Beating the repeaterless bound with adaptive measurement-device-independent quantum key distribution

TL;DR

This paper analyzes the robustness of a quantum key distribution protocol that surpasses the repeaterless bound, focusing on the impact of source imperfections and identifying conditions sources must meet to maintain this advantage.

Contribution

It derives necessary conditions on photon-number statistics for sources to beat the repeaterless bound and shows that certain practical sources like parametric down-conversion cannot achieve this.

Findings

Parametric down-conversion sources do not meet the necessary conditions.

The protocol's robustness depends on specific photon-number statistics.

Idealized devices are required to surpass the repeaterless bound.

Abstract

Surpassing the repeaterless bound is a crucial task on the way towards realizing long-distance quantum key distribution. In this paper, we focus on the protocol proposed by Azuma et al. in [Nature Communications 6, 10171 (2015)], which can beat this bound with idealized devices. We investigate the robustness of this protocol against imperfections in realistic setups, particularly the multiple-photon pair components emitted by practical entanglement sources. In doing so, we derive necessary conditions on the photon-number statistics of the sources in order to beat the repeaterless bound. We show, for instance, that parametric down-conversion sources do not satisfy the required conditions and thus cannot be used to outperform this bound.

Equations

$$R=p_{\mathrm{Z}}^2{p}_{\mathrm{s}}{p}_{\mathrm{BSM}}[1-fh(e_{\mathrm{Z}})-h(e_{\mathrm{X}})],$$

$$|\psi ⟩=\sum _{n=0}^{\infty }\sqrt{p_n}|{\varphi }_n⟩,$$

$$|{\varphi }_n⟩=\frac{1}{n!\sqrt{n+1}}(x_H^{†}{y}_H^{†}+x_V^{†}{y}_V^{†}{)}^n|0⟩,$$

$$p_n=\frac{(n+1){\lambda }^n}{(1+\lambda {)}^{n+2}},$$

$${\Pi }_k=\sum _{n=k}^{\infty }\left(\genfrac{}{}{0ex}{}{n}{k}\right){\eta }_{\det }^k(1-{\eta }_{\det }{)}^{n-k}|n⟩⟨n|,$$

$$\begin{gathered} \left[\begin{array}{c}{y}_H^{†}\\ y_V^{†}\end{array}\right]=\frac{1}{\sqrt{2}}\left[\begin{array}{cc}1& 1\\ 1& -1\end{array}\right] \\ \left[\begin{array}{c}{x}_H^{†}\\ x_V^{†}\end{array}\right], \end{gathered}$$

$${\eta }_{\mathrm{ch}}=\exp \left[-\frac{L}{2L_{\mathrm{att}}}\right],$$

$$R_{[{\eta }_{\det }=1,\tau =0]}=\frac{3p_1{q}_1^2{\eta }_{\mathrm{ch}}^2}{8q_2+4(3q_1-2q_2){\eta }_{\mathrm{ch}}},$$

$$q_2\le \min \left(\frac{25}{96}{p}_1{q}_1^2,1-q_1\right),$$

$$-{\log }_2(1-{\eta }_{\mathrm{ch}}^2)=\sum _{n=1}^{\infty }\frac{{\eta }_{\mathrm{ch}}^{2n}}{n\ln 2}\ge 1.44{\eta }_{\mathrm{ch}}^2.$$

$$R_{[{\eta }_{\det }=1,\tau =0]}=\frac{3p_1{q}_1^2{\eta }_{\mathrm{ch}}^2}{8q_2+4(3q_1-2q_2){\eta }_{\mathrm{ch}}}\le \frac{3p_1{q}_1^2{\eta }_{\mathrm{ch}}^2}{12q_1}$$

$$=\frac{p_1{q}_1{\eta }_{\mathrm{ch}}^2}{4}\le \frac{{\eta }_{\mathrm{ch}}^2}{4}\le 1.44{\eta }_{\mathrm{ch}}^2.$$

$$R_{[{\eta }_{\det }=1,\tau =0]}=\frac{3p_1{q}_1^2{\eta }_{\mathrm{ch}}^2}{8q_2+4(3q_1-2q_2){\eta }_{\mathrm{ch}}}\le \frac{3p_1{q}_1^2{\eta }_{\mathrm{ch}}^2}{8q_2}.$$

$$\frac{3p_1{q}_1^2{\eta }_{\mathrm{ch}}^2}{8q_2}\ge 1.44{\eta }_{\mathrm{ch}}^2,$$

$$q_2\le \frac{25p_1{q}_1^2}{96}.$$

$$q_2\le 1-q_1.$$

$$p_n^{\mathrm{PDC}}=\frac{(n+1){\lambda }^n}{(1+\lambda {)}^{n+2}}\mathrm{and}{\text{q}}_m^{\mathrm{PDC}}=\frac{(m+1){\mu }^m}{(1+\mu {)}^{m+2}},$$

$$\frac{\lambda }{(1+\lambda {)}^3(1+\mu {)}^2}\ge \frac{36}{25}$$

$$\frac{\lambda }{(1+\lambda {)}^3(1+\mu {)}^2}\le \frac{4}{27},$$

$$|{\varphi }_2^{\prime }⟩=2\sqrt{3}|{\varphi }_2⟩=(b_H^{†}{e}_H^{†}+b_V^{†}{e}_V^{†}{)}^2|0⟩$$

$$=\left[(b_H^{†}{)}^2(e_H^{†}{)}^2+(b_V^{†}{)}^2(e_V^{†}{)}^2+2b_H^{†}{b}_V^{†}{e}_H^{†}{e}_V^{†}\right]|0⟩.$$

$$c_H^{†}{d}_V^{†}=\frac{1}{2}\left(a_H^{†}{a}_V^{†}+a_V^{†}{b}_H^{†}-a_H^{†}{b}_V^{†}-b_H^{†}{b}_V^{†}\right),$$

$$c_H^{†}{c}_V^{†}=\frac{1}{2}\left(a_H^{†}{a}_V^{†}+a_V^{†}{b}_H^{†}+a_H^{†}{b}_V^{†}+b_H^{†}{b}_V^{†}\right),$$

$$c_V^{†}{d}_H^{†}=\frac{1}{2}\left(a_H^{†}{a}_V^{†}-a_V^{†}{b}_H^{†}+a_H^{†}{b}_V^{†}-b_H^{†}{b}_V^{†}\right),$$

$$d_H^{†}{d}_V^{†}=\frac{1}{2}\left(a_H^{†}{a}_V^{†}-a_V^{†}{b}_H^{†}-a_H^{†}{b}_V^{†}+b_H^{†}{b}_V^{†}\right),$$

$$g_H^{†}{g}_V^{†}$$

$$-\frac{(f_V^{†}{)}^2}{4},$$

$$g_H^{†}{h}_V^{†}$$

$$+\frac{(f_V^{†}{)}^2}{4},$$

$$h_V^{†}{h}_H^{†}$$

$$-\frac{(f_V^{†}{)}^2}{4},$$

$$g_V^{†}{h}_H^{†}$$

$$+\frac{(f_V^{†}{)}^2}{4},$$

$$R=p_{\mathrm{s}}{p}_{\mathrm{BSM}}\left[1-h(e_{\mathrm{Z}})-h(e_{\mathrm{X}})\right],$$

$$p_{\mathrm{s}}=8p_{\mathrm{QND}}.$$

Full text

I Introduction

Quantum key distribution (QKD) protocols can provide two distant parties (Alice and Bob) with information-theoretically secure secret keys GisinReview ; NorbertReview ; MarcosReview . However, in point-to-point QKD via pure-loss bosonic channels, the achievable secret key rate is fundamentally limited by the so-called repeaterless bound TGW ; PLOB ; AnotherPaperOnBounds . In the limit of high channel loss (i.e., long distances) the repeaterless bound is proportional to the transmittance of the channel connecting Alice and Bob, denoted by $\eta$. This means that the secret key rate of any point-to-point QKD protocol scales at most with $\eta$. As in the case of optical fibers $\eta=e^{-L/L_{\rm{att}}}$, where $L$ is the distance between the parties and $L_{\rm{att}}$ is the attenuation length of the fiber, this poses a stringent limitation on the achievable secret key rate. Therefore, surpassing the repeaterless bound is an essential step towards efficient long-distance quantum communication.

