Conference key agreement in a quantum network

Quantum conference key agreement (QCKA) allows multiple users to establish a secure key from a shared multi-partite entangled state. In a quantum network, this protocol can be efficiently implemented using a single copy of a N-qubit Greenberger-Horne-Zeilinger (GHZ) state to distil a secure N-user conference key bit, whereas up to N-1 entanglement pairs are consumed in the traditional pair-wise protocol. We demonstrate the advantage provided by GHZ states in a testbed consisting of a photonic six-user quantum network, where four users can distil either a GHZ state or the required number of Bell pairs for QCKA using network routing techniques. In the asymptotic limit, we report a more than two-fold enhancement of the conference key rate when comparing the two protocols. We extrapolate our data set to show that the resource advantage for the GHZ protocol persists when taking into account finite-key effects.

One of the great promises of quantum technology is the development of quantum networks, which will allow global distribution of entanglement for tasks such as distributed quantum computing [1,2], distributed quantum sensing [3,4] and quantum-secure communication [5][6][7][8][9][10]. To leverage the full potential of quantum networks we require protocols that draw an efficiency advantage from genuine multi-partite entanglement as opposed to strictly pair-wise correlations such as Bell states. Multiuser entanglement such as Greenberger-Horne-Zeilinger (GHZ) states have already found application in quantum conference key agreement [11][12][13][14], quantum secret sharing [15][16][17] and quantum communication complexity problems [18,19].
In quantum conference key agreement (QCKA), N users aim to establish a common and identical secret key for group-wide encryption. Using standard two-party QKD schemes, this can be achieved by generating a set of N-1 pair-wise keys either via prepare-and-send schemes or via shared entangled Bell pairs [20,21]. The set of keys can then be used to algorithmically generate the conference key by performing a bit-wise XOR operation on the individual keys-we will refer to this as the '2QKD' approach. If the participating users are part of a network as depicted in Figure 1, a more resource-efficient protocol called 'NQKD' leverages multi-partite entanglement to obtain conference key bits directly from GHZ states supplied to all participating users. NQKD can outperform the 2QKD scheme by consuming up to N−1 times fewer network resources in constrained quantum † These two authors contributed equally. * Corresponding author: a.fedrizzi@hw.ac.uk networks [11,22]. QCKA was recently demonstrated in a four-user NQKD scenario where a four-photon GHZ state was transmitted over up to 50 km of telecom fibre [14]. However, a direct comparison showing the experimental resource advantage over the 2QKD approach in a quantum network has not yet been achieved.
In this work we consider the scenario of multi-user conference key agreement in a small-scale quantum network, as illustrated in Figure 1. The network comprises six users: Alice and three Bobs distil a secure conference key, while two non-participants, Charlie and Debbie, facilitate the operation of the network. This scenario, wherein participants of a protocol are indirectly connected via other non-participating users, is expected to naturally occur in future multi-node quantum networks that generate large-scale entanglement in the background. In order to efficiently distribute entanglement resources to requesting parties, we will use so-called network coding techniques [23][24][25] which involve local operations, quantum measurements and classical communication to alter the network connectivity. Using this network we implement the two QCKA approaches, i.e., NQKD and 2QKD, to demonstrate the resource advantage when using the multi-partite-entanglement-enabled protocol.
For the NQKD approach we consider the N-BB84 protocol [12] that was implemented in Ref. [14]. In each protocol round, an N-partite GHZ state is distributed among N users. Each user performs a measurement on their respective qubit according to a pre-agreed sequence of two possible measurements. In type-1 rounds each user measures their qubit in the Pauli Z-basis, exploiting the perfect Z-correlations for generation of the raw key; type-2 rounds correspond to jointly measuring in the Pauli Xbasis and are used for parameter estimation. Security is established by evaluating the phase error rate (Q X ) from  1. Conceptual illustration of a multi-node quantum network. Physical qubits are represented by nodes (circles), while edges (lines) represent pair-wise interactions that entangle the qubits within the wider network. Here, we define a network consisting of six users represented by nodes within the rounded rectangle. Within this network, four of the users may wish to perform quantum protocols such as conference key agreement. The traditional method involves distributing Bell pairs among the participants first, followed by post-processing steps to extract keys in a pairwise fashion before arriving at the final conference key as shown by the right path in blue. An alternative approach is to obtain a GHZ state and employ a multi-party quantum conference key agreement protocol to extract the key directly, as represented in the left red path.
