Coherent-State-Based Twin-Field Quantum Key Distribution

Large-scale quantum communication networks are still a huge challenge due to the rate-distance limit of quantum key distribution (QKD). Recently, twin-field (TF) QKD has been proposed to overcome this limit. Here, we prove that coherent-state-based TF-QKD is a time-reversed entanglement protocol, where the entanglement generation is realized with entanglement swapping operation via an entangled coherent state measurement. We propose a coherent-state-based TF-QKD with optimal secret key rate under symmetric and asymmetric channels by using coherent state and cat state coding. Furthermore, we show that our protocol can be converted to all recent coherent-state-based TF-QKD protocols by using our security proof. By using the entanglement purification with two-way classical communication, we improve the transmission distance of all coherent-state-based TF-QKD protocols.


Results
where  | 〉 even a ( odd a  | 〉 ) means that the output mode  a contains even (odd) photon numbers. If we consider the case of ideal photon-number-resolving detector and lossless channel, one can unambiguously discriminate the four ECSs by performing photon-number parity measurement.
For the case of lossy channel and threshold detector, one can only discriminate the case with or without detector clicks. Generally, a successful detection event in TF-QKD 13 is defined that one and only one detector clicks. Therefore, we make only detector L (R) clicking represent that the result of the ECS measurement is the state |Φ 〉 − |Ψ 〉 − ( ). Due to decoherence of the cat states in lossy channel, the states |Φ 〉 + and |Ψ 〉 + will always be mistakenly measured as quantum states |Φ 〉 − and |Ψ 〉 − , respectively. However, the corresponding probabilities can be restricted to be very low when the optical intensity is low and there is no eavesdropper's disturbance. The post-selected joint quantum states of two legitimate users have quantum correlations, which then means that coherent-state-based TF-QKD have MDI characteristic. tf-QKD with cat state. We introduce a coherent-state-based TF-QKD with coherent state and cat state coding, as shown in Fig. 1. State preparation. Alice (Bob) randomly chooses the Z and X bases with probabilities p Z and p X . For the Z basis, Alice (Bob) randomly prepares coherent state optical pulses α | 〉 a b ( ) and a b ( ) α |− 〉 with equal probabilities for the logic bits 0 and 1. For the X basis, Alice (Bob) randomly prepares cat state optical pulses with equal probabilities for the logic bits 0 and 1. Entanglement measurement. Alice and Bob send the optical pulses to the untrusted Charlie through insecure quantum channel with efficiency η a and η b (with detector efficiency taken into account). Charlie is supposed to perform the ECS measurement. For example, he let the two optical pulses interfere in the symmetric BS which would be detected by two threshold detectors L and R. Announcement. Charlie publicly discloses whether he has obtained a successful measurement result and which ECS is acquired. Alice and Bob only keep the data of successful measurement and discard the rest. Reconciliation. Alice and Bob announce their bases over an authenticated classical channel. They only keep the data of the same basis and discard the rest. For the Z basis, Bob flips his key bit if Charlie announces a result with |Ψ 〉 − . For the X basis, Bob always flips his key bit. Parameter estimation. The data of the Z basis are used for constituting raw key and calculating the gain Q Z and quantum bit error rate (QBER) E Z of the Z basis. The data of the X basis are all announced to calculate QBER E X of the X basis. Key distillation. Alice and Bob exploit the error correction and privacy amplification to distill secret key.
Here, we prove that coherent-state-based TF-QKD with coherent state and cat state coding is secure against coherent attacks in the asymptotic regime. Any one of two successful detections is enough for proving the security. The coherent-state-based TF-QKD can be regarded as a time-reversed entanglement protocol, where Alice and Bob prepare maximally entangled state , respectively. |± 〉 z are the eigenstates of Pauli's Z operator. Alice and Bob keep the qubit and send the optical mode to Charlie, who is supposed to perform entanglement swapping via the ECS measurement. Thereby, the bipartite states between Alice and Bob have quantum correlation through Charlie's entanglement swapping operation. One can use the entanglement purification technique 38 to distill maximally entangled state and generate the secret key. If Alice and Bob measure qubits before sending optical pulses in the virtual entanglement protocol, it will become the prepare-and-measurement protocol, i.e., coherent-state-based TF-QKD. Details can be found in Supplemental Material. The efficient QKD scheme 43 can ( ) if choosing the Z and X bases, respectively. Alice and Bob use the insecure channels η a and b η to send the optical pulses to untrusted Charlie, who is supposed to perform the ECS measurement on the two incoming pulses. Only L (R) detector click means a successful measurement www.nature.com/scientificreports www.nature.com/scientificreports/ be directly applied, where we let ≈ p 1 Z in the asymptotic limit. The secret key rate of our coherent-state-based TF-QKD with one-way classical communication 39 in the asymptotic limit is is the Shannon entropy and = . f 1 16 is the error correction efficiency. In our simulation, without Charlie's disturbance, we have gain Q p pe is the misalignment rate of the Z basis and p d is the dark count rate. The misalignment of the X basis can be neglected since Bob always flips his bit.
Here, we exploit the two-way entanglement purification 40 into our coherent-state-based TF-QKD protocol to increase transmission distance. Specifically, before implementing Key distillation step, Alice randomly permutes all raw key bits and divides them into two groups, Bob does the same. Alice and Bob compute a parity on raw key of two groups and compare the parities. The second group is always discarded. If their parities are the same, they keep the bit of the first group. Otherwise, they discard it. One can repeat the above operation once for each B step. After kth B step is applied, the gain, bit and phase error rates can be given by . The secret key rate of our coherent-state-based TF-QKD after kth B step in the asymptotic limit is Converting to other protocols. Without loss of generality, let positive-operator valued measure E 10 and . The density matrix of the Z and X bases are , they always generate the error gain since Bob always flips his bit, and the corresponding density Let Q X and Q X E represent the gain and error gain of the X basis. In the case of asymptotic limit, we always have s . Therefore, the QBER E X (phase error rate of the Z basis) in the asymptotic limit can be given by If one can acquire an upper bound of Q X E , the QBER E X can be bounded. By using the entanglement purification with one-way 38,39 and two-way 40 classical communication to prove security, we only require the estimation of the QBER E X . This means that we do not need to prepare cat state if we can acquire the QBER E X through alternative method. The alternative method need to ensure that the prepared state by Alice (Bob) is linearly dependent, which cannot allow Charlie to implement unambiguous-state-discrimination attack 44 before performing the entanglement swapping. Here, we show that our protocol can be converted to the coherent-state-based protocols of refs 14,18-20 by using our security proof.
For the protocol proposed in ref. 20  . As pointed out in ref. 20 , the operator X E ρ can be approximated to arbitrary precision in the Hilbert-Schmidt norm by the discrete diagonal coherent state representation P ( , ) i is the tensor product of coherent state and λ i is complex number. Thereby, the error gain Q X E can be precisely obtained by using coherent states with infinite intensities. Indeed, in the ideal situation with symmetric channel, µ µ µ = = η η η = = , the secret key rate of this protocol by using our security proof with one-way classical communication is given by , which is the same with the results of ref. 20 .
For the protocol proposed in refs 18,19 , Alice and Bob randomly prepare phase-randomized coherent state if they choose the X basis. As pointed out in refs 18,19 , by using the Cauchy-Schwarz inequality, we can bound the error gain Q X E with photon-number state, i.e., Q E Tr( ) Y n m , is the yield given that Alice and Bob send n and m photon states and P e n / !
. Decoy-state method [45][46][47] can be used to estimate the yield Y n m , , which has been realized with finite intensities 18,48 . Here, we use the three-intensity, 0 ω ν < < , to estimate the yield, which can be found in Methods. For the protocol proposed in ref. 14 . They keep the raw key bit only if 0 a b θ θ | − | = or π. As pointed out in ref. 14 , one can introduce a virtual trusted party who prepares a state, splits it using symmetric BS, and sends it to both Alice and Bob. We have the following observations P( ) P( ) P( ( ) ) P( ( ) ) α α ξ α ξ α | 〉 + |− 〉 = | 〉 + | 〉 , where we need to assume . Y n is the yield given that the total photon number sent by Alice and Bob is n. Only even photon numbers have contribution to the phase error rate in our security proof which is only the same with the results of ref. 14 in the ideal situation. Different from protocols of ours and refs [18][19][20] , the protocol of ref. 14 seems to be only suitable for symmetric channel.

