Measurement-Device-Independent Twin-Field Quantum Key Distribution

The ultimate aim of quantum key distribution (QKD) is improving the transmission distance and key generation speed. Unfortunately, it is believed to be limited by the secret-key capacity of quantum channel without quantum repeater. Recently, a novel twin-field QKD (TF-QKD) is proposed to break through the limit, where the key rate is proportional to the square-root of channel transmittance. Here, by using the vacuum and one-photon state as a qubit, we show that the TF-QKD can be regarded as a measurement-device-independent QKD (MDI-QKD) with single-photon Bell state measurement. Therefore, the MDI property of TF-QKD can be understood clearly. Importantly, the universal security proof theories can be directly used for TF-QKD, such as BB84 encoding, six-state encoding and reference-frame-independent scheme. Furthermore, we propose a feasible experimental scheme for the proof-of-principle experimental demonstration.


Measurement-Device-Independent twin-Field Quantum Key Distribution
Hua-Lei Yin 1,2 & Yao Fu 2 the ultimate aim of quantum key distribution (QKD) is improving the transmission distance and key generation speed. Unfortunately, it is believed to be limited by the secret-key capacity of quantum channel without quantum repeater. Recently, a novel twin-field QKD (TF-QKD) is proposed to break through the limit, where the key rate is proportional to the square-root of channel transmittance. Here, by using the vacuum and one-photon state as a qubit, we show that the TF-QKD can be regarded as a measurement-device-independent QKD (MDI-QKD) with single-photon Bell state measurement. Therefore, the MDI property of TF-QKD can be understood clearly. Importantly, the universal security proof theories can be directly used for TF-QKD, such as BB84 encoding, six-state encoding and reference-frame-independent scheme. Furthermore, we propose a feasible experimental scheme for the proof-of-principle experimental demonstration.
Throughout history, the battle between encryption and decryption never ends. Currently, relying on computational complexity, the widely used public-key cryptosystem becomes vulnerable to quantum computing attacks. The one-time pad is the only provably secure cryptosystem according to information theory known today. Thereinto, an important issue exists that the common secret key is at least as long as the message itself and can be used only once. Quantum key distribution (QKD) constitutes the only way to solve the real time key distribution problem 1 . QKD allows two distant parties to establish a string of secret keys with information-theoretic security 2,3 . One can ensure legitimate parties to exchange messages with perfect confidentiality by combining QKD with one-time pad.
The longest transmission distance of QKD has been implemented over 421 km with ultralow-loss optical fiber 4 and 1200 km satellite-to-ground 5 . Improving the transmission distance and key rate are the most important tasks of QKD research. However, this task has been proven impossible beyond a certain limit without quantum repeaters 6,7 . The secret-key capacity of quantum channel can be used to bound the extractable maximum secret key 6,7 . Generally, the secret-key capacity can be regarded as a linear key rate Pirandola-Laurenza-Ottaviani-Banchi (PLOB) bound 7 η =− − R log (1 ) PLOB 2 , where η is the transmittance. To overcome the rate-distance limit of QKD, quantum repeaters are usually believed as a strong candidate 8,9 . However, the long-time quantum memory and high-fidelity entanglement distillation are far from feasible. Despite the recent advance 10 relaxing the requirement, the actual implementation is also difficult to realize, for example, quantum non-demolition (QND) measurement. Although the trusted relay-based QKD has been deployed over 2000 km 11 , its security is compromised.
Recently, a novel protocol called twin-field QKD (TF-QKD) 12 has been proposed to overcome the rate-distance limit. The secret key rate of TF-QKD has been scaled with the square-root of the transmittance, η R O( ). In the TF-QKD, a pair of optical fields are generated respectively at locations of two remote parties and then sent to the untrusted center to implement single-photon detection. Compared with measurement-device-independent QKD (MDI-QKD) 13 , TF-QKD retains the properties of being immune to all detector attack, multiplexing of expensive single-photon detectors and natural star network architecture. In the original paper of TF-QKD 12 , the communication parties, Alice and Bob, prepare the phase-randomized coherent state with phase encoding in X and Y basis. To acquire the correction of raw keys, they should announce the random phase of each pulse. The key rate of unconditional security proof is still missing in the original paper 12

MDI-QKD with single-photon BsM.
