Implementation of continuous-variable quantum key distribution with composable and one-sided-device-independent security against coherent attacks

Secret communication over public channels is one of the central pillars of a modern information society. Using quantum key distribution this is achieved without relying on the hardness of mathematical problems, which might be compromised by improved algorithms or by future quantum computers. State-of-the-art quantum key distribution requires composable security against coherent attacks for a finite number of distributed quantum states as well as robustness against implementation side channels. Here we present an implementation of continuous-variable quantum key distribution satisfying these requirements. Our implementation is based on the distribution of continuous-variable Einstein–Podolsky–Rosen entangled light. It is one-sided device independent, which means the security of the generated key is independent of any memoryfree attacks on the remote detector. Since continuous-variable encoding is compatible with conventional optical communication technology, our work is a step towards practical implementations of quantum key distribution with state-of-the-art security based solely on telecom components.

Secret communication over public channels is one of the central pillars in modern information technology.Using arbitrary-attack-proof quantum key distribution 1,2 (aapQKD) this is realized without relying on the hardness of mathematical problems which might be compromised by improvements in algorithms or by future quantum computers 3 .Up to now real world aapQKD systems required single photon preparation and detection 4,5 , as QKD systems using amplitude and phase modulations failed to provide the same security standard [6][7][8][9][10][11] .Here, we present the first implementation of aapQKD without an encoding in single photons, but instead with one in amplitude and phase modulations of an optical field.In a table-top experiment based on Einstein-Podolsky-Rosen entangled light with an unprecedented entanglement strength, we generated about 97 MBit key from 2×10 8 measurements using a novel highly efficient error reconciliation algorithm.This is more than 1 bit per sample in the raw key and, thus, exceeds the theoretical bound for aapQKD protocols using single photons 4 .We furthermore showed that our setup is suitable for urban telecommunication networks reaching a distance of several kilometers between the two communicating parties.Since our concept is compatible with conventional optical communication technology we consider our work to be a major promotion for commercialized aapQKD providing highest security standards.
Today, several companies are commercializing QKD systems 12 and whole QKD networks have been built in field tests 13,14 .These also include aapQKD systems, but all of them use a discrete-variable encoding based on single photons.Experimentally they rely on single photon sources, which might not always produce only a single photon and, hence, have to integrate decoy states which reduce the secure key rate 15,16 .They also rely on single photon detectors suffering from low efficiency and dark counts, and which are particularly vulnerable to side channel attacks 17 .To avoid these problems one can use an encoding in amplitude and phase modulations of a light field 18,19 , whose principles are well established in conventional communication technology.These so-called continuous-variable (CV) QKD protocols are based on homodyne detection in which a strong local oscillator beam is superimposed with a signal field at a balanced beam splitter, and its outputs are detected by PIN photo diodes.Such photo detectors have already been realized with close to 100 % quantum efficiency, bandwidths of more than 1 GHz and low electronic dark noise. 20ile CV QKD systems provide experimental benefits over discrete variable ones, they have the drawback that security proofs are more involved and error reconciliation codes are often less efficient.The security proof is an integral part of any protocol certifying that if certain assumptions are met, security is warranted.So far, the security of only a few CV QKD protocols have been proven under the necessary condition that the key is generated from only a finite number of measurements 21,22 .Among them is for instance the Gaussian modulation protocol for which transmission distances of up to 80 km have recently been demonstrated 11 .But as in all earlier implementations, the security could only be certified against a restricted class of attacks, namely, collective Gaussian attacks in which each signal is attacked independently and identically using a Gaussian operation.Although these attacks are indeed the strongest possible attacks in the limit of an infinite number of communication rounds, it is currently not known whether this is true in a realistic finite length protocol.
Here, we report the first implementation of a complete CV aapQKD system that provides the same high security level as systems using single photons.The security against arbitrary attacks, including any attacks that might be implemented with future technology, was mathematically proven in Ref. 22.The security of the key is guaranteed even under attacks of the eavesdropper on the local oscillator beam.Furthermore the security analysis takes the resolution of the digitalization of the measurement as well as the finite range of the homodyne detectors arXiv:1406.6174v2[quant-ph] 3 Jul 2014 into account.The classical post-processing is based on direct reconciliation.