Discussion
For simulation, we use the following parameters. The inherent loss of fiber is 0.16 dB/km, the efficiency and dark count rate of threshold single-photon detector are η = 85% d and p 10 d 7 = − . For simplicity, we let Protocol 1 represent our coherent state and cat state coding protocol. Let Protocol 2 represent the protocol in refs 18,19 with three-intensity phase-randomized coherent state. Here, we fix the intensities of phase-randomized coherent state with ν = . 0 1 and 0 02 ω = . . The secret key rate of our protocol is equal to that of protocol in ref. 20 since cat state can be approximated to arbitrary precision in the Hilbert-Schmidt norm by the discrete diagonal coherent state representation 20 . The performance of Protocols 1 and 2 under symmetric channel have been shown in Fig. 2, which assumes 1 GHz system repetition rate 23 . Here, we do not consider the performance of protocols in ref. 14 , whose secret key rate has been shown lower than protocols in refs [18][19][20] . The secret key rate and transmission distance of Protocol 1 are both superior to Protocol 2. The transmission distance of Protocols 1 and 2 can both be improved by using the two-way classical communication. Especially, the advantages are very clear when the system misalignment rate is large, like e 10% d Z = .
The large system misalignment of TF-QKD is reasonable since the phase-locking and long-distance phase stabilization techniques in field are still difficult even with some experimental progresses [23][24][25][26] . The performance of Protocols 1 and 2 under asymmetric channel have been shown in Fig. 3. The secret key rate of Protocol 1 can still surpass the repeaterless bound when the asymmetric channel ratio is 70%. The asymmetric channel ratio is the ratio between A-C and A-B, where A-C (B) represents the distance between Alice and Charlie (Bob). Compare Fig. 2 with 3, the performance of coherent-state-based TF-QKD is the best under symmetric channel due to the single-photon-type interference.
In summary, we propose a coherent-state-based TF-QKD with optimal secret key rate by using coherent state and cat state coding. By using the ECS measurement as the entanglement swapping operation, we unify all known coherent-state-based TF-QKD protocols under a single framework. We have proved that the coherent-state-based TF-QKD is a time-reversed entanglement protocol, which means that one can use the known techniques of qubit-based QKD to further develop the coherent-state-based TF-QKD. The results show that coherent-state-based TF-QKD is suitable for building quantum communication networks within hundreds of kilometers without trusted relay or quantum repeater. We remark that cat states used for high-speed QKD will have difficulty under current experimental conditions. However, current experiments on the demonstration of various quantum tasks with cat states are very active [33][34][35][36][37] , implying that cat states may become a practical resource with the rapid development of technology.