,W_{t})$ be a random vector such that $W_{m}$ takes on value from the same bounded set of real numbers ${\mathcal{W}}=\{\alpha_{j}\}_{j=1}^{k}$ for all $m=1,2,\ldots,t$. Suppose further that $W_{m}$’s are multivariate hypergeometrically distributed. Let $f_{m}({\mathbf{W}})=\sum_{i=1}^{m}W_{i}$ for all $m=1,2,\ldots,t$. Then, the sequence of random variables $\{V_{m}\}_{m=1}^{t}$ defined in Definition 1 is centering provided that $E[V_{m}-V_{m-1}\mid V_{m-1}=v]$ is well-defined for all $v$. Besides, Theorem 1 holds with $\hat{r}=\sqrt{t}\operatorname{Width}({\mathcal{W}})$, where $\operatorname{Width}({\mathcal{W}})\equiv\operatorname{ess}\sup{\mathcal{W}}-\operatorname{ess}\inf{\mathcal{W}}$.

Proof.

This proof is adapted from Example 1 in Ref. McDiarmid (1997). From Definition 1, it suffices to show that $E[U_{m}\mid\sum_{i=1}^{m-1}W_{i}=\upsilon]=E[W_{m}\mid\sum_{i=1}^{m-1}W_{i}=\upsilon]$ is a decreasing function of $\upsilon$. Suppose $W_{i}$’s are drawn from a collection of $M$ objects out of which $M_{j}$ of them take the value $\alpha_{j}$ for all $j$. Suppose further that among $W_{i}$’s with $1\leq i<m$, there are $m_{j}$ of them taking the value of $\alpha_{j}$ for all $j$. Then, the probability that $W_{m}=\alpha_{j}$ is $(M_{j}-m_{j})/(M-m+1)$. Moreover, the condition $\sum_{i=1}^{m-1}W_{i}=\upsilon$ means that $\sum m_{j}\alpha_{j}=\upsilon$. As a result, $E[W_{m}\mid\sum_{i=1}^{m-1}W_{i}=\upsilon]=\sum_{j}(M_{j}-m_{j})\alpha_{j}/(M-m+1)=(\sum_{j}M_{j}\alpha_{j}-\upsilon)/(M-m+1)$, which is a decreasing function of $\upsilon$ whenever $\sum_{i=1}^{m-1}W_{i}=\upsilon$. Hence, $\{V_{m}\}$ is a centering sequence.

By applying Theorem 1 to $\{U_{m}\}$, we have $r_{m}=\operatorname{ess}\sup\{W_{m}\mid V_{m-1}=\upsilon\}-\operatorname{ess}\inf\{W_{m}\mid V_{m-1}=\upsilon\}=\operatorname{ess}\sup{\mathcal{W}}-\operatorname{ess}\inf{\mathcal{W}}=\operatorname{Width}({\mathcal{W}})$ for all $m$ and $V_{m-1}$. Hence, it is proved. ∎

Remark 2**.**

The above corollary was first proven by Hoeffding in Ref. Hoeffding (1963) without using the concept of centering sequence. Actually, Corollary 1 is more often referred to as the Hoeffding’s inequality. In fact, Hoeffding’s inequality has been used to compute the provably secure key rate $R$ when the raw key length $\ell_{\text{raw}}$ is finite in previous works Lim et al. (2014); Hayashi and Nakayama (2014); Brádler et al. (2016); Chau (2018a). In Sec. V below, we use the above corollary to bound $e_{{\mathtt{Z}},1}$ in Methods A and B.

Corollary 2**.**

Let ${\mathbf{W}}=(W_{1},\ldots,W_{t})$ be a random vector where each $W_{m}$ takes on value from a bounded set of real numbers ${\mathcal{W}}=\{\alpha_{j}\}_{j=1}^{k}$. Suppose $W_{m}$’s are multivariate hypergeometrically distributed in the sense that they are chosen without replacement from a collection of $M$ objects out of which $M_{j}$ of them take the value of $\alpha_{j}$ for all $j$. Let $x\in[\operatorname{ess}\inf{\mathcal{W}},\operatorname{ess}\sup{\mathcal{W}}]$ and $y>0$ be two fixed numbers. Let $P\colon\{1,2,\ldots,t\}\mapsto\{1,2,\ldots,t\}$ be an arbitrary but fixed permutation. Suppose

[TABLE]

Define

[TABLE]

for $m=1,2,\ldots,t$. Then, the sequence $\{V_{m}\}_{m=1}^{t}$ is centering provided that

[TABLE]

where $\delta$ is a small correlation term of the order of $\operatorname{Width}({\mathcal{W}})/(y+tx)^{2}$. Furthermore, by picking $x$ to be the R.H.S. of Inequality (17), then Inequality (11) is true with

[TABLE]

where $\{w_{P(i)}\}$ is a decreasing sequence.