Our implemented protocol uses two continuous-wave light fields which were produced by a source at one of the communicating parties (Alice) and whose amplitude and phase modulations (also called quadratures) were mutually entangled 23,24 .The schematic of the experimental setup is illustrated in Fig. 1(a).Two squeezed-light sources 25,26 , each composed of a nonlinear PPKTP crystal and a coupling mirror, were pumped with a bright pump field at 775 nm (yellow) to produce two squeezed vacuum states at the telecommunication wavelength of 1550 nm (red).The two squeezed vacuum fields, both exhibiting a high squeezing of more than 10 dB, were superimposed at a balanced beam splitter with a relative phase of π/2, thus generating Einstein-Podolsky-Rosen entanglement 24 .One of the outputs of the beam splitter was kept by Alice, while the other was sent to the other party (Bob).The technical details of the source, including the locking scheme, were characterized in Ref. 27.
Figures 1(b)-(e) show the distribution of measurement outcomes obtained by the two parties measuring either the amplitude (X) or phase (P ) quadrature of their respective light field with balanced homodyne detection.Each measurement outcome is thereby truly random and a result of parametrically amplified zero-point fluctuations.When both parties simultaneously measure either X or P the strong correlations between their outcomes are clearly visible (Fig. 1 (b) and (e)).If the two parties measure different quadratures instead, the measurement outcomes are uncorrelated (Fig. 1(c) and (d)).The strength of the correlations of Alice's and Bob's measurement for the same quadratures, which is related to the initial squeezing strength, is a central parameter in our QKD protocol and enters the key length computation directly in the form of an average distance d pe , introduced below.
The precise steps of the QKD protocol are as follows: 22 Preliminaries Alice and Bob use a pre-shared key to authenticate the classical communication channel for post processing 28,29 .Furthermore, Alice and Bob negotiate all parameters needed during the protocol run.
Measurement Phase Both Alice and Bob choose, randomly and independently from each other, a quadrature X or P , which they simultaneously measure by homodyne detection of their light fields.The outcome of this measurement is called a sample.This step is repeated until 2N samples have been obtained.
Sifting Alice and Bob announce their measurement bases and discard all samples measured in different quadratures.
Discretization The continuous spectrum of the measurement outcomes is discretized by the analog-to-digital converter (ADC) used to record the measurement.During the discretization step Alice and Bob map the fine grained discretization of their remaining samples caused by the ADC to a coarser one consisting of consecutive 2 d bins.In the interval [−α, α] a binning with equal length is used, which is complemented by two bins (−∞, −α) and (α, ∞).The parameter α is used to include the finite range of the homodyne detectors into the security proof.
Channel Estimation The secret key length is calculated using the average distance between Alice's and Bob's samples.To estimate it, the two parties randomly choose a common subset of length k from the sifted and discretized data, X pe A and X pe B , respectively, which they communicate over the public classical channel.Using these, they calculate Error Reconciliation Bob corrects the errors in his data to match Alice's using the hybrid error reconciliation algorithm described below.Afterwards, Alice and Bob confirm that the reconciliation was successful.
Calculation of Secret Key Length Using the results from the channel estimation and considering the number of published bits during error reconciliation, Alice and Bob calculate the secret key length according to Ref. 22.If the secret key length is negative, they abort the protocol.
Privacy Amplification Alice and Bob apply a hash function which is randomly chosen from a two-universal family 30 , to their corrected strings to produce the secret key of length .
The key generated by the above protocol is proven to be -secure against arbitrary attacks in Ref. 22, where is the so-called composable security parameter.The security proof makes no assumptions on the attacks and only weak ones on our implementation.It only requires that Alice's measured quadrature angles are exactly X and P and that Alice's station is inaccessible to the eavesdropper.Thus, she can trust her source and knows the probability for measuring a quadrature amplitude value exceeding α.There are no assumptions on Bob's measurement device (one-sided device independent) such that even attacks on his local oscillator are fully covered.Both parties used balanced homodyne detection (BHD) to measure their part of the quadrature entangled state.The measured quadrature phase was controlled by a computer via a fast fiber-coupled electro-optical modulator (EOM).To make sure that Alice and Bob switched between the same orthogonal quadratures, a phase shifter (PS) was employed to compensate slow phase drifts.Optical losses of the transmission channel to Bob were modelled by a variable attenuator consisting of a half-wave plate (λ/2) and a polarizing beam splitter (PBS).PD: Photo Diode.
The implementation of the measurement phase of the protocol requires fast switching between the X and P quadratures in Alice's and Bob's homodyne receivers.Since the relative phase between the local oscillator and the signal field determines the measured quadrature angle, switching has been achieved by a fast fiber-coupled electro-optical modulator, which was used to apply π/2 phase shifts to set the quadrature either to X or P (see Fig. 2).The phase shift applied by the modulator ensured the orthogonality of the two quadratures used in the QKD protocol.To make sure Alice and Bob switched between the same set of quadratures, a piezo attached mirror was employed to compensate for slow drifts.The measurement rate was 100 kHz.
