Discrete-phase-randomized measurement-device-independent quantum key distribution

Quantum key distribution (QKD) provides an information-theoretically secure method to distribute identical keys between two parties, and is hence one of the most important ingredients in information-theoretically secure communication. The first QKD protocol was developed by Bennett and Brassard in 1984 Bennett and Brassard (1984), which consisted of two sides, a source side and a detector side. We refer to this protocol as BB84 hereafter. The security of BB84, however, relies on a few idealized assumptions. These assumptions are often violated in practice, which allows attacks mostly on the detector side. Measurement-device-independent (MDI) QKD is hence developed to close all loopholes on the detector side Lo et al. (2012). To achieve higher security, it is ideal to also close loopholes on the source side in MDI-QKD.

In an idealized MDI-QKD, each of the two parties, called Alice and Bob, provide single photons in the eigenstates of the rectilinear basis or the diagonal bases. The measurement device performs a Bell measurement on Alice’s and Bob’s signals. It can be shown that if both Alice and Bob choose the rectilinear basis, they can recover identical keys based on the Bell measurement outcomes. The events that Alice and Bob choose different bases are discarded. It was shown that the security of this protocol can be proved by treating the protocol as the time-reversed version of an entanglement-based QKD Ekert (1991).

In a practical scenario, single photon sources are not available. Instead, a phase-randomized weak coherent laser is often utilized to approximate a single photon source. However, continuous phase randomization is impossible to be realized experimentally. Heuristically, the laser is turned off and then on again to approximate phase randomization, but there is no theoretical guarantee that this can provide perfect phase randomization. Indeed there is evidence that this method is far from perfect phase randomization Xu et al. (2012).

Failure in phase randomization can yield the QKD system insecure with respect to the original security analysis. In a related work Cao et al. (2015), it was shown that the phase randomization loophole in BB84 can be closed by using discrete phase randomization. Inspired by that work, we propose a discrete-phase-randomized (DPR) MDI-QKD protocol for solving the phase randomization loophole in MDI-QKD. In addition, we provide a formal security proof of the DPR MDI-QKD protocol.

The roadmap for the rest of the paper is as follows. In Sec. II, we first provide a brief review of the MDI-QKD protocol. In Sec. III, we show an attack against a MDI-QKD system with imperfect phase randomization. In Sec. IV, we describe the DPR MDI-QKD protocol and provide its security analysis. In Sec. V, we summarize the results and discuss future work.

A diagram of the MDI-QKD protocol is shown in Fig. 1. In a typical MDI-QKD setup, Alice and Bob prepare source states in the rectilinear basis or in the diagonal basis. A measurement device which may be controlled by Eve performs a joint Bell measurement on Alice’s and Bob’s states, and outputs either $\mbox{$\left|01\right\rangle$}+\mbox{$\left|10\right\rangle$}$ or $\mbox{$\left|01\right\rangle$}-\mbox{$\left|10\right\rangle$}$ (other Bell measurement outcomes are discarded). Afterwards, Alice and Bob announce the bases they used and discard the events that they use different bases. It can be shown that if both Alice and Bob were using the rectilinear basis with different (the same) eigenstates, the measurement result is always $\mbox{$\left|01\right\rangle$}-\mbox{$\left|10\right\rangle$}$ ($\mbox{$\left|01\right\rangle$}+\mbox{$\left|10\right\rangle$}$). If both parties were using the diagonal bases, then outputting $\mbox{$\left|01\right\rangle$}+\mbox{$\left|10\right\rangle$}$ and $\mbox{$\left|01\right\rangle$}-\mbox{$\left|10\right\rangle$}$ will have the same probability 0.5. By these properties, Alice and Bob can use the rectilinear basis to generate keys, and use the diagonal basis to estimate the errors in the measurement device. In addition, the two parties use the decoy state method Hwang (2003); Lo et al. (2005); Wang (2005) to estimate the channel gain and error rate with higher precision. The MDI-QKD protocol can be viewed as a time-reversed version of an entanglement-based QKD protocol Ekert (1991) and indeed its security can be proved using this time-reversal symmetry Lo et al. (2012).

