Twin-field quantum key distribution with passive-decoy state

With the help of quantum key distribution (QKD), distant agents (Alice and Bob) are able to share secret keys with information-theoretic security which is guaranteed by quantum physics Bennett and Brassard (1984); Ekert (1991); Lo and Chau (1999). QKD has been developed rapidly both in theory and experiment over the decades Inoue et al. (2002); Gobby et al. (2004); Zhao et al. (2006); Lo et al. (2012); Wang et al. (2015); Zhou et al. (2016); Yin et al. (2016); Liao et al. (2017); Wang et al. (2020). However, a fundamental limit is that the secret key rate (SKR) is scaled by the transmittance $\eta$ Takeoka et al. (2014); Pirandola et al. (2017); Wilde et al. (2017), which is finally revealed as the linear key rate bound: $R\leq-\rm log_{2}(1-\eta)$ Pirandola et al. (2017). Fortunately, the Twin-Field quantum key distribution (TF-QKD) protocol made a difference Lucamarini et al. (2018), in TF-QKD protocol, pairs of phase-randomized optical pulses are generated at Alice and Bob and then combined at a central measuring station Charlie, single-photon interference is produced at Charlie, this lets TF-QKD gain the square-root of the channel transmittance, which is the same as it with a quantum repeater. The Ref. Tamaki et al. (2018) enhanced the security proof of that given in Ref. Lucamarini et al. (2018), it proposed a novel way to use decoy states by switching between decoy mode and code mode, by doing this, it confirmed the scaling properties of the original scheme and overcame the linear key bound at long distances.

Inspired by the original TF-QKD, many variants are proposed including Phase-matching protocol Ma et al. (2018), Sending-or-not-sending protocol Wang et al. (2018). And Ref. Cui et al. (2019); Curty et al. (2019); Lin and Lütkenhaus (2018) removed active phase randomization and phase postselection in code mode, this proved to reach a higher final key rate. Yet, the security proof of all these protocols are based on decoy-state method Hwang (2003); Lo et al. (2005); Wang (2005), the essential idea behind decoy-state method in TF-QKD is simple, the sender (Alice and Bob) varies the mean photon number of each pulse she transmits to the central station (Charlie), users can obtain a better estimation of the behavior of the quantum channel from the measurement results corresponding to different intensity settings, this helps to enhance the achievable SKR and communicating distance. In practical experiments, decoy-state method is usually performed by actively modulating a variable optical attenuator together with a random number generator Schmitt-Manderbach et al. (2007). However, these approaches may lead to side channel and can even break the security of the system Jiang et al. (2012), if the VOA, which changes the intensity of Alice’s (Bob’s) pulses, is not properly designed, it may happen that some physical parameters (for example frequency spectrum) of the pulses emitted by the sender depend on the particular setting selected, which could open a security loophole in the active schemes. Fortunately, passive-decoy protocol Mauerer and Silberhorn (2007); Adachi et al. (2007); Ma and Lo (2008) is able to remove certain side channel caused by actively modulating intensity of the source. Specifically, in our proposed scheme, this kind of side channel can be removed provided that Alice and Bob have perfect local detectors and there is no Trojan horse attack. Even though perfect detectors are not available in practical experiments, the side channel may still be significantly reduced when high-detection-efficiency local detectors are equipped. The original passive-decoy protocol utilizes a parametric downconversion source in conjunction with a photon number resolving detector to substitute an idealized single-photon source, the passive-decoy state selection can be accomplished without the need for any active optical elements. Besides, the Refs.Curty et al. (2009, 2010); Zhang et al. (2018) implemented passive-decoy method by using weak coherent pulses (WCPs), in which Alice and Bob treat click and no click of the detectors separately and distill a secret key from both of them.

To enhance the source security of TF-QKD, in this paper we propose passive-decoy TF-QKD, in our scheme, different decoy states are generated passively according to the mode of photon detectors. Our passive scheme can eliminate the side channel generated by active modulation of source intensities, simultaneously, it provides a performance as good as the active decoy method when the setup with four-intensity settings is applied. In Sec.II, we introduce our scheme and the setups. In Sec.III, we give the method to calculate SKR with two-intensity decoy setups and four-intensity setups. The conclusion and a discussion are given in Sec.IV.