Proof.

Since $(W_{P(1)},W_{P(2)},\ldots,W_{P(t)})$ is also a multivariate hypergeometrically distributed random vector, we only need to prove the case when $P$ is an identity operator as the general case can be proven in the same way. From Eq. (15), $f_{m}$ has a positive denominator and is an increasing function of $W_{m}$. So to prove that $\{V_{m}\}$ is centering, it suffices to show that $E[U_{m}\mid\sum_{i=1}^{m-1}W_{i}=(m-1)w]$ is a decreasing function of $(m-1)w=\sum_{j=1}^{k}m_{j}\alpha_{j}$ for all non-negative integers $m_{j}$’s obeying $\sum_{j=1}^{k}m_{j}=m-1$. Since $\alpha_{j}$’s are fixed, the only way to change $w$ is to change $m_{j}$’s but at the same time keeping $\sum_{j=1}^{n}m_{j}$ fixed. Clearly, $w$ can only be changed if $m\geq 3$. More importantly, as $m_{j}$’s are integers, any such change can be expressed as a composition of a series of elementary changes, each increases a certain $m_{j_{1}}$ by one and decreasing a certain $m_{j_{2}}$ by one with $1\leq j_{1}\neq j_{2}\leq k$.

Observe that

[TABLE]

Moreover, after the elementary change, $w\mapsto w+\alpha_{j_{1}}-\alpha_{j_{2}}\equiv w+\Delta w$. From Inequality (15), $D>|\alpha_{j}-x|$. So by Taylor’s theorem,

[TABLE]

with $\xi_{1}\in[0,1]$. As $x\in[\operatorname{ess}\inf{\mathcal{W}},\operatorname{ess}\sup{\mathcal{W}}]$, we conclude that $0\leq\sum_{j}(M_{j}-m_{j})(\alpha_{j}-x)^{2}\leq(M-m+1)\operatorname{Width}({\mathcal{W}})^{2}$ almost surely. From Inequality (15), we may expand $1/(D+\Delta w)$, $1/(D+\Delta w+\alpha_{j_{1}}-x)$ and $1/(D+\Delta w+\alpha_{j_{2}}-x)$ as series of $\Delta w$ via Taylor’s theorem. In this way, the R.H.S. of Eq. (20) can be expressed in the form $E[U_{m}\mid\sum_{i=1}^{m-1}W_{i}=(m-1)w=\sum_{j=1}^{k}m_{j}\alpha_{j}]+g_{1}\Delta w+g_{2}$ with

[TABLE]

where $\xi_{2},\xi_{3}\in[0,1]$. And the correlation term $g_{2}$ obeys $|g_{2}|\leq 3y[\sum_{j}M_{j}\alpha_{j}-(M-m+1)x-(m-1)w](\Delta w)^{2}/[(M-m+1)D^{4}]$.

A sufficient condition for $\{V_{m}\}$ to be centering is $g_{1}\Delta w+g_{2}\leq 0$ for all $m$ and $w$. Moreover, this condition is satisfied if

[TABLE]

for all $m=1,\ldots,t$ and for all $(m-1)w=\sum_{i=1}^{m-1}W_{i}$, where the correlation term $\delta\leq|g_{2}|\Delta w+2\operatorname{Width}({\mathcal{W}})+(3M-3m+2)\operatorname{Width}({\mathcal{W}})^{2}/D$. (Note that Inequality (22) is consistent with the constraint that $\operatorname{ess}\inf{\mathcal{W}}\leq x\leq\operatorname{ess}\sup{\mathcal{W}}$ because this inequality is trivially satisfied when $x=\operatorname{ess}\inf{\mathcal{W}}$.) Hence, $\{V_{m}\}$ is centering if Inequality (17) holds.

