Phase self-aligned continuous-variable measurement-device-independent quantum key distribution

Continuous-variable measurement-independent-device quantum key distribution (CV-MDI-QKD) can offer high secure key rate at metropolitan distance and remove all side channel loopholes of detection as well. However, there is no in-field experimental demonstration of CV-MDI-QKD due to the remote distance phase-locking techniques challenge. Here, we present a new optical scheme to overcome this difficulty and also removes the requirement of two identical independent lasers. Furthermore, we give an alternate but detailed proof of the minimized key rate condition to extract the secure key rate. We anticipate that our new scheme can be used to demonstrate the in-field CV-MDI-QKD experiment and build the CV-MDI-QKD network with untrusted source.

the main challenge is that remote distance phase-locking technique is necessary to achieve correct CV BSM. However, this requirement is not needed in DV-MDI-QKD due to the fact that the two-photon Hong-Ou-Mandel interference is phase unrelated 55 .
In this paper, we present a new optical scheme to solve the common phase-reference problem. The central idea of this new optical scheme is that reliable phase reference can be established by transmitting the two laser pulses quantum states through the same optical path, such as optical fiber or free space. Compared with the previous protocol 49 , a pair of Faraday mirrors (FM) and several polarization beam splitters (PBS) are needed 56,57 . No complicated active or passive phase-locking or compensation technology is required in this new scheme, which greatly simplifies the experimental realization of CV-MDI-QKD. Similar structures has already been successfully used in a proof-of-principle experimental demonstration of quantum fingerprinting beating the classical limit 58 . Furthermore, we give an alternate but detailed proof of the minimized key rate condition to extract the secure key rate, which has been used and first proved in ref. 49 .

Results
Phase self-aligned CV-MDI-QKD. The basic idea of CV-MDI-QKD protocol is shown in Fig. 1. It includes the following major steps [49][50][51] : (1) Alice and Bob prepare the sequence of Gaussian-modulated coherent states |x A + ip A 〉 and |x B + ip B 〉, respectively. (2) The quantum states are transmitted through insecure quantum links to the untrusted relay for CV BSM. . The measurements together give γ = + − +x ip ( ) / 2 with the probability p(γ), and the results γ are transmitted to both Alice and Bob through the public channel. (4) Based on the measurement results, Alice or Bob confirms the other's state value, then correlation is built. (5) Similar with the usual CV-QKD protocol, through error correction and privacy amplification, a secure key is acquired. Figure 2 shows the detailed structure of our new scheme with optical fiber. The laser pulse goes through a polarization maintaining fiber PBS (PMF-PBS) to filter out its horizonal (H) polarized component. Then after a polarization maintaining optical circulator, the laser pulse directly goes through a balanced PMF beam splitter (PMF-BS) and be splitted into two identical laser pulses that each will be finally transmitted to Alice and Bob for CV encoding. Meanwhile, this PMF-BS will be reused in the CV BSM later. For simplicity, we name the two identical laser pulses as the left and right pulse. Here, we take the optical transmission process of the left pulse as an example. The left pulse goes out of the PMF-BS and into a PMF-PBS, due to its H polarization, it transmits through the PMF-PBS. Through a long distance single mode optical fiber, the left pulse goes into Alice's port. All the modulators are not working at this moment. The left pulse is then reflected by the FM, changing its polarization to vertical (V) polarization. Once the left pulse is transmitted back to the PMF-PBS, due to the change of its polarization it is reflected this time and going to the right branch of this set. Then it meets another PMF-PBS and again reflected. The left pulse is transmitted to Bob's port through another long distance single mode optical fiber, then it is reflected by FM. Once reflected, the polarization is restored back to H, and Bob prepares his CV Gaussian-modulated quantum states. The modulated left pulse goes back to the PMF-PBS, due to its H polarization, it transmits through the PMF-PBS and back to the balanced PMF-BS of untrusted relay for CV BSM. As for the right pulse, the process is quite similar, except that the modulation process takes place at Alice's port. The CV quantum states prepared by Alice and Bob will stably interfere due to the two identical laser pulses go through the same optical path. In another word, the phase-reference is self-aligned. By the way, a π/2 phase modulation to the encoded pulse back from Bob's port is added for CV Bell detection purpose 49 . For simplified, the additional π/2 phase can be directly implemented in Bob's quantum states preparation stage. It's worth noting that the idea The secure key rate and simulation result. The security of general CV-MDI-QKD protocol has been analyzed under two kinds of quantum attack. One is using two independent entanglement cloners 50,51 , each attacking the channel between the relay and Alice or Bob independently. This kind of attack just extends the one-channel entanglement cloner attack in CV-QKD protocol to two channels independently. The other kind of attack is more general 49 , two ancillary modes from a reservoir of ancillas each attacks one of the two channels. These two ancillary modes may be correlated, which means the first kind of attack is nothing but a special condition of the second kind of attack. It has been proven that the most effective attack is when the two ancillary modes are entangled 49 , and this is also the most powerful attack of Eve can launch in the CV-MDI-QKD protocol.
Here, we follow the security analysis in ref. 49 . For general two channel attack, the two Gaussian ancillas can be described by the following covariance matrix 49 . Where ω A and ω B are the eigen-frequencies of these two ancillas, while G stands for the correlation between two ancillary modes with corresponding parameters g and g′.
Here we assume that Alice's raw key is the reference. For simplify, we ignore the Trojan-horse attack in the quantum states preparation. The Trojan-horse attack of untrusted source in plug-and-play structure will be discussed in discussion section later. With the ideal Gaussian modulation variance ϕ  1, the secure key rate of CV-MDI-QKD protocol R can be given by 49 In the proof-of-principle CV-MDI-QKD experiment 49 , the modulation variance ϕ = 60 has been achieved, so the ideal modulation assumption is a good approximation. As for reconciliation efficiency ξ = 0.97 can be achieved 38 , which is very close to 1. The difference seems minor but has a major impact on the rate, improving ξ is a major task in nowadays CV-QKD research. When the transmission efficiency τ A = τ B = τ, i.e., the symmetric condition, the secure key rate of CV-MDI-QKD under the realistic condition can be given by . When the transmission efficiency τ A ≠ τ B , i.e., the asymmetric condition, the secure key rate of CV-MDI-QKD under the realistic condition can be given by Follow the discussion in ref. 49 , two situations need to be considered: one is that Alice and Bob know the transmissivities (τ A and τ B ) and the thermal noise affecting each link (ω A and ω B ). Then they must calculate the lower bound of the key rate for various g and g′. To determine Eve's best strategy and give a lower bound of the key rate is of central importance in any QKD protocol 1-3 , since overestimate of the rate will harm the security of the final key. The minimized key rate of Eqs (3) and (4) in this situation can be written as respectively, with λ opt = κ + u|g| max and χ opt = 2 (2τ + λ opt )/τ. The two expressions can be obtained by using the following two steps. First, by using the condition g = −g′, one can minimize the key rate. Second, by using the condition g = |g| max , we can further minimize the key rate. The second situation is that Alice and Bob know the transmissivities and the equivalent noise (χ). Actually, this is a more realistic situation since these parameters can be determined through data comparison in the classical post-process of the QKD protocol 49 . So the expression of the minimized key rate in symmetric condition is and in asymmetric condition is and ε is the excess noise. The above two expressions can be achieved when g = −g′. So in the above two situations (thermal noise and equivalent noise), the condition g = −g′ can always minimize the key rate. Based on Eq. (8) and the experiment parameters of ref. 49 , the secure key rate of CV-MDI-QKD for various transmissivities τ A and τ B is shown in Fig. 3. We can see the secure key rate is smaller when the untrusted relay is closer to the center between Alice and Bob. The ideal situation is that the untrusted relay is very close to Alice or even the CV BSM is performed by Alice. Once Bob's raw key is used as the reference, the conclusion is opposite due to the symmetry of CV-MDI-QKD protocol. We remark that Eqs (3) to (8) are a natural generalization of the secure key rate formulas given in ref. 49 from ξ = 1 to a more general condition with ξ ≤ 1. Here, we assume the condition that minimize the rate when ξ = 1 also holds for ξ < 1. In the next section, we will rigourously prove this assumption and shows the above generalization is valid.

