Abstract
The ultimate aim of quantum key distribution (QKD) is improving the transmission distance and key generation speed. Unfortunately, it is believed to be limited by the secretkey capacity of quantum channel without quantum repeater. Recently, a novel twinfield QKD (TFQKD) is proposed to break through the limit, where the key rate is proportional to the squareroot of channel transmittance. Here, by using the vacuum and onephoton state as a qubit, we show that the TFQKD can be regarded as a measurementdeviceindependent QKD (MDIQKD) with singlephoton Bell state measurement. Therefore, the MDI property of TFQKD can be understood clearly. Importantly, the universal security proof theories can be directly used for TFQKD, such as BB84 encoding, sixstate encoding and referenceframeindependent scheme. Furthermore, we propose a feasible experimental scheme for the proofofprinciple experimental demonstration.
Introduction
Throughout history, the battle between encryption and decryption never ends. Currently, relying on computational complexity, the widely used publickey cryptosystem becomes vulnerable to quantum computing attacks. The onetime pad is the only provably secure cryptosystem according to information theory known today. Thereinto, an important issue exists that the common secret key is at least as long as the message itself and can be used only once. Quantum key distribution (QKD) constitutes the only way to solve the real time key distribution problem^{1}. QKD allows two distant parties to establish a string of secret keys with informationtheoretic security^{2,3}. One can ensure legitimate parties to exchange messages with perfect confidentiality by combining QKD with onetime pad.
The longest transmission distance of QKD has been implemented over 421 km with ultralowloss optical fiber^{4} and 1200 km satellitetoground^{5}. Improving the transmission distance and key rate are the most important tasks of QKD research. However, this task has been proven impossible beyond a certain limit without quantum repeaters^{6,7}. The secretkey capacity of quantum channel can be used to bound the extractable maximum secret key^{6,7}. Generally, the secretkey capacity can be regarded as a linear key rate PirandolaLaurenzaOttavianiBanchi (PLOB) bound^{7} \({R}_{{\rm{PLOB}}}=\,\,{\mathrm{log}}_{2}\mathrm{(1}\eta )\), where η is the transmittance. To overcome the ratedistance limit of QKD, quantum repeaters are usually believed as a strong candidate^{8,9}. However, the longtime quantum memory and highfidelity entanglement distillation are far from feasible. Despite the recent advance^{10} relaxing the requirement, the actual implementation is also difficult to realize, for example, quantum nondemolition (QND) measurement. Although the trusted relaybased QKD has been deployed over 2000 km^{11}, its security is compromised.
Recently, a novel protocol called twinfield QKD (TFQKD)^{12} has been proposed to overcome the ratedistance limit. The secret key rate of TFQKD has been scaled with the squareroot of the transmittance, \(R \sim O(\sqrt{\eta })\). In the TFQKD, a pair of optical fields are generated respectively at locations of two remote parties and then sent to the untrusted center to implement singlephoton detection. Compared with measurementdeviceindependent QKD (MDIQKD)^{13}, TFQKD retains the properties of being immune to all detector attack, multiplexing of expensive singlephoton detectors and natural star network architecture. In the original paper of TFQKD^{12}, the communication parties, Alice and Bob, prepare the phaserandomized coherent state with phase encoding in X and Y basis. To acquire the correction of raw keys, they should announce the random phase of each pulse. The key rate of unconditional security proof is still missing in the original paper^{12}. Various different important works have been shown to give the key rate formulas with informationtheoretic security^{14,15,16,17,18,19}.
Here, we prove that TFQKD can be seen as a special type of MDIQKD. Thereinto, a qubit is physically implemented by a twodimensional subspace with vacuum and onephoton state. One can consider that the untrusted center performs the singlephoton Bell state measurement (BSM) while Alice and Bob prepare quantum state in the complementary bases. Since the vacuum state is immune to the loss, it can always have a detection (detector without click means a successful detection), thus the probability of coincident detection is exactly equal to that of single detection. Therefore, the TFQKD inherits all positive features of MDIQKD and increases the key rate a lot to break through the linear key rate bound. The unconditional security proof technologies with entanglement purification^{20,21}, information theory analysis^{22}, entropy uncertainty relation^{23} can be directly applied in the TFQKD. The bit of Z basis is independent of the phase misalignment. Naturally, there is no need to publish random phase of Z basis and the state can be seen as a mixture of photon number states. Therefore, the distilled secret key of Z basis in the TFQKD can exploit the taggingmethod of GottesmanLoLütkenhausPreskill (GLLP) analysis^{24}. Combining the decoystate method^{25,26,27}, we could acquire the tight key rate formula of TFQKD with BB84 encoding^{1}, sixstate encoding^{28} and referenceframeindependent (RFI)^{29} scheme.