We now switch back to consider the situation of an arbitrary but fixed permutation $P$. To optimize the bound in Theorem 1, we use the freedom to pick a suitable permutation $P$ to minimize $\hat{r}$. From Theorem 1, $\hat{r}_{m}=y\operatorname{Width}({\mathcal{W}})/\{[y+(t-m)x+\operatorname{ess}\sup{\mathcal{W}}+\sum_{i=1}^{m-1}w_{P(i)}][y+(t-m)x+\operatorname{ess}\inf{\mathcal{W}}+\sum_{i=1}^{m-1}w_{P(i)}]\}$, which is a decreasing function of both $x$ and $w$. Hence, the optimal situation occurs when we pick the permutation so that $w_{P(i)}$ is a decreasing function of $i$. In this case, $\sum_{i=1}^{m}w_{P(i)}/m$ is a decreasing function of $m$. In this way, we arrive at $\hat{r}^{2}$ in Eq. (18). ∎

Remark 3**.**

The ability to optimize $\hat{r}$ by means of picking the best possible permutation $P$ and hence the best possible centering sequence is a novel feature of McDiarmid inequality. As far as we know, this feature has not been exploited before. In contrast, from the proof of Corollary 1, it is clear that the value of $\hat{r}$ obtained from the Hoeffding’s inequality does not depend on the choice of $P$. In Sec. V below, we fully exploit this freedom of picking $P$ to bound $e_{{\mathtt{Z}},1}$ in Method D. Note however that the above Corollary requires the knowledge of $M_{j}$’s. In addition, $\hat{r}^{2}$ is written as a rather involved sum. Let us replace every $w_{P(i)}$ in Eq. (18) by the average observed value, namely, $\sum_{i=1}^{t}w_{i}/t$. In this way, $\hat{r}$ would increase by a factor of $\operatorname{O}(t\operatorname{Width}({\mathcal{W}})/D)$. Suppose that we fix $x=\sum_{i=1}^{t}w_{i}/t\equiv\langle w\rangle$ as well (without caring whether Inequality (17) holds or not). Then $\hat{r}$ would change by a factor of $\operatorname{O}(\operatorname{Width}({\mathcal{W}})/D\sqrt{t})$ most of the time due to statistical fluctuation. Thus, in practice, we may replace $\hat{r}$ in Eq. (18) by the following more convenient and useful expression

[TABLE]

which does not depend on the knowledge of $M_{j}$’s. This expression for $\hat{r}$ shall be used to bound $e_{{\mathtt{Z}},1}$ in Method C to be reported in Sec. V.

V Application Of The Improved McDiarmid Inequality In Finding The Key

Rate

There is a subtlety in applying Theorem 1 to study the statistical fluctuation of $e_{{\mathtt{Z}},1}$. A naive way to do so is to use Inequalities (5) and (7) to obtain the bound $e_{{\mathtt{Z}},1}\leq(\sum_{n=1}^{k}a_{2n}Q_{{\mathtt{Z}},\mu_{n}}E_{{\mathtt{Z}},\mu_{n}})/(\sum_{n=1}^{k}a_{1n}Q_{{\mathtt{Z}},\mu_{n}})$. Then one could regard $Q_{{\mathtt{Z}},\mu_{n}}$’s and $Q_{{\mathtt{Z}},\mu_{n}}E_{{\mathtt{Z}},\mu_{n}}$’s as random variables and directly apply Theorem 1 and Definition 1 to the R.H.S. of the above inequality. Nonetheless, it does not work for the R.H.S. of this inequality need not be bounded. Besides, the bound obtained is not strong enough even if we ignore the boundedness problem.

To proceed, we first write $Q_{{\mathtt{Z}},\mu_{n}}=\sum_{j}\tilde{W}_{nj}/\tilde{s}_{{\mathtt{Z}},\mu_{n}}$ where $\tilde{s}_{{\mathtt{Z}},\mu_{n}}$ is the number of photon pulses that Alice prepares using photon intensity $\mu_{n}$ and that Alice prepares and Bob tries to measure (but may or may not have detection) in ${\mathtt{Z}}$ basis. In addition, $\tilde{W}_{nj}$ denotes the possibly correlated random variable whose value is $1$ ([math]) if the $j$th photon pulse among the $\tilde{s}_{{\mathtt{Z}},\mu_{n}}$ photon pulses is (not) detected by Bob. Clearly, $\tilde{s}_{{\mathtt{Z}},\mu_{n}}\approx Tp_{\mathtt{Z}}^{2}p_{\mu_{n}}$ with $T$ being the total number of photon pulses sent by Alice and $p_{\mathtt{Z}}=1-p_{\mathtt{X}}$ is the probability for Alice (Bob) to prepare (measure) in the ${\mathtt{Z}}$ basis. Since $s_{\mathtt{Z}}\approx Tp_{\mathtt{Z}}^{2}\langle Q_{{\mathtt{Z}},\mu}\rangle$, I arrive at