A simple idea to outperform the repeaterless bound is to introduce intermediate nodes, dividing the channel into many smaller segments so that the probability of losing a signal stays relatively small on each segment. This naturally leads to the concept of quantum repeaters BriegelRepeater ; DuanRepeater ; HybridRepeater ; KokRepeater ; JiangRepeater ; SangouardRepeater ; KojiRepeater ; MunroRepeater ; KojiRepeater2 , which are typically based on entanglement swapping and distillation. However, to truly benefit from a quantum repeater, one needs many nodes and demanding technological resources, which makes the experimental realization very challenging with current technology RepeaterDifficult .

Another, recently proposed idea is twin-field QKD (TF-QKD) LucamariniTfQkd , which is based on single-photon interference and includes one intermediate node performing such conceptually simple interferometric measurement. Indeed, this offers a square root improvement in the scaling of the secret key rate. This proposal has triggered a lot of attention in the field and various simple security proofs and improved versions of the original protocol have been very recently introduced MarcosTf ; CuiTF ; JieTF ; kiyoshiTF ; MaTF ; WangTF ; YinTF . Proof-of-principle experiments to show the feasibility of some of the suggested TF-type QKD protocols have already been demonstrated experimentally ProofOfPrincipleTF ; ToshibaExpTF ; PanTF ; WangTFExp , which may suggest the viability of this approach to achieve intercity QKD with current technology.

The same square root improved scaling can be achieved if one extends the original measurement-device-independent QKD (MDI-QKD) mdi protocol, based on two-photon interference, with some feedback mechanism to make sure that the Bell state measurement (BSM) is performed between signals that actually survived the channel loss. One way is to make use of quantum memories luong ; abruzzo ; panayi , but the required memory parameters are still challenging for current technology posterQCrypt . To avoid the need for quantum memories while having the same square root improved scaling, Azuma et al. proposed the idea of a fully optical, adaptive MDI-QKD koji (AMDI-QKD) protocol, using standard optical teleportation for performing a quantum non-demolition measurement (QND) qnd to confirm the arrival of the single-photon signals at the middle node. While the required technology to implement the AMDI-QKD protocol is far off our current experimental capabilities, this protocol could offer higher secret key rates than the TF-QKD protocol, because the former is based on two-photon interference at the middle node while the latter is based on single-photon interference HadamardOperation .

The original AMDI-QKD scheme koji assumes highly idealized devices, like, for instance, perfect entanglement sources, which are capable of generating a perfect EPR pair on demand for the teleportation in the QND measurement, and perfect single-photon sources. In this paper, we investigate the robustness of this protocol against source imperfections, like for example a non-vanishing probability of emitting multiple-photon signals and thus introducing extra noise into the system. By performing a full-mode analysis of a realistic setup we derive a necessary condition on the photon-number statistics of the sources for overcoming the repeaterless bound in PLOB .

In doing so, we also show, for example, that with parametric down-conversion (PDC) sources, the AMDI-QKD protocol has a scaling of at most $\eta$, therefore unable to beat the repeaterless bound. This is due to the fact that PDC sources have a too large probability of emitting multiple-photon pairs compared to the probability of emitting single-photon pairs.

We note that a similar behavior has also been observed in the context of the ensemble-based quantum memory assisted MDI-QKD mohsen protocol. Ensemble-based quantum memories have many favorable properties, but they inherently suffer from a non-negligible probability of emitting multiple-photons (similar to that of the PDC sources) causing the advantageous scaling offered by a traditional memory assisted system luong ; abruzzo ; panayi to vanish. In this regard, we remark that our result is stronger than that introduced in mohsen in the sense that it applies even with photon-number resolving (PNR) detectors, while mohsen assumes threshold detectors.

The paper is organised as follows. In Sec. II, the investigated protocol is introduced and its secret key rate formula is presented. Sec. III describes mathematically the physical devices used for the implementation of the protocol. Next, in Sec. IV we present the main results of the paper. Here, we obtain necessary conditions on the applied entanglement sources for overcoming the repeaterless bound PLOB with the AMDI-QKD protocol. As a corollary, we prove that the protocol is not capable of beating the repeaterless bound PLOB using PDC sources. Lastly, Sec. V contains the conclusions of the paper. The paper also includes two appendices for providing the details of the calculations.

II The AMDI-QKD protocol

II.1 Protocol steps

The schematic layout of the AMDI-QKD protocol koji can be seen in Fig. 1. The protocol runs as follows:

Each of Alice and Bob generates $m$ signals with their on-demand entanglement sources $S_{\rm{AC}}$ and $S_{\rm{BC}}$, respectively. One mode of each signal is sent to Charlie’s QND measurement simultaneously via the quantum channel, using a multiplexing technique (e.g. wavelength based). The other mode is kept by Alice and Bob and they measure it in the $Z$ or $X$ basis, which they choose with probabilities $p_{\rm{Z}}$ and $p_{\rm{X}}=1-p_{\rm{Z}}$, respectively. 2. 2.

Charlie applies QND measurements to the incoming pulses to confirm the arrival of the signals coming from Alice and Bob. 3. 3.

Charlie pairs the successfully arriving signals via optical switches and performs BSMs between signals coming from the different parties. To be more precise, if there are, say $n_{\rm{A}}$ ($n_{\rm{B}}$) successfully arriving signals from Alice (Bob), then Charlie performs $\min(n_{\rm{A}},n_{\rm{B}})$ BSMs. 4. 4.

Charlie announces to Alice and Bob which BSMs were successful, together with the measurement result obtained. Here the successful BSM is assumed to distinguish the Bell states ${\lvert\psi^{-}\rangle}=1/\sqrt{2}({\lvert HV\rangle}-{\lvert VH\rangle})$ and ${\lvert\phi^{-}\rangle}=1/\sqrt{2}({\lvert HH\rangle}-{\lvert VV\rangle})$ from the others, as we consider (see Fig. 3 in Sec. III) a standard linear-optics implementation of the BSMs. Here $H$ ($V$) represents a horizontally (vertically) polarized single-photon state. 5. 5.

For key generation, Alice and Bob post-select the events by communicating over an authenticated classical channel where they used the $Z$-basis to measure their modes in step 1 (and in which they both had a successful photon detection) and also the corresponding BSM was successful. To make sure that their key bits are identical, they apply a bit flip procedure mdi . To be precise, Alice or Bob flips her or his bits, except for the cases when they chose the $Z$ basis and Charlie’s BSM outcome was the state ${\lvert\phi^{-}\rangle}=1/\sqrt{2}({\lvert HH\rangle}-{\lvert VV\rangle})$.

II.2 Secret key rate formula

The secret key rate formula for the protocol above has been derived in koji when the number of multiplexing $m$ tends to infinity. It reads:

[TABLE]

where $p_{\rm{s}}$ is the probability that Charlie’s QND and the $Z$ measurements are both successful either at Alice’s or Bob’s site. The quantity $p_{\rm{BSM}}$ represents the success probability of one BSM. The quantities $e_{\rm{Z}}$ and $e_{\rm{X}}$, on the other hand denote the bit and phase error rates, respectively. The parameter $f$ is an inefficiency function for the error correction process and $h(x)=-x\log_{2}(x)-(1-x)\log_{2}(1-x)$ is the binary entropy function. We remark that the fact that in Eq. (1) only $p_{\rm{s}}$ rather than the square of it appears is due to the advantage that the original AMDI-QKD protocol offers, that is, BSMs are only performed between signals that survived the channel loss. Therefore, a particular signal only needs to survive travelling through one path koji .

We also note that since we evaluate the secret key rate in the asymptotic regime where $m\rightarrow\infty$, the parties perform steps 1-5 of the protocol only once. Also, for simplicity, we assume that $p_{\rm{Z}}\gg p_{\rm{X}}$, so that we take $p_{\rm{Z}}^{2}\approx 1$ in Eq. (1) for the simulations below. Moreover, we assume for simplicity that $f=1$.

