Introduction

With the rise of quantum algorithms capable of breaking modern encryption schemes, there follows a global response to search for stronger security levels1,2,3. While the security of most current schemes relies on the complexity of solving difficult mathematical problems, quantum-mechanical laws can provide security against adversaries endowed with unlimited computational power for some tasks4,5. This type of security, known as information-theoretic security, motivates research towards a quantum internet6.

Modern communication networks rely on a handful of fundamental building blocks, known as cryptographic primitives7,8. These can be combined with one another to provide security in various applications such as message encryption, electronic voting, digital signatures, online banking, anonymous messaging, and software licensing, to name a few. In order to reach information-theoretic security through quantum primitives, information is typically encoded onto quantum properties of light, such as photonic path, time-bin, polarization, and photon number5. In the quantum realm, the uncertainty principle then ensures that any eavesdropper attempting to access quantum-encoded information, while unaware of the preparation basis, will alter the quantum states in a way that is detectable by the honest parties4,9.

For such quantum primitives, it is expected that quantum dot-based single-photon sources (QDS) can excel by generating photons on-demand, with high brightness and low multiphoton contribution10,11. In fact, source brightness is crucial in achieving high-speed quantum communication12,13, while low multiphoton contribution minimizes information leakage to a malicious eavesdropper14. In contrast to these on-demand single-photon sources, widely used Poisson-distributed sources (PDS), such as attenuated laser states5 and spontaneous parametric down-conversion15, suffer from a stringent trade-off between high brightness and low multiphoton emission. Despite elaborate countermeasures proposed to overcome this trade-off16,17, the distance and rate of secure quantum communication can be increased using on-demand single-photon sources.

Some pioneering works have already implemented instances of quantum key distribution (QKD) employing QDS18,19,20,21,22,23,24,25 or other single-photon sources26,27, comparing their performance to PDS in terms of secret key rate. In these works, brightness and purity are the sole figures of merit used to establish a comparison, while the additional tuning capabilities of QDS and their role in quantum cryptography have not yet been investigated.

In this work, we explore features of QDS to enhance the performance and security of quantum-cryptographic primitives, with an emphasis on telecom wavelengths. We first optimize and compare the brightness and single-photon purity of three main optical pumping schemes, using realistic intra-cavity simulations of quantum dot dynamics. We then show how photon-number coherence generated from QDS, experimentally demonstrated in28, can be erased or preserved to boost the performance of practical QKD, and match its fundamental security requirements17,29. We further explain how the field of mistrustful quantum cryptography7,8, not yet implemented with QDS, can significantly benefit from this feature. Our findings are designed to bridge the gap between the quantum dot and quantum cryptography communities: we optimize and benchmark QDS optical pumping schemes for four main quantum cryptographic primitives, exploiting the combined advantage of brightness, single-photon purity, and photon-number coherence. The studied primitives include quantum key distribution (standard BB84, decoy and twin-field)5,16,30,31, unforgeable quantum tokens32,33,34, quantum strong coin flipping35,36,37, and quantum bit commitment38,39,40 under storage assumptions.

Results

Comparison of pumping schemes

Solid-state single-photon sources can be excited under different optical pumping schemes, and we aim to provide a fair comparison of their performance for quantum cryptography. Using realistic intra-cavity simulations for GaAs-based QDS, we calculate the emitted photon-number occupations up to three photons for resonant excitation (RE), longitudinal phonon-assisted (LA) excitation and two-photon excitation (TPE). In Fig. 1, we then compare each scheme’s brightness and single-photon purity, and estimate the full-width-at-half-maximum excitation pulse length which maximizes both properties (marked with black symbols).

