Improved security bound for the round-robin-differential-phase-shift quantum key distribution

The round-robin-differential-phase-shift (RRDPS) quantum key distribution (QKD) protocol has attracted intensive study due to its distinct security characteristics; e.g., information leakage is bounded without learning the error rate of key bits. Nevertheless, its practicality and performance are still not satisfactory. Here, by observing the phase randomization of the encoding states and its connection with eavesdropper’s attack, we develop an improved bound on information leakage. Interestingly, our theory is especially useful for implementations with short trains of pulses, and running without monitoring signal disturbance is still available. As a result, the practicality and performance of RRDPS are improved. Furthermore, we realize a proof-of-principle experiment with up to 140 km of fiber, which has been the longest achievable distance of RRDPS until now, whereas the original theory predicted that no secret key could be generated in our experiment. Our results will help in bringing practical RRDPS closer to practical implementations.

where, e ij ⟩ is the quantum state of Eve's ancilla. Without loss of generality, we assume c ij 0 and ∑ L j=1 c 2 ij 1, where the reason of setting ∑ L j=1 c 2 ij 1 is that Eve may introduce vacuum state. For each trial, Eve only retains her ancilla e ij ⟩ to obtain maximum information on key bits. In RRDPS protocol, Bob measures the phase shift between |i⟩ and |j⟩ of the incoming single photon states. If Bob projects the incoming single photon states into (|a⟩ ± |b⟩)/ √ 2 successfully, he will announce {a, b}(a < b) to Alice, who will calculate k a ⊕ k b as her sifted key. The evolution of quantum state is given by |ψ⟩|e 00 ⟩ −→(−1) ka (c aa |a⟩ +c ab |b⟩) + (−1) k b (c bb |b⟩ +c ba |a⟩) where,c ij c ij e ij ⟩ . The density matrix (non-normallized) of Eve's ancilla will be where P {|x⟩} = |x⟩⟨x|. Eve aims to guess k a ⊕ k b after Bob reveals the values of a and b. Next, we try to simplify Eve's density matrix. Since k i (i ̸ = a, b) equals to 0, 1 randomly, the relative phase between |e aa ⟩(|e bb ⟩) and |e ia ⟩(|e bb ⟩), i ̸ = a, b, will be randomized. In other words, we have the following consideration Based on the above equation, if k a + k b = 0, the density matrix (non-normalized) of Eve's ancilla |e⟩ will be ρ (a,b) 0 If k a + k b = 1, the density matrix of Eve's ancilla |e⟩ will be Without compromising the security, we can assume that ⟨ e im |e jn ⟩ = δ ij δ mn . Then, Eve's information on k a ⊕ k b is given by the Holevo bound [1], which is where, is the yield for any a, b, φ(x 2 , y 2 ) = −x 2 log 2 x 2 − y 2 log 2 y 2 + (x 2 + y 2 ) log 2 (x 2 + y 2 ). Thus Eve's information on raw key bit is Note that φ(x 2 , y 2 ) is a concave function, then using the Jensen's inequality, we have where, we define By searching the maximum of above function with free non-negative variables x 1 and x 2 (x 1 + x 2 > 0), we can obtain the maximal information leaked to Eve. Next, we try to bound I AE further tightly by finding the relationship between x 1 and x 2 .
Intuitively, the parameters x 1 and x 2 may depend on the error rate of the sifted key bit. In the following, we try to introduce the error rate into the security proof of RRDPS protocol. According to Eq.(2), when k a + k b = 0, the probability of Bob obtaining an error bit is In the case that k a + k b = 1, the probability of Bob obtaining We are ready to give the relation between error rate E (a,b) and c ij , which is given by Furthermore, the error for all sifted key bits is Thus, we have x 2 /(x 1 + x 2 ) 2(L − 1)E/(L − 2). In conclusion, with this relation, we can calculate a more tighter bound of I AE with (10).

SUPPLEMENTARY NOTE 2 -SECURITY PROOF IN THE TWO-PHOTON CASE
Alice randomly prepares the two-photon state |ψ⟩ = 1} is Alice's raw key bit, and |ij⟩(i ∈ {1, .., L}) represents that there is one photon in the i-th and j-th time-bins respectively. Similar to the single photon case, Eve's general collective attack in two-photon case can be given by: When Bob projects the incoming single photon states into (|a⟩ ± |b⟩)/ √ 2 successfully, the evolution of quantum state will be For the ease of presentation, we denote c ijl e ijl ⟩ asc ijl , and if i > j for some c ijl , we should recognize it as c jil . For ∑ ic iil , we further simplify it asc l . Clearly, as a result of the random phase (−1) ki , i ̸ = a, b, Eve's state collapses into a mixture state given by Now based on very similar considerations in single photon case, we write Eve's information as Furthermore, we have where, Here, to obtain (19) we used the Jensen's inequality and the following mathematical observations: hold for any non-negative array. Next we try to analyze the restrictions on x 1 , x 2 and x 3 with the help of error rate E. We return to Eq.(16), it's straightforward to see that the probability for error key events from the first row of Eq. (16) is where, we used the Cauchy-Schwartz inequality twice. And the probability for error-key events from the third row of Eq. (16) is Summing over the Eq. (22) and (23), dividing by This ends the analyses on two-photon case.