The system of our passive-decoy TF-QKD scheme is given in Fig.1(a). The setups on Alice have no difference from that on Bob, thus we take Alice as an example. Weak coherent pulse (WCP) is generated at Alice side, $\rm BS_{1}$ splits the pulses into two paths (path r and path s), the transmittance of $\rm BS_{1}$ is $t_{1}$. Path r and path s are the same in length so the pulses at these two paths will interfere in the passive-decoy setup (PDS). After interference, the outcome mode $a_{1}$ is sent to untrusted party Charlie. The PDS is the setup we designed to implement our passive-decoy scheme, it mainly consists of BSs and photon detectors, specifically, Fig.1(b) and Fig.1(c) are two PDSs with two-intensity settings and four-intensity settings. the specific steps of our passive-decoy TF-QKD scheme can be described as follows Cui et al. (2019):

step 1. Alice and Bob randomly choose code mode or decoy mode in each trial.

step 2.a. When Alice (Bob) chooses code mode, The intensity modulator (IM) blocks the pulses on path s, here we choose Lithium Niobate-based Mach-Zehnder (LNMZ) intensity modulator for its advantages of low driving voltage, high bandwidth, adjustable chirp. The phase modular ($\rm PM_{1}$) on path r modulates the signal phase according to the random classical key bit 0 or 1. By doing these, Alice (Bob) prepares a weak coherent state $|\pm\sqrt{\mu}\rangle_{A}$ ($|\pm\sqrt{\mu}\rangle_{B}$) mentioned in Ref. Cui et al. (2019).

step 2.b. When Alice (Bob) chooses decoy mode, $\rm PM_{1}$ and $\rm PM_{2}$ randomize the phase of the pulses on each path and leave the IM on path s unmodulated, the randomized phase will never be publicly announced. By doing these, mixed state in Fock space is generated on path r and path s, and the photon distribution of the mixed state is depending on the mode of photon detectors in PDS.

step 3. For each trial, Charlie publicly announces which detector (L or R) clicks or is a no click event.

step 4. After repeating steps 1 to 3 for sufficient times, Alice and Bob publicly announce which trials are code modes and which trials are decoy modes. For the trials in which Alice and Bob both select the code mode and Charlie announces a click event, the raw key bits are generated. For the trials in which Alice and Bob both select decoy mode, Alice and Bob can estimate the yield $Y_{nm}$, $Y_{nm}$ is the probability of Charlie announcing click event provided Alice emits an $n$-photon state and Bob emits an $m$-photon state in a decoy mode.

In step 2, the IM we choose is LNMZ intensity modulator. Since the only purpose of the IM is blocking the pulses on path s in code mode with no information encoded, thus it won’t lead to side channel attacks. On the other hand, LNMZ intensity modulator has high bandwidth (usually GHz), making it suitable for systems with high repetition rate like ours. Besides, the extinction ratio of LNMZ intensity modulator is usually more than 25 dB, which means the error rate caused by the IM could be neglected compared with the code rate of our system (see detailed derivation in appendix A).

In the scheme, the secret key rate per trial in a code mode is given as follow

Here $h(x,y)=-xlog_{2}x-ylog_{2}y+(x+y)log_{2}(x+y)$, $Q_{\mu}$ is the counting rate in code mode, $er_{\mu}$ is the error rate of raw key bits, $Q_{\mu}$ and $er_{\mu}$ can be directly observed experimentally. $I^{u}_{AE}$ is the upper bound of the information leakage, and $I^{u}_{AE}$ can be solved by the following optimization problem

in which $P_{k}=e^{-\mu}\mu^{k}/k!$ is Poissonian distribution. $P_{n}$ $(P_{m})$ is determined by the input parameter $\mu$, which is chosen by the parties prior to initiating the experiment.

To get the secret key rate R in code mode, we need to know the information leakage $I^{u}_{AE}$ in Eq.(2). For that $P_{n},P_{m}$ and $Q_{\mu}$ in Eq.(2) can be observed in practical experiments, thus it is necessary to estimate $Y_{n,m}$. In our scheme, $Y_{n,m}$ can be bounded with the passive-decoy state method. The gain of the decoy states satisfies

Here $Q_{d}$ is the counting rate in decoy mode, $Pr_{a}(n)$ ($Pr_{b}(m)$) is the $n$-photon ($m$-photon) distribution of the state on Alice (Bob) in decoy mode, which depends on the mode of photon detectors on PSD in our passive-decoy scheme. In ideal case with infinite decoy states, we can list infinite linear equations like Eq.(3) to calculate $Y_{n,m}$ accurately. On the other hand, finite decoy states can also help to estimate the lower bound for yields and it is more feasible in practical system.

In our scheme, when the two-intensity setup is implemented in PDS as shown in Fig.1(b), pulses on path r and path s will interfere at $\rm BS_{2}$ with two outcomes $a_{1}$ and $a_{2}$, $a_{1}$ is sent to Charlie and $a_{2}$ is detected by $\rm D_{1}$. Denote the detect efficiency of $\rm D_{1}$ is $\eta$, the darkcount rate is $\eta_{d}$, we can get

in which $P_{c}(n)$ and $P_{u}(n)$ are probabilities that detector click or not when $n$ photons come. With these two probabilities, we have two different conditional photon number distributions according to the mode of $\rm D_{1}$ (see the details in the appendix B)