Fig. 1: Simulation of emission properties under different pumping schemes.
figure 1

Simulated brightness and single-photon purity for individual pumping schemes calculated from our numerical model (see Methods) for (a) resonant excitation (RE) between ground \(\left|G\right\rangle\) and exciton \(\left|X\right\rangle\) states, (b) longitudinal phonon-assisted excitation (LA) (c) two-photon excitation (TPE) between ground \(\left|G\right\rangle\) and biexciton \(\left|XX\right\rangle\) states. Insets show a schematic representation of each pumping scheme (the upper grey area in the LA sketch represents the vibrational quasi-continuum of the exciton state). Optimal FWHM pulse lengths are marked with black disks and circles, chosen pulse areas for maximum population inversion are \({\pi }_{{{{\rm{RE}}}}}\) for RE and πTPE for TPE, while we choose \(10{\pi }_{{{{\rm{RE}}}}}\) for LA. Simulation parameters are: dot-cavity coupling \(\hbar{g}\, = \,50\,{\mu}\mathrm{eV}\), radiative decay rate \(\hbar\)γ = 0.66 μeV, cavity loss rate \(\hbar\)κ = 379 μeV (yielding a Purcell factor of P = 10), initial system temperature T = 4.2K, electron confinement length 3 nm, and material properties typical for GaAs. Throughout the paper, we assume that photonic states are maximally pure in the photon-number basis for RE, i.e. expressed as \(\mathop{\sum }\nolimits_{n = 0}^{\infty }\sqrt{{p}_{n}}\left|n\right\rangle\), while they are expressed as diagonal states for LA and TPE, i.e. as \(\mathop{\sum }\nolimits_{n = 0}^{\infty }{p}_{n}\left|n\right\rangle \left\langle n\right|\).

Full size image

RE schemes are based on resonant excitation of a two-level system41,42,43. The spectral degeneracy of the excitation laser and the emitted photons usually imposes separation based on polarization filtering, which may cause significant collection losses of around 50%42,44. Other methods, exploiting dichromatic pumping or trion recombination in asymmetric cavities however, can overcome such limitations45,46. Since RE exhibits Rabi oscillations of the excitonic state populations, its brightness and single-photon purity are susceptible to pump power fluctuations—thus presenting challenges for quantum network applications47. As we show in Fig. 1a, for a fixed RE π-pulse area, single-photon purity decreases with pulse length due to re-excitation processes, while brightness decreases as the emission statistics tend to a Poisson distribution48,49.

The main limitations of RE may be overcome by using LA excitation schemes. Here, the pump energy is slightly higher than the relevant excitonic transition, and the fast emission of a longitudinal-acoustic (LA) phonon precedes the population of the excited state. Due to this additional incoherent step, Rabi oscillations vanish, and the purity of the emitted single photons becomes less sensitive to small pump power fluctuations50. Recently, it was shown that LA excitation can reach even smaller multiphoton components than its RE counterpart51, while still enabling spectral filtering of the pump52,53. As regards to brightness, Fig. 1b displays an increase with pulse length, as was experimentally demonstrated in52. With longer pulses however, the peak intensity decreases for a fixed pulse area, thus lowering the efficiency of the phonon excitation process.

RE and LA multiphoton contributions can be greatly reduced by addressing the exciton-biexciton cascade through TPE schemes, usually employed to generate spectrally-separated entangled photon pairs. Here, the re-excitation probability scales quadratically with the pulse length, as opposed to linearly in the resonantly-driven RE scheme49, which can reduce multiphoton emission by several orders of magnitude54. Moreover, TPE offers the possibility to overcome the collection efficiency limitations of RE: the spectral separation of the generated photons allows for frequency filtering of the pump laser55, avoiding the polarisation filtering losses. We show in Fig. 1c that the brightness is low for short pulse lengths, due to a remaining overlap with the exciton transition, causing the biexciton level to be only partially populated. Although the emitted exciton polarization is random, which would limit the brightness to half the values of Fig. 1c, recent works have shown the possibility of deterministically preparing the exciton polarization with near-unit brightness by adding a stimulated biexciton excitation after the original two-photon excitation56,57,58.

