Phase Matching Quantum Key Distribution based on Single-Photon Entanglement

Two time-reversal quantum key distribution (QKD) schemes are the quantum entanglement based device-independent (DI)-QKD and measurement-device-independent (MDI)-QKD. The recently proposed twin field (TF)-QKD, also known as phase-matching (PM)-QKD, has improved the key rate bound from O(η) to O\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$(\sqrt{{\boldsymbol{\eta }}})$$\end{document}(η) with η the channel transmittance. In fact, TF-QKD is a kind of MDI-QKD but based on single-photon detection. In this paper, we propose a different PM-QKD based on single-photon entanglement, referred to as single-photon entanglement-based phase-matching (SEPM)-QKD, which can be viewed as a time-reversed version of the TF-QKD. Detection loopholes of the standard Bell test, which often occur in DI-QKD over long transmission distances, are not present in this protocol because the measurement settings and key information are the same quantity which is encoded in the local weak coherent state. We give a security proof of SEPM-QKD and demonstrate in theory that it is secure against all collective attacks and beam-splitting attacks. The simulation results show that the key rate enjoys a bound of O\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$(\sqrt{{\boldsymbol{\eta }}})$$\end{document}(η) with respect to the transmittance. SEPM-QKD not only helps us understand TF-QKD more deeply, but also hints at a feasible approach to eliminate detection loopholes in DI-QKD for long-distance communications.

Two time-reversal quantum key distribution (QKD) schemes are the quantum entanglement based device-independent (DI)-QKD and measurement-device-independent (MDI)-QKD.The recently proposed twin field (TF)-QKD, also known as phase-matching (PM)-QKD, has improved the key rate bound from O (η) to O √ η with η the channel transmittance.In fact, TF-QKD is a kind of MDI-QKD but based on single-photon detection.In this paper, we propose a different PM-QKD based on single-photon entanglement, referred to as SEPM-QKD, which can be viewed as a time-reversed version of the TF-QKD.Detection loopholes of the standard Bell test, which often occur in DI-QKD over long communication distances, are not present in this protocol because the measurement settings and key information are the same quantity which is encoded in the local weak coherent state.We give a security proof of SEPM-QKD and demonstrate in theory that it is secure against all collective attacks and beam-splitting attacks.The simulation results show that the key rate enjoys a bound of O √ η with respect to the transmittance.SEPM-QKD not only helps us understand TF-QKD more deeply, but also hints at a feasible approach to eliminate detection loopholes in DI-QKD for long-distance communications.

I. INTRODUCTION
Quantum key distribution (QKD), a secure communication method to enabling a secret random number string to be shared by two well-separated parties, says Alice and Bob, has been proven to be robust against channel attacks and against the power of quantum computation [1,2].The random number string, known only to Alice and Bob, can be used to encrypt messages transmitted between them.In theoretical research, the work has focused on the secureness of QKD taking into consideration the imperfections of actual devices [3][4][5][6][7].In practical applications, research on the extractable key rate has been categorized as focusing on improving the key rate, such as decoy state protocols [8][9][10][11][12], asymmetric coding [13][14][15], higher dimensional systems [16][17][18][19][20][21], and parameter optimization [22][23][24][25], or focusing on improving the key communication distance [13,26,27].
In addition to the recent satellite QKD scheme [28], the current mainstream QKD is based on photon transmission over optical fiber.For a given QKD scheme, the factors that determine the key rate and communication distance are the error rate and the transmittance η.In the initial stage of QKD research, a singlephoton was used as the carrier of quantum information and secret key rate was bounded to O (η) [29][30][31], which is equal to the maximum probability of successful detection of a single-photon state.The measurement-deviceindependent (MDI)-QKD proposed latter is based on the correlation measurement of a two-photon state and closed all detection loopholes [26,32].Because the error rate for MDI-QKD has a quadratic decrease with respect to BB84, the communication distance doubled.However, the transmittance for a single-photon in MDI-QKD is unchanged, and so the key rate is still bounded by O (η).
In Lucamarini et al. (2018) the twin-field (TF)-QKD [33], also known as phase-matching (PM)-QKD by Ma et al. [34], was proposed to improve the key rate.TF-QKD and PM-QKD are essentially identical, the former reflects what states are used to carry the keys, and the latter reflects how the keys are generated.After that, some variants of TF-QKD have been proposed, such as the sending or not sending protocol by Wang et al. [35,36] and removing of phase randomization and postselection in the coding mode by cui et al. [37].TF-QKD is a singlephoton version of MDI-QKD [38,39], in which a single count is used to extract the quantum key.In TF-QKD, the information carrier is no longer a single photon but a weak coherent field or wave state with definite phase and amplitude [39].Independent coherent states with locked global phase can interfere with each other, so they can be used in phase matching to extract keys.A weak coherent state can be approximated as a coherent superposition of a vacuum state and a single photon state.The detection probability has a √ η dependence on the channel transmittance, which leads to a bound for key rate of O √ η .Because η is a quantity less than 1, this protocol further enhances the communication distance of rate keys in optical fibers.
Indeed, MDI-QKD itself may be regarded as a time-reversed version of an entanglement-based deviceindependent (DI)-QKD [40,41], and therefore conclude that TF-QKD is a time-reversed version of the singlephoton entanglement-based DI-QKD.Over 30 years ago, scientists proposed and experimentally verified the existence of single-photon entanglement and confirmed the Bell inequalities for quantum correlations in different forms [42][43][44][45][46][47].Subsequently, single-photonentanglement-based DI-QKD was proposed in which the key is extracted according to whether Alice or Bob has detected that photon [48].However, this work did not attract much attention, let alone the relationship between this protocol and TF-QKD.In our previous work, we proposed confirming Bell inequalities for single-photon entanglement from joint measurements in wave spacethe conjugate space of the photon number space.As a new carrier of quantum information, the wave state has similar properties to the weak coherent state; both can be viewed as a coherent superposition of a vacuum state and a single-photon state.In this paper, we propose single-photon entanglement-based phase-matching (SEPM)-QKD, which is actually a TF-QKD with quantum entanglement.In this protocol, single-photon entanglement provides the quantum link in the communications between Alice and Bob, who choose the two groups of phases to encode the key.Monitoring Eve's eavesdropping is performed by detecting violations of Bell inequality.Security proofing against collective attacks and beam-splitting attacks is thereby established.We also compare the key rate of SEPM-QKD with the wave-state-based QKD, as for TF(PM)-QKD and singlephoton-based QKD, like the BB84-and MDI-QKD protocols.