and

Here $Pr^{1}(k)$ is the probability of finding $k$ photons in $a_{1}$ when $\rm D_{1}$ produces a click, $Pr^{0}(k)$ is the probability of that when $\rm D_{1}$ doesn’t click, $P(q,k|\mu_{1},\mu_{2})$ is the conditional probability of finding $k$ photons in $a_{1}$ and $q$ photons in $a_{2}$ when the mean photon numbers of pulses in path s and path r are $\mu_{1}$ and $\mu_{2}$, $P(q,k|\mu_{1},\mu_{2})$ is derived in appendix. Then substituting $Pr^{1}(k)$ and $Pr^{0}(k)$ into Eq.(3), we can have:

in which $Q_{d}^{0,0}$, $Q_{d}^{0,1}$, $Q_{d}^{1,0}$ and $Q_{d}^{1,1}$ are counting rates on different detector modes in decoy mode . For example, in Eq.(7) $Q_{d}^{0,1}$ is the counting rate when the detector on Alice doesn’t click and the detector on Bob produces a click, $Pr^{0}_{a}(n)$ and $Pr^{0}_{b}(n)$ are defined as same as $Pr^{0}{(n)}$ while the subscripts $a$ and $b$ denote the distributions on Alice’s and Bob’s sides respectively.

In practice, after observing $Q_{d}^{0,0}$, $Q_{d}^{0,1}$, $Q_{d}^{1,0}$ and $Q_{d}^{1,1}$, we can give approximations to $Y_{0,0}$, $Y_{0,1}$, $Y_{1,0}$, $Y_{2,0}$, $Y_{0,2}$ and $Y_{2}$ by linear programming using Eq.(7), where $Y_{2}$ denots the yields that are from decoy trials in which Alice and Bob share two photons in total, which means $n+m=2$. Then following the same technique in Sec.V of Ref. Cui et al. (2019), we substitute these yields into Eq.(2) to bound the information leakage $I^{u}_{AE}$ and calculate the final key rate $R$ in Eq.(1).

After presenting the scheme of generating two-intensity decoy state passively, we decide to go further, thus we add $\rm BS_{3}$ and two photon detectors at the end, as shown in Fig.1(c). There are four different modes with two photon detectors in the setup, thus we can get four different conditional photon distributions according to the modes of detector $\rm D_{1}$ and $\rm D_{2}$, which means four-intensity decoy states (see the details in the appendix B)

in which $Pr^{00}(k)$, $Pr^{10}(k)$, $Pr^{01}(k)$ and $Pr^{11}(k)$ are the photon distributions in $a_{1}$ given that $\rm D_{1}$ and $\rm D_{2}$ are in different modes. For example, $Pr^{10}(k)$ is the probability of finding $k$ photons in $\rm a_{1}$ when $\rm D_{1}$ produces a click and $\rm D_{2}$ doesn’t. Note that when the transmittance of $\rm BS_{3}$ is $t_{3}=0.5$, we will get $Pr^{10}(k)=Pr^{01}(k)$, which means $Pr^{10}(k)$ and $Pr^{01}(k)$ are not independent. To get more useful constraints in linear program, we let $0.5<t_{3}<1$. For readability we write $Pr^{00}$, $Pr^{10}$, $Pr^{01}$, $Pr^{11}$ as $Pr^{1}$, $Pr^{2}$, $Pr^{3}$, $Pr^{4}$, and define the following gains: $Q_{d}^{4,4}$, $Q_{d}^{1,4}$, $Q_{d}^{2,4}$, $Q_{d}^{3,4}$, $Q_{d}^{4,1}$, $Q_{d}^{4,2}$, $Q_{d}^{4,3}$, $Q_{d}^{1,1}$, $Q_{d}^{2,2}$ and $Q_{d}^{3,3}$. For example, $Q_{d}^{1,4}$ is the counting rate when both $\rm D_{1}$ and $\rm D_{2}$ on Alice don’t click and the both $\rm D_{1}$ and $\rm D_{2}$ on Bob produce click, then like what we do in two-intensity cases, after observing these gains, we can give approximations to $Y_{0,0}$, $Y_{0,1}$, $Y_{1,0}$, $Y_{2,0}$, $Y_{0,2}$ and $Y_{2}$ by linear programming, and we can get the final key rate $R$ using Eq.(1,2). This’s the passive scheme of generating four-intensity decoy state with two BS and two photon detectors.

Comparing Fig.1(b) with Fig.1(c), we can know that Alice could increase the mode of the detectors by adding a BS at the end to get more constrains in linear programing and improve key rates. Following this idea, we can actually generalize our setup to infinite passive-decoy case. we denote the joint photon number distribution of the passive setup with $n$ ($n$=1,2,3…) intensity settings is $p^{n}$, we can get a recursive formula

From Eq.(12), we can get the conditional probabilities of photon number distribution in $a_{1}$ on each mode of the detectors, one may refer to the appendix for detailed derivations.