Photon-number coherence

We now discuss the presence of coherence in the photon-number basis, a usually disregarded feature of interest, under each excitation scheme. For PDS such as attenuated laser states, this quantity refers to a fixed phase relationship between the various Poisson-distributed number states. For QDS, this will materialize as a coherent superposition of vacuum, single and two-photon states.

In RE, it was experimentally demonstrated in28 that the coherently-driven Rabi oscillations translate into emitted photon-number coherence: values of coherence purity as high as 96% for π-pulse areas were measured. On the other hand, this coherence can gradually vanish as the pump is detuned from resonance in LA schemes, along with the vanishing of Rabi oscillations51. Our quantum dot dynamics simulations support these findings: for the optimal pulse lengths of Fig. 1, the normalized off-diagonal density matrix elements of LA between the vacuum and single-photon components are around 10 times smaller than the RE ones. Accordingly, we will assume in this work that states emitted under RE are pure in photon-number basis, while those emitted under LA present vanishing off-diagonal elements.

In TPE, our simulation results display off-diagonal elements around 20 times smaller than the RE ones. Although the biexciton level follows Rabi oscillations under resonant TPE54,55, loss of coherence arises from a radiative decay between the biexciton to exciton state, which creates a timing jitter similar to the phonon-induced jitter in LA schemes. We will therefore also assume that states emitted under TPE present vanishing off-diagonal elements. Note that this assumption is expected to hold for the stimulated schemes discussed in56,57,58, since the remaining jitter due to the biexciton transition is significantly larger than the jitter responsible for coherence erasure.

Practical sources and security

We now discuss the role of brightness, single-photon purity and photon-number coherence in quantum primitives involving two parties, exchanging a sequence of classical and quantum (photonic) messages that do not rely on quantum entanglement. Each of these primitives achieves a different functionality within quantum networks, and thus also requires its own security figure of merit.

The main efficiency limitations of PDS may be understood upon inspection of the generated state \(\mathop{\sum }\nolimits_{n = 0}^{\infty }{C}_{\mu }\left(n\right)\left|n\right\rangle\), where the \({P}_{\mu }\left(n\right)={\left|{C}_{\mu }\left(n\right)\right|}^{2}\) coefficients follow a Poisson distribution with average photon number μ, and \(\{\left|n\right\rangle \}\) span the photon-number basis. Increasing the source brightness (i.e., increasing μ) comes at the cost of increasing the multiphoton components n ⩾ 2, which renders the respective quantum primitive vulnerable to attacks involving photon number splitting on lossy channels14. Thus, μ is typically kept very low in quantum-cryptographic implementations, in the range μ ~ 0.005–0.55,32,35,39, which limits the communication rate. On the other hand, single-photon purity in QDS can be increased without an intrinsic penalty on the multiphoton component. Achieving higher QDS brightness is then ultimately a technological challenge, limited by the collection efficiency of the source11,46, and not a fundamental limitation as in the case of PDS.

In contrast to their PDS counterparts, QDS have not yet been optimized to suit the security requirements of quantum primitives. Most importantly, a main assumption behind the implementation of decoy QKD and other primitives is that the global phase of PDS must be actively scrambled, to effectively destroy the coherence in the number basis17,29:

$$\mathop{\sum }\limits_{n=0}^{\infty }{C}_{\mu }\left(n\right)\left|n\right\rangle\mathop{\longrightarrow}\limits^{\mathrm{phase}}_{\mathrm{scrambling}} \mathop{\sum }\limits_{n=0}^{\infty }{P}_{\mu }\left(n\right)\left|n\right\rangle \left\langle n\right|.$$
(1)

Under this assumption, the adversary’s cheating strategy is restricted to performing an attack conditioned on the photon-number content of each pulse. Many works rely on this feature to prove the security of quantum primitive implementations5,16,31,32,35.