Discussion
In this paper, a new optical kind of CV-MDI-QKD scheme has been proposed. Through delicately manipulating the polarization, two laser pulses quantum states transmitted through the same fibers before CV BSM in the relay, thus their relative phase fluctuation is negligible and the phase-reference is self-aligned without introducing any complicated technologies. Furthermore, we give an alternate proof of the minimized key rate condition to generate the secure key rate. We hope that our work can help the experimental study of the CV-MDI-QKD. One should note that the remote distance phase-locking technology may be achieved by the development of frequency combs or atom-clock synchronization.
We should point out that there are still some drawbacks in our scheme. Like all plug-and-play type QKD systems 56 , there exists untrusted source problem in our scheme 64,65 . The most well-known threat for an untrusted source QKD protocol is the Trojan-horse attack 66,67 . Recently, a work shows Trojan-horse attack will greatly decrease the key rate along with the increasing of the mean photon number of the Trojan-horse mode 68 . The practical security bound against the Trojan-horse attack in DV-QKD has been shown 67 . The security of collective attack in plug-and-play CV-QKD system has also been given 69 . The wavelength filter and the intensity monitoring detector are the most suitable countermeasures for the Trojan-horse-type attack 64,65,67,69 . Note that these countermeasures will inevitably reduce the key rate. However, the unconditional security proof of CV-QKD with untrusted source is still an important open problem for future study. Similar with the plug-and-play QKD system 56 , another drawback of our scheme is the strong Rayleigh scattering, which will effect the coherent detection at Charlie. This drawback has been studied in the work of the plug-and-play CV-QKD 69 . Several methods have been presented to solve this problem, such as using a wideband shot-noise-limited homodyne detector and preparing optical pulses with a narrow full width at half maximum 69 . At last, the repetition rate is limited in the plug-and-play QKD system. Surprisingly, one could use the new scheme to build a CV-MDI-QKD network with a single untrusted source by further security analysis, which is similar with the DV-MDI-QKD network with an untrusted source 65 . Recently, the composable security against coherent attacks of CV-MDI-QKD has been proven 70 .