Results
MDIQKD with singlephoton BSM
Here, let us first introduce an entanglementbased MDIQKD with singlephoton BSM protocol, as shown in Fig. 1(a). Let {0〉, 1〉} represent Z basis, where 0 and 1 are the vacuum and the onephoton state, respectively. Accordingly, the eigenvectors of X basis and Y basis are \(\,\pm \,\rangle =(0\rangle \pm 1\rangle )/\sqrt{2}\) and \(\pm i\rangle =(0\rangle \pm i1\rangle )/\sqrt{2}\). Considering that one photon inputs a lossless symmetric beam splitter, the output state is a singlephoton entangled state, \({\psi }^{+}\rangle =(0\rangle 1\rangle +1\rangle 0\rangle )/\sqrt{2}\). Alice and Bob prepare a series of entangled states \({{\psi }^{+}\rangle }_{Aa}=({0\rangle }_{A}{1\rangle }_{a}+{1\rangle }_{A}{0\rangle }_{a})/\sqrt{2}\) and \({{\psi }^{+}\rangle }_{Bb}=({0\rangle }_{B}{1\rangle }_{b}+{1\rangle }_{B}{0\rangle }_{b})/\sqrt{2}\), respectively, where A (B) and a (b) are a pair of field modes. Afterwards, they hold the qubit of a and b modes and send the quantum states of A and B modes to the untrusted third party, Charlie, who performs the BSM to identify the two singlephoton Bell states \({{\psi }^{+}\rangle }_{AB}=({0\rangle }_{A}{1\rangle }_{B}+{1\rangle }_{A}{0\rangle }_{B})/\sqrt{2}\) and \({{\psi }^{}\rangle }_{AB}=({0\rangle }_{A}{1\rangle }_{B}{1\rangle }_{A}{0\rangle }_{B})/\sqrt{2}\). Therefore, a coincidence detection with L click and R no click indicates a projection into the Bell state \({{\psi }^{+}\rangle }_{AB}\). A coincidence detection with R click and L no click, implies a projection into the Bell state \({{\psi }^{}\rangle }_{AB}\). Note that the identification of any one Bell state is enough to prove the security. When Charlie performs a successful BSM, the qubit that the legitimate users hold becomes a singlephoton Bell state, the process of which can be regarded as an entanglement swapping, as experimentally demonstrated^{30}. Alice and Bob can utilize quantum memory to store their qubit a and b modes. After Charlie announces the events through public channels whether he has obtained a Bell state and which Bell state he has identified, Alice and Bob will measure qubit a and b modes, respectively. They publish the basis information through an authenticated classical channel. Bob will apply a bit flip when they choose Z (X or Y) basis and Charlie receives a Bell state \({{\psi }^{\pm }\rangle }_{AB}\) \(({{\psi }^{}\rangle }_{AB})\). They use the data of Z basis to form the raw key, while the data of other bases are all used to estimate the leaked information. Alice and Bob can acquire the secure key through the error correction and privacy amplification.
We can equivalently convert our entanglementbased protocol in Fig. 1(a) to the prepareandmeasure protocol as shown in Fig. 1(b) by the ShorPreskill’s arguments^{21}. Let Alice and Bob measure the modes a and b before they send the qubit of A and B modes to Charlie, meaning Alice and Bob directly prepare the quantum state A mode and B mode. Other steps are all same to the entanglementbased protocol, including the BSM, basis comparison, bit flip, error correction and privacy amplification. Hereafter, we use the TF state to represent the joint quantum state of Alice’s A mode and Bob’s B mode. In the case of ideal detector (photonnumberresolving and without dark count) and lossless channel, the MDIQKD with singlephoton BSM protocol is similar with the twophoton BSM protocol. However, the singlephoton BSM exploits the vacuum state identification, namely, detector without click, the case of TF state with 1_{A}〉1_{B}〉 will create error Bell state detection under the case of lossy channel, which will cause the unbalanced bit value and high bit error rate.
To solve this issue, Alice and Bob need to decrease the probability of qubit 1〉 preparation and increase the probability of qubit 0〉 preparation. Therefore, Alice (Bob) should exploit the entangled state \({\psi \rangle }_{t}=\sqrt{1t}0\rangle 1\rangle +\sqrt{t}1\rangle 0\rangle \) to replace the maximally entangled state \({\psi }^{+}\rangle =(0\rangle 1\rangle +1\rangle 0\rangle )/\sqrt{2}\) in the entanglementbased protocol with Fig. 1(a), where t is the transmittance of partial BS. Note that the nonmaximally entangled state is also used to prove the security in the TFQKD^{18}. Taking into account the threshold detector and lossy channel, the joint quantum state of Alice’s a mode and Bob’s b mode after Charlie’s BSM with \({{\psi }^{\pm }\rangle }_{AB}\) under the case without eavesdropper’s disturbance can be written as (see Methods for detail)
where q = q_{0} + q_{1} + q_{2}, q_{0}, q_{1} and q_{2} are the probabilities of Charlie’s successful BSM given that the photon numbers of TF state are zero, one and two. Consider a virtual step, if Alice and Bob jointly perform QND measurement on TF state to implement photonnumberresolving before they send TF state to Charlie, the joint quantum state of Alice’s a mode and Bob’s b mode is \({{\psi }^{\pm }\rangle }_{ab}\) given that the TF state with onephoton and Charlie’s BSM with \({{\psi }^{\pm }\rangle }_{AB}\), which reduces to the the case of ideal detector and lossless channel.