the type-2 rounds and determining the quantum bit error rate (QBER) from a random subset of publicly disclosed type-1 outcomes. We can assess the performance of the N-BB84 protocol, in the limit of an infinite number of rounds, by determining these two parameters and calculating the asymptotic key rate (AKR) [12,14]. The AKR establishes the fractional secret key bit extracted for each copy of the resource state and is defined as, where is the binary entropy function. The explicit evaluation of QBER and Q X is detailed in the Methods.
In the case of 2QKD, users initially obtain sets of Bell states, rather than a GHZ state, from which they run pairwise BB84 protocols whose AKR is also given by the expression in (1). However, unlike in the NQKD approach, the 2QKD method involves obtaining N−1 unique, pairwise keys spanning the N-user group first. This is followed by a classical step, e.g., applying the bitwise XOR, to transform the individual keys into the final conference key [11]. As we will show in our experiment, depending on the underlying topology of the quantum network, this leads to the 2QKD approach requiring up to N−1 times more network resource states than NQKD.

Results
Quantum networking studies usually assume a basic universal building block, for example the 'ring' network from which larger networks can be constructed. A common feature of these building blocks is that they allow arbitrary pairs of nodes to share Bell pairs via network coding routines, which distill sub-graphs from a network via local measurements and the discarding of non-participating network nodes. The six-node quantum network we implement, Figure 2 (a), shares several features with the universal ring network, allowing us to directly compare GHZ-based QCKA and the Bell-pair-based 2QKD. We experimentally constructed the 6-photon network via a linear optics setup consisting of telecom-wavelength photon-pair sources and polarisation optics, see Methods for details.
We now outline the method of manipulating the 6-node graph state [23] via local complementation (LC) [23][24][25]. The LC operations on the six-photon graph results in a four-party GHZ state in modes {1, 2, 5, 6}, corresponding to four users, e.g., Alice, Bob-1, Bob-2 and Bob-3, implementing NQKD is shown in Figure 2(b). Conventionally, Alice denotes the party who co-ordinates the error correction and privacy amplification steps after the raw key is established [11,12,14]. We also include LC operations mapped to sets of single-qubit gates [25] in the circuit. Nodes 3 and 4 represent users Charlie and Debbie, who do not participate in the QCKA key generation. They measure their qubits in the Z basis then announce their outcomes, which allows the qubits to be coherently removed from the graph. The remaining four qubits are transformed into the star graph which is a locally equivalent to the four-party GHZ state [23] required for the NQKD protocol. We then construct measurement sequences consistent with type-1 and type-2 rounds, i.e., Z ⊗4 and X ⊗4 respectively, of the NQKD protocol.
The method for allocating Bell pairs in the network, for the 2QKD protocol, is shown in Figure 2(c). To generate a conference key among the four users, at least three pairwise keys are required. There are two sets of network transformations for obtaining three individual Bell pairs among the same group of four users that participated in the NQKD protocol. The top of Figure 2(c) shows how to obtain Bell pairs between nodes {1, 2} and {5, 6} respectively from a single copy of the network resource state. The bottom panel shows how a single Bell pair is established between modes {2, 5}. We similarly construct the measurement sequences corresponding to type-1 and type-2 rounds for each Bell pair, see Methods for details. The outcomes of type-1 and type-2 rounds are used to calculate the noise parameters QBER and Q X which are then used to evaluate the AKR using the expression in (1). This expression corresponds to the asymptotic conference key rate for the NQKD approach and we denote it as AKR N . For the 2QKD approach, we use Eq. (1) to compute the pairwise AKR of each BB84 protocol, denoted {r AB1 , r B2B3 , r AB2 }; the resulting asymptotic conference key rate is then obtained using the expression, In the ideal case where the AKR of each Bell pair is unity, we obtain AKR ideal 2 = 1/2 while for the NQKD case with an ideal four-party GHZ state we can attain AKR ideal N = 1. The expected ratio of the key rate advantage in favour of NQKD is therefore AKR ideal N : AKR ideal 2 = 2. This advantage originates from the ability to use a single copy of the network resource state to produce one secure bit of the conference key via NQKD, whereas in 2QKD each secure bit requires two copies of the network resource state.