Achieving phase randomization with active phase modulation or laser gain switching imposes practical limitations of a few GHz on repetition rates12,59. These limitations, combined with the low values of μ required due to fundamental PDS source statistics, can bring effective communication rates down to a few MHz. Unwanted remnants of coherence in the number basis, furthermore, can be exploited for a large spectrum of attacks, using unambiguous state discrimination for instance60,61. In contrast, as discussed in this work, QDS can be excited in such a way that this coherence is intrinsically suppressed, thus circumventing the need for active phase scrambling. With demonstrated Purcell-enhanced photon lifetimes of tens of picoseconds46,62 and source efficiencies now beyond the 50% level46, QDS have the potential to enable secure communication rates of tens of GHz13, i.e. around 3 orders of magnitude higher than effective PDS communication rates. This is not only true for QKD but for many quantum primitives as shown in the following sections.

Quantum key distribution

A few decades after the birth of quantum key distribution (QKD)4, experimentalists started demonstrating that QDS with low collection efficiencies can already outperform PDS in terms of secret key rate22,23,24,25. We first show that, while this is true for standard QKD implemented without the decoy-state countermeasure, beating PDS with decoy states16 requires much higher QDS collection efficiencies at an equal repetition rate. Our results, based on the optimal performance of pumping schemes in Fig. 1, are displayed in Fig. 2: without decoy states (a), QDS with collection efficiency 1% are enough to outperform PDS after 100 km, while infinite decoy schemes (b) require at least 30%. We should emphasize, however, that this benchmark must be scaled by a repetition rate factor for QDS which could achieve considerably higher repetition rates than phase-randomized PDS. Any state preparation losses, including modulator losses, can be absorbed in the QDS collection efficiency, and the resulting key rate inferred from Fig. 2. Comparisons can also be established using finite (and different) number of decoy intensities for QDS and PDS.

Fig. 2: Source comparison for three main QKD schemes.
figure 2

Simulated secret key rates using one-way classical post-processing82,83 for (a) BB84 without decoy states, (b) BB84 with infinite decoy states, (c) twin-field with infinite decoy states. The continuum in each plot shows the attainable key rates for QDS ranging from 1 to 100% collection efficiencies, with intermediate curves showing steps of 10%. The dashed line indicates the optimal performance of randomized-phase (RP) PDS. For QDS, pulse lengths were chosen to simultaneously maximize the brightness and single-photon purities from Fig. 1: 3 ps for RE, 8 ps for LA, 12 ps for TPE. Chosen pulse areas: \({\pi }_{{{{\rm{RE}}}}}\) for RE, \(10{\pi }_{{{{\rm{RE}}}}}\) for LA, πTPE for TPE. photon-number populations {pn} up to n = 3 were inferred from the subsequent values of brightness and single-photon purity. Parameters for all plots are: e = 2% single photon error rate, 0.21 dB/km single mode telecom fiber losses, Y0 = 10−9 dark count probability, unit detection efficiency, and error-correcting code inefficiency f = 1.2.

Full size image

The optimal pumping scheme for QKD then follows from Eq. 1: the states’ global phase must be uniformly randomized17,29, which implies that standard and decoy-state QKD should only be implemented with LA and TPE. Any remaining photon-number coherence will lead to a decrease in the secure key rate, as shown in29.

Twin-field QKD, on the other hand, requires two states, generated by Alice and Bob, to interfere on an untrusted party’s beamsplitter30,31. This forces Alice and Bob to scramble the global phase of their states in an active manner (using a modulator for instance), such that they can record their original fixed phase encoding. We therefore argue that twin-field schemes must be implemented with RE QDS, in order to provide the two parties with a shared phase reference before the scrambling. We simulate the protocol performance of31 under these conditions in Fig. 2c, assuming the implementation of decoy states. We note that performing TF-QKD with a perfect single photon source (RE π-pulse and unit single-photon purity) is impossible, since there is no accessible phase to encode the key information. However, by decreasing the pulse area a little below π, in the same manner as28, it is possible to create a coherent superposition of vacuum and single-photon, thus providing an accessible phase to perform the protocol.