Similarly, we can have a equivalent prepareandmeasure protocol corresponding to the entanglementbased protocol with entangled state \({\psi \rangle }_{t}=\sqrt{1t}0\rangle 1\rangle +\sqrt{t}1\rangle 0\rangle \). Alice (Bob) prepares the qubit +z〉 = 0〉 and −z〉 = 1〉 with probability 1 − t and t as Z basis logic bit 0 and 1, respectively. Alice (Bob) prepares the qubit \(+x\rangle =\sqrt{1t}0\rangle +\sqrt{t}1\rangle \) and \(x\rangle =\sqrt{1t}0\rangle \sqrt{t}1\rangle \) with equal probability as X basis logic bit 0 and 1, respectively. Alice (Bob) prepares the qubit \(+y\rangle =\sqrt{1t}0\rangle +i\sqrt{t}1\rangle \) and \(y\rangle =\sqrt{1t}0\rangle i\sqrt{t}1\rangle \) with equal probability as Y basis logic bit 0 and 1, respectively. Obviously, the quantum state can be seen as a mixture of photon number states for TF state in the Z basis. For the TF state with onephoton in the Z basis, one of Alice and Bob needs to prepare 0〉 as logic bit 0 and the other prepare 1〉 as logic bit 1. However, the quantum state is coherent superposition of photon number states for TF state in the X (Y) basis. Here, if we assume Alice and Bob knowing the quantum bit error rate (QBER) of TF state with onephoton in the X basis, for example, Alice and Bob can perform joint QND measurement on TF state to implement photonnumberresolving in the X basis, one can use the case of TF state with onephoton to extract secure key in the BB84 encoding, which can be given by (see Methods for detail)
where E_{ZZ} = (q_{0} + q_{2})/q is the QBER of Z basis, \(H(x)=\,\,x{\mathrm{log}}_{2}(x)\mathrm{(1}x)\,{\mathrm{log}}_{2}\mathrm{(1}x)\) is the binary Shannon entropy and \({e}_{XX}^{b1}\) is the QBER in X basis for TF state with onephoton. We can have optimal secure key rate in Eq. (2) with the transmittance of partial BS t ≈ 8% given that QBER \({e}_{XX}^{b1}=\mathrm{3 \% }\), dark count rate of threshold detector p_{d} = 10^{−6}, efficiency of threshold detector η_{d} = 40% and the fiber distance between Alice and Bob L ≥ 100 km. Note that the entanglementbased protocol in Fig. 1(a) and prepareandmeasure protocol in Fig. 1(b) are the virtual protocols, which are not used to perform experiment but prove the security in theory.
TFQKD with phaseencoding coherent state
Manipulating the quantum state with superpositions of the vacuum and onephoton states and, in particular, requiring control about the relative phase between the vacuum and onephoton state is quite problematic^{31}. However, we consider the coherent state \(\alpha \rangle ={e}^{\mu \mathrm{/2}}{\sum }_{n=0}^{\infty }\,\frac{{({e}^{i\theta }\sqrt{\mu })}^{n}}{\sqrt{n!}}n\rangle \), where the relative phase θ between the different Fock states in the superposition is reflected physically in the phase of the classical electric field. Hereafter, the phaseencoding basis means to implement phase modulation of coherent state, such as X and Y basis. In order to achieve Alice and Bob knowing the QBER of TF state with onephoton in the phaseencoding basis without the requirement of QND measurement, one can use the postselected phasematching method for phaserandomized coherent state^{12,15}. By using the postselected phasematching method, the phases of Alice’s and Bob’s coherent state can be seen as equal and randomized, which means that they can use decoystate method to estimate the yield and QBER of TF state with onephoton in the phaseencoding basis (see Methods).
Efficient TFQKD
Here, we propose an efficient TFQKD that the singlephoton source used for Z basis and laser source used for phaseencoding basis in Fig. 1(c). The qubit prepared in Z basis can be implemented by turning on and off (such as optical switch) the singlephoton source, while the qubit of phase encoding basis should exploit the phaserandomized coherent state combined with phase modulation. However, the perfect singlephoton source is still a challenge under the current technology. Therefore, we propose a practical TFQKD by exploiting phaserandomized coherent state to replace singlephoton source used for Z basis encoding.
Practical TFQKD
In the following, let us explain our practical TFQKD in detail as shown in Fig. 2(a). (i) Alice and Bob use the stabilized narrow linewidth continuouswave laser and amplitude modulator to prepare the global phase stabilized optical pulses. Alice’s and Bob’s random phases θ_{A} ∈ [0, 2π) and θ_{B} ∈ [0, 2π) are realized by using phase modulators. For Z basis encoding, the phaserandomized coherent state with intensities 0 and μ as logic bits 0 and 1 with probabilities 1 − t and t by using amplitude modulator. For X (Y) basis encoding, they use the phase and amplitude modulator to randomly implement 0 (π/2) and π (−π/2) phase modulation as logic bits 0 and 1 with intensities {ν/2, ω/2, 0}. (ii) Then they send quantum states to Charlie for singlephoton BSM through the insecure quantum channel. Charlie publishes the successful events of singlephoton BSM. (iii) Alice and Bob will announce the basis information through the authenticated classical channel. The intensity and random phase information k_{A,B} of phaseencoding basis should be disclosed, while those of Z basis are confidential to Charlie, where they have \({\theta }_{A,B}\in {{\rm{\Delta }}}_{{k}_{A,B}}\), \({{\rm{\Delta }}}_{{k}_{A,B}}=[\frac{2\pi {k}_{A,B}}{M},\frac{2\pi ({k}_{A,B}+\mathrm{1)}}{M})\) and k_{A,B} ∈ {0, 1, …, M − 1}. (iv) Alice and Bob use the data of Z basis as the raw key, while the data of phaseencoding basis are announced to estimate the amount of leaked information. (v) They exploit the classical error correction and privacy amplification to extract the secure key rate.
After Charlie announces the measurement results, he cannot change the yield and QBER due to information causality^{32}. The decoystate method of estimating the yield and QBER of TF state with nphoton in phaseencoding basis is also true even for the postselected phasematching method, which has also been used in phasematching QKD^{15}. The GLLP analysis^{24} can be used for the data of Z basis, since the random phases information of Alice’s and Bob’s coherent states are all confidential to Charlie. Bob will always flit his bit in Z basis. Due to the density matrix of TF state with onephoton \({\rho }_{{\rm{TF}}}^{1ZZ}={\rho }_{{\rm{TF}}}^{1XX}=\frac{1}{2}({01\rangle }_{AB}\langle 01+{10\rangle }_{AB}\langle 10)\), we can use the yield of TF state with onephoton \({Y}_{{\rm{TF}}}^{1ZZ}={Y}_{{\rm{TF}}}^{1XX}\) in the asymptotic limit. Note that, we can also directly estimate the yield \({Y}_{{\rm{TF}}}^{1ZZ}\) by using the data of phaseencoding basis given that one of Alice and Bob sends intensity 0.