We compare the experimental results of type-1 and type-2 measurements for both approaches in Figure 3. We set the pump power to each source to obtain an average six-photon detection rate of ∼ 0.0141 Hz for all measurements. This optical pumping regime was chosen to limit multi-photon events while still ensuring sufficient detection rates to collect statistics for each protocol, for details on the effect of optical pump parameters see Supplementary Materials. From the data in Figure 3 we calculate QBER and Q X , for each resource state. We then evaluate the asymptotic conference key rate for NQKD, AKR N = 0.093 (22) and for 2QKD, AKR 2 = 0.044 (15). We arrive at the experimentally measured ratio of the two approaches to be AKR exp N : AKR exp 2 = 2.13 (6). The uncertainties reported here are taken as one standard deviation from the average of samples via a Monte Carlo simulation which assumes Poissonian counting statistics. In practice, only a limited number of rounds can be performed and this necessitates accounting for finite-key effects in the conference key rate [14]. We perform a finite-key analysis for both NQKD and 2QKD by using the measured noise parameters for each resource state, see Table I, and by simulating the finite-key effects for a range of total rounds, L tot , where each round corresponds to a successful distribution of the shared resource state. The finite key rate expression for the NQKD approach is explicitly defined in Ref. [12,14], while its calculation for 2QKD presents some notable differences. In the 2QKD approach, the first step is to obtain three separate pairwise keys, whose length is given by the finite-key rate formula of the BB84 protocol (it can be recovered from the NQKD finite-key rate by setting the number of parties to two). The second step employs the established keys to distribute the final conference key via a one-time pad. As a result, the conference key length cannot exceed the shortest pair-wise key among the three established ones. Moreover, for a given security parameter associated to the conference key, ϵ tot , each bipartite key must be processed with a more stringent security parameter in order to recover ϵ tot through composability, which reduces the overall key rate. Furthermore, in 2QKD the total number of network resource states is subdivided among the three pairwise protocols, implying that each protocol can only rely on a smaller set of data, thereby increasing the weight of the statistical corrections in the key rate. By these arguments, we expect the NQKD approach to retain its advantage over 2QKD in the finite-key regime. Figure 4 reports the conference key rates with finite-key effects of both NQKD and 2QKD, where the total security parameter is fixed to: ϵ tot = 10 −8 . We observe that the advantage of the NQKD protocol over the 2QKD counterpart increases significantly in the finite-key regime. Remarkably, the minimal number of resource states required to distil a non-zero conference key is reduced by nearly one order of magnitude with NQKD. Conference key rate, with finite-key effects, as a function of the number of successful network usages (Ltot). The performance for the NQKD protocol is shown by the solid line, while the 2QKD protocol is given by the dashed line. Both assume a fixed total security parameter, ϵtot = 10 −8 .

Discussion
We have shown that, once genuine quantum networks capable of providing multi-node entanglement in the back-ground become available, NQKD conclusively outperforms 2QKD in terms of key rate per network use. The NQKD advantage is at best N − 1. Many graphs however will allow for a Bell state multi-cast [11,24], where more than one Bell pair can be distilled in a single network use between participating users. The graph we chose for our network demonstration allows precisely this, reducing the maximal theoretical NQKD advantage over 2QKD from three-fold to two-fold, thus providing the fairest possible comparison between the two QCKA protocols. In the Supplementary Discussion we investigate the option to multi-cast in the ring network.
Conversely, in a scenario with direct transmission of GHZ states over multiple quantum channels connecting Alice to the Bobs (as in [14]), NQKD is unlikely to achieve higher absolute rates than what is possible via 2QKD with state-of-the-art systems. GHZ state generation is currently probabilistic and slow, but will eventually catch up because deterministic multi-photon sources are on the development path for optical quantum computation. Even then, NQKD requires N photons to be detected simultaneously, which exponentiates the known rate-distance limit [26,27] in individual quantum channels. In 2QKD, N−1 photons can be transmitted and detected asynchronously, and the rate loss is therefore merely additive. This comparison becomes more complex once repeater nodes are incorporated into networks, as multi-hops and routing configurations need to be considered [28][29][30]. Indeed, when allowing for storage of quantum states at repeater nodes the transmission of GHZ states instead of Bell pairs can improve transmission distances, storage times and robustness to noise [31][32][33].