In this section, we propose an attack to show that there is a serious loophole in MDI-QKD if the phase of the coherent source is not properly randomized. For simplicity, we consider the extreme case that there is no phase randomization, and the phases of the signal state and the decoy state are known to the eavesdropper Eve. We now describe how to use unambiguous state discrimination (USD) to attack a MDI-QKD system without phase randomization.

In the first step, Eve uses USD to distinguish the signal state and the decoy state on both Alice’s and Bob’s sides, each with some probability $q$ (note that in the case of perfect phase randomization, Eve cannot distinguish the signal state and the decoy state, i.e., $q=0$). Eve discards the events that he fails to distinguish the signal state and the decoy state. Then Eve measures the photon number and chooses to forward some of the photons conditioned on the results of signal or decoy states and the photon number to preserve the channel statistics.

In a normal MDI-QKD, the key rate is lower bounded by

where the first term is the error correction term and the second term is the privacy amplification term. Here $Q_{\textrm{Rect}}$ is the gain of the rectilinear basis, $E_{\textrm{Rect}}$ is the bit error rate of the rectilinear basis, $Q^{1,1}_{n}$ is the estimated gain when both parities emit single-photon states, $f(\cdot)\geq 1$ is the error correction efficiency, $E^{1,1,b}_{\textrm{Diag}}$ is the bit error rate of the diagonal basis, and $H(\cdot)$ is the binary Shannon entropy. Under the attack, the key rate is upper bounded by $R^{u}=Q^{1,1}_{a}$ where $Q^{1,1}_{a}$ is the actual gain of the single photon states from both parities under the attack. Apparently, if $R_{l}>R^{u}$, then Alice and Bob would mistakenly generate keys with a key rate higher than the maximal secure key rate possible under the attack, thus leaking part of the key information to Eve. The goal of Eve is hence to minimize $R^{u}$ to the extent that it is smaller than $R^{l}$. We next show that this indeed can happen.

Suppose the intensities of the signal state and the decoy state are $\mu$ and $\nu$ respectively, it can be shown Tang et al. (2013) that on each side, the optimal success probability of unambiguous state discrimination is

In the attack, the gains of the signal state and the decoy state at each side are

respectively, where $Z_{i}^{\mu}$ ($Z_{i}^{\nu}$) is the probability of Eve forwarding the photons conditioned on the signal state (the decoy state) and the photon number $i$. Here we make the simplified assumption that the dark count is zero, so the summation index starts from 1.

Eve should choose $Z_{i}^{\mu}$ and $Z_{i}^{\nu}$ properly so that his faked gains match the normal channel gains of both the signal state and the decoy state, namely,

Here $\eta$ is the channel loss and we assume there is no dark count for simplicity. In addition, since

minimizing $R^{u}$ is equivalent to minimizing $Z_{1}^{\mu}$.

Assume $\mu\ll 1$ and $\mu>\nu>\mu^{2}/2$ and let $\eta=q_{\textrm{opt}}\mu/2$, we can take

For these parameters, it can be checked that the constraints Eqs. (III) to (III) are satisfied. Hence we have $Z_{1}^{\mu}=0$, thus $R^{u}=0$, meaning that all the key information is leaked to Eve. It only remains to show that $R^{l}>0$ for these parameters.

For simplicity, we assume there are no errors, namely $E_{\mu}=0$. The estimated key rate lower bound $R^{l}$ is then reduced to $Q^{1,1}_{n}$. In a normal estimation, since Eve cannot distinguish the signal state and the decoy state, we have

Here $Q_{\alpha,\beta}$ stands for the gain when the mean photon number of Alice’s state is $\alpha$ and the mean photon number of Bob’s state is $\beta$, $Y_{i,j}$ stands for the gain when Alice’s state contains $i$ photon and Bob’s state contains $j$ photons. Since Alice and Bob send their states independently, we have $Q_{\alpha,\beta}=Q_{\alpha}Q_{\beta}$, where $Q_{\alpha}$ and $Q_{\beta}$ are given by Eq. (III).

By a two-step estimation, we first estimate the intermediate quantities $Y^{1}_{\mu}$ and $Y^{1}_{\nu}$ defined by

Using Eq. (III), $Y^{1}_{\mu}$ can be estimated from $Q_{\mu,\mu}$ and $Q_{\nu,\mu}$ as

and similarly for $Y^{1}_{\nu}$, we have

Finally, by Eqs. (III) to (10), $Y_{1,1}$ can be estimated as

Thus $R^{l}=Q_{1,1}=Y_{1,1}(e^{-\mu}\mu)^{2}>0=R^{u}$, which shows that Eve’s attack is successful.