The full-mode analysis of the AMDI-QKD protocol described above can be found in Appendix B, based on Eq. (1) and the device models described in the next section.

III Device models

Here, we describe the mathematical models that we use to characterise the behavior of the different devices employed to evaluate the performance of the AMDI-QKD protocol.

III.1 Photonic sources

We shall assume that all entanglement sources emit states of the following form:

[TABLE]

where $\sum_{n=0}^{\infty}p_{n}=1$ and $p_{n}\geq 0$. The $n$-photon pair states ${\lvert\phi_{n}\rangle}$ are given by

[TABLE]

where $x_{H}^{\dagger}$ and $y_{H}^{\dagger}$ ($x_{V}^{\dagger}$ and $y_{V}^{\dagger}$) are the creation operators of horizontally (vertically) polarized photons in the modes $x$ and $y$, respectively and ${\lvert 0\rangle}$ denotes the vacuum state.

We note that if we choose $p_{1}=1$ (i.e., $p_{n}=0$ for any $n\neq 1$) then Eq. (2) represents a perfect entanglement source that is capable of emitting maximally entangled states ${\lvert\phi_{1}\rangle}$ with certainty. Another interesting special case is when

[TABLE]

holds, in which case Eq. (2) describes a type-II PDC source PDC with $\lambda$ being a positive parameter, related to the amplitude of the pumping laser.

III.2 Detectors

We shall assume that all the detectors are PNR detectors, characterized by the following positive operator-valued measure (POVM) elements

[TABLE]

with $k=0,1,\cdots,\infty$ denoting the number of detected photons. In Eq. (5), the parameter $\eta_{\rm{det}}$ is the detection efficiency of the detectors and ${\lvert n\rangle}$ is the $n$-photon Fock state. We note that for simplicity in Eq. (5) we have disregarded the dark count probability of the PNR detectors.

III.3 QND measurement

A linear-optics teleportation-based implementation of the QND measurement can be seen in Fig. 2. It consists of a standard linear-optics BSM module together with an entanglement source $S^{\rm{QND}}$ that emits the state described in Eq. (2). The purpose of the QND measurement module is to herald if a photon successfully arrived at Charlie’s node, so that, in this case, he can continue the protocol with performing his BSMs. The successful heralding events are constituted by the same detection patterns as in the original MDI-QKD protocol mdi , that is, a successful heralding event occurs if the detectors detect exactly one photon in horizontal polarization and one photon in vertical polarization. The setup is based on quantum teleportation. Indeed, in the case of a single-photon input and $S^{\rm{QND}}$ being a perfect EPR source with $p_{1}=1$, the QND module teleports its input mode to its output mode teleportation . We note that there exist more efficient implementations of a BSM GriceBSM ; ewertBSM in terms of the success probability (which can approach $1$ instead of $1/2$ as in the scheme shown in Fig. 2), but they come with the overhead of the need for complicated ancilla states.

III.4 Optical switches

Charlie directs the successfully arriving signals into his BSMs with the help of optical switches. For this, an active feedforward mechanism is required since it takes time to align the ports of the switches properly, so that successful signals from Alice and Bob end up in the same BSM at Charlie’s site. It is assumed that one active feedforward takes time $\tau$, during which signals propagate in optical fibers. Therefore, the feedforward procedure can be modelled as a lossy channel with transmittance $\eta_{\rm{f}}=\exp(-\tau c/L_{\rm{att}})$ due to the propagation of the signals through the fibers, where $c$ denotes the speed of light in the optical fiber. Otherwise, we assume perfect switching devices with unlimited number of entries.

III.5 BSM modules after the switches

In this case, the linear-optics implementation of the middle BSM modules is depicted in Fig. 3. Similarly to the QND module, the success events are constituted by the same detection patterns as in the original MDI-QKD protocol mdi . Note, however, that this middle BSM module differs from the one used in the QND measurement. Here, Hadamard gates (denoted in Fig. 3 by H) are applied HadamardOperation , whose operation can be described as

[TABLE]

where $y_{H}^{\dagger}$ ($y_{V}^{\dagger}$) and $x_{H}^{\dagger}$ ($x_{V}^{\dagger}$) are the creation operators of the input and output modes of the Hadamard gate in horizontal (vertical) polarization.

Including the Hadamard gates is advantageous, since they can prevent errors that can occur otherwise. For example, when the source $S^{\rm{QND}}$ emits a two-photon pair state and the input of the QND module is the vacuum state, a successful heralding event can still occur, despite of the fact that the signal coming from the corresponding party was lost. In this scenario, it can be shown (see Appendix A) that the output state of the QND measurement, heading towards the middle BSM, is a two photon signal consisting of one vertically and one horizontally polarized photon. Now, without the Hadamard gates, this state could give a successful detection event at the middle BSM, which is undesired since there was no signal received from the party connected to the seemingly successful QND measurement. Intuitively, one expects that adding the Hadamard gates, i.e., rotating the signal, will just decrease the chance of the two photons ending up in detectors corresponding to different polarizations. This is so because, after the rotation, it is not predetermined any more which detector they hit after the polarizing beam splitter, and it rather becomes a probabilistic process. However, carrying out the calculation shows (see Appendix A) that, in fact, the Hadamard gates force the spurious two photon signal to give non-conclusive detection events at the final BSM, which is the best possible scenario.

III.6 Quantum channel

For concreteness, we assume that the quantum channel connecting Alice (Bob) to Charlie is an optical fiber with attenuation length $L_{\rm{att}}$ and transmittance

[TABLE]

where $L$ is the distance between Alice and Bob, and $L_{\rm{att}}=10\,\textrm{dB}/(\alpha\log 10)$, where $\log$ denotes the natural logarithm and $\alpha$ is the loss coefficient of the channel measured in dB/km. For simplicity, we do not consider any misalignment effect in our system.

Using the above devices, we can summarize the differences between the AMDI-QKD scheme considered in this paper and the original proposal. In particular, here we have replaced both the perfect entanglement source for the QND measurement and the perfect single-photon sources of Alice and Bob in the original AMDI-QKD koji by more realistic entanglement sources, described by Eq. (2), which have non-zero probability of emitting multiple-photon signals in general. Note that the single-photon sources possessed by Alice and Bob are achieved in our scheme by measuring one mode of their entanglement sources. Another modification is to change all the threshold detectors, which were in the BSM and the QND measurement, to PNR detectors. Apart from these, the protocol, of course, runs in a similar manner as in the original proposal koji , described in Sec. II.1.

IV Necessary conditions

In this section, we first derive a simple but non-trivial analytical necessary condition on the photon-number statistics of the sources for the AMDI-QKD protocol to be able to beat the repeaterless bound reported in PLOB , which is given by the formula $-\log_{2}(1-\eta_{\rm{ch}}^{2})$. For this, we use the fact that, if one cannot beat the bound with $\eta_{\rm{det}}=1$ and $\tau=0\,\rm{s}$, then it is also impossible to beat it with $\eta_{\rm{det}}<1$ and $\tau>0\,\rm{s}$, since the secret key rate cannot increase with lower efficiency detectors. Thus, we can construct the necessary condition by requiring that the bound in PLOB is overcome when we set $\eta_{\rm{det}}=1$ and $\tau=0\,\rm{s}$, which significantly simplifies the secret key rate formula, making the derivation of an analytical result possible. With this simple necessary condition, it is already possible to show that PDC sources cannot beat the repeaterless bound with the AMDI-QKD protocol.

Afterwards, we consider the general case where $\eta_{\rm{det}}<1$ and $\tau>0\,\rm{s}$. In this scenario we can only obtain the condition on the sources to beat the repeaterless bound by numerically evaluating the secret key rate formula, given by Eq. (1). The required formulas to evaluate Eq. (1) can be found in Appendix B.

By comparing the two results, we see that the finite detection efficiency of the detectors has a significant impact on the required photon-number statistics of the sources. To be precise, when the detection efficiency of the detectors decreases, then the requirements on the maximum values of the multi-photon probabilities of the sources become more severe.