[TABLE]

where $s^{\text{e}}_{{\mathtt{Z}}}=s_{{\mathtt{Z}}}\langle Q_{{\mathtt{Z}},\mu}E_{{\mathtt{Z}},\mu}\rangle/\langle Q_{{\mathtt{Z}},\mu}\rangle$ and $s^{\bar{\text{e}}}_{{\mathtt{Z}}}=s_{{\mathtt{Z}}}\langle Q_{{\mathtt{Z}},\mu}\bar{E}_{{\mathtt{Z}},\mu}\rangle/\langle Q_{{\mathtt{Z}},\mu}\rangle$) are the number of bits that are prepared and successfully measured in the ${\mathtt{Z}}$ basis such that the preparation by Alice and measurement result by Bob are unequal and equal, respectively. Moreover, $W^{\text{e}}_{{\mathtt{Z}},i}$’s ($W^{\bar{\text{e}}}_{{\mathtt{Z}},i}$’s) are multivariate hypergeometrically distributed random variables taking values in the set $\{a_{2n}/p_{\mu_{n}}\}_{n=1}^{k}$ ($\{a_{1n}/p_{\mu_{n}}\}_{n=1}^{k}$).

From Inequalities (24a) –(24c), $e_{{\mathtt{Z}},1}$ obeys

[TABLE]

Interestingly, these two inequalities can be used to give four different bounds on the finite-size statistical fluctuations in $e_{{\mathtt{Z}},1}$. More importantly, these four bounds are

1. A.

Use an upper bound of $\sum_{i=1}^{s_{\mathtt{Z}}^{\text{e}}}W_{{\mathtt{Z}},i}^{\text{e}}$ and a lower bound of $\sum_{j=1}^{s_{\mathtt{Z}}}W_{{\mathtt{Z}},j}$ to deduce an upper bound of $e_{{\mathtt{Z}},1}$. Specifically, from Corollary 1, we conclude that the true value of $\sum_{j=1}^{s_{\mathtt{Z}}}W_{{\mathtt{Z}},j}$ is less than the observed value by $\left[s_{\mathtt{Z}}\ln(1/\epsilon_{\mathtt{Z}})/2\right]^{1/2}\operatorname{Width}(\{a_{1n}/p_{\mu_{n}}\}_{n=1}^{k})$ with probability at most $\epsilon_{\mathtt{Z}}$. (Recall that $\operatorname{Width}({\mathcal{W}})$ of a bounded set ${\mathcal{W}}$ of real numbers is defined as $\operatorname{ess}\sup{\mathcal{W}}-\operatorname{ess}\inf{\mathcal{W}}$.) And the true value of $\sum_{i=1}^{s_{\mathtt{Z}}^{\text{e}}}W_{{\mathtt{Z}},i}^{\text{e}}$ is greater than its observed value by $\left[s^{\text{e}}_{\mathtt{Z}}\ln(1/\epsilon^{\text{e}}_{\mathtt{Z}})/2\right]^{1/2}\operatorname{Width}(\{a_{2n}/p_{\mu_{n}}\}_{n=1}^{k})=\left[s_{\mathtt{Z}}\langle Q_{{\mathtt{Z}},\mu}E_{{\mathtt{Z}},\mu}\rangle\ln(1/\epsilon^{\text{e}}_{\mathtt{Z}})/2\langle Q_{{\mathtt{Z}},\mu}\rangle\right]^{1/2}\operatorname{Width}(\{a_{2n}/p_{\mu_{n}}\}_{n=1}^{k})$ with probability at most $\epsilon_{\mathtt{Z}}^{\text{e}}$. Since $W_{{\mathtt{Z}}_{i}}^{\text{e}}$ and $W_{{\mathtt{Z}},j}$ are positively correlated, from Inequalities (24a), (24b) and (25a), we have

[TABLE] 2. B.