As one of the first multi-user quantum communication protocols with a network advantage, QCKA is now a very active research area. Protocols have been developed for measurement-device independent scenarios [30,34] and implementations with weak coherent states that might outperform N-photon GHZ state transmission [35,36]. Loss-resilient encoding of GHZ states for QCKA using error correction methods have also been proposed [37]. Studies of QCKA have raised fundamental questions about the type of entanglement that is useful in multiuser quantum communication. It has been shown that genuine multi-partite entanglement is not strictly required for QCKA [38]. Nonetheless, obtaining a non-zero conference key could be used as a witness for entanglement in a network [38,39].
It will be important to explore other network protocols that gain an advantage from multi-partite entanglement. One example is QCKA-based anonymous conference key agreement which generates a conference key while hiding the identities of the participants [40][41][42][43], theoretically achieving a significant advantage when using both GHZ states and Bell pairs [41] compared to using Bell pairs alone [44]. Quantum secret sharing [45] also gains a network advantage from GHZ states. Go-ing beyond communication protocols, it has been shown that distributed sensing can benefit from multi-partite entanglement shared between measurement nodes [46]. A key question for these protocols is whether the required multi-party sub-graphs can be obtained from a network efficiently. For networks based on graph states this has been answered in the affirmative [24] however generalisations to other resource states is an ongoing challenge [47]. Acknowledgements Author contributions AP and JH are co-first authors. MP, AF conceived the project. F Grasselli, AP, and JH developed the theoretical framework. AP, JH, AU, CLM, F Graffitti, and PB performed the experiment and collected the data. AP, JH analysed experimental data and prepared figures. All authors contributed to writing the manuscript.

Competing interests
The authors declare no competing interests.

Methods
Parameter estimation. In the N-BB84 protocol QBER is defined as the largest pair-wise error rate observed from the type-1 rounds, i.e., when all users measure jointly in the Z basis. For convenience we adopt a general labelling of a group of N users following the set, {A, B1, B2, ..., BN−1}. Thus for an N-GHZ state, errors in the Z basis occur when there is a non-zero probability that one of the Bobs obtains an outcome that differs from Alice. Explicitly, the QBER is defined as: where When evaluating the pair-wise error rates for different i, the role of Alice does not have to be assigned to a specific user. Rather, we can permute the role of Alice within the set of users, by updating the indices of each user. We find different maximum pair-wise error rates (QBER) depending on the permutation, due to noise being distributed unevenly among each of the six qubits of the resource state. By iterating through all permutations, we select the role of Alice based on yielding the lowest QBER, optimising the conference key rate. Phase error for a N-GHZ state can be estimated from X basis measurements. This is calculated by determining the deviation in measurement outcome from the expected correlations. This is expressed as, Both QBER and QX are zero in the absence of error and noise, indicating that there is no deviation from the expected behaviour of the GHZ state. For Bell states, both QBER and QX can be evaluated using the same expressions as above. However, since there are only two users sharing a Bell state we skip the step of permuting the role of Alice in the group.
Experimental layout. Photon pair sources-To produce the six-photon graph state we use three photon-pair sources which are optically pumped by a 1.3 picosecond Ti-Sapph laser that has a nominal repetition rate of 80 MHz. All three are type-II parametric down-conversion (PDC) sources based on domain-engineered aperiodically-poled KTP (aKTP) crystals that are optimally phase-matched for spectrally pure photon pairs at 1550 nm. We can therefore achieve twophoton interference visibilities of up to 98.6 ± 1.1%. For more details on the design of the crystals, please see Ref. [48]. High spectral purity is achieved without needing narrowband filters which improves collection efficiency and increases the overall detection rate. Each aKTP crystal is embedded in a polarisation-based Sagnac interferometer which can be optically pumped bidirectionally to produce polarisationentangled photon pairs [49], where |h⟩ and |v⟩ correspond to horizontal and vertical polarisation states respectively, and subscripts denote optical modes. We remark that the |Ψ − ⟩ Bell state can be transformed into the |Φ + ⟩ Bell state via a local operation using polarisation optics. Both Sagnac interferometers produced Bell states with purities of 0.9783(5) and 0.9706 (3). Lastly, we can configure one of the sources to produce separable states by optically pumping the Sagnac loop in one direction, thus generating the state | + +⟩ . = |dd⟩, where |d⟩ . = (|h⟩ + |v⟩) / √ 2 is the diagonal polarisation state.