For the BB84 encoding^{1}, Alice and Bob only keep the data of k_{B} − k_{A} = 0 and M/2 when they both choose X basis by the postselected phasematching method. If k_{B} − k_{A} = 0 (k_{B} − k_{A} = M/2), Bob will flit his bit when Charlie receives a Bell state \({{\psi }^{}\rangle }_{AB}\) \(({{\psi }^{+}\rangle }_{AB})\). The secure key rate of practical TFQKD can be given by
where Q_{ZZ} is the gain in Z basis acquired directly from the experiment, f = 1.15 is the error correction coefficient.
For the RFI scheme^{29,33}, one can allow Alice and Bob to have different phase references which can be changed slowly (details can be found in Methods). Therefore, they can collect the data of k_{B} − k_{A} = k, k ∈ {0, 1, …, M − 1} to form a set D_{k}, where the probability of k_{B} − k_{A} = k is \(\frac{1}{M}\). For each set D_{k}, they calculate the value \({C}_{k}^{1}={\mathrm{(1}2{e}_{XXk}^{b1})}^{2}+{\mathrm{(1}2{e}_{XYk}^{b1})}^{2}+{\mathrm{(1}2{e}_{YXk}^{b1})}^{2}+{\mathrm{(1}2{e}_{YYk}^{b1})}^{2}\), where \({e}_{XXk(XYk,YXk,YYk)}^{b1}\) is the QBER of TF state with onephoton in set D_{k} given that Alice and Bob choose X − X(X − Y, Y − X, Y − Y) basis. The secure key rate of practical TFQKD with RFI scheme can be given by
where \({I}_{E}({C}^{1})=\mathrm{(1}{e}_{ZZ}^{b1})H(\frac{1+\mu }{2})+{e}_{ZZ}^{b1}H(\frac{1+v}{2})\) describes eavesdropper Eve’s information, thereinto, \(v=\sqrt{{C}^{1}\mathrm{/2}{\mathrm{(1}{e}_{ZZ}^{b1})}^{2}{u}^{2}}/{e}_{ZZ}^{b1}\), \(u=\,{\rm{\min }}[\sqrt{{C}^{1}\mathrm{/2}}\mathrm{/(1}{e}_{ZZ}^{b1}),\,1]\) and \({C}^{1}=\frac{1}{M}{\sum }_{k=0}^{M1}\,{C}_{k}^{1}\). Compared with the BB84 encoding, all data of RFI scheme can be exploited to estimate parameter C^{1}, which can be used to slow down the finite size effect. Alice and Bob can change M to acquire the maximum key rate without impacts on efficiency. The QBER of Z basis for TF state with onephoton \({e}_{ZZ}^{b1}\equiv 0\) leads to \({I}_{E}({C}^{1})=H\mathrm{((1}+\sqrt{{C}^{1}\mathrm{/2}}\mathrm{)/2)}\).
The secure key rate of practical TFQKD using BB84 encoding changes with the dark count rate as shown in Fig. 3. We use the practical parameters to simulate the secure key rate in Fig. 3, where the efficiency of detector is η_{d} = 40%, the loss coefficient of the channel is 0.2 dB/km and the optical error rate of system is e_{opt} = 1%. The optical error rate is usually large due to the longdistance singlephotontype interference. We compare the secure key rates of practical TFQKD using BB84 encoding and RFI scheme with the different optical error rate as shown in Fig. 4. To show the advantage of TFQKD, the efficiency and dark count rate of detector are assumed to be η_{d} = 90% and p_{d} = 10^{−9} in Fig. 4, respectively. In the simulation, both schemes can surpass the PLOB bound and tolerate the big optical error rate e_{opt}. The key rate of TFQKD with BB84 encoding will significantly decline with e_{opt} rising, while the RFI scheme is robust. However, the longdistance phasestabilization (it could not be a perfect match but is required to vary slowly) also exists since the relative phase changes too fast in the longdistance fiber or freespace channel.
The experimental demonstration of TFQKD with independent lasers in Fig. 2(a) is a big challenge, although the MDIQKD with twophoton BSM has been implemented over 404 km optical fiber^{34} by using asymmetric fourintensity decoystate method^{35}. Compared with the twophoton BSM, greater technological challenges exist in the TFQKD with singlephoton BSM. The frequency difference of two independent lasers is required more rigorously^{12}. The phaselocking technique may be used to compensate the frequency difference. Importantly, the longdistance phasestabilization technique is required to implement singlephoton interference with phase matching. The RFI scheme can allow the phase mismatching. However, the relative phase change is still required to vary slowly. To rapidly implement the proofofprinciple TFQKD experiment, we present a phase selfaligned TFQKD with single laser interference as shown in Fig. 2(b). The horizontal polarization optical pulse generated by Charlie is divided into two pulses by the polarizationmaintaining beam splitter. By exploiting the π/2 rotation effect of Faraday mirror, the two pulses interfere after they go through the same path. Though the phase selfaligned scheme would be affected by the loss and noise, the frequency difference and longdistance phasestabilization problems are both solved^{36}. An extra security analysis with untrusted source^{37} should be used to defeat the attack from systems of Alice and Bob.