Alternatively, we may use Inequality (25b) and Corollary 1 to bound $e_{{\mathtt{Z}},1}$. Specifically, the true value of $\sum_{j=1}^{s_{\mathtt{Z}}^{\bar{\text{e}}}}W_{{\mathtt{Z}},j}^{\bar{\text{e}}}$ is less than the observed value by $[s_{\mathtt{Z}}\langle Q_{{\mathtt{Z}},\mu}\bar{E}_{{\mathtt{Z}},\mu}\rangle\ln(1/\epsilon_{\mathtt{Z}}^{\bar{\text{e}}})/2\langle Q_{{\mathtt{Z}},\mu}\rangle]^{1/2}\operatorname{Width}(\{a_{1n}/p_{\mu_{n}}\}_{n=1}^{k})$ with probability at most $\epsilon_{\mathtt{Z}}^{\bar{\text{e}}}$. Note that $W_{{\mathtt{Z}},j}^{\text{e}}$’s and $W_{{\mathtt{Z}},j}^{\bar{\text{e}}}$’s are statistically independent. Therefore, from Inequalities (24b), (24c) and (25b), we have

[TABLE]

with probability at least $1-\epsilon_{\mathtt{Z}}^{\text{e}}-\epsilon_{\mathtt{Z}}^{\bar{\text{e}}}$, where $\Delta Y_{{\mathtt{Z}},1}e_{{\mathtt{Z}},1}$ is given by Eq. (26b) and

[TABLE] 3. C.

An even more interesting way to bound $e_{{\mathtt{Z}},1}$ is to use Inequality (25b), Corollary 2 and Remark 3. Since $\langle w\rangle$ in this case is the measured $Y_{{\mathtt{Z}},1}e_{{\mathtt{Z}},1}/s_{\mathtt{Z}}^{\text{e}}$, which is lower-bounded by Inequality (7e), Remark 3 gives

[TABLE]

with probability at least $1-\epsilon_{\mathtt{Z}}^{\bar{\text{e}}}-\epsilon_{\mathtt{Z}}^{\text{e}}$, where

[TABLE]

provided that Inequalities (15) and (17) hold. (See Ref. Ng (2019) for an alternative proof of this result.) 4. D.

There is an alternative way to apply Inequality (25b) and Corollary 2 to find $\Delta e_{{\mathtt{Z}},1}$ in Inequality (26f), which is quite aggressive. Since $\sum_{i=1}^{t}w_{i}/t$ is an estimate of $Y_{{\mathtt{Z}},1}e_{{\mathtt{Z}},1}=\langle w\rangle$, we know from Corollary 1 and Inequality (7e) that $\langle w\rangle\geq\sum_{n=1}^{k}a_{1n}Q_{{\mathtt{Z}},\mu_{n}}E_{{\mathtt{Z}},\mu_{n}}-\Delta Y_{{\mathtt{Z}},1}e_{{\mathtt{Z}},1}$ with probability at least $1-\epsilon_{\mathtt{Z}}^{\text{e}}$. In other words, by fixing $t=s_{\mathtt{Z}}^{\text{e}}$ and $x=(\sum_{n=1}^{k}a_{1n}Q_{{\mathtt{Z}},\mu_{n}}E_{{\mathtt{Z}},\mu_{n}}-\Delta Y_{{\mathtt{Z}},1}e_{{\mathtt{Z}},1})/s_{\mathtt{Z}}^{\text{e}}$, we conclude that Inequality (22) is satisfied with probability at least $1-\epsilon_{\mathtt{Z}}^{\text{e}}$. Next, we could upper-bound the R.H.S. of Eq. (18) by approximating the sum over $m$ there by an integral. Specifically, set $y=\sum_{n=1}^{k}a_{1n}Q_{{\mathtt{Z}},\mu_{n}}\bar{E}_{{\mathtt{Z}},\mu_{n}}-\Delta Y_{{\mathtt{Z}},1}\bar{e}_{{\mathtt{Z}},1}$, then

[TABLE]

As $w_{P(m)}$’s are arranged in descending order and ${\mathcal{W}}$ in our case is the set $\{\langle Q_{{\mathtt{Z}},\mu}\rangle a_{2n}/(p_{\mu_{n}}s_{\mathtt{Z}})\}_{n=1}^{k}$ of at most $k$ elements, R.H.S. of the above inequality can be simplified to a big sum of at most $k$ terms. To be more explicit, suppose the descending sequence $\{w_{P(m)}\}_{m=1}^{t}$ contains $n^{(1)}$ copies of $w^{(1)}$, followed by $n^{(2)}$ copies of $w^{(2)}$, and so on until ending with $n^{(k)}$ copies of $w^{(k)}$. Surely, $\sum_{i=1}^{k}n^{(i)}=t=s_{\mathtt{Z}}^{\text{e}}$ and $\sum_{i=1}^{k}n^{(i)}w^{(i)}/t$ is the observed $\langle w\rangle$. Then, Eq. (26h) becomes