SUPPLEMENTARY NOTE 3 -SECURITY PROOF IN THE THREE-PHOTON CASE
Alice randomly prepares the three-photon state where k i , k j , k l ∈ {0, 1} are Alice's raw key bit, and |ijl⟩(i, j, l ∈ {1, .., L}) represents that there is one photon in the i-th, j-th and l-th time-bins respectively. Similar to the single photon case, Eve's general collective attack in three-photon case can be given by: When Bob projects the incoming single photon states into (|a⟩ ± |b⟩)/ √ 2 successfully, the evolution of quantum state will be |ψ⟩|e 0000 ⟩ −→(−1) ka (c aa |a⟩ +c ab |b⟩) + (−1) k b (c bb |b⟩ +c ba |a⟩) where,c ij We have observed that its first row and third row have very similar same form with the evolution of single photon given by Eq.(2), while the second row has the similar form with the first row of Eq.(16). Thus, analogous to the calculations in single photon and two-photon cases, we have where, Here, to obtain (28) we used the Jensen's inequality and the following mathematical observations: hold for any non-negative array. Next we try to analyze the restrictions on x 1 , x 2 and x 3 with the help of error rate E. Based on similar method in last subsection, we have where, we used Cauchy-Schwartz inequality and the following mathematical identity ∑ a<b ∑ i<j<l,i,j,l̸ =a,b always holds.
This ends the analyses on three-photon case.

SUPPLEMENTARY NOTE 4 -SECURITY PROOF IN THE FOUR-PHOTON CASE
Alice randomly prepares the four-photon state where we treat the efficiencies as part of quantum state, e.g., a|ijlm⟩ is simply denoted by |ijlm⟩. Similar to the single photon case, Eve's general collective attack in four-photon case can be given by: When Bob projects the incoming single photon states into (|a⟩ ± |b⟩)/ √ 2 successfully, the evolution of quantum state will be |ψ⟩|e 00000 ⟩ −→(c a |a⟩ +c b |b⟩) + (−1) ka+k b (c aba |a⟩ +c abb |b⟩) Clearly, each row has the same pattern with evolution of two-photon case. Based on similar techniques used in last three subsections, we have where, And these parameters are constrained by the error rate E, This ends the analyses on four-photon case.

SUPPLEMENTARY NOTE 5 -SECURITY PROOF IN THE ODD PHOTON-NUMBER CASE
Alice randomly prepares an encoding state like before, but the photon-number N is an odd number and L N + 1. It is clear that her encoding state has the form i.e., it consists of n-phase (n = 1, 3, 5, ..., N ) state, denoted by |i 1 i 2 ..i n ⟩. For example, |i 1 i 2 ...i n ⟩ represents that the photon number in time-bins i 1 , i 2 ,..., and i n must be odd, while the photon numbers in all other time-bins must be even. Eve's general collective attack in this case can be given by: When Bob projects the incoming single photon states into (|a⟩ ± |b⟩)/ √ 2 successfully, the evolution of quantum state will be Evidently, for each summation we can calculate Eve's information. Specifically, for the summations with the global phase (−1) ki 1 +..+ki n and n is odd, we obtain For the summations with the global phase (−1) ki 1 +..+ki n and n is even, we obtain Noting the following mathematical identities ∑ a<b c aa 2 + c bb And define Combining Eqs. (42), (43), (44) and (45) (46) Besides, with Eqs.(39), (40) and (45), it's easy to verify ∑ a<b Q (a,b) = (L − 1)(x 1 + x 2 + ... + x N +1 ). In conclusion, Eve's information is Through calculating the probabilities of error-key events corresponds to the n-th (n is even) row of Eq. (41), we obtain that the error rate E must satisfy This ends the security proof for odd photon-number case.

SUPPLEMENTARY NOTE 6 -SECURITY PROOF IN THE EVEN PHOTON-NUMBER CASE
Alice randomly prepares an encoding state like before, but the photon-number N is an even number and L N + 1. It is clear that her encoding state has the form i.e., it consists of n-phase (n = 0, 2, 4, ..., N ) state, denoted by |i 1 i 2 ..i n ⟩. For example, |i 1 i 2 ...i n ⟩ represents that the photon number in time-bins i 1 , i 2 ,..., and i n must be odd, while the photon numbers in all other time-bins must be even. Eve's general collective attack in this case can be given by: When Bob projects the incoming single photon states into (|a⟩ ± |b⟩)/ √ 2 successfully, the evolution of quantum state will be Evidently, for each summation we can calculate Eve's information. Specifically, for the summations with the global phase (−1) ki 1 +..+ki n and n is even, we obtain For the summations with the global phase (−1) ki 1 +..+ki n and n is odd, we obtain

SUPPLEMENTARY NOTE 7 -CONCLUSION IN GENERAL N-PHOTON CASE
We summarize and simplify the results given by the even photon-number and odd photon-number cases here. For a RRDPS protocol with N photon-number source, packet size L and L N + 1, Eve's information can by bounded by where, φ(x, y) = −x log 2 x − y log 2 y + (x + y) log 2 (x + y), and non-negative real parameters x i satisfying ∑ N +1 i=1 x i = 1. If Alice and Bob make sure that their error rate is E, then the parameters will also satisfy that: if N is odd, if N is even, Base one above results, a corollary is straightforward which is: for any N < L − 1, I AE < 1 holds. Lets prove this corollary by reduction to absurdity. We consider I AE = 1 in case of N < L − 1. According to the property of φ(x, y) function, Evidently, this suggests that x N +1 = 0, which leads to φ((L − N )x N , x N +1 ) = 0. Then Eq.(61) is rewritten as which implies x N = 0. Through repeating above arguments for N times, we obtain that x n = 0(n = 2, 3, 4..) and I AE = 0, which conflicts with I AE = 1. This ends the proof of this corollary.