Discussion
In summary, we have proved that the TFQKD can be regarded as a MDIQKD with singlephoton BSM. By introducing the Z basis encoding, the secret key extraction can exploit the tagging method of GLLP analysis and the decoystate method. Compared with BB84 encoding, the RFI scheme has the advantages of increasing the data of parameter estimation and reducing the effect of phase drift. We should point out that the extra Y basis preparation in RFI scheme does not add additional operation due to the active phase randomization requirement, which is different from the traditional QKD. We propose a feasible experimental scheme to implement the proofofprinciple experimental demonstration. Note that, the security of this proofofprinciple experiment in Fig. 2b is not guaranteed with our current analysis, which requires a further security evaluation due to introducing untrusted source. Through simulation, we show that the secure key rate of practical TFQKD can surpass the PLOB bound. The universally composable security with finitekey analysis needs to be considered in the future. Our proposal suggests an important avenue for practical highspeed and longdistance QKD without detector vulnerabilities. During the preparation of this paper and posting it on the arXiv, we became aware of some important works^{14,15,16,17,18,19} of TFQKD.
Methods
MDIQKD with singlephoton BSM
For the case of entanglementbased protocol with the entangled state \({\psi }_{t}\rangle =\sqrt{1t}0\rangle 1\rangle +\sqrt{t}1\rangle 0\rangle \), the joint quantum state of Alice and Bob can be given by
For the threshold detector and lossy channel, the TF state 00〉_{AB}, 01〉_{AB}, 10〉_{AB} and 11〉_{AB} will all have singlephoton Bell state clicks. Due to the singlephoton BSM of Charlie, the photon number of TF state will collapse to three events, namely vacuum, onephoton and twophoton. The corresponding probability can be expressed as
where the expression of q_{2} is acquired by the HongOuMandel interference of twophoton. The parameter \(\sqrt{\eta }={\eta }_{d}\times {10}^{0.02L\mathrm{/2}}\) is the transmittance between Alice (Bob) and Charlie.
For the case of prepareandmeasure protocol corresponding to entanglementbased protocol with the entangled state \({\psi }_{t}\rangle =\sqrt{1t}0\rangle 1\rangle +\sqrt{t}1\rangle 0\rangle \), the density matrix of TF state in the Z basis is
which means a mixture of photon number states for TF state in the Z basis. The TF state of Z basis is the product state of Alice’s and Bob’s quantum state. The density matrix of TF state with onephoton in the Z basis is
which needs one of Alice and Bob prepares 0〉 as logic bit 0 and the other prepares 1〉 as logic bit 1.
The density matrix of TF state in the X basis can be written as
Thereinto, we have
which means a coherent superposition of photon number state for TF state in the X basis. If Alice and Bob jointly perform QND measurement on TF state to implement photonnumberresolving, we have
where \({\rho }_{{\rm{TF}}}^{1ZZ}\) (\({\rho }_{{\rm{TF}}}^{1XX}\)) is the density matrix of TF state with onephoton in the Z (X) basis. We have \({Y}_{{\rm{TF}}}^{1ZZ}={Y}_{{\rm{TF}}}^{1XX}\) in the asymptotic limit due to \({\rho }_{{\rm{TF}}}^{1ZZ}={\rho }_{{\rm{TF}}}^{1XX}\), where \({Y}_{{\rm{TF}}}^{1ZZ}\) (\({Y}_{{\rm{TF}}}^{1XX}\)) is the yield given that Alice and Bob choose Z (X) basis and TF state contains onephoton. Alice and Bob can know the locations of the TF state with onephoton by using the QND measurement, they could discard all other states and apply error correction and privacy amplification only to the TF state with onephoton. In this case with BB84 encoding, they can achieve a key rate of^{20,21}
For the TF state with onephoton in the Z basis, we have \({e}_{ZZ}^{b1}\equiv 0\) since we only have the case of Alice’s logic bit 0 (1) and Bob’s logic bit 1 (0) corresponding to quantum state 01〉 (10〉).
However, if we assume that Alice and Bob can know the QBER of TF state with onephoton in the X basis, one can acquire the secure key in the Z basis without Alice and Bob knowing the locations (QND measurement) of the TF state with onephoton by using the GLLP analysis^{24}. The secure key rate can be given by
where the parameter q_{1} should be calculated by using the decoystate method, for example, we choose three value of t in the Z basis.
TFQKD with phaseencoding coherent state
In order to make Alice and Bob know the QBER of TF state with onephoton in the X basis without the requirement of QND measurement, we need to consider the case of phaserandomized coherent state
where the global phases of Alice’s coherent state \({\alpha \rangle }_{A}={{e}^{i\theta }\sqrt{\mu }\rangle }_{A}\) and Bob’s \({{e}^{i\delta }\alpha \rangle }_{B}={{e}^{i(\theta +\delta )}\sqrt{\mu }\rangle }_{B}\) should be randomized and have a fixed phase difference δ. Therefore, we have
For the X basis encoding, we have
where the global phases of Alice’s and Bob’s coherent state should be equal and randomized. It can be realized by using postselected phasematching method for phaserandomized coherent state introduced in the original TFQKD^{12} and phasematching QKD^{15}. If we consider the photon number space of TF state given that the global phases of Alice’s coherent state and Bob’s are randomized and have a fixed phase difference, the density matrix can be given by
which is similar with the phase encoding phaserandomized coherent state in the traditional decoystate QKD^{26,27}. Therefore, the decoy state method can be used for estimating the yield and QBER of TF state with onephoton.