It should be noted that this example is not the only case that Eve can successfully attack a MDI-QKD system without phase randomization. The exact parameter region which is vulnerable to Eve’s attack is beyond the scope of this paper, and is left as an interesting future research direction.

In this section, we first describe our discrete-phase-randomized MDI-QKD protocol and then provide its security analysis.

A weak coherent laser can be described by the following state Glauber (1963)

where $\alpha$ is a complex number and $\left|n\right\rangle$ is the Fock state of $n$ photons. In continuous phase randomization, a random phase $\theta\in[0,2\pi)$ is applied on $\left|\alpha\right\rangle$, and the input state becomes

Conditioning on sufficiently small $|\alpha|$ and photon detection, this input state approximates the single photon state $\left|1\right\rangle$$\left\langle 1\right|$ quite well and hence is a good substitute for a single photon source.

In contrast to continuous phase randomization, in our discrete-phase-randomized MDI-QKD protocol, we apply one of the discrete phases

randomly on the weak coherent laser $\left|\sqrt{2}\alpha\right\rangle$. Here $N$ is the number of discrete phases. Using the virtual qudit formalism of randomization, the input state can be written as

where

Here $\{\mbox{$\left|a_{k}\right\rangle$}\}_{k=0,1,\dots,N-1}$ and $\{\mbox{$\left|b_{j}\right\rangle$}\}_{j=0,1,\dots,N-1}$ are sets of orthogonal bases, and $\left|a_{k}\right\rangle$ can be transformed from $\left|b_{j}\right\rangle$ by

By Taylor expansion on $\left|\lambda_{j}\right\rangle$, one has

The probability of obtaining $\left|\lambda_{j}\right\rangle$ is

where $\mu=2|\alpha|^{2}$. It can be seen that as $N$ goes to infinity, $\left|\lambda_{j}\right\rangle$ approaches the Fock state $\left|j\right\rangle$. Therefore we will call $\left|\lambda_{j}\right\rangle$ the approximated $j$-photon state.

The input state $\left|\lambda_{j}\right\rangle$ is then encoded into four BB84 states with the phase encoding and becomes one of

where $\left|0_{x}^{L}\right\rangle$ and $\left|1_{x}^{L}\right\rangle$ are logical qubits in the $X$ basis, and $\left|0_{y}^{L}\right\rangle$ and $\left|1_{y}^{L}\right\rangle$ are logical qubits in the $Y$ basis, the first coherent state is the reference state and the second coherent state is the signal state with BB84 phases. Since the probabilities of choosing the eigenstates are equal, the overall states encoded in the $X$ basis and the $Y$ basis are

respectively. In the ideal case of basis-independent sources, we have

We can characterize the deviation from the ideal case by bounding the fidelity between $\rho_{AB}^{X}$ and $\rho_{AB}^{Y}$ as

The concrete derivation can be found in Appendix A. The first order approximation of $F_{1,1}$ with respect to $\mu^{N}$ is

This will be later used in the key rate formula. Its derivation can also be found in Appendix A.

In summary, we showed that MDI-QKD with imperfect phase randomization is vulnerable to attacks and, as a solution, proposed a discrete-phase-randomized measurement-device-independent quantum key distribution protocol. We also provided a security proof of the protocol. Simulation results confirm that the protocol with only a few phases (14 phases) already approximates continuous phase randomization quite well.

As future work, we can consider further source imperfection in measurement-device-independent quantum key distribution. One direction is to consider imperfectly prepared discrete phases $\{\mbox{$\left|\alpha e^{i(2\pi k/N\pm\delta)}\right\rangle$}\}_{k=1,\dots,N}$, where $\delta$ is a small quantity characterizing the deviation from the exact discrete phases. One can modify the fidelity calculation to accommodate for this change. Another direction is to extend our analysis to other MDI protocols requiring weak coherent sources, such as MDI entanglement witness Branciard et al. (2013).

This work was supported by the internal Grant No. SLH00202007 from East China University of Science and Technology.