IV.1 Simple analytical necessary condition

When we set $\eta_{\rm{det}}=1$ and $\tau=0\,\rm{s}$, we find that the secret key rate formula can be written as (for the details of the calculation see Appendix B):

[TABLE]

where the $p_{n}$ ($q_{m}$) values represent the photon-number statistics of the sources $S_{\rm{AC}}$ and $S_{\rm{BC}}$ ($S^{\rm{QND}}$). We remark that we can choose the values of $p_{n}$ to be equal for the sources $S_{\rm{AC}}$ and $S_{\rm{BC}}$ because Charlie is located halfway between them, and such selection is optimal in this scenario. Importantly, we note that in Eq. (8) only the probabilities $p_{1}$, $q_{1}$ and $q_{2}$ appear. This is so because of the following. The appearance of $p_{1}$ and $q_{1}$ is the consequence of the fact that only single-photon pairs can give rise to true success events. Using unit efficiency detectors, the only possible way for multiple-photon pairs to cause a seemingly successful QND measurement is when the $S^{\rm{QND}}$ source emits the state ${\lvert\phi_{2}\rangle}$ and the signal from Alice (Bob) is lost during the transmission through the optical fiber, which explains the appearance of $q_{2}$.

From Eq. (8) we learn, that in the case of the use of detectors with unit efficiency, in the asymptotic limit of $L\rightarrow\infty$ (i.e., $\eta_{\rm{ch}}\rightarrow 0$), $R_{[\eta_{\rm{det}}=1,\,\tau=0]}\simeq 3\,p_{1}\,q_{1}^{2}/(8\,q_{2})\,\eta_{\rm{ch}}^{2}$, which means that choosing the parameters $p_{1}$, $q_{1}$ and $q_{2}$ properly, we can actually beat the repeaterless bound PLOB in this limit. The reason why the secret key rate never breaks down in the unit efficiency detector case is due to the fact that we have neglected dark counts and misalignment in the quantum channel.

Claim**.**

To beat the repeaterless bound PLOB with the AMDI-QKD protocol, using PNR detectors and entanglement sources $S_{\rm{AC}}$ and $S_{\rm{BC}}$ ($S^{\rm{QND}}$) of the form given by Eq. (2), with photon-number statistics $p_{n}$ ($q_{m}$), it is necessary that

[TABLE]

is fulfilled.

Proof.

Making use of the Taylor expansion, the following inequality trivially holds for the repeaterless bound, reported in PLOB :

[TABLE]

Then, for the necessary condition, we require that $R_{[\eta_{\rm{det}}=1,\,\tau=0]}$, given by Eq. (8), is greater than $1.44\,\eta_{\rm{ch}}^{2}$.

If $(3q_{1}-2q_{2})\leq 0$ holds for the sources, an upper bound can be given on $R_{[\eta_{\rm{det}}=1,\,\tau=0]}$ by plugging $\eta_{\rm{ch}}=1$ in the denominator of Eq. (8):

[TABLE]

Therefore, to be able to overcome the repeaterless bound PLOB , $(3q_{1}-2q_{2})>0$ must hold, which means that we can upper bound the secret key rate by plugging $\eta_{\rm{ch}}=0$ in the denominator of Eq. (8):

[TABLE]

For the necessary condition it is then required that

[TABLE]

holds, which can be simplified to

[TABLE]

This inequality is tighter than $(3q_{1}-2q_{2})>0$. Moreover, since $\sum_{m=0}^{\infty}q_{m}=1$, we have that

[TABLE]

Considering this validity condition, we obtain the simple necessary condition given by Eq. (9). ∎

The necessary condition, given by Eq. (9), is depicted in Fig. 4, where we plot the value of $q_{2}$, above which it is not possible to beat the bound PLOB , given the values of $p_{1}$ and $q_{1}$. We can see that the necessary condition is more sensitive to the value of $q_{1}$, than to the value of $p_{1}$ in the sense that if $q_{1}$ is too small then no matter how large we set $p_{1}$, we need to have $q_{2}=0$ (purple area in Fig. 4). However, in the converse situation, having $p_{1}$ small does not imply that $q_{2}=0$. One can also see this formally by noting that in Eq. (9) only $q_{1}$ appears squared. This is so, because, as explained before, even in the ideal efficiency detector case the source $S^{\rm{QND}}$ can cause errors by introducing two-photon pair signals. While the sources $S_{\rm{AC}}$ and $S_{\rm{BC}}$ cannot, since the detectors in the $Z$/$X$ measurement filter out all the two-photon pair signals.

Corollary**.**

Using PDC sources, it is impossible to beat the repeaterless bound PLOB with the AMDI-QKD protocol.

Proof.

The photon-number statistics of the PDC sources can be written as

[TABLE]

where, as already mentioned previously, $\lambda$ ($\mu$) is a positive parameter, related to the amplitude of the laser used to pump the sources $S_{\rm{AC}}$ and $S_{\rm{BC}}$ ($S^{\rm{QND}}$). We note that due to the symmetries of the setup, that is, Charlie is located halfway between Alice and Bob, we can set the $\lambda$ values for the sources $S_{\rm{AC}}$ and $S_{\rm{BC}}$ equal.

Plugging Eq. (16) into Eq. (9), we have that

[TABLE]

is necessary to overcome the repeaterless bound PLOB . However, since $(1+\mu)^{-2}<1$ and $\max\{\lambda\,(1+\lambda)^{-3}\}=4/27$ (the latter can be seen easily by taking the derivative with respect to $\lambda$), we have that

[TABLE]

which obviously contradicts Eq. (17), meaning that for PDC sources the necessary condition cannot be fulfilled. Therefore, it is impossible to overcome the repeaterless bound PLOB . ∎

IV.2 Tighter necessary condition

In this section, we now analyse the necessary condition without the assumption of $\eta_{\rm{det}}=1$ and $\tau=0\,\rm{s}$. For this, we numerically evaluate the general secret key rate formula derived in Appendix B.

For simplicity, however, in the simulations, we restrict ourselves to the case where every source emits at most two photon pairs, that is, we set $q_{n}=p_{n}=0$ for any $n\geq 3$. We remark, however, that, with the general secret key rate formula given in Appendix B, it is possible to allow for an arbitrary number of emitted photon pairs if one has sufficient computational power. The results can be seen in Fig. 5. We introduced the quantities $P\equiv p_{2}/p_{1}$ and $Q\equiv q_{2}/q_{1}$ to characterise the quality of the sources, lower values meaning higher quality sources since emitting two photon pairs is less likely than emitting the desired EPR pair, for given values of $p_{0}$ and $q_{0}$.

Let $Q^{\rm{max}}_{[\eta_{\rm{det}},\tau]}$ denote the maximally allowable value of $Q$ to be able to overcome the bound PLOB , as a function of $p_{0}$ and $P$, given the parameters $\eta_{\rm{det}}$ and $\tau$. In Fig. 5, we plot the quantity $Q^{\rm{max}}_{[\eta_{\rm{det}}<1,\,\tau=67\,\rm{ns}]}/Q^{\rm{max}}_{[\eta_{\rm{det}}=1,\,\tau=0\,\rm{ns}]}$ as a function of $p_{0}$ and $P$ for different values of $\eta_{\rm{det}}<1$, given the value of $q_{0}$. So that we can observe how does the $Q^{\rm{max}}$ value decreases for a given $p_{0}$ and $P$ if we have $\eta_{\rm{det}}<1$ and $\tau=67\,\rm{ns}$, compared to the $\eta_{\rm{det}}=1$ and $\tau=0\,\rm{ns}$ case. We set $\tau=67\,\rm{ns}$ as illustration, since this is the value used in the original implementation koji , based on the experiments reported in feedforward1 ; feedforward2 . Our simulations show that the value of $q_{0}$ does not influence significantly the order of magnitude tendencies observed while decreasing the detection efficiency of the detectors. Loosely speaking, varying the value of $q_{0}$ only translates the secret key rate curve vertically (i.e., the secret key rate basically decreases by a constant factor for all values of the channel loss) for given $P$ and $p_{0}$ values. This means that in the comparison, every curve for the different detection efficiencies will be translated by the same factor, therefore, for a different $q_{0}$ value, the $Q^{\rm{max}}$ values will also be altered by a common factor for each detection efficiency, and since we are plotting their quotients, it means that the plots on Fig. 5 will stay very similar.