Here, let us first introduce an entanglement-based MDI-QKD with single-photon BSM protocol, as shown in Fig. 1(a). Let {|0〉, |1〉} represent Z basis, where 0 and 1 are the vacuum and the one-photon state, respectively. Accordingly, the eigenvectors of X basis and Y basis are ± = ± ( 0 1 )/ 2 and ± = ± i i ( 0 1 )/ 2. Considering that one photon inputs a lossless symmetric beam splitter, the output state is a single-photon entangled state, ψ = + + ( 0 1 1 0 )/ 2. Alice and Bob prepare a series of entangled states ψ = + and ψ = + , respectively, where A (B) and a (b) are a pair of field modes. Afterwards, they hold the qubit of a and b modes and send the quantum states of A and B modes to the untrusted third party, Charlie, who performs the BSM to identify the two single-photon Bell states ψ = + . Therefore, a coincidence detection with L click and R no click indicates a projection into the Bell state ψ + AB . A coincidence detection with R click and L no click, implies a projection into the Bell state ψ − AB . Note that the The phase-reference of long-distance should be stabilized to implement laser interference. The single-photon source is used to implement Z basis encoding, while the laser source is used to implement the phase encoding, such as X and Y basis.
www.nature.com/scientificreports www.nature.com/scientificreports/ identification of any one Bell state is enough to prove the security. When Charlie performs a successful BSM, the qubit that the legitimate users hold becomes a single-photon Bell state, the process of which can be regarded as an entanglement swapping, as experimentally demonstrated 30 . Alice and Bob can utilize quantum memory to store their qubit a and b modes. After Charlie announces the events through public channels whether he has obtained a Bell state and which Bell state he has identified, Alice and Bob will measure qubit a and b modes, respectively. They publish the basis information through an authenticated classical channel. Bob will apply a bit flip when they choose Z (X or Y) basis and Charlie receives a Bell state ψ ± AB ψ − ( ) AB . They use the data of Z basis to form the raw key, while the data of other bases are all used to estimate the leaked information. Alice and Bob can acquire the secure key through the error correction and privacy amplification.
We can equivalently convert our entanglement-based protocol in Fig. 1(a) to the prepare-and-measure protocol as shown in Fig. 1(b) by the Shor-Preskill's arguments 21 . Let Alice and Bob measure the modes a and b before they send the qubit of A and B modes to Charlie, meaning Alice and Bob directly prepare the quantum state A mode and B mode. Other steps are all same to the entanglement-based protocol, including the BSM, basis comparison, bit flip, error correction and privacy amplification. Hereafter, we use the TF state to represent the joint quantum state of Alice's A mode and Bob's B mode. In the case of ideal detector (photon-number-resolving and without dark count) and lossless channel, the MDI-QKD with single-photon BSM protocol is similar with the two-photon BSM protocol. However, the single-photon BSM exploits the vacuum state identification, namely, detector without click, the case of TF state with |1 A 〉|1 B 〉 will create error Bell state detection under the case of lossy channel, which will cause the unbalanced bit value and high bit error rate.