Now we carry out a numerical simulation to evaluate the performance of our two-intensity and four-intensity protocols. We focus on the symmetric case, which means that Charlie is at the middle of Alice and Bob and all other device parameters on Alice’s side and Bob’s side are identical. The simulation model can be found in the appendix of Ref.Cui et al. (2019), the parameters in our simulation are listed in Table.1.

Our results are shown in Fig.2. It shows that, in two-decoy settings, there is a gap between active decoy scheme and passive-decoy scheme, while in four-decoy settings, our passive-decoy scheme performs as good as the active one and even slightly better at a long distance. This shows that our passive-decoy state method can perform as good as the active one. Furthermore, our method can eliminate side channels on sources which may be caused by active modulation. Thus our scheme is very promising for applications of practical systems.

Besides, we also add a simulation of the passive setup with eight decoys, and compare it with the infinite decoy states.The result shows that the secret key rate of passive setup with the eight decoys surpasses that of the four decoys at a long range of distance. More importantly, the gap between the passive setup with the eight decoys and the infinite decoy states is narrow, which shows our protocol can present satisfactory performance with just a few detectors.

We have proposed the scheme of passive-decoy state TF-QKD, in which different decoy states are generated passively according to the modes of photon detectors. In this way, our scheme can eliminate side channel on source caused by actively modulating of the source intensity. Moreover we presented a simulation comparing the key generation rate with that in active-decoy, it shows our result can performs as good as that in active decoy TF-QKD, and our scheme could reach satisfactory secret key rates with just a few photon detectors. Thus our work provides a useful approach to improve the performance of TF-QKD in practical implementation.

Nevertheless, although our scheme can remove certain side channel caused by actively modulating intensity of the source, we can not remove all side channels, there are still further work to do. For example, the scheme is still threatened by Trojan horse attack although it’s not easy in practice, and an imperfect real-life source may emit imperfect states with varied frequency spectra, which will also lead to side channel. Fortunately, imperfect states preparation may be remedied by Ref. Wang et al. (2019), which proposed that an imperfect source $S$ and a perfect source $P$ are identical in side-channel space if there exists a quantum process that can map the $S$ to $P$. Besides, the intensities of the photon pulses could be unstable. To solve this issue, Refs. Wang et al. (2009); Hu and Wang (2010) have discussed these issues. Ref. Wang et al. (2009) bounded the fraction of single-photon counts in the decoy-state QKD, while Ref. Hu and Wang (2010) proposed a theory that decoy-state QKD with an unstable source can work as if the source were stable provided the condition: $\max\limits_{j}(\frac{p_{j}a_{kj}}{p^{\prime}_{j}a^{\prime}_{kj}})\leq\max\limits_{j}(\frac{p_{j}a_{2j}}{p^{\prime}_{j}a^{\prime}_{2j}})<\max\limits_{j}(\frac{p_{j}a_{1j}}{p^{\prime}_{j}a^{\prime}_{1j}})$, for all $k\geq 2$ hold. In our scheme, this condition still holds by optimizing the transmittance of BS(s), therefore, our scheme can work under unstable source in principle. Moreover, there are still side channels in our scheme due to bases switching, i.e., different values in phase modulation in the code mode. It would be interesting to study this issue in the future.

This work has been supported by the National Key Research and Development Program of China (Grant No. 2016YFA0302600), the National Natural Science Foundation of China (Grant Nos. 61822115,61961136004, 61775207, 61702469, 61771439, 61627820,61675189), National Cryptography Development Fund (Grant No. MMJJ20170120) and Anhui Initiative in Quantum Information Technologies.

We take Alice as an example, for simplicity, we let the extinction ratio of the IM be 20 dB, the intensity of the weak coherent pulses from laser be $\mu$, the transmittance of $\rm BS_{1}$ is $t_{1}$, thus we have

in which $\mu_{s}$, $\mu_{r}$ are the intensity of the pulses at the two outputs of $\rm BS_{1}$, then pulses on path s will be blocked by the IM, the intensity of the output pulses is $\mu_{s}^{\prime}=\mu_{s}/100$, thus we can get the probability

Where $P(n=0,\mu_{s}^{\prime})$ is the probability of finding no photons from the output of path s after blocking of the IM, $P(n\neq 0,\mu_{s}^{\prime})=1-e^{-\mu_{s}^{\prime}}$ is the probability of finding at least one photon from the output of path s.

For simplicity, we take the error rate $er=0.5$ on $a_{1}$ as long as there are photons come from path s, thus we have the total error rate

Since $\mu_{s}^{\prime}=\mu_{s}/100$, thus $er_{total}$ is a small value, we take $\mu_{s}=0.1$ for example, we get $er_{total}=0.00005$, it’s a small value that it won’t affect the performance of our system.