First, let us examine the region of the plots where $P\approx 0$ (reddish areas in Fig. 5), which means that the sources of Alice and Bob are close to perfect entanglement sources. We see that decreasing the value of $\eta_{\rm{det}}$ from 1 to 0.9, 0.7 and 0.5 results in the need for about an order of magnitude higher quality sources at Charlie’s hand for each efficiency compared to the previous one. This is partly due to fact that eight detections are needed for obtaining a raw key bit (one in the $Z$/$X$ measurement of each Alice and Bob, two in the QND measurement at each side and two more in the BSM), therefore, now we have a factor of $\eta_{\rm{det}}^{8}<1$ in the probability of each key generation event, but this only translates the secret key rate curve vertically. On top of this, and what is more important, we now have an increased probability of obtaining erroneous key generation events from the two-photon pair component of the sources $S^{\rm{QND}}$. To see this, suppose that one of the sources $S^{\rm{QND}}$ on Alice’s side emits a two-photon pair signal and all the other sources emit one-photon pair signals, and suppose that the signal from Alice towards the QND measurement is lost in the transmission. In this case, as already mentioned previously, we can get a seemingly successful detection event if one photon out of the two going from the QND module towards the BSM is lost in the detection process of the BSM, which happens with a probability $1-\eta_{\rm{det}}$. Thus, the error rate will increase as we decrease the detection efficiency. The only way to compensate this error is to have better quality sources at Charlie’s hand (meaning lower $Q$ values).

Now, let us observe the part of the plots, where $P\approx 0.25$ (purplish areas in Fig. 5), meaning that Alice and Bob no longer have perfect entanglement sources. In this case, we find that the more we decrease the value of $\eta_{\rm{det}}$ the more the values of $Q^{\rm{max}}_{[\eta_{\rm{det}}<1,\,\tau=67\,\rm{ns}]}/Q^{\rm{max}}_{[\eta_{\rm{det}}=1,\,\tau=0\,\rm{ns}]}$ in the region of $P\approx 0.25$ will decrease compared to the values in the region of $P\approx 0$. In other words, in the $P\approx 0.25$ region the $Q^{\rm{max}}_{[\eta_{\rm{det}}<1,\,\tau=67\,\rm{ns}]}/Q^{\rm{max}}_{[\eta_{\rm{det}}=1,\,\tau=0\,\rm{ns}]}$ values do not decrease linearly with $\eta_{\rm{det}}$, which is more or less true in the $P\approx 0$ region. What has been said before for the region $P\approx 0$ is true for this region as well, but, on top of those effects, since $P>0$, the sources of Alice and Bob now have a non-zero probability of producing erroneous successful detections in the $Z$/$X$ measurements due to their two-photon pair component, which was not possible before in the $P\approx 0$ region. Consider the previously explained situation with the difference, that Alice’s source now emits a two-photon pair signal and both photons from Alice heading towards the QND module are lost in the transmission. In this case we can only get a seemingly successful raw key generation event if one photon out of the two in the $Z$/$X$ measurement at Alice’s site is lost in the detection, which occurs with a probability $1-\eta_{\rm{det}}$. Thus, the probability of this type of error scales with $(1-\eta_{\rm{det}})^{2}$ (the other $1-\eta_{\rm{det}}$ factor comes from the fact that in the scenario considered, we need to lose one more photon in the detection process of the BSM to have a seemingly successful raw key generation event), meaning that it does not depend linearly on the detection efficiency as in the $P\approx 0$ region, which explains the observed behaviour for the $P\approx 0.25$ region. From this, we can see that, as expected, $P$ has a more significant impact on the $Q^{\rm{max}}$ values than $p_{0}$, which, since increasing $p_{0}$ will not increase the probabilities of an error, just translates the secret key rate curve vertically. These are the main reasons behind this dramatic increase in the quality of Charlie’s sources as we decrease $\eta_{\rm{det}}$.

Summing up the observations from Fig. 5 we can say that the necessary quality of the sources can be much higher than what is expected from the unit detection efficiency condition if we have non-perfect detectors. We also note that using the formulas for the secret key rate from Appendix B, Fig. 5 can be easily made for arbitrary $0\leq q_{0}<1$ and $0<\eta_{\rm{det}}\leq 1$.

V Conclusion

We have investigated the performance of a more realistic implementation of the original AMDI-QKD protocol koji , assuming that the parties have access to a broad class of entanglement sources of the form given by Eq. (2) and photon-number resolving (PNR) detectors. We have shown that the improved $\eta_{\rm{ch}}$ scaling (with $\eta_{\rm{ch}}$ being the transmittance of the channel connecting Alice and Bob to Charlie), offered by the protocol, is very sensitive to multiple-photon pair components emitted by the sources.

More precisely, we have derived a simple non-trivial analytical necessary condition on the photon-number statistics of the entanglement sources to be able to overcome the repeaterless bound PLOB with the AMDI-QKD protocol. With this condition, we have demonstrated analytically that employing the widely available parametric down-conversion sources does not enable the protocol to beat the repeaterless bound. Furthermore, we have quantitatively investigated the effect that the finite detection efficiency of the detectors have on the required photon-number statistics of the sources. In this regard, we have shown that, when the detection efficiency of the detectors decreases, then the maximum tolerable values of the multi-photon probabilities of the sources in order to beat the repeaterless bound become significantly more severe. This latter study, however, was only feasible by numerically evaluating the secret key rate formula of the protocol.

Our results suggest, that, while the AMDI-QKD protocol could in principle overcome the repeaterless bound with idealized devices, in practice it demands very high quality entanglement sources, which are thus still challenging to realize with current technology, besides, of course, the involved multiplexing techniques depending on the channel length.

VI Acknowledgement

We thank the Spanish Ministry of Economy and Competitiveness (MINECO), the Fondo Europeo de Desarrollo Regional (FEDER) through the grant TEC2017-88243-R, and the European Union’s Horizon 2020 research and innovation programme under the Marie Sklodowska-Curie grant agreement No 675662 (project QCALL) for financial support. K.A. thanks support, in part, from PRESTO, JST JPMJPR1861.

Appendix A BSM with Hadamard gates

In this appendix we give an intuitive argument on the reason why the use of Hadamard gates is advantageous in the BSM after the optical switches. Suppose that the state used for key generation is ${\lvert\phi_{1}\rangle}$, given by Eq. (3). If every source emits this state and a successful detection pattern occurs, the parties share the desired quantum correlation to obtain their secret key (given that dark counts are neglected). However, if some of the sources emit multiple-photon pair states, for example the state ${\lvert\phi_{2}\rangle}$, also given by Eq. (3), this could result in a seemingly successful detection event, which does not provide the parties with the desired correlations and will end up producing errors. As we will show below, including the Hadamard gates in the BSM removes the possibility of getting errors from the state ${\lvert\phi_{2}\rangle}$.

Let us illustrate this with an example depicted in Fig. 6. In particular, let us consider the situation when $S_{\rm{AC}}$ emits the state ${\lvert\phi_{1}\rangle}$ and there is a correct detection in Alice’s $Z$/$X$ measurement but the photon in the other mode (mode $a$ in Fig. 6), going towards the QND measurement, is lost in the transmission. Moreover, suppose that the $S^{\rm{QND}}$ source on Alice’s side emits the ${\lvert\phi_{2}\rangle}$ state, which can cause a seemingly successful QND measurement on Alice’s side and also a seemingly successful BSM at Charlie’s site.

Furthermore, suppose that the sources $S_{\rm{BC}}$ and $S^{\rm{QND}}$ on Bob’s side both emit the ${\lvert\phi_{1}\rangle}$ state. Let us assume that these signals cause successful $Z$/$X$ and QND measurements on Bob’s side, but the photon in the other mode (mode $f$ in Fig. 6), going from the $S^{\rm{QND}}$ source towards Charlie’s BSM module, is lost, say during the feedforward mechanism. Therefore, in this example, there is no actual signal coming from Bob to the BSM. This way, if the Hadamard gates are not used, it is possible that the ${\lvert\phi_{2}\rangle}$ state coming from the $S^{\rm{QND}}$ source on Alice’s side will result in a seemingly successful BSM. Consequently, the parties would conclude that the protocol had run correctly and they can obtain a secret key bit, but in reality, they will get random outcomes instead of correlated ones. Next, we show that this cannot occur in the presence of the Hadamard gates.