To solve this issue, Alice and Bob need to decrease the probability of qubit |1〉 preparation and increase the probability of qubit |0〉 preparation. Therefore, Alice (Bob) should exploit the entangled state ψ = − + t t 1 0 1 1 0 t to replace the maximally entangled state ψ = + + ( 0 1 1 0 )/ 2 in the entanglement-based protocol with Fig. 1(a), where t is the transmittance of partial BS. Note that the non-maximally entangled state is also used to prove the security in the TF-QKD 18 . Taking into account the threshold detector and lossy channel, the joint quantum state of Alice's a mode and Bob's b mode after Charlie's BSM with ψ ± AB under the case without eavesdropper's disturbance can be written as (see Methods for detail) where q = q 0 + q 1 + q 2 , q 0 , q 1 and q 2 are the probabilities of Charlie's successful BSM given that the photon numbers of TF state are zero, one and two. Consider a virtual step, if Alice and Bob jointly perform QND measurement on TF state to implement photon-number-resolving before they send TF state to Charlie, the joint quantum state of Alice's a mode and Bob's b mode is ψ ± ab given that the TF state with one-photon and Charlie's BSM with ψ ± AB , which reduces to the the case of ideal detector and lossless channel. Similarly, we can have a equivalent prepare-and-measure protocol corresponding to the entanglement-based protocol with entangled state ψ = − + t t 1 0 1 1 0 t . Alice (Bob) prepares the qubit |+z〉 = |0〉 and |−z〉 = |1〉 with probability 1 − t and t as Z basis logic bit 0 and 1, respectively. Alice (Bob) prepares the qubit 0 1 with equal probability as X basis logic bit 0 and 1, respectively. Alice (Bob) prepares the qubit + = − + y t i t 1 0 1 and − = − − y t i t 1 0 1 with equal probability as Y basis logic bit 0 and 1, respectively. Obviously, the quantum state can be seen as a mixture of photon number states for TF state in the Z basis. For the TF state with one-photon in the Z basis, one of Alice and Bob needs to prepare |0〉 as logic bit 0 and the other prepare |1〉 as logic bit 1. However, the quantum state is coherent superposition of photon number states for TF state in the X (Y) basis. Here, if we assume Alice and Bob knowing the quantum bit error rate (QBER) of TF state with one-photon in the X basis, for example, Alice and Bob can perform joint QND measurement on TF state to implement photon-number-resolving in the X basis, one can use the case of TF state with one-photon to extract secure key in the BB84 encoding, which can be given by (see Methods for detail) is the binary Shannon entropy and e XX b1 is the QBER in X basis for TF state with one-photon. We can have optimal secure key rate in Eq. (2) with the transmittance of partial BS t ≈ 8% given that QBER = e 3%

XX b1
, dark count rate of threshold detector p d = 10 −6 , efficiency of threshold detector η d = 40% and the fiber distance between Alice and Bob L ≥ 100 km. Note that the entanglement-based protocol in Fig. 1(a) and prepare-and-measure protocol in Fig. 1(b) are the virtual protocols, which are not used to perform experiment but prove the security in theory. the relative phase θ between the different Fock states in the superposition is reflected physically in the phase of the classical electric field. Hereafter, the phase-encoding basis means to implement phase modulation of coherent state, such as X and Y basis. In order to achieve Alice and Bob knowing the QBER of TF state with one-photon in the phase-encoding basis without the requirement of QND measurement, one can use the post-selected phase-matching method for phase-randomized coherent state 12,15 . By using the post-selected phase-matching method, the phases of www.nature.com/scientificreports www.nature.com/scientificreports/ Alice's and Bob's coherent state can be seen as equal and randomized, which means that they can use decoy-state method to estimate the yield and QBER of TF state with one-photon in the phase-encoding basis (see Methods).
Efficient TF-QKD. Here, we propose an efficient TF-QKD that the single-photon source used for Z basis and laser source used for phase-encoding basis in Fig. 1(c). The qubit prepared in Z basis can be implemented by turning on and off (such as optical switch) the single-photon source, while the qubit of phase encoding basis should exploit the phase-randomized coherent state combined with phase modulation. However, the perfect single-photon source is still a challenge under the current technology. Therefore, we propose a practical TF-QKD by exploiting phase-randomized coherent state to replace single-photon source used for Z basis encoding.