II. THEORY OF SINGLE PHOTON ENTANGLEMENT
The physical basis of SEPM-QKD is the detection of single-photon entanglement in wave space, (Fig. 1).When a third-party Charlie directs a single-photon state onto an optical beam splitter, the photon states at the two output ports may be regarded as an entangled state of a vacuum state |0 and a single-photon state |1 in the two path modes [42] where e iθ is the accumulated phase difference between the two arms.Equation ( 1) is a representation of singlephoton entanglement in photon-number space.Based on the wave-particle duality in quantum mechanics, it is convenient to call the conjugate space of this photon number space the wave space.Applying a two-dimensional Fourier transformation, we obtain single-photon entanglement in the conjugate space where states with a subscript w denote wave states, α and α − θ each with a value ranging from 0 to 2π denotes the phase characterizing Alice's and Bob's wave state.
The pair of orthogonal bases states in wave space are It is these states that are used to distribute the quantum correlation between Alice and Bob.
Next, we analyze single-photon entanglement in wave space.Here we refer to the photon states |α w , |α + π w as the Z basis if α = 0, and |α w , |α + π w as the Y basis if α = π 2 ; then the states |0 and |1 belong to the X basis.Because the value of α is any real number, then, if we set the value of θ to zero, the initial singlephoton entangled state is the Bell state Φ − A,B w , which is rotationally symmetric in the ZY plane.
In our previous work, we demonstrated that a wave state can be measured through interference with a reference weak coherent state, as shown in the measurement device at the sites of Alice and Bob.Assuming that the weak coherent states selected by Alice and Bob are γe iα and γe iβ with a same small amplitude γ far less than 1, the weak coherent state has the approximate form where α and β are the phase values of the wave states of Alice and Bob.Taking into account the transmittance of a single photon η in the optical channel, the dependence of the measurement results on measurement settings α and β reads where i, j ∈ {1, 2} are the ordinal numbers the singlephoton detectors of Alice and Bob.If the intensity of the weak coherent field γ 2 is far less than the transmittance η, then the second term on the right-hand side of Eq. ( 4) may be omitted.According to the above theory, the single-photon entanglement-based PM-QKD protocol is described as follows.
III. SEPM-QKD PROTOCOL State preparation .A single-photon state from a third untrusted party Charlie is sent to a 50:50 optical beam splitter to produce a single-photon entangled state close to the maximum entanglement.Next, he sends the photon states to Alice and Bob through two identical fibers with a common transmittance η.Because of channel noise and Eve's possible attack, the photon states reaching the terminals of Alice and Bob are not restricted to ideal single-photon entanglement.A heralded singlephoton source is used to increase the proportion of effective counting.
Selection of measurement settings.With different phase-locking methods [49,50], the lase source of Alice and Bob are perfectly locked to achieve athe same global phase.Alice generates a random bit string K a in which each bit takes value k a ∈ {0, 1} and a random phase Alice and Bob interfere their weak coherent states with the single-photon state distributed by Charlie to measure the wave states and the interference results are recorded as the joint counting of the single-photon detectors on both sides.
Announcement.When all measurements are completed, Alice and Bob announce their detection results, i.e., the ordinal numbers of the fired single-photon detectors, and the phase values φ a and φ b .
Sifting.A successful detection event is defined as having only one detector response on both sides at a given time.After they have announced the phases φ a and φ b , the secret key is extracted when φ a = φ b .If the sum of the ordinal number i + j is an even number, Alice and Bob keep their raw key; if i + j is an odd number, then Bob flips his key.
Parameter estimation.With a single-photon entanglement distribution, a bit-flipping error on the X basis can never happen, otherwise photon number conservation is violated.In addition to entanglement degradation caused by channel transmission loss, information loss is mainly caused by phase noise, i.e., bit flipping on Z and Y bases.During the measurement, the selection of the Z and Y bases is equivalent, so the bit error rates on the two bases, e Z and e Y , are equal.Alice and Bob agree on a random bit string with half the length of the sifted key to be check-bit to measure the bit error rate e. Next, they use part of the remaining data in which |φ a − φ b | = π 4 to construct the Bell function S on the ZY plane to estimate the maximal information that may have leaked to Eve.Key distillation .In the post-processing, Alice and Bob perform error corrections in accordance with the bit error rate e and privacy amplification according to the Bell function S to generate the final secret key.