The linear optical circuit responsible for producing the sixphoton graph state consists of three fusion gates [50] along with single-qubit gates on the respective modes, shown in Figure 2. The linear optical fusion gate is probabilistic, with a success rate of 1/2, however successful operation is heralded by the detection of one photon in each output of the gate. The overall success probability of all three fusion gates is 1/8. See Supplementary Methods for further experimental detail. After the network of fusion gates and upon detecting one photon in each of the six numbered modes, the joint quantum state of the system is given by, We remark that this state is equivalent to the six-photon graph state discussed in the main body of work, subject to a set of local rotations, where the target state is a graph state, |G⟩ target and H is the Hadamard gate.
After the fusion gates, the photons go to tomography stages which consist of a HWP, QWP and a PBS, after which photons are coupled into single mode fibres.
Graph state formalism. We use the graph state formalism to represent the transformations of the resource state used to distribute the GHZ state and Bell pairs between the four users. As the resource state is capable of distilling a GHZ state and sets of Bell pairs, this enables direct comparison of QCKA based on NQKD and 2QKD without changing the structure of the linear optical circuit. The general form of a graph state G = (V, E) reads: where CZi,j is the two-qubit controlled-Z gate acting on modes {i, j}, E is the list of edges connecting two vertices and |V | is the number of vertices of the graph. Using this notation, we define our target graph state as, For more details on this construction and the graph state formalism see Supplementary Methods.
One specific transformation within the graph state formalism is called local complementation (LC). An LC operation itself is comprised of two different unitaries. On a vertex designated as the target, the operation T = √ −i Xt is applied where, whilst each vertex neighbouring the target, the operation N = √ i Zn is applied where, Measurement sequences-After the fusion gates, each photon is sent to a tomography stage consisting of a set of controllable HWP and QWP then onto a PBS with both output ports fibre coupled. From the initial target graph |G⟩ target LC operations are used, transforming the initial graph into alternative graphs within the same entanglement class (or graph state orbit), whereby different combinations of Bell states or a single GHZ state can be obtained [25]. This is illustrated in Figure 2 in the main text.
We assign Alice, Bob-1, Charlie, Debbie, Bob-2 and Bob-3, to qubit numbers 1, 2, 3, 4, 5 and 6 respectively. To evaluate the AKR for a comparison between QCKA techniques, we need to calculate QZ (or QBER) and QX for each state that plays a part in the QCKA protocol. All single-qubit operations applied to the initial graph such that network users obtain the correct state and perform the correct measurements are encoded onto the measurement settings, including the LC operations. Obtaining a GHZ shared between Alice and the Bobs in the four-photon state space, to carry out QCKA with a multi-partite resource, Charlie and Debbie are required to make projections in the Z basis. So for each round of measurements, whilst Charlie and Debbie should always measure in the Z basis, Alice and the Bobs measurements are made based on whether they want to complete a type-1 round or type-2 round of the protocol. For example, to measure the observable ⟨Z1Z2Z5Z6⟩ of the GHZ state to evaluate the QBER, all users must measure the observable ⟨Z1Z2X3X4Z5Z6⟩, where the required single-qubit operations leave the default measurement settings unchanged for Alice and the Bobs, but rotate Charlie and Debbie's measurement settings. To measure the observable ⟨X1X2X5X6⟩ of the GHZ state to obtain QX, all network users must measure the observable ⟨X1Y2X3X4X5Y6⟩, where now single-qubit operations encoded onto the measurement settings correspond to rotations of measurements into a different basis. When Alice and the Bobs wish to partake in QCKA with bi-partite resources, the measurement procedure suitably follows that of the GHZ state, except now the observables are for Bell states, and alternate single-qubit operations-based on required rotations applied to the initial graph-are encoded onto these settings. Full blueprints containing the operations applied to each qubit within each measurement set are presented in Figure 2. The measured ⟨Z ⊗N ⟩ and ⟨X ⊗N ⟩ observables, where N is the qubit number, of the three Bell states and the GHZ state used in this protocol are presented in Figure 3.