Practical TF-QKD. In the following, let us explain our practical TF-QKD in detail as shown in Fig. 2(a). (i) Alice and Bob use the stabilized narrow line-width continuous-wave laser and amplitude modulator to prepare the global phase stabilized optical pulses. Alice's and Bob's random phases θ A ∈ [0, 2π) and θ B ∈ [0, 2π) are realized by using phase modulators. For Z basis encoding, the phase-randomized coherent state with intensities 0 and μ as logic bits 0 and 1 with probabilities 1 − t and t by using amplitude modulator. For X (Y) basis encoding, they use the phase and amplitude modulator to randomly implement 0 (π/2) and π (−π/2) phase modulation as logic bits 0 and 1 with intensities {ν/2, ω/2, 0}. (ii) Then they send quantum states to Charlie for single-photon BSM through the insecure quantum channel. Charlie publishes the successful events of single-photon BSM. (iii) Alice and Bob will announce the basis information through the authenticated classical channel. The intensity and random phase information k A,B of phase-encoding basis should be disclosed, while those of Z basis are confidential to Charlie, (iv) Alice and Bob use the data of Z basis as the raw key, while the data of phase-encoding basis are announced to estimate the amount of leaked information.
(v) They exploit the classical error correction and privacy amplification to extract the secure key rate. After Charlie announces the measurement results, he cannot change the yield and QBER due to information causality 32 . The decoy-state method of estimating the yield and QBER of TF state with n-photon in phase-encoding basis is also true even for the post-selected phase-matching method, which has also been used in phase-matching QKD 15 . The GLLP analysis 24 can be used for the data of Z basis, since the random phases information of Alice's and Bob's coherent states are all confidential to Charlie. Bob will always flit his bit in Z basis. in the asymptotic limit. Note that, we can also directly estimate the yield Y ZZ  www.nature.com/scientificreports www.nature.com/scientificreports/ where Q ZZ is the gain in Z basis acquired directly from the experiment, f = 1.15 is the error correction coefficient. For the RFI scheme 29,33 , one can allow Alice and Bob to have different phase references which can be changed slowly (details can be found in Methods). Therefore, they can collect the data of |k is the QBER of TF state with one-photon in set D k given that Alice and Bob choose X − X(X − Y, Y − X, Y − Y) basis. The secure key rate of practical TF-QKD with RFI scheme can be given by The secure key rate of practical TF-QKD using BB84 encoding changes with the dark count rate as shown in Fig. 3. We use the practical parameters to simulate the secure key rate in Fig. 3, where the efficiency of detector is η d = 40%, the loss coefficient of the channel is 0.2 dB/km and the optical error rate of system is e opt = 1%. The optical error rate is usually large due to the long-distance single-photon-type interference. We compare the secure key rates of practical TF-QKD using BB84 encoding and RFI scheme with the different optical error rate as shown in Fig. 4. To show the advantage of TF-QKD, the efficiency and dark count rate of detector are assumed to be η d = 90% and p d = 10 −9 in Fig. 4, respectively. In the simulation, both schemes can surpass the PLOB bound and tolerate the big optical error rate e opt . The key rate of TF-QKD with BB84 encoding will significantly decline with e opt rising, while the RFI scheme is robust. However, the long-distance phase-stabilization (it could not be a perfect match but is required to vary slowly) also exists since the relative phase changes too fast in the long-distance fiber or free-space channel.