Our results are focused on QKD implemented with discrete degrees of freedom, such as polarization or time-bin. For completeness, we note the existence of QKD protocols optimized for continuous degrees of freedom of PDS, such as phase and amplitude63. These can actually compete with discrete-variable QKD over metropolitan distances, using simpler technology, but are sensitive to larger attenuations due to heavier post-selection and noise estimation techniques64,65.

Quantum primitives beyond QKD

Quantum cryptography presents a broad spectrum of other primitives, many of which belong to the branch of mistrustful cryptography7,8: unlike in QKD, Alice and Bob are not collaborators, but adversaries wishing to compute a common function. Decoy-state methods are then more challenging to apply (although not impossible for all protocols), since Alice and Bob do not trust each other.

Remarkably, the desired security properties for such primitives can be very sensitive to photon-number coherence. In this instance, substituting PDS by appropriately optimized QDS can yield even more benefits than in QKD. To show this, we extend the practical security analyses of three mistrustful quantum primitives32,35,38 to the QDS framework, and estimate the QDS collection efficiencies required to outperform PDS for the relevant security figures of merit. Our performance results are summarized in Table 1 for all primitives.

Table 1 QDS performance for the main quantum primitives.
Full size table

We display the performance of QDS and PDS for one example primitive in Fig. 3: unforgeable quantum tokens. This primitive allows a central authority to issue tokens, comprised of quantum states, whose unforgeability is intrinsically guaranteed by the no-cloning theorem, thus requiring no hardware assumptions. One famous application is quantum money, which, in its private-key form, can prevent banknote forgery9, double-spending with credit cards32,66 and guarantee features such as user privacy34.

Fig. 3: Source comparison for unforgeable quantum tokens (quantum verification protocol from66).
figure 3

a Numerical noise tolerance as a function of source efficiency for RE, LA and TPE QDS, along with fixed-phase (FP) and randomized-phase (RP) PDS. Source efficiency is defined as 1 − e−μ for PDS and \(1-\mathop{\sum }\nolimits_{n = 0}^{\infty }{p}_{n}{(1-\eta )}^{n}\) for QDS, where η is the QDS collection efficiency. Photon-number populations {pn} emitted under different QDS excitation schemes were obtained from the brightness and single-photon purity results of Fig. 1, assuming the optimal pulse lengths marked in black. RE photonic states are assumed to be maximally pure in number basis, expressed as \(\mathop{\sum }\nolimits_{n = 0}^{\infty }\sqrt{{p}_{n}}\left|n\right\rangle\), while LA states were expressed as diagonal states \(\mathop{\sum }\nolimits_{n = 0}^{\infty }{p}_{n}\left|n\right\rangle \left\langle n\right|\). Colored circles indicate the performance of three state-of-the-art quantum dots, inferred from the experimental brightness and purity values reported in [A]=84, [B]=85, [C]=46, corrected to unit detector efficiency. Stars indicate the potential of these quantum dots assuming the reported collection losses, but no setup losses. b Numerical noise tolerance as a function of QDS collection efficiency, compared to the best performance of PDS sources (dashed line). c Numerical noise tolerance plotted as a function of distance, assuming single mode telecom fiber losses of 0.21 dB/km. The QDS collection efficiencies were chosen as the intersection points from (b), also summarized in Table 1.

Full size image

In Fig. 3a, we compare the noise tolerance of the quantum token scheme from66 for PDS and QDS as a function of source efficiency. Noise tolerance indicates how much experimental error rate can be tolerated such that the unforgeability property holds, while source efficiency is the probability that a threshold single-photon detector will click in a lossless setting. Naturally, PDS reach a maximal noise tolerance for source efficiencies around 63%, corresponding to μ ≈1, before dropping again when the multiphoton contribution becomes too significant. For QDS, we notice a striking difference between schemes with coherence (RE) and those without (LA and TPE): the latters give an overhead of almost 2% on the noise tolerance with respect to RE at high source efficiencies. This difference is crucial in making implementations feasible, since boosting the fidelity of quantum state preparation and quantum storage by a few percent can be extremely challenging. These differences are also reflected in Fig. 3b, which identifies the collection efficiencies at which QDS can outperform the best PDS performance: while LA and TPE require 44% and 38%, respectively, RE must be pushed to 47% to beat PDS. For information purposes, we also select three state-of-the art experimental QDS, and show how they would perform in such a beyond-QKD protocol with their reported values of brightness and single-photon purity.