Important for a high key rate is an error reconciliation protocol which has an efficiency close to the Shannon limit.While for discrete variable protocols very efficient binary error correcting codes are available 11 , they have not been available for CV QKD prior to this work.The reason is that the discretized sample values are not uniformly distributed but instead, follow a Gaussian distribution.To solve the problem, we designed a two-phase error reconciliation protocol which can exploit the nonuniform distribution efficiently.First the d 1 least significant bits of each sample are sent to Bob.Since these bits are only very weakly correlated this step works with an efficiency very close to the Shannon limit.In a second step Alice and Bob use a non-binary low density parity check (LDPC) code over the Galois field GF(2 d2 ) to correct the d 2 = d − d 1 most significant bits.d 1 , d 2 , as well as the LDPC code are optimized for each QKD run using the k revealed samples from the channel estimation.Figure 3 shows the experimental results.First we removed the variable attenuator in the transmission line to Bob and executed the protocol for different sample sizes to show the effect of the finite sample size on the secure key length (Fig. 3 (a)).For each sample size the number of samples k used for channel estimation was optimized before the QKD run to yield maximum key length.The hybrid error reconciliation had a total efficiency of β = 94.6 %, showing that our hybrid scheme achieves an efficiency as high as the reconciliation efficiencies achieved for discrete variables 11 .The theoretical model, which is the solid line in the figure, shows that a secret key can be distilled from 5 × 10 6 samples.Using 2×10 8 samples, however, we achieved a remarkable secret key length of about 97 Mbit, which is about 1.14 bit per sample left in the raw key.Thus, we have more than 1 bit secret key per sample in the raw key which exceeds the theoretical limitation of single photon QKD systems. 4ith the variable attenuator in place, we varied the optical loss of the channel to Bob between 0 % and 15 % (see Figure 3 (b)), which is equivalent to a fiber length of up to 3.5 km when standard telecommunication fibers with an attenuation of 0.2 dB/km are used.By measuring a total of 2×10 8 samples we were still able to achieve a secret key length of about 21 Mbit at an equivalent fiber length of 3.5 km.This value, as well as the secret key sizes at the other attenuation values, were achieved by having a very high overall error reconciliation efficiency between β = 94.3 % and 95.5 %.The theoretical model shown in the figure reveals that even a distance of about 5.5 km between Alice and Bob should be possible, which is already enough to implement CV aapQKD links between parties in, for instance, a city's central business district.
In conclusion, we have for the first time successfully demonstrated a CV QKD setup with security against arbitrary attacks.While in our setup Alice and Bob were located on the same optical table, they could easily be separated and connected by a standard telecommunication fiber.Although our implementation is limited to about 5.5 km due to direct reconciliation, longer distances will be possible with a reverse reconciliation protocol.
Our implementation can be seen as a paradigm change.In the past only the single-photon based QKD systems were secure against arbitrary attacks.With our result, the modulation based (CV) systems have to be accepted as a tantamount approach, however, with important capabilities.Not only higher key rates are possible but also is the implementation less prone to loopholes.Modulation based systems cannot only be operated with standard detector technology, but also with standard light sources which are based on coherent states of light.Up to now a rigorous security proof for an aapQKD system constisting of standard telecommunication devices only is not available, but it would render CV aapQKD systems even more favourable for km-scale local-area networks.

Experimental Details
The measurement rate of our implementation was 100 kHz.For each measurement, both Alice and Bob had to choose randomly between the X and P quadrature.The necessary relative phase shifts of π/2 of the local oscillator with respect to the signal beam were applied to the local oscillator beam by a high-bandwidth fiber-coupled electro-optical phase modulator driven by a digital pattern generator PCI-Express card.Since not only the orthogonality of the measurements is important but also that Alice and Bob measure the same set of quadratures, we compensated slow phase drifts by a phase shifter made of a piezo attached mirror.The error signal for this locking loop was derived by employing a 82 MHz single sideband from the entanglement generation 27 which was detected by the homodyne detector.By lowpass filtering the demodulated homodyne signal at 10 kHz with a sufficiently high order, the high frequency phase changes from the fibercoupled phase modulator were averaged over.To make the average independent of the chosen sequence of quadratures we used the following scheme.For a choice of the X quadrature, the phase modulator was first set to a phase of π/2 during the first half of the 10 µs interval, and then to 0. For the P quadrature, the phase was first set to 0 and then to π/2.Thus, this scheme made sure that the phase did not stay in one quadrature for longer than 10 µs even in the case where one party chose by chance to measure one quadrature for a while.The measurement was performed synchronously by Alice and Bob in the second half of the interval after 3 µs settling time.