The experimental demonstration of TF-QKD with independent lasers in Fig. 2(a) is a big challenge, although the MDI-QKD with two-photon BSM has been implemented over 404 km optical fiber 34 by using asymmetric four-intensity decoy-state method 35 . Compared with the two-photon BSM, greater technological challenges exist in the TF-QKD with single-photon BSM. The frequency difference of two independent lasers is required more rigorously 12 . The phase-locking technique may be used to compensate the frequency difference. Importantly, the long-distance phase-stabilization technique is required to implement single-photon interference with phase matching. The RFI scheme can allow the phase mismatching. However, the relative phase change is still required to vary slowly. To rapidly implement the proof-of-principle TF-QKD experiment, we present a phase self-aligned TF-QKD with single laser interference as shown in Fig. 2(b). The horizontal polarization optical pulse generated by Charlie is divided into two pulses by the polarization-maintaining beam splitter. By exploiting the π/2 rotation effect of Faraday mirror, the two pulses interfere after they go through the same path. Though the phase self-aligned scheme would be affected by the loss and noise, the frequency difference and long-distance phase-stabilization problems are both solved 36 . An extra security analysis with untrusted source 37 should be used to defeat the attack from systems of Alice and Bob. www.nature.com/scientificreports www.nature.com/scientificreports/

Discussion
In summary, we have proved that the TF-QKD can be regarded as a MDI-QKD with single-photon BSM. By introducing the Z basis encoding, the secret key extraction can exploit the tagging method of GLLP analysis and the decoy-state method. Compared with BB84 encoding, the RFI scheme has the advantages of increasing the data of parameter estimation and reducing the effect of phase drift. We should point out that the extra Y basis preparation in RFI scheme does not add additional operation due to the active phase randomization requirement, which is different from the traditional QKD. We propose a feasible experimental scheme to implement the proof-of-principle experimental demonstration. Note that, the security of this proof-of-principle experiment in Fig. 2b is not guaranteed with our current analysis, which requires a further security evaluation due to introducing untrusted source. Through simulation, we show that the secure key rate of practical TF-QKD can surpass the PLOB bound. The universally composable security with finite-key analysis needs to be considered in the future. Our proposal suggests an important avenue for practical high-speed and long-distance QKD without detector vulnerabilities. During the preparation of this paper and posting it on the arXiv, we became aware of some important works [14][15][16][17][18][19] of TF-QKD. For the threshold detector and lossy channel, the TF state |00〉 AB , |01〉 AB , |10〉 AB and |11〉 AB will all have single-photon Bell state clicks. Due to the single-photon BSM of Charlie, the photon number of TF state will collapse to three events, namely vacuum, one-photon and two-photon. The corresponding probability can be expressed as  www.nature.com/scientificreports www.nature.com/scientificreports/ For the case of prepare-and-measure protocol corresponding to entanglement-based protocol with the entangled state ψ = − + t t 1 0 1 1 0 t , the density matrix of TF state in the Z basis is which needs one of Alice and Bob prepares |0〉 as logic bit 0 and the other prepares |1〉 as logic bit 1.

MDI-QKD with single-photon BsM. For the case of entanglement-based protocol with the entangled
The density matrix of TF state in the X basis can be written as XX AB AB AB AB TF Thereinto, we have ) is the yield given that Alice and Bob choose Z (X) basis and TF state contains one-photon. Alice and Bob can know the locations of the TF state with one-photon by using the QND measurement, they could discard all other states and apply error correction and privacy amplification only to the TF state with one-photon. In this case with BB84 encoding, they can achieve a key rate of 20 since we only have the case of Alice's logic bit 0 (1) and Bob's logic bit 1 (0) corresponding to quantum state |01〉 (|10〉).
However, if we assume that Alice and Bob can know the QBER of TF state with one-photon in the X basis, one can acquire the secure key in the Z basis without Alice and Bob knowing the locations (QND measurement) of the TF state with one-photon by using the GLLP analysis 24 . The secure key rate can be given by where the parameter q 1 should be calculated by using the decoy-state method, for example, we choose three value of t in the Z basis.
tF-QKD with phase-encoding coherent state. In order to make Alice and Bob know the QBER of TF state with one-photon in the X basis without the requirement of QND measurement, we need to consider the case of phase-randomized coherent state  where the global phases of Alice's and Bob's coherent state should be equal and randomized. It can be realized by using post-selected phase-matching method for phase-randomized coherent state introduced in the original TF-QKD 12 and phase-matching QKD 15 . If we consider the photon number space of TF state given that the global phases of Alice's coherent state and Bob's are randomized and have a fixed phase difference, the density matrix can be given by n n TF 2 0 which is similar with the phase encoding phase-randomized coherent state in the traditional decoy-state QKD 26,27 . Therefore, the decoy state method can be used for estimating the yield and QBER of TF state with one-photon.