Data availability
Data collected from the experimental work supporting the results reported in this manuscript, as well as the analysis, is available at https://gitlab.com/EMQlab/ conference-key-agreement-in-a-quantum-network.

Supplementary Methods
Here we outline how the six-qubit graph state in the experiment is mapped from the graph notation onto the linear optical circuit shown in Supplementary Figure 1. From the mathematical description of a graph (Equation 6 in the Methods of the main text) one can see that to prepare a graph state requires V qubits initialised as |+⟩ (equivalent to |d⟩ in polarisation encoding), connected via CZ gates between specific qubits classified by E. The graph state generated in this work can be mapped onto a general circuit model depiction which consists of six qubits initialised in |+⟩ and five CZ gates. Directly translating the circuit model depiction into an experimentally realisable linear optical circuit leads to large inefficiencies. Realising CZ gates with linear optics results in a low probability of success of 1/9 per gate [1][2][3]. Instead, we found a linear optical circuit that could produce a state equivalent to the targeted graph state (up to local rotations) based on linear optical fusion gates, which have a much higher probability of success of 1/2. Explicitly realising this linear optical circuit does require some entangled resources, namely two Bell pairs as well as a pair of separable photons. Three linear optical fusion gates are then used to generate multi-photon entanglement, producing the desired state. Finding the translation to a linear optical circuit enabled the investigation in this work, as the general circuit model approach carries a probability of success of 1/59,049. Our arrangement has a probability of success of 1/8.
We generate photon pairs using type-II parametric down-conversion (PDC) sources that operate in the filter-less regime, owed to the fact we employ domain engineering techniques to modify the phase-matching function (PMF) of the down-conversion process. Despite our aperiodically poled KTP (aKTP) crystals operating without filters, two-photon interference visibilities of up to 98.6 ± 1.1% are still obtainable, meaning we carry forward minimal errors after any instances of two-photon interference. Without lossy spectral filters we can also access heralding efficiencies of up to 67.5% [4].
We use a pulsed Ti:saphh laser with a central wavelength of 774.9nm producing photon pairs in a degenerate condition at 1549.8nm. These wavelengths were chosen to keep the crystal temperatures sufficiently far away from room temperature. This laser operates with a pulse duration of 1.3ps, matching the pump-envelope function (PEF) bandwidth to the PMF bandwidth at a repetition rate of 80MHz.
For generating Bell states, we place our PDC sources inside a Sagnac interferometer, where a pump photon generates signal and idler pairs in either a clockwise or anti-clockwise direction depending on the polarisation state of the pump photon. When the pump photon is equally likely to produce photons in the clockwise direction and the anti-clockwise direction an entangled state is generated. This configuration explicitly consists of a Glan-Taylor prism, which ensures the pump is in a linear polarisation state followed by a HWP which rotates this linear polarisation state into |d⟩ for generating an entangled state, or a linear basis state for generating a separable state. After the pump polarisation state is prepared, it is transmitted through a dichroic mirror (DM) which only reflects the down converted photons propagating back towards the pump. The pump is then probabilistically split on a dual-wavelength polarising beamsplitter (dPBS) into transmitted or reflected spatial modes. In the transmitted mode, the pump photon is in the |h p ⟩ polarisation state and will generate signal and idler pairs in a clockwise direction. In the reflected mode, the pump photon is rotated from |v p ⟩ into |h p ⟩ by a dual-wavelength HWP (dHWP) to facilitate type-II PDC in the anti-clockwise direction. When photons are generated from a pump photon in the transmitted mode of the dPBS, the down-converted pair are each rotated by the dHWP, which acts to fix the temporal offset the different set of photon pairs possess, before being split by the dPBS and collected into SMFs [5]. Upon collection, the signal and idler pairs exist in a maximally entangled state To generate the six-photon state presented in this work, we prepare two Bell states as |Φ + ⟩ (which are equivalent to |Ψ − ⟩ up to local rotations) in modes {1, 2} and {5, 6} and a single separable state prepared as |dd⟩ in modes {3, 4}. We employ linear plate polarisers (LPPs) to prepare the state |dd⟩. The required unitaries for Bell state preparation are performed with manual fibre polarisation controllers (FPCs). These unitaries act between the sources and fusion gates. The fusion gates consist of imposing two input optical modes, launched from