For simplicity, instead of ${\lvert\phi_{2}\rangle}$, we assume that the source $S^{\rm{QND}}$ on Alice’s side emits the following unnormalised state

[TABLE]

The QND measurement is successful if there are exactly two, orthogonally polarized photons in the modes $c$ and $d$ (see Fig. 6):

[TABLE]

where we expressed the output modes $c$ and $d$ after the 50:50 BS in the QND measurement as a function of the input modes $a$ and $b$. As explained above, in the particular example considered, there is no photon in mode $a$. Therefore, a successful event could only be caused by the $b_{H}^{\dagger}b_{V}^{\dagger}$ component from Eq. (A). Comparing with ${\lvert\phi^{\prime}_{2}\rangle}$ in Eq. (A), we conclude, that if the QND measurement on Alice’s side succeeded, then the state in mode $e$ has to be characterised by $e_{H}^{\dagger}e_{V}^{\dagger}$.

As explained previously, there is no photon in mode $f$ (coming from Bob). This means that, since there is one horizontally and one vertically polarized photon incident on the 50:50 BS in the BSM (mode $e$), a successful detection pattern in the BSM is easily produced, if there are no Hadamard gates.

Now, let us consider what happens with the Hadamard gates. Similarly to the QND measurement, the BSM is successful if there are exactly two, orthogonally polarized photons in the modes $g$ and $h$:

[TABLE]

[TABLE]

[TABLE]

[TABLE]

where we expressed the modes $g$ and $h$ after the Hadamard gates as a function of the input modes $e$ and $f$. In doing so, we used the matrices describing the quantum optical operation of the BS and the Hadamard gate. It is clear that in this example, the state $e_{H}^{\dagger}e_{V}^{\dagger}$, which we have after the seemingly successful QND measurement, cannot cause a successful BSM, since in Eqs. (A)-(A) there is no component that contains $e_{H}^{\dagger}e_{V}^{\dagger}$. Therefore, the error that was possible before is now filtered out by the Hadamard gates.

Appendix B Full-mode analysis

B.1 Rephrasing the secret key rate formula

The secret key rate formula, given by Eq. (1), can be written as koji

[TABLE]

where we have set $f=1$. Also, as explained in the main text, we assume that $p_{Z}\approx 1$ since we consider the asymptotic scenario. We remind the reader that $p_{\rm{s}}$ is the probability that Charlie’s QND and the $Z$/$X$ measurements are both successful either at Alice’s or Bob’s site. The quantity $p_{\rm{BSM}}$ represents the success probability of one BSM. We note that since the $Z$-basis is used for the key generation the above quantities are defined in the case when Alice and Bob choose the $Z$-basis. We also note that the probabilities $p_{\rm{s}}$ and $p_{\rm{BSM}}$ by definition include all the possible detection patterns that constitute that particular success event.

However, due to the symmetries of the channel model, for our simulations, it is not necessary to calculate the probabilities of all the detection patterns that constitute a certain event, which would be rather tedious and redundant. Thus, in the remainder of this section, we are going to relate the quantities $p_{\rm{s}}$, $p_{\rm{BSM}}$, $e_{\rm{Z}}$ and $e_{\rm{X}}$ to the probabilities of some particular detection patterns, relying on the symmetries of the channel model.

First, let $p_{\rm{QND}}$ denote the probability that there is exactly one photon detected in each of the detectors $D_{\rm{2H}}$, $D_{\rm{2V}}$ and $D_{\rm{3H}}$ and zero photons detected in the other detectors $D_{\rm{1H}}$, $D_{\rm{1V}}$ and $D_{\rm{3V}}$ in Fig. 7. Note that this means a successful QND measurement and simultaneously a successful $Z$ measurement on Alice’s side, where she obtained the horizontal ($H$) polarization, and therefore this particular detection pattern represents one of the patterns that constitute $p_{\rm{s}}$. A successful QND measurement can be realized by four different detection patterns (observing altogether two photons in the QND module, one in $H$ polarization and one in $V$ polarization, i.e., if $D_{\rm{1H}}$ and $D_{\rm{2V}}$, or $D_{\rm{1V}}$ and $D_{\rm{2H}}$, or $D_{\rm{1H}}$ and $D_{\rm{1V}}$, or $D_{\rm{2H}}$ and $D_{\rm{2V}}$ in Fig. 7 detect one photon each). The $Z$ measurement can be realized by two different detection patterns (one photon detected in either $D_{\rm{3H}}$ or $D_{\rm{3V}}$ in Fig. 7). Altogether, this means eight different possibilities. Note that these eight detection patterns all have the same probability due to the symmetries of the channel model considered. Moreover, $p_{\rm{QND}}$ is also independent of the basis choice of Alice. Therefore, we can write that

[TABLE]

Now, let us also express $p_{\rm{BSM}}$ with probabilities corresponding to particular detection patterns. For this, first, let $p_{\rm{c}}^{\rm{Z}}$ (correct) denote the probability of the following particular detection pattern given that the parties choose to measure their local modes in the $Z$-basis. Suppose that Charlie’s QND and the $Z$ measurement were successful on both Alice’s and Bob’s side with the particular detection pattern described before for $p_{\rm{QND}}$ (i.e., both parties detected $H$ polarization) and then in the BSM after the optical switches there is exactly one photon detected in each of the detectors $D_{\rm{2H}}$ and $D_{\rm{2V}}$ and zero photons detected in the other detectors $D_{\rm{1H}}$ and $D_{\rm{1V}}$ in Fig. 8. Note, that this detection pattern corresponds to a projection into the Bell state ${\lvert\phi^{-}\rangle}$, which means that the parties will not apply bit flip, this way obtaining correlated (correct) raw key bits. The success probability of the BSM alone, corresponding to the above described particular detection pattern can be written as $p_{\rm{c}}^{\rm{Z}}/p_{\rm{QND}}^{2}$. We also note that in the BSM after the switches there is another detection pattern that corresponds to obtaining correlated (correct) raw key bits (projection into the Bell state ${\lvert\phi^{-}\rangle}$), which happens when there is one photon detected in both $D_{\rm{1H}}$ and $D_{\rm{1V}}$ and zero photons detected in $D_{\rm{2H}}$ and $D_{\rm{2V}}$ in Fig. 8. Due to the symmetries, this particular click pattern will also have probability $p_{\rm{c}}^{\rm{Z}}$. Therefore, the contribution to $p_{\rm{BSM}}$ in this case will be $2\,p_{\rm{c}}^{\rm{Z}}/p_{\rm{QND}}^{2}$.

Now, let us define $p_{\rm{nc}}^{\rm{Z}}$ (non-correct) in the same way as we defined $p_{\rm{c}}^{\rm{Z}}$, with the only difference being that in the BSM after the optical switches there is exactly one photon detected in each of the detectors $D_{\rm{2H}}$ and $D_{\rm{1V}}$ and zero photons detected in the other detectors $D_{\rm{1H}}$ and $D_{\rm{2V}}$ in Fig. 8. Note that this particular detection pattern corresponds to a projection into the Bell state ${\lvert\psi^{-}\rangle}$, meaning that one of the parties will apply a bit flip, therefore obtaining anti-correlated (non-correct) raw key bits. Similarly to $p_{\rm{c}}^{\rm{Z}}$, there is another detection pattern that corresponds to obtaining the same anti-correlated raw key bits (one photon detected in both $D_{\rm{1H}}$ and $D_{\rm{2V}}$ and zero photons detected in $D_{\rm{1V}}$ and $D_{\rm{2H}}$ in Fig. 8). Again, due to the symmetries, this particular click pattern will also have $p_{\rm{nc}}^{\rm{Z}}$ probability, therefore the contribution to $p_{\rm{BSM}}$ is $2\,p_{\rm{nc}}^{\rm{Z}}/p_{\rm{QND}}^{2}$ in this case.