Figure 3c finally compares the performance of each source as a function of distance. Once again, the difference between LA/TPE and RE is significant due to the coherence feature. We notice here that the maximal distance for all sources is much shorter than in QKD schemes, since our selected quantum token scheme bears a maximal loss tolerance of 50%: above this limit, an adversary can clone the quantum token without introducing any errors66.

Our work showcases the importance of engineering optical pumping schemes towards specific primitives. Table 1 displays non-trivial requirements for quantum strong coin flipping for instance: unlike with QKD and quantum tokens, QDS perform better at lower collection efficiencies, thus rendering state-of-the art QDS already capable of providing quantum advantage in such mistrustful primitives. Furthermore, the absence of photon number coherence in LA and TPE allow these schemes to reach quantum advantage over significantly longer distances than RE schemes: for the selected protocol from35, these values read 86 km and 36 km for TPE and LA, respectively, vs. 25 km for RE.

Discussion

We have estimated threshold collection efficiencies for which GaAs-based quantum-dot photon sources can outperform Poisson-distributed-based implementations in four main quantum-cryptographic primitives. The estimations include the combined effect of brightness, single-photon purity, and photon-number coherence. We have shown in particular that resonant excitation should be used for twin-field QKD, but not for decoy QKD and other quantum primitives due to the unwanted presence of photon-number coherence that violates practical security assumptions.

We believe that these results will provide a benchmark for future achievements in quantum dot cavity structures, especially at telecom wavelengths13,67,68,69. Although state-of-the-art dot-cavity simulation frameworks cannot account for all characteristics of quantum dots emitting in the telecom range, current telecom performance13,70,71 shows good agreement with our 900nm framework: the brightness and purities are not strongly dependent on the emission wavelength. Furthermore, frequency conversion of 900nm photons to telecom photons can currently reach efficiencies up to 57%72. These extra losses can be absorbed in our collection efficiency quantity.

We wish to encourage future quantum key distribution experiments with optimal pumping schemes, taking into account the security assumptions provided by the quantum cryptography community. Finally, we hope to stimulate experiments that explore the full potential of quantum dot-based single-photon sources for other quantum network primitives like unforgeable tokens32,33,34, coin flipping35,36 and bit commitment38,39,40. We believe our analysis can be extended in future works to multipartite entanglement-based quantum network primitives, such as secret sharing73 and anonymous messaging74.

Methods

Quantum dot dynamics

Our GaAs-based quantum dot, driven by a pulsed pump laser, is modelled either as a two- or a three-level system coupled to a single-mode microcavity in the Jaynes-Cummings manner. The interaction of the quantum dot with phonons is treated by the standard pure-dephasing Hamiltonian75,76,77,78. In this way, we solve for the dynamics of the dot-cavity system by employing a numerically exact path-integral formalism79,80,81. The detailed intra-cavity simulations, along with the derivation of the photon number populations, are presented in Supplementary Note 1.

Practical security analyses

Supplementary Notes 2 and 3 show how the collection efficiencies and state encodings are modelled, both in the presence and absence of photon number coherence, for PDS and QDS, respectively. Supplementary Note 4 provides some high-level descriptions of the four main quantum primitives, and displays all results justifying our claims. Supplementary Note 5 briefly introduces mathematical tools required to understand the security analyses, namely semidefinite programs and Choi’s theorem on completely positive maps. Supplementary Notes 6 to 10 provide the practical security analyses of all protocols, and the extensions to account for the presence of coherence in the QDS framework.