SMFs, onto a PBS. Each output modes of the PBS are then collected into SMFs. A successful fusion operation occurs when there is one and only one photon in each output optical mode. This means that for the full circuit to be successful, only a single photon should be in the six optical modes after the three fusion gates. Within each fusion gate there are additional optics to correct for the local phase that the PBS within each of these gates introduces. The correction optics are made up of a HWP sandwiched between two QWPs. Fusion gate 1 (F 1) acts between modes {2, 3}, fusion gate 2 (F 2) between {4, 5} and finally, fusion gate 3 (F 3) acts between one of the outputs of both F 1 and F 2, in modes {3, 4}. The only difference between these gates is the presence of an additional HWP, just before the PBS within F 3, which is present to apply a single-qubit Hadamard gate. Final FPCs situated directly after the fusion gates ensure that photons undergo an identity operation between the fusion gates and measurement. Only the detection of a six-fold event (six photons arriving individually across all six optical modes comprised of daughter PDC photons created from the same pump pulse train) heralds the success of all three fusion gates, even in our case where the outputs of F 1 and F 2 feed directly into the input of F 3.
The final part of the circuit is comprised of measurement stages which consist of a QWP, HWP and PBS. These stages perform projective measurements. The measured photons are detected using superconducting nano-wire single photon detectors that operate at quantum efficiencies > 80% at our wavelengths. Detection events are processed by time-tagging logic. A full schematic of the experimental arrangement can be seen in Supplementary Figure 3.
All rotations required to allow Alice and Bobs to share different resource states among them are encoded onto the measurement settings. Supplementary Figure 2 is an example of the experimental arrangement for a round in which Alice and the Bobs wish to share a GHZ state. The single-qubit operations acting on each mode after the creation of the resource state, highlighted in yellow and orange within Supplementary Figure 2, are applied to each qubit upon measurement, meaning that each user is provided with measurement settings required to extract different states from the shared network resource state. In this way, entanglement amongst a subset of the six network users can be allocated in a dynamic way. To determine the correct measurements users have to perform, we first decide which type of measurement round being performed, either type-1 or type-2. For both measurement types we already know that Charlie and Debbie, modes {3,4}, are required to measure in the Z-basis, so operations on their qubits are encoded onto their measurement basis. Settings on Alice and Bobs qubits, or modes {1,2,5,6}, do depend on which type of round is being performed. If a type-1 round is taking place, then their starting measurement basis is Z, and the single qubit operations on that mode are applied to rotate (or leave unchanged) this measurement basis. Likewise for type-2 rounds. Hence, as shown in the Methods section, the measurement ⟨Z 1 Z 2 Z 3 Z 4 Z 5 Z 6 ⟩ to complete a type-1 round actually requires the measurement ⟨Z 1 Z 2 X 3 X 4 Z 5 Z 6 ⟩ after rotation have been applied, and the measurement As a consequence of the GME implicit of the shared network resource state, whenever Charlie and Debbie perform a measurement they need to disentangle themselves from the system coherently. When Charlie and Debbie measurements are in the X basis (due to rotations), they can attain either 0 or 1 as their result. The resulting GHZ may contain a local phase rotation conditioned on the outcomes of Charlie and Debbie. This rotation must be corrected for and is done so in a post-processing step. The measurement results used for constructing and then measuring the correct noise parameters for each of the distilled states are shown in Supplementary Figure 4 The work contained within this manuscript focuses on an investigation into a network protocol, where the particular scenario demands the distribution of a GHZ and a number of Bell states to specific users. For the determining how to obtain states, we use a software library which can manipulate graph states based on available experimental    transformations. This lets us form a search of available smaller resource states a given graph can produce. The search is brute-force, emanating from the fact that transforming graphs, or more generally stabilizer states, into tensor products of bipartite Bell pairs, or just a set of Bell pairs between specific vertices, using only a certain class of local operations and classical communication is a NP-complete problem [6]. Likewise for GHZ state distillation from arbitrary graphs, if we wish to arrive at a GHZ state between a specific set of vertices [7] or if we require a GHZ state of fixed size [8], the task is NP-complete.