[TABLE]

which is efficient to compute. (Note that the sum in R.H.S. of Eq. (18) is a decreasing function of $x$ and $w_{P(i)}$’s, the above integral approximation is accurate up to a correction term of at most $\operatorname{Width}({\mathcal{W}})^{2}=\operatorname{O}(1/s_{\mathtt{Z}}^{2})$. Surely, this correction can be safely ignored in practice provided that $t=s_{\mathtt{Z}}^{\text{e}}\gtrsim 10^{4}$.) In this way, Inequality (26f) holds with probability at least $1-\epsilon_{\mathtt{Z}}^{\bar{\text{e}}}-2\epsilon_{\mathtt{Z}}^{\text{e}}$ with

[TABLE]

where $\hat{r}$ is given by the R.H.S. of Inequality (26i).

In reality, we use the minimum of the above four methods to upper-bound the value of $e_{{\mathtt{Z}},1}$. To study the statistical fluctuation of $R$, it remains to consider the fluctuation of $Q_{{\mathtt{X}},\mu_{n}}$ in the first term in Expression (8). (Although the second term also depends on $Q_{{\mathtt{X}},\mu_{n}}$’s implicitly through $\Lambda_{\text{EC}}$, statistical fluctuation is absent from this term. This is because $\Lambda_{\text{EC}}$ is the amount of information leaking to Eve during classical post-processing of the measured raw bits. Thus, it depends on the observed values of $Q_{{\mathtt{X}},\mu_{n}}$’s and $E_{{\mathtt{X}},\mu_{n}}$’s instead of their true values.) Using the same technique as in the estimation of statistical fluctuation in $e_{{\mathtt{Z}},1}$, the first term of Expression (8) can be rewritten as $\langle Q_{{\mathtt{X}},\mu}\rangle\sum_{i=1}^{s_{\mathtt{X}}}W_{{\mathtt{X}},i}$ where $W_{{\mathtt{X}},i}$’s are multivariate hypergeometrically distributed random variables each taken values in the set $\{b_{n}/p_{\mu_{n}}\}_{n=1}^{k}$. Here $b_{n}$ is given by Eq. (9) with $e_{p}$ equals the R.H.S. of Inequality (5) where $e_{{\mathtt{Z}},1}$ is given by any one of the following four equations depending on which of the four methods we use: Eq. (26a), (26d), (26f) and (26j). Corollary 1 implies that due to statistical fluctuation, the true value of the first term in Expression (8) is lower than the observed value by $\langle Q_{{\mathtt{X}},\mu}\rangle\left[\ln(1/\epsilon_{\mathtt{X}})/(2s_{\mathtt{X}})\right]^{1/2}\operatorname{Width}(\{b_{n}/p_{\mu_{n}}\}_{n=1}^{k})$ with probability at most $\epsilon_{\mathtt{X}}$. We remark that this way of finding a lower bound for $\sum_{n}b_{n}Q_{{\mathtt{X}},\mu_{n}}$ is more direct than the standard one that separately bounds $Y_{{\mathtt{X}},0}$ and $Y_{{\mathtt{X}},1}$ Lim et al. (2014); Brádler et al. (2016); Chau (2018a); Hayashi (2007).

Putting everything together and by setting $\epsilon_{\mathtt{X}}=\epsilon_{\mathtt{Z}}=\epsilon_{\mathtt{Z}}^{\text{e}}=\epsilon_{\mathtt{Z}}^{\bar{\text{e}}}=\epsilon_{\bar{\gamma}}=\epsilon_{\text{sec}}/\chi$, we conclude that the secret key rate $R$ satisfies

[TABLE]