For phaserandomized coherent state used for Z basis encoding, we have
We need 0〉 as logic bit 0 and 1〉 as logic bit 1, therefore the efficient TF state with onephoton in Z basis only results from the case of logic bit 0_{A}1_{B} and 1_{A}0_{B} with the probability 2t(1 − t)μe^{−μ}. For simulation, we consider the case without Charlie’s disturbance. In the Z basis of practical TFQKD, by going through the quantum channel and beam splitter, we have (1 − t)^{2} probability of quantum state
t(1 − t) probability of quantum state
t(1 − t) probability of quantum state
and t^{2} probability of quantum state
Here, we have θ_{A} ∈ [0, 2π) and θ_{B} ∈ [0, 2π), L and R represent the left detector and right detector of Charlie, respectively. The gain Q_{ZZ} and QBER E_{ZZ} of practical TFQKD can be given by
and
For phaseencoding basis of practical TFQKD, by going through the quantum channel and beam splitter, we have 1/4 probability of quantum state
where h_{A}, h_{B} ∈ {0, 1} represent basis X and Y, g_{A}, g_{B} ∈ {0, 1} represent logic bit 0 and 1 given that the intensities of Alice’s and Bob’s are λ and χ, respectively, λ, χ ∈ {ν/2, ω/2, 0}. Here, we define \({Q}_{{h}_{A},{h}_{B}}^{{\theta }_{A},{\theta }_{B},\lambda ,\chi }\) and \({E}_{{h}_{A},{h}_{B}}^{{\theta }_{A},{\theta }_{B},\lambda ,\chi }\) are the gain and QBER that Alice and Bob choose basis h_{A} and h_{B} when they send the global phase θ_{A} and θ_{B} optical pulses with intensities λ and χ, respectively. Here,
and
where \(x={\theta }_{B}{\theta }_{A}+\frac{\pi }{2}({h}_{B}{h}_{A})\), \({E}_{{h}_{A},{h}_{B}}^{{\theta }_{A},{\theta }_{B},\lambda ,\lambda }\simeq \frac{1\,\cos \,x}{2}\) when we assume \(\sqrt{\eta }\to 0\) and p_{d} → 0.
Obviously, we can directly estimate the yield \({Y}_{{\rm{TF}}}^{1ZZ}\) by using the data of phaseencoding basis given that one of Alice and Bob sends intensity 0. We define \(\lambda \uplus \chi \) as the intensity set when Alice and Bob send intensity λ and χ phaserandomized coherent state. Therefore, \({Q}^{\frac{\nu }{2}}\), \({Q}^{\frac{\nu }{2}}\) and Q^{0} are the gain when Alice and Bob send intensities set \(\{0\uplus \frac{\nu }{2},\,\frac{\nu }{2}\uplus 0\}\), \(\{0\uplus \frac{\omega }{2},\,\frac{\omega }{2}\uplus 0\}\) and \(\mathrm{\{0}\uplus \mathrm{0\}}\), which can be written as
The \({Y}_{{\rm{TF}}}^{0ZZ}\) and \({Y}_{{\rm{TF}}}^{1ZZ}\) are the yields of TF state with vacuum and onephoton in the Z basis, respectively, which can be given by (ν > ω > 0)^{26,27}
and
We assume that the optical error rate e_{opt} of X basis exists due to the singlephoton interference. For simplicity, we assume that the optical error rate is introduced by the phase misalignment^{12}. Here, a fixed phase difference between Alice’s and Bob’s global phase is δ_{0} = arccos(1 − 2e_{opt}). By using the postselected phasematching method in practical TFQKD with BB84 encoding, \({Q}_{XX}^{\nu }\) \(({Q}_{XX}^{\omega })\) and \({E}_{XX}^{\nu }\) \(({E}_{XX}^{\omega })\) are gain and QBER given that Alice chooses X basis with intensity \(\frac{\nu }{2}\) \((\frac{\omega }{2})\) and Bob chooses X basis with intensity \(\frac{\nu }{2}\) \((\frac{\omega }{2})\) in the case of k_{B} − k_{A} = 0 and \(\frac{M}{2}\). They can be given by
and
Due to the random phase shifting, there is still an intrinsic QBER because the random phases are not perfectly matched. If e_{opt} = 0.03, we have δ_{0} = 0.35 and \({E}_{XX}^{\nu } \sim \mathrm{3.6 \% }\). By using the decoystate mentod^{26,27}, the yield \({Y}_{{\rm{TF}}}^{1XX}\) and QBER \({e}_{XX}^{b1}\) can be given by
where \({e}^{b0}=\frac{1}{2}\) is the QBER of TF state with vacuum in phaseencoding basis.
For sixstate encoding^{28}, the probability that both bit flip and phase shift occurs can be given by^{38}
To simplify, we assume that those cases of qubit preparation with relative phase modulation are symmetrical since the random phase is unknown before Charlie performs singlephoton BSM. Therefore, we abtain \(a={e}_{ZZ}^{b1}\mathrm{/2}\). Interestingly, the QBER \({e}_{ZZ}^{b1}\equiv 0\), which means that the key rate of practical TFQKD with sixstate encoding has no advantage compared with BB84 encoding.