Assessing the performance of the protocol at a variety of different six-photon generation rates, reveals how the rates scale with noise. The main source of noise that degrades the quality of the prepared state is from higher order photon pair emissions due to the probabilistic nature of PDC sources. Even whilst operating with a post-selection criteria, higher order emission events can trigger detection patterns identical to that of the signal. These higher order emission terms result in a reduction to the magnitude of coherence, as events from incorrect pair generation events interfere with signal photons and degrade the purity of the state. The relation between the overall noise and the AKR is not trivial, partly due to the fact noise is not symmetrically distributed across the quantum state. This is evidenced by the different QBER and Q X for each of the Bell states derived from the same resource state. Multi-photon generation rate from a PDC source is not linear with respect to the amount of optical pump power applied to the non-linear crystal. The benefit of having higher pump powers is a larger N-fold generation rate. A caveat to this relationship is the additional noise generated by the presence of > N photons consequential of the probabilistic nature of the PDC sources. As such, to attain the highest possible key generation rate, a power dependence measurement is requiredthis will reveal the ideal power to operate the protocol at. By computing the product of the AKR, which will fall with respect to an increase in pump power, and the raw photon generation rate, which will increase as a function of the pump power, the key generation rate can be calculated. Supplementary Figure 5 presents the scaling of AKR, generation rate and ultimately the key generation rate as a function of pump power, revealing that the highest key generation rate is at ∼105 mW. Power ( (mW) ) Power ( (mW) ) Supplementary Figure 5. AKR, raw photon generation rate and key generation rate as a function of the pump power. (a) Data points correspond to the AKR from experimentally measured noise terms for NQKD and 2QKD. For each dataset a linear fit has been used to extrapolate the expected performance. (b) The measured 6-fold rate as a function of pump power is shown. A line of best fit assuming a cubic function has been used. (c) The key generation rate is a product of both the AKR and the raw generation rate. The ideal pump power is ∼ 105 mW in order to obtain the highest overall key generation rate for QCKA.

Supplementary Discussion
We remark that owing to the non-deterministic operation of the fusion gates and photon sources in this experiment, all six users must detect a single photon in their measurement stages to obtain the correct graph state. It would be an interesting prospect to determine whether this graph state inherits any loss robustness for the purposes of QCKA, or indeed other applications when deterministic sources and gates are used to generate them. Starting form |G⟩ initial , to achieve two Bell states between {1, 2} and {5, 6} all that is required-in principle-is a single Z basis measurement on qubit 4, tolerating the loss of qubit 3 and still adhering to the graph state formalism.
In this work, we chose to generate the resource graph state |G⟩ initial based on its accessibility with probabilistic photon sources and linear optical components. If we had generated a N qubit GHZ state and distributed this amongst network users, the rate advantage for NQKD scales as N − 1. We however, showed a rate advantage for the NQKD approach which did not scale as N − 1, but a rate advantage of a factor of two, due to the ability to multi-cast Bell pairs from the shared resource state. Interestingly, there are families of graph states where the rate advantage can be Supplementary Figure 6. Ring graph state and operations required to obtain smaller network resource states. The ring graph can be used in a similar means to |G⟩ initial to compare the key rates of different approaches to QCKA. Four users-in this illustration {1, 3, 5, 6}-are designated as the network users. These four users can attain pair-wise correlations with each other upon the application of Z measurements or X measurements by the two remaining users. Whilst there are several ways to obtain a GHZ state from the ring graph, we show how to obtain the state from measurements in the Pauli basis.
reduced even further. In a similar scenario to the work in the main text, the ring graph is capable of distributing a GHZ state and Bell states to network users. Using the ring graph as a network resources can allow users to cast pairs of Bell states in every round, differing from the graph used for investigations within this work. Because of this, there is more contribution to the overall key per network usage due to more pair-wise key distribution within the 2QKD rounds. Supplementary Figure 6 shows the operations required to obtain smaller network resources from the ring graph state. Like in the main text, all operations are either local rotations or single-qubit projection measurements.