For phase-randomized coherent state used for Z basis encoding, we have We need |0〉 as logic bit 0 and |1〉 as logic bit 1, therefore the efficient TF state with one-photon in Z basis only results from the case of logic bit 0 A 1 B and 1 A 0 B with the probability 2t(1 − t)μe −μ . For simulation, we consider the case without Charlie's disturbance. In the Z basis of practical TF-QKD, by going through the quantum channel and beam splitter, we have (1 − t) 2 probability of quantum state and t 2 probability of quantum state Here, we have θ A ∈ [0, 2π) and θ B ∈ [0, 2π), L and R represent the left detector and right detector of Charlie, respectively. The gain Q ZZ and QBER E ZZ of practical TF-QKD can be given by For phase-encoding basis of practical TF-QKD, by going through the quantum channel and beam splitter, we have 1/4 probability of quantum state www.nature.com/scientificreports www.nature.com/scientificreports/ λ χ λ η χ η λ η χ η + ⊗ − θ π π θ π π θ π π θ π π θ π π θ π π + + + +  are the gain and QBER that Alice and Bob choose basis h A and h B when they send the global phase θ A and θ B optical pulses with intensities λ and χ, respectively. Here, when we assume η → 0 and p d → 0.
Obviously, we can directly estimate the yield Y ZZ TF 1 by using the data of phase-encoding basis given that one of Alice and Bob sends intensity 0. We define  λ χ as the intensity set when Alice and Bob send intensity λ and χ phase-randomized coherent state.  are the yields of TF state with vacuum and one-photon in the Z basis, respectively, which can be given by (ν > ω > 0) 26,27  We assume that the optical error rate e opt of X basis exists due to the single-photon interference. For simplicity, we assume that the optical error rate is introduced by the phase misalignment 12 . Here, a fixed phase difference between Alice's and Bob's global phase is δ 0 = arccos(1 − 2e opt ). By using the post-selected phase-matching method in practical TF-QKD with BB84 encoding, ν Q XX ) XX are gain and QBER given that Alice chooses X basis with intensity ν  ν ν δ δ π π θ θ ν ν θ θ ν ν ω ω δ δ π π θ θ ω ω θ θ ω ω is the QBER of TF state with vacuum in phase-encoding basis. For six-state encoding 28 , the probability that both bit flip and phase shift occurs can be given by 38 To simplify, we assume that those cases of qubit preparation with relative phase modulation are symmetrical since the random phase is unknown before Charlie performs single-photon BSM. Therefore, we abtain = a e /2 ZZ b1 . Interestingly, the QBER ≡ e 0

ZZ b1
, which means that the key rate of practical TF-QKD with six-state encoding has no advantage compared with BB84 encoding.
For the RFI scheme 29 , the Z basis is always well defined, which is Z A = Z B = Z for Alice and Bob. The other two bases may vary with the slow phase shifting β, the relation can be given by where Z A and Z B , X A and X B , Y A and Y B are the location reference frames for Z, X and Y basis of Alice and Bob, respectively. β A (β B ) is the deviation between the practical and standard reference frame for Alice (Bob). Therefore, the eigenstates of X A (X B ) and Y A (Y B ) can be written as ± = ± β e ( 0 1 )/ 2 . Note that β A and β B are the phases of intrinsic degree of freedom between 0 and 1 and can vary slowly in the virtual protocol with RFI theory. The key rate of single-photon with RFI theory is given by 29 quantifies the information of Eve's knowledge, parameters which is independent of phase drifting β A (β B ) and can just be used to bound Eve's information. However, the phase drifting will add the QBER of X basis, which will decrease the key rate of BB84 encoding. We can see that C is only related to phase change Δβ and is not related to phase difference β in theory. The value C will decrease with Δβ increasing.
In the practical TF-QKD with RFI scheme, we define that ν Q XXk and ν E XXk are gain and QBER when Alice chooses X basis with intensity ν k M A B   and ω ω ω ω