where $b_{n}=b_{n}(e_{p})$ is given by Eq. (9). Here $e_{p}$ equals the R.H.S. of Inequality (5) with $e_{{\mathtt{Z}},1}$ given by Eq. (26a), (26d), (26f) or (26j). Note that $\chi=9=4+1+4$ for Methods A to C and $\chi=10$ for Method D. (Here the first number $4$ comes from the generalized chain rule for smooth entropy in Ref. Lim et al. (2014), the number $1$ comes from the finite-size correction of the raw key in Eq. (B1) of Ref. Lim et al. (2014), and the last number $4$ comes from $\epsilon_{\bar{\gamma}}$, $\epsilon_{\mathtt{X}}$, $\epsilon_{\mathtt{Z}}^{\text{e}}$ as well as either $\epsilon_{\mathtt{Z}}$ or $\epsilon_{\mathtt{Z}}^{\bar{\text{e}}}$. Moreover, $\chi$ for Method D is larger than the rest by 1 because of the extra condition on the statistical fluctuation of a lower bound of $Y_{{\mathtt{Z}},1}e_{{\mathtt{Z}},1}$.) Interestingly, unlike the schemes used in Refs. Lim et al. (2014); Hayashi and Nakayama (2014); Chau (2018a), the number $\chi$ in our scheme is independent on the number of photon intensities $k$ used. This is because we directly tackle the finite sample statistical fluctuations of quantities like $Y_{{\mathtt{B}},1}$. Note however that even though $\chi$ does not depend on $k$, it does not mean that one could use arbitrarily large number of photon intensities as decoys (so as to obtain better bounds on quantities like $Y_{{\mathtt{B}},1}$) without adversely affecting the key rate for a fixed finite $s_{\mathtt{X}}$. The reason is that $\operatorname{Width}(\{a_{1n}/p_{\mu_{n}}\}_{n=1}^{k}\})$, $\operatorname{Width}(\{a_{2n}/p_{\mu_{n}}\}_{n=1}^{k}\})$ and $\operatorname{Width}(\{b_{n}/p_{\mu_{n}}\}_{n=1}^{k}\})$ diverge as $k\to+\infty$ due to divergence of $a_{1n}$, $a_{2n}$ and $b_{n}$ Chau (2018a) as well as the decrease in $\min\{p_{\mu_{n}}\}_{n=1}^{k}$. Recall that computing $a_{1n}$, $a_{2n}$ and $b_{n}$ is numerically stable and with minimal lost in precision if $\mu_{n}-\mu_{n+1}\gtrsim 0.1$ for $n=1,2,\dots,k-1$ Chau (2018a). This means the number of photon intensities $k$ used in practice should be $\lesssim 10$.

VI Performance Analysis

We study the following quantum channel, which models a commonly used 100 km long optical fiber in QKD experiments, to test the performance of this new key rate formula in realistic situation. The findings here are generic as the general trend and performance improvement are also found in other situations including using the same fiber of different lengths as well as other randomly generated quantum channels. The yield and error rate of that quantum channel is given by $Q_{{\mathtt{B}},\mu}=(1+p_{\text{ap}})d_{\mu}$ and $Q_{{\mathtt{B}},\mu}E_{{\mathtt{B}},\mu}=p_{\text{dc}}+e_{\text{mis}}[1-\exp(-\eta_{\text{ch}}\mu)]+p_{\text{ap}}d_{\mu}/2$, where $d_{\mu}=1-(1-2p_{\text{dc}})\exp(-\eta_{\text{sys}}\mu)$. Here we fix after pulse probability $p_{\text{ap}}=4\times 10^{-2}$, dark count probability $p_{\text{dc}}=6\times 10^{-7}$, error rate of the optical system $e_{\text{mis}}=5\times 10^{-3}$. In addition, the transmittance of the system $\eta_{\text{sys}}=0.1\eta_{\text{ch}}$, and the transmittance of the fiber is given by $\eta_{\text{ch}}=10^{-0.2L/10}$ with $L$ is the length of the fiber in km. These parameters are obtained from optical fiber experiment on a 100 km long fiber in Ref. Walenta et al. (2012); and have been used in Refs. Lim et al. (2014); Chau (2018a) to study the performance of decoy-state QKD in the FRKL situation. We also follow Refs. Lim et al. (2014); Chau (2018a) by using the following security parameters: $\epsilon_{\text{cor}}=\kappa=10^{-15}$, where $\epsilon_{\text{sec}}=\kappa\ell_{\text{final}}$ with $\ell_{\text{final}}\approx Rs_{\mathtt{X}}/(p_{\mathtt{X}}^{2}\langle Q_{{\mathtt{X}},\mu}\rangle)$ is the length of the final key measured in bits. Note that $\kappa$ can be interpreted as the secrecy leakage per final secret bit.