The quantity $e_{\rm{X}}$ can be defined and calculated, similarly to the case for $e_{\rm{Z}}$, by considering probabilities with which agreed and disagreed bits are adopted by Alice and Bob. However, for clarity, here we use another method to calculate $e_{\rm{X}}$. Choosing the $X$-basis means that the parties apply a Hadamard gate on the mode $a$ in Fig. 7 before their local measurement with detectors $D_{\rm{3H}}$ and $D_{\rm{3V}}$. From the symmetry of the protocol, without loss of generality, we can focus on a specific success event of Charlie where Charlie’s QND measurements on Alice’s side and Bob’s side announce single-photon detection in each of the detectors $D_{{\rm 2H}}$ and $D_{{\rm 2V}}$ and zero-photon detection in the other detectors $D_{{\rm 1H}}$ and $D_{{\rm 1V}}$ in Fig. 7, and Charlie’s final Bell measurement announces single-photon detection in each of the detectors $D_{{\rm 2H}}$ and $D_{{\rm 2V}}$ and zero-photon detection in the other detectors $D_{{\rm 1H}}$ and $D_{{\rm 1V}}$ in Fig. 8. Then, since Alice and Bob would share entanglement close to ${\lvert\phi^{-}\rangle}$, we define $p_{\rm{c}}^{\rm{X}}$ (correct) [$p_{\rm{nc}}^{\rm{X}}$ (non-correct)] as a probability with which Charlie obtains the specific success event and Alice (Bob) detects exactly one photon in the detector $D_{\rm{3H}}$ ($D_{\rm{3V}}$) [$D_{\rm{3H}}$ ($D_{\rm{3H}}$)] on her (his) side and zero photons in the other detector included in her (his) $X$ measurement in Fig. 7.

With these at our hands, we can write that

[TABLE]

and

[TABLE]

Consequently, we can rewrite Eq. (25) to the following form:

[TABLE]

The remainder of Appendix B is structured as follows. In Appendix B.2 we derive $p_{\rm{QND}}$, then in Appendix B.3 and Appendix B.4 we derive $p_{\rm{c}}^{\rm{Z}}$, $p_{\rm{nc}}^{\rm{Z}}$ and $p_{\rm{c}}^{\rm{X}}$, $p_{\rm{nc}}^{\rm{X}}$. And finally, in B.5 we obtain the secret key rate formula for the $\eta_{\rm{det}}=1$ and $\tau=0\,\rm{s}$ case.

B.2 Derivation of $p_{\rm{QND}}$

The layout for this derivation can be seen in Fig. 7. For convenience, we use the density matrix formalism for the sources. It is easy to see that converting the emitted state ${\lvert\psi\rangle}$, given by Eq. (2), into a density matrix in the ${\lvert\phi_{n}\rangle}$-basis, only the diagonal terms will give contributions when calculating the probabilities of the different detection patterns (described by the POVMs of Eq. (5), which are diagonal in the Fock basis) since different values of $n$ represent different photon numbers. This means that for our calculations, instead of using the pure states given by Eq. (2), we can use mixed states of the following form:

[TABLE]

with $\sum_{n=0}^{\infty}p_{n}=1$ and $\sum_{m=0}^{\infty}q_{m}=1$. For the experimental setup considered, the results in both cases (i.e., by using Eq. (2) or Eq. (B.2)) coincide. The states ${\lvert\phi_{n}\rangle}$ and ${\lvert\varphi_{m}\rangle}$ are given by

[TABLE]

where $a_{H}^{\dagger}$, $c_{H}^{\dagger}$, $f_{H}^{\dagger}$ and $b_{H}^{\dagger}$ ($a_{V}^{\dagger}$, $c_{V}^{\dagger}$, $f_{V}^{\dagger}$ and $b_{V}^{\dagger}$) are the creation operators of horizontally (vertically) polarized photons of the corresponding modes.

Next, we calculate the quantum state from Alice that enters the 50:50 beam splitter (BS) within the QND measurement after travelling through the quantum channel. For this, we model the quantum channel by a BS with transmittance $\eta_{\rm{ch}}=\exp(-L/(2L_{\rm{att}}))$. In doing so, it turns out that such a state is given by

[TABLE]

where the states ${\lvert\phi^{n}_{aed}\rangle}$ are given by

[TABLE]

The 50:50 BS combines the states $\rho_{ea}$ and $\rho^{\rm{QND}}$. So, the state after the 50:50 BS can be written as

[TABLE]

where the pure states ${\lvert\varphi^{nm}_{abghd}\rangle}$ have the form of

[TABLE]

The quantity $p_{\rm{QND}}$ is defined (see Appendix B.1) by the probability of the event that there is exactly one photon detected in each of the modes $g_{h}$, $g_{v}$ and $a_{h}$ (detectors $D_{\rm{2H}}$, $D_{\rm{2V}}$ and $D_{\rm{3H}}$ in Fig. 7) and zero photons detected in the modes $h_{h}$, $h_{v}$ and $a_{v}$ (detectors $D_{\rm{1H}}$, $D_{\rm{1V}}$ and $D_{\rm{3V}}$ in Fig. 7). This event is described by the following POVM

[TABLE]

where we extended the notation used in Eq. (5) with including the corresponding optical mode as a superscript.

The unnormalised state that enters Charlie’s BSM module from Alice (Bob) is then given by

[TABLE]

We repeatedly make use of the following transformation of the summation indices, whenever we calculate the trace of an expression.

[TABLE]

where $f$ is an arbitrary function of the indices $A$, $B$ and we introduced the sum $G=A+B$ of the summation indices. Carrying out the calculations, it can be shown, by using Eq. (38), that $\Gamma_{b}$ can be put into the following form

[TABLE]

where $\gamma_{b}(n,m)$ can be written as

[TABLE]

where ${\lvert i,j\rangle}_{b}$ denotes that there are $i$ and $j$ photons in modes $b_{h}$ and $b_{v}$, respectively. The quantity $\Lambda(n,m,k,x,y,o,s,t,u,v,u^{\prime},v^{\prime})$, on the other hand, equals to

[TABLE]

The probability $p_{\rm{QND}}$ can be obtained as the normalization factor of $\Gamma_{b}$:

[TABLE]

B.3 Derivation of $p_{\rm{c}}^{\rm{Z}}$ and $p_{\rm{nc}}^{\rm{Z}}$

The layout for this derivation can be seen in Fig. 8. Using the previous result for the state coming from the QND and the $Z$ measurement, which is given by Eq. (39), the state that enters Charlie’s BSM module from Alice’s (Bob’s) side is $\Gamma_{c}$ ($\Gamma_{d}$). Therefore, their collective state can be written as

[TABLE]

where note that upper case indices are used to describe quantities corresponding to mode $d$ (coming from Bob’s side), while using lower case indices to describe quantities corresponding to mode $c$ (coming from Alice’s side). For simplicity, in Eq. (B.3) we introduced the following notation:

[TABLE]

For brevity, after the last equation sign in Eq. (B.3) we denoted all the sums collectively by $\sum_{n,\cdots,V^{\prime}}$. The state after the 50:50 BS can then be written concisely as

[TABLE]

where the states ${\lvert\psi^{omOM}_{ef}\rangle}$ are given by

[TABLE]

Then, the state after the Hadamard gates can be written as

[TABLE]

where the pure states ${\lvert\chi^{omOM}_{gh}\rangle}$ have the form

[TABLE]

With Eq. (38), we can rewrite the states ${\lvert\chi^{omOM}_{gh}\rangle}$ into a form, in which it will be more convenient to take the trace of Eq. (47):

[TABLE]

The quantity $p_{\rm{c}}^{\rm{Z}}$ is defined (see Appendix B.1) by the probability of the event that, one photon is observed in each of the modes $g_{h}$ and $g_{v}$ (one detection in each of the detectors $D_{\rm{2H}}$ and $D_{\rm{2V}}$ in Fig. 8) and zero photons are observed in each of the modes $h_{h}$ and $h_{v}$ (no detection in neither of the detectors $D_{\rm{1H}}$ and $D_{\rm{1V}}$ in Fig. 8)

Similarly, $p_{\rm{nc}}^{\rm{Z}}$ is by definition equal to the probability of the event that one photon is observed in each of the modes $g_{h}$ and $h_{v}$ (one detection in each of the detectors $D_{\rm{2H}}$ and $D_{\rm{1V}}$ in Fig. 8) and zero photons are observed in each of the modes $g_{v}$ and $h_{h}$ (no detection in neither of the detectors $D_{\rm{1H}}$ and $D_{\rm{2V}}$ in Fig. 8).