Methods
The detailed proof of the minimized key rate condition. Due to the fact that R is the same under the transformation g ↔ −g ′, R is symmetric with respect to the bisector g = −g ′ 49 . It should to be noticed that the minimized key rate condition g = −g ′ has been proven and used in ref. 49 . Here, we give an alternate proof of the minimized key rate condition by using the differential method. Our proof is quite straightforward. Under different situations, the key rate is a monotonic increasing function with the corresponding variable through the positivity of its first derivative. Then the minimum of R is achieved once the variable reaches its minimum.
Consider any accessible point Once ω A and ω B are fixed (κ is fixed), we let λ = κ − u(d′ + l), λ′ = κ + u(d′ − l), we have λ + λ′ = 2δ and λλ′ = δ 2 − u 2 d′ 2 with δ = κ − ul > 0. The minimization procedure should be considered over two parameters d′ and l. Here we show an alternate proof that g = −g′ minimize the key rate whenever the thermal noise or the equivalent noise is fixed for symmetric condition with τ A = τ B . First, we consider the case of the fixed thermal noise. Under the symmetric condition, the expression of the key rate in Eq. (3) can be written as and ν δ τ = −y / 3 2 with y = u 2 d′ 2 and 0 ≤ y ≤ δ 2 . Obviously, ν 3 < ν 1 .
The second situation is that the equivalent noise χ is fixed. Under this situation, the key rate of Eq. (6) 2 4 . It is easy to check that ν 1 > ν 2 . Next, we prove that R(y) is a monotonic increasing function. The first derivative of R(y) is . Due to χ ≥ β 2 /α = 4, one has υ υ − = . So ν ν − ≥ 1 1 2 2 2 and along with the fact that a 2 > a 1 , with χ being a variable, together with the fact that → τχ ( ) . So R(y) is a monotonic increasing function with its minimum obtained once y reaches its minimum. Due to the fact that y reaches its minimum when d′ = 0, then g = −g ′ minimize the key rate under the symmetric condition.
In the above discussion, we have provided an alternate proof that g = −g ′ is Eve's best strategy in the symmetric condition no matter with the fixed thermal noise or equivalent noise. Next we analyze the general condition with τ τ ≠ A B . We first consider the situation with fixed equivalent noise. The key rate of Eq. (8) can be expressed as Next, we prove that R(y) is a monotonic increasing function with y. Then its minimum can be achieved once y reaches its minimum (d′ = 0 or equivalently g = −g ′). The first derivative of R(y) is  . The relationship between ν 1 and ν 2 can be summarized as While there is an extra restriction for χ when ν 1 < ν 2 otherwise ν 1 > ν 2 . Meanwhile, p′(y) > 0 holds for any value of the parameters. For ν 1 > ν 2 , since g(x) is a monotonically decreasing function, we have g(ν 1 ) < g(ν 2 ). Alongside with the fact that q′ < 0 and p′ > 0, it's easy to see that R′(y) > 0. The remaining problem is to prove R′(y) > 0 also holds for ν 1 < ν 2 . Introducing a new function . Thus, we have w i t h k(y) = a 2 ν 1 − a 1 ν 2 . Here we use the fact that k(y) ≤ k(y min ) when which leads to , we have A(y) ≥ 0, thus R′(y) > 0. Therefore, R′(y) > 0 is a general result independent of the values of parameters. In conclusion, g = −g′ always minimized the key rate when χ is fixed. As for the condition with thermal noise ω A and ω B fixed, we can follow the above procedures to prove g = −g′ minimize the rate. For simplicity, we will not show the detailed calculations here. Follow the above discussion, in this situation the rate can be further minimized when λ = λ opt , we also prove this conclusion.
Minimization over λ. Once the thermal noise is fixed, the minimization is actually a two-step procedure.
We have already proved g = −g ′ minimize the key rate, next is to prove λ = λ opt further minimize the key rate. The key rate can be divided into the following two parts τ τ λ τ τ λ = + R H L ( , , ) ( , , ), It is easy to see that L(τ A , τ B , λ) is minimized when maximizing λ, so the remaining part is to prove that H(τ A , τ B , λ) is also minimized under this same condition. To find the minimum of H(τ A , τ B , λ), we give its first and second  physical. So H″(τ A , τ B , λ) > 0, makes H′(τ A , τ B , λ) monotonically increasing in the region. For λ → +∞, H′(τ A , τ B , λ) → 0, combined with the fact that it increases monotonically, we obtain H′(τ A , τ B , λ) < 0. So H(τ A , τ B , λ) monotonically decreases in the region, and it reaches its minimum when maximizing λ, which equals λ opt = λ + u|g| max . Based on the deduction above, we prove that R reaches its minimum when λ reaches its maximum. For simplicity, we only give the proof for asymmetric condition above. It's easy to prove the conclusion also holds for the symmetric condition.