For the RFI scheme^{29}, the Z basis is always well defined, which is Z_{A} = Z_{B} = Z for Alice and Bob. The other two bases may vary with the slow phase shifting β, the relation can be given by X_{B} = cosβX_{A} + sinβY_{A}, Y_{B} = cosβY_{A}−sinβY_{B} and β = β_{B} − β_{A}, where Z_{A} and Z_{B}, X_{A} and X_{B}, Y_{A} and Y_{B} are the location reference frames for Z, X and Y basis of Alice and Bob, respectively. β_{A} (β_{B}) is the deviation between the practical and standard reference frame for Alice (Bob). Therefore, the eigenstates of X_{A} (X_{B}) and Y_{A} (Y_{B}) can be written as \({\pm \rangle }_{A}=(0\rangle \pm {e}^{i{\beta }_{A}}1\rangle )/\sqrt{2}\) \(({\pm \rangle }_{B}=(0\rangle \pm {e}^{i{\beta }_{B}}1\rangle )/\sqrt{2})\)) and \({\pm i\rangle }_{A}=(0\rangle \pm i{e}^{i{\beta }_{A}}1\rangle )/\sqrt{2}\) \(({\pm i\rangle }_{B}=(0\rangle \pm i{e}^{i{\beta }_{B}}1\rangle )/\sqrt{2})\). Note that β_{A} and β_{B} are the phases of intrinsic degree of freedom between 0 and 1 and can vary slowly in the virtual protocol with RFI theory. The key rate of singlephoton with RFI theory is given by^{29}
Here, \({I}_{E}(C)=\mathrm{(1}{e}_{b})H(\frac{1+\mu }{2})+{e}_{b}H(\frac{1+v}{2})\) quantifies the information of Eve’s knowledge, parameters \(v=\sqrt{C\mathrm{/2}{\mathrm{(1}{e}_{b})}^{2}{u}^{2}}/{e}_{b}\) and \(u=\,{\rm{\min }}\,[\sqrt{C\mathrm{/2}}\mathrm{/(1}{e}_{b}),\,\mathrm{1]}\). We have \({I}_{E}(C)=H\mathrm{((1}+\sqrt{C\mathrm{/2}}\mathrm{)/2)}\) if the QBER e_{b} = 0. The value C can be defined as
which is independent of phase drifting β_{A} (β_{B}) and can just be used to bound Eve’s information. However, the phase drifting will add the QBER of X basis, which will decrease the key rate of BB84 encoding. Thereinto, E_{XX(YY, XY, YX)} is the QBER given that Alice and Bob choose X − X(Y − Y, X − Y, Y − X) basis, which can be written as
One can acquire the maximum value C = 2 in the ideal case and I_{E}(C = 2) = 0 if the phase difference β is fixed. For phase change from β to β + Δβ, Δβ ∈ [0, 2π] (uniformity variation), we have
We can see that C is only related to phase change Δβ and is not related to phase difference β in theory. The value C will decrease with Δβ increasing.
In the practical TFQKD with RFI scheme, we define that \({Q}_{XXk}^{\nu }\) and \({E}_{XXk}^{\nu }\) are gain and QBER when Alice chooses X basis with intensity \(\frac{\nu }{2}\) and Bob chooses X basis with intensity \(\frac{\nu }{2}\) in the case of set D_{k} by using the postselected phasematching method. Therefore, the gain \({Q}_{XXk}^{\nu }\), \({Q}_{XYk}^{\nu }\), \({Q}_{YXk}^{\nu }\) and \({Q}_{YYk}^{\nu }\) of set D_{k} are
The QBER \({E}_{XXk}^{\nu }\), \({E}_{XYk}^{\nu }\), \({E}_{YXk}^{\nu }\) and \({E}_{YYk}^{\nu }\) of set D_{k} can be written as
By using the decoystate method, the lower and upper bounds of yield \({Y}_{{\rm{TF}}}^{1XXk}\), \({Y}_{{\rm{TF}}}^{1XYk}\), \({Y}_{{\rm{TF}}}^{1YXk}\) and \({Y}_{{\rm{TF}}}^{1YYk}\) will be
and
The lower and upper bounds of QBER \({e}_{XXk}^{b1}\), \({e}_{XYk}^{b1}\), \({e}_{YXk}^{b1}\) and \({e}_{YYk}^{b1}\) can be given by
and
For the practical TFQKD with RFI scheme, we need to calculate the minimum value of \({C}_{k}^{1}\). Therefore, for the value
we have
the parameters \({e}_{XYk}^{b1}\), \({e}_{YXk}^{b1}\) and \({e}_{YYk}^{b1}\) are similar with the case of \({e}_{XXk}^{b1}\).
References
Bennett, C. H. & Brassard, G. Quantum cryptography: public key distribution and coin tossing. In Proceedings of the Conference on Computers, Systems and Signal Processing, 175–179 (IEEE Press, New York, 1984).
Scarani, V. et al. The security of practical quantum key distribution. Rev. Mod. Phys. 81, 1301–1350 (2009).
Weedbrook, C. et al. Gaussian quantum information. Rev. Mod. Phys. 84, 621–669 (2012).
Boaron, A. et al. Secure quantum key distribution over 421 km of optical fiber. Phys. Rev. Lett. 121, 190502 (2018).
Liao, S.K. et al. Satellitetoground quantum key distribution. Nature 549, 43 (2017).
Takeoka, M., Guha, S. & Wilde, M. M. Fundamental rateloss tradeoff for optical quantum key distribution. Nature Commun. 5, 5235 (2014).
Pirandola, S., Laurenza, R., Ottaviani, C. & Banchi, L. Fundamental limits of repeaterless quantum communications. Nature Commun. 8, 15043 (2017).
Duan, L.M., Lukin, M., Cirac, J. I. & Zoller, P. Longdistance quantum communication with atomic ensembles and linear optics. Nature 414, 413 (2001).
Sangouard, N., Simon, C., de Riedmatten, H. & Gisin, N. Quantum repeaters based on atomic ensembles and linear optics. Rev. Mod. Phys. 83, 33–80 (2011).
Azuma, K., Tamaki, K. & Munro, W. J. Allphotonic intercity quantum key distribution. Nature Commun. 6, 10171 (2015).
Qiu, J. et al. Quantum communications leap out of the lab. Nature 508, 441–442 (2014).
Lucamarini, M., Yuan, Z., Dynes, J. & Shields, A. Overcoming the rate–distance limit of quantum key distribution without quantum repeaters. Nature 557, 400–403 (2018).
Lo, H.K., Curty, M. & Qi, B. Measurementdeviceindependent quantum key distribution. Phys. Rev. Lett. 108, 130503 (2012).