These events are described by the following POVMs

[TABLE]

and

[TABLE]

Since for convenience in the calculations we incorporate the loss corresponding to the active feedforward mechanism into the efficiency of the detectors in the BSM module, the efficiency becomes

[TABLE]

This is the efficiency assumed in the POVM elements given by Eq. (50) and Eq. (51), where $\tau$ is the necessary time for performing one active feedforward and $c$ is the speed of light in the optical fiber.

Therefore, $p_{\rm{c}}^{\rm{Z}}$ and $p_{\rm{nc}}^{\rm{Z}}$ can be calculated as follows

[TABLE]

and

[TABLE]

with $\rho_{gh}$ given by Eq. (47). Carrying out the calculations and plugging all the indices back in, we find that $p_{\rm{c}}^{\rm{Z}}$ and $p_{\rm{nc}}^{\rm{Z}}$ are given by the following formulas:

[TABLE]

and

[TABLE]

Note, that the only differences between $p_{\rm{c}}^{\rm{Z}}$ and $p_{\rm{nc}}^{\rm{Z}}$ are in the limits of the index $\omega$ and in the expression after the sums. Moreover, the term $G(m,o,M,O,I,\Omega,i,\omega,l,q,\alpha,\varphi,i^{\prime},l^{\prime},q^{\prime},\alpha^{\prime},\varphi^{\prime})$ is given by the following expression

[TABLE]

B.4 Derivation of $p_{\rm{c}}^{\rm{X}}$ and $p_{\rm{nc}}^{\rm{X}}$

The derivation of the probabilities $p_{\rm{c}}^{\rm{X}}$ and $p_{\rm{nc}}^{\rm{X}}$ is very similar to the derivation of $p_{\rm{c}}^{\rm{Z}}$ and $p_{\rm{nc}}^{\rm{Z}}$ in Appendix B.3. However, for the $X$-basis we perform the derivation with a slightly different structure, that is, we perform the $X$ measurements at the very end, after Charlie’s QND measurement and BSM have gone through successfully. However, we remark that the calculations could also be done using the same structure like in Appendix B.3.

So firstly, we obtain the state that Alice (Bob) has after Charlie’s QND measurement was performed successfully on her (his) side, which is described by the following POVM:

[TABLE]

where note that we use the same notation for the modes as in Fig. 7 and we excluded the $X$ measurement so far. Let us denote this state by $\sigma_{AC}$ ($\sigma_{BC}$) on Alice’s (Bob’s) side. Then, we take the tensor product $\sigma_{AC}\otimes\sigma_{BC}$ and perform the middle BSM with the POVM of Eq. (58), but here the modes correspond to Fig. 8 since this is the measurement being executed. Next, on the obtained state from the BSM, the parties perform the $X$ measurement, which essentially means that they apply Hadamard gates on their modes and after that they perform the $Z$ measurement in Fig. 7. Let $\sigma^{\prime}_{ab}$ denote the state held by Alice and Bob after they apply the Hadamard gates, where $a$ ($b$) represents the optical mode entering the PNR detectors in the $Z$ measurement at Alice’s (Bob’s) site.

Considering the detection patterns that define the correlated (correct) and anti-correlated (non-correct) raw key generation events, as explained previously in Appendix B.1, we have that

[TABLE]

[TABLE]

with

[TABLE]

and

[TABLE]

Here, for simplicity we only present the results for the main steps of the derivation. The state $\sigma_{AC}$ is given by the following formula:

[TABLE]

where $a^{\prime}$ ($c$) is the mode that enters Alice’s $X$ measurement (Charlie’s BSM from Alice’s side) and $\Lambda_{\rm{QND}}(n,m,k,x,y,o,k^{\prime})$ is given by the following expression:

[TABLE]

We note that $\sigma_{BC}$ has the exact same form with mode $b^{\prime}$ ($d$) entering Bob’s $X$ measurement (Charlie’s BSM from Bob’s side) and in the expression of $\sigma_{BC}$ we use capital letter indices similarly to Appendix B.3:

[TABLE]

Then we obtain $\sigma^{\prime}_{ab}$ by performing Charlie’s BSM on modes $c$ and $d$ and applying Hadamard gates to the modes $a^{\prime}$ and $b^{\prime}$:

[TABLE]

where, for the sake of convenience, we introduced the following functions:

[TABLE]

and

[TABLE]

which enters into the expressions when the Fock-states are expressed with the creation/annihilation operators, and

[TABLE]

which is introduced due to the Hadamard gates included in the implementation, and

[TABLE]

which comes from the successful detection pattern’s POVM. With the formula for $\sigma^{\prime}_{ab}$, given by Eq. (B.4), and Eqs. (59)-(60) we can obtain

[TABLE]

and

[TABLE]

Note that the differences between $p_{\rm{c}}^{\rm{X}}$ and $p_{\rm{nc}}^{\rm{X}}$ are in the limits of the summation index $\omega$ and in the arguments of the function $d$. Moreover, we note that we have found strong numerical evidence that $p_{\rm{c}}^{\rm{X}}=p_{\rm{c}}^{\rm{Z}}$ and $p_{\rm{nc}}^{\rm{X}}=p_{\rm{nc}}^{\rm{Z}}$ hold, but we have not been able to show it analytically by comparing Eq. (B.3) and Eq. (B.3) to Eq. (B.4) and Eq. (B.4).

Now, with Eq. (B.2), Eq. (B.3), Eq. (B.3), Eq. (B.4) and Eq. (B.4) we have all the quantities that are required in order to evaluate the secret key rate of the protocol, which is given by Eq. (29).

B.5 Derivation of the secret key rate in the case of $\eta_{\rm{det}}=1$ and $\tau=0$

The unit efficiency secret key rate formula can be obtained by noting that in the quantities $p_{\rm{QND}}$, $p_{\rm{c}}^{\rm{Z}}$, $p_{\rm{nc}}^{\rm{Z}}$, $p_{\rm{c}}^{\rm{X}}$ and $p_{\rm{nc}}^{\rm{X}}$, given by Eq. (B.2), Eq. (B.3), Eq. (B.3), Eq. (B.4) and Eq. (B.4) only those terms in which the power of $(1-\eta_{\rm{det}})$ and $(1-\eta^{\prime}_{\rm{det}})$ is [math] contribute to the sums. This gives restriction on the indices appearing in the power of the terms $(1-\eta_{\rm{det}})$ and $(1-\eta^{\prime}_{\rm{det}})$. Systematically examining the different cases one by one, we can rule out most of possibilities for the indices. For this, we need to keep in mind that if a sum happens to have a smaller number in the upper limit than that in the lower limit, then the corresponding term gives no contribution to the sum.

Using the recipe given above and the formulas Eq. (B.2), Eq. (B.3), Eq. (B.3), Eq. (B.4) and Eq. (B.4), we have that

[TABLE]

[TABLE]

and

[TABLE]

It is interesting that $p_{\rm{nc}}^{\rm{Z}}$ turns out to be [math] when we set $\eta_{\rm{det}}=1$ and $\tau=0\,\rm{s}$. In the case considered in the calculations above, Alice and Bob both measured $H$ (horizontal) polarizations in their $Z$ measurement and the two QND measurements succeeded on both side. This means that Charlie’s BSM will get input signals in $V$ (vertical) polarizations from both sides. An error can only occur when they apply the bit flip (see step 5 of the protocol), which only happens when Charlie detects a singlet state. But due to the Hong-Ou-Mandel effect the photons will always go to the same arm, therefore in this ideal case Charlie cannot obtain a singlet detection. The same argument holds for the $X$-basis as well. Plugging Eq. (73), Eq. (74) and Eq. (75) into Eq. (29) we obtain the secret key rate formula for the unit detection efficiency case, given by Eq. (8).