Table 1 compares the optimized key rates for the state-of-the-art method reported recently Eq. (3) of Ref. Chau (2018a) with Eq. (27) for various $s_{\mathtt{X}}$ and $k$. (This is the best provably secure key rate obtained before the posting of the original proposal using McDiarmid inequality by one of us in Ref. Chau (2018b).) The optimized rates are found by fixing the minimum photon intensity to $1\times 10^{-6}$, while maximizing over $p_{\mathtt{X}}$ as well as all other photon intensities $\mu_{n}$’s and all the $p_{\mu_{n}}$’s. This optimization is done by Monte Carlo method plus simulated annealing with a sample size of at least $10^{10}$ for each data entry in Table 1. For Method D, the optimized key rate depends on the actual ${\mathtt{Z}}$-basis measurement results. Here we simply fix $n^{(i)}$’s to their expectation values.

The table clearly shows that using McDiarmid inequality improves the optimized key rates in almost all cases. It also shows that for any method used, the provably secure key rate increases as the raw key length $s_{\mathtt{X}}$ increases. And they all gradually converge to the same infinite-size key rate. Besides, the asymptotic key rate generally increases with $k$. These are natural as longer $s_{\mathtt{X}}$ implies smaller finite-size statistical fluctuation and larger number of decoys $k$ used allows better estimation of the bounds of various $Y_{{\mathtt{B}},m}$’s and $Y_{{\mathtt{B}},1}e_{{\mathtt{B}},1}$’s.

Among the four methods introduced here, Method A almost always gives the least provably secure key rate. This implies that it is more effective to estimate a lower bound for $Y_{{\mathtt{Z}},1}$ via estimating an upper bound for $Y_{{\mathtt{Z}},1}e_{{\mathtt{Z}},1}$ plus a lower bound for $Y_{{\mathtt{Z}},1}\bar{e}_{{\mathtt{Z}},1}$. Method B is slightly better than Method C for large $s_{\mathtt{X}}$ (say when $\gtrsim 10^{8}$, the improvement is about a few percent). Method D is about 5-15% or so better than Method C when $10^{8}\lesssim s_{\mathtt{X}}\lesssim 10^{11}$. This is not unexpected for the following reason. Although Method D is more aggressive than Method C in estimating the statistical fluctuation of $e_{{\mathtt{Z}},1}$ and hence the key rate, it requires an additional condition for lower-bounding $\langle w\rangle$. Thus the value of $\chi$ for Method D is 1 greater than that of Method C. As a result, for small raw key length, the improvement in estimating $e_{{\mathtt{Z}},1}$ for Method D may not be able to compensate the need to control the statistical fluctuation of one more variable. Table 1 also depicts that Method D is about $5-20\%$ better than Method B when $10^{8}\lesssim s_{\mathtt{X}}\lesssim 10^{11}$. Furthermore, for fixed $s_{\mathtt{Z}}$ and $\kappa$ and a fixed method to compute bound for $e_{{\mathtt{Z}},1}$, the provably secure key rate reaches a maximum at a finite $k$. This is not unexpected because even though the $\chi$ we deduce is independent of the number photon intensities $k$ used, $\operatorname{Width}({\mathcal{W}})$ diverges as $k\to+\infty$. Last but not least, in the case of $k=4$, Method D always gives the best key rate. We do not have a good answer to this observation. It is instructive to study why in future.

VII Summary And Outlook

To summarize, for $s_{\mathtt{X}}\approx 10^{5}-10^{6}$, at least one of the four methods reported here could produce a provably secure key rate that is at least twice that of the state-of-the-art method. And for $s_{\mathtt{X}}\approx 10^{8}$, Method D is at least 40% better than the state-of-the-art method. These improvements are of great value in practical QKD because the computational and time costs for classical post-processing can be quite high when the raw key length $s_{\mathtt{X}}$ is long. More importantly, the McDiarmid inequality method reported here is effective to increase the key rate of real or close to real time on demand generation of the secret key — an application that is possible in near future with the advancement of laser technology. It is instructive to extend our McDiarmid inequality method to handle the case of FRKL decoy-state measurement-device-independent QKD and compare it with existing methods in literature, such as the one that uses the Chernoff bound Zhou et al. (2016) and its extension specifically for decoys with four different intensities Mao et al. (2018).

In addition to QKD, powerful concentration inequalities in statistics such as McDiarmid inequality could also be used beyond straightforward statistical data analysis. One possibility is to use it to construct model independent test for physics experiments that involve a large number of parameters but with relatively few data points.

Acknowledgements.

This work is supported by the RGC grants 17304716 and 17302019 of the Hong Kong SAR Government. We would like to thank K.-B. Luk for his discussion on potential applications of McDiarmid inequality in physics.