Tamaki, K., Lo, H.K., Wang, W. & Lucamarini, M. Information theoretic security of quantum key distribution overcoming the repeaterless secret key capacity bound. arXiv:1805.05511 (2018).
Ma, X., Zeng, P. & Zhou, H. Phasematching quantum key distribution. Phys. Rev. X 8, 031043 (2018).
Wang, X.B., Yu, Z.W. & Hu, X.L. Twinfield quantum key distribution with large misalignment error. Phys. Rev. A 98, 062323 (2018).
Cui, C. et al. Phasematching quantum key distribution without phase postselection. arXiv:1807.02334 (2018).
Curty, M., Azuma, K. & Lo, H. K. Simple security proof of twinfield type quantum key distribution protocol. arXiv:1807.07667 (2018).
Lin, J. & Lütkenhaus, N. Simple security analysis of phasematching measurementdeviceindependent quantum key distribution. Phys. Rev. A 98, 042332 (2018).
Lo, H.K. & Chau, H. F. Unconditional security of quantum key distribution over arbitrarily long distances. Science 283, 2050–2056 (1999).
Shor, P. W. & Preskill, J. Simple proof of security of the bb84 quantum key distribution protocol. Phys. Rev. Lett. 85, 441 (2000).
Kraus, B., Gisin, N. & Renner, R. Lower and upper bounds on the secretkey rate for quantum key distribution protocols using oneway classical communication. Phys. Rev. Lett. 95, 080501 (2005).
Tomamichel, M. & Renner, R. Uncertainty relation for smooth entropies. Phys. Rev. Lett. 106, 110506 (2011).
Gottesman, D., Lo, H.K., Lütkenhaus, N. & Preskill, J. Security of quantum key distribution with imperfect devices. Quantum Inf. Comput. 4, 325 (2004).
Hwang, W.Y. Quantum key distribution with high loss: toward global secure communication. Phys. Rev. Lett. 91, 057901 (2003).
Wang, X.B. Beating the photonnumbersplitting attack in practical quantum cryptography. Phys. Rev. Lett. 94, 230503 (2005).
Lo, H.K., Ma, X. & Chen, K. Decoy state quantum key distribution. Phys. Rev. Lett. 94, 230504 (2005).
Lo, H.K. Proof of unconditional security of sixstate quantum key distribution scheme. Quantum Inf. Comput. 1, 81 (2001).
Laing, A., Scarani, V., Rarity, J. G. & OBrien, J. L. Referenceframeindependent quantum key distribution. Phys. Rev. A 82, 012304 (2010).
Sciarrino, F., Lombardi, E., Milani, G. & De Martini, F. Delayedchoice entanglement swapping with vacuum–onephoton quantum states. Phys. Rev. A 66, 024309 (2002).
Lombardi, E., Sciarrino, F., Popescu, S. & De Martini, F. Teleportation of a vacuum–onephoton qubit. Phys. Rev. Lett. 88, 070402 (2002).
Pawłowski, M. et al. Information causality as a physical principle. Nature 461, 1101 (2009).
Wang, C. et al. Phasereferencefree experiment of measurementdeviceindependent quantum key distribution. Phys. Rev. Lett. 115, 160502 (2015).
Yin, H.L. et al. Measurementdeviceindependent quantum key distribution over a 404 km optical fiber. Phys. Rev. Lett. 117, 190501 (2016).
Zhou, Y.H., Yu, Z.W. & Wang, X.B. Making the decoystate measurementdeviceindependent quantum key distribution practically useful. Phys. Rev. A 93, 042324 (2016).
Guan, J.Y. et al. Observation of quantum fingerprinting beating the classical limit. Phys. Rev. Lett. 116, 240502 (2016).
Zhao, Y., Qi, B., Lo, H.K. & Qian, L. Security analysis of an untrusted source for quantum key distribution: passive approach. New J. Phys. 12, 023024 (2010).
Yin, H.L., Fu, Y., Mao, Y. & Chen, Z.B. Security of quantum key distribution with multiphoton components. Sci. Rep. 6, 29482 (2016).
Acknowledgements
We thank W. Zhu for the help with the figure. H.L. Yin gratefully acknowledges support from the National Natural Science Foundation of China under Grant No. 61801420, the Fundamental Research Funds for the Central Universities.
Author information
Authors and Affiliations
Contributions
H.L.Y. and Y.F. have the main idea. All results are acquired through the discussion among all authors. All authors contribute to the writing and reviewing of the manuscript.
Corresponding author
Ethics declarations
Competing Interests
The authors declare no competing interests.
Additional information
Publisher’s note: Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
Rights and permissions
Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license, and indicate if changes were made. The images or other third party material in this article are included in the article’s Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the article’s Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this license, visit http://creativecommons.org/licenses/by/4.0/.
About this article
Cite this article
Yin, HL., Fu, Y. MeasurementDeviceIndependent TwinField Quantum Key Distribution. Sci Rep 9, 3045 (2019). https://doi.org/10.1038/s41598019394541
Received:
Accepted:
Published:
DOI: https://doi.org/10.1038/s41598019394541
This article is cited by

More optimal relativistic quantum key distribution
Scientific Reports (2022)

Continuous variable measurement device independent quantum conferencing with postselection
Scientific Reports (2022)

2×N twinfield quantum key distribution network configuration based on polarization, wavelength, and time division multiplexing
npj Quantum Information (2022)

Extended singlephoton entanglementbased phasematching quantum key distribution
Quantum Information Processing (2022)

Proofofprinciple experimental demonstration of twinfield quantum key distribution over optical channels with asymmetric losses
npj Quantum Information (2021)
Comments
By submitting a comment you agree to abide by our Terms and Community Guidelines. If you find something abusive or that does not comply with our terms or guidelines please flag it as inappropriate.