The data acquisition was triggered by the pattern generator and performed by a two channel PCI-Express card at a rate of 256 MHz.The 200 acquired samples per channel were digitally mixed down at 8 MHz, lowpass filtered by a 200-tap finite impulse response filter with a cut-off frequency of 200 kHz and down-sampled to one sample.After the total number of samples were recorded the classical post processing of the QKD protocol was performed.
Alice and Bob both employed a local oscillator with a power of 10 mW, yielding a dark noise clearance of about 18 dB.The pump powers for the two squeezed-light sources were 140 mW and 170 mW, respectively.
The optical attenuation of the variable attenuator used in Fig. 3 The security of the protocol relies substantially on the use of true random numbers which are needed by Alice and Bob to choose between the X and P quadrature, and to determine a random hash function during privacy amplification.We implemented a quantum random number generator following a scheme of Ref. 31 based on vacuum state measurements performed by a balanced homodyne detector.For this purpose we implemented another balanced homodyne detector with the signal port blocked using an independent 6 mW 1550 nm beam from a fiber-laser as local oscillator.The output of the homodyne detector circuit was anti-alias filtered by a 50 MHz fourth-order Butterworth filter and sampled with a sampling frequency of 256 MHz by a data acquisition card.The data was subsequently mixed down digitally at 8 MHz, lowpass filtered with a 200-tap finite-impulse-response filter with a cutoff frequency of 5 MHz and down-sampled to 2 MHz.The generation of the random numbers from the data stream followed the procedure in Ref. 31.where c(δ) ≈ δ 2 /(2π) and γ is a bound on the correlation between Alice and Bob depending on the measured average distance dpe and statistical fluctuations µ.Alice chooses a hash function randomly from a two-universal hash family and communicates her choice to Bob.Then Alice and Bob both apply this hash function to the reconciled blocks and obtain the -secure key Ksec.

Figure 1 . 2 .
Figure 1.Einstein-Podolsky-Rosen entanglement source for aapQKD.(a) The source consists of two continuous-wave squeezed vacuum beams, generated by type I parametric down-conversion at 1550 nm (red), which are superimposed at a balanced beam splitter with a relative phase of π 2 .Yellow beam: 775 nm pump field, DBS: Dichroic beam splitter, PS: Phase shifter.(b)-(e) Correlations between Alice's and Bob's data, measured by balanced homodyne detection in either the amplitude (X) or phase (P ) quadrature.The data is normalized to the noise standard deviation of a vacuum state.Blue: Einstein-Podolsky-Rosen entangled state used for QKD.Black: Reference measurement of zeropoint fluctuations of the ground state (vacuum).

Figure 2 .
Figure2.Implementation of Alice's and Bob's QKD receivers.Both parties used balanced homodyne detection (BHD) to measure their part of the quadrature entangled state.The measured quadrature phase was controlled by a computer via a fast fiber-coupled electro-optical modulator (EOM).To make sure that Alice and Bob switched between the same orthogonal quadratures, a phase shifter (PS) was employed to compensate slow phase drifts.Optical losses of the transmission channel to Bob were modelled by a variable attenuator consisting of a half-wave plate (λ/2) and a polarizing beam splitter (PBS).PD: Photo Diode.

Figure 3 .
Figure 3. Secure key lengths achieved by our aapQKD system.Common parameters: α = 61.6,d = 12, = 2 × 10 −10 .(a) Effect of the finite number of performed measurements on the secret key length.The QKD protocol was executed without the variable attenuator in Bob's arm.The theoretical model (solid line) was calculated by reconstructing the covariance matrix for 10 8 samples and taking the actual leakage due to the error reconciliation into account.(b) Secure key length versus optical attenuation in the transmission line to Bob's detector for 2 × 10 8 measured samples.The equivalent fiber length was obtained by using an attenuation value of 0.2 dB/km which is standard for telecommunication fibers.The error bars are due to the accuracy of the measurement of the optical attenuation.The theoretical model was calculated by reconstructing the covariance matrix of the state corresponding to no attenuation (0 km) and using a reconciliation efficiency of β = 94.3 %.
(b) was measured by determining the strength of the 35.5 MHz phase modulation used to lock one of the squeezedlight sources 27 with Bob's homodyne detector.The error bars in the figure are due to the accuracy of this measurement.