IV. SECURITY OF SEPM-QKD
In SEPM-QKD, the key is distributed through a nonlocalized single-photon entangled state.Alice and Bob measure entangled states jointly.When entangled states are eigenstates of joint measurement operators, their measurements are perfectly correlated.They can extract keys based on joint measurement results or measurement settings.Eve's attack can be monitored based on violations of Bell's inequality.At first glance, this protocol belongs to DI-QKD.Although conventional DI-QKD is secured in theory, it is nevertheless difficult to distribute keys over long distances due to detection loopholes.
Here, we point out that the detection loophole in the standard Bell experiment will not be a factor affecting the key security of the protocol.Previously, it was found that the security of QKD can be related to entanglement purification [3,4].The amount of security information that can be extracted between Alice and Bob is determined by the amount of purifiable entanglement.In DI-QKD, we certify that the bound of the accessible private key is determined by how much entanglement we can distill from the imperfect entangled state [51][52][53].
In a standard Bell experiment, to give a rigorous proof of quantum delocalization, all loopholes in the experiment need to be closed, including the efficiency of the detector and transmission loss [54].For the DI-QKD protocol, we just need to accept quantum delocalization as rigorous and correct.After solving this issue, DI-QKD is equivalent to the BB84 protocol.In this protocol, we only focus on the data that can be measured successfully.In a conventional Bell experiment with polarization entanglement, the measurement in the Z− and X− bases needs the switching of the angle of the polarizers, which must be perfectly correlated with the secret key.This may leave Eve a chance to fabricate the measurement settings if she takes full control of the measurement setup.In the following, we need to establish whether in such an event Eve could fabricate a fake result of the Bell's inequality test given the limited information publicly announced by Alice and Bob.
In SEPM-QKD, Alice and Bob encode the key information in the phases of the weak coherent states.The encoding is equivalent to the measurement settings, and no switch of the measurement basis is needed.If this initial key information had been leaked to Eve, all QKD protocols would fail.From Eq. ( 5), the quantum measurement of the protocol may be considered to consist of three systems: the single-photon entangled state Φ − A,B , the joint states of the single-photon detector D, and the corresponding joint key states K.The initial state of the total system is written which is a tensor product of the three subsystems, with ρ A,B the single-photon entangled state sent by Charlie, and |N in and |κ in the initial joint states of the two-sided single-photon detectors and the key state with N = i + j and κ = |k a − k b |.Measurement is in general regarded as a unitary operation of the system; the joint measurement performed by Alice and Bob with two POVM elements {E κ } may be written as Once the QKD-protocol is determined, after the announcement of N publicly, the information of κ may be revealed by Eve.However, she still does not know the exact value of k a and k b .At this stage, we find SEPM-QKD is equivalent to MDI-QKD.Eve barely gets any information about the measurement settings of Alice and Bob, so it is almost impossible for her to successfully fabricate the measurement results to cheat Alice and Bob.
With the presence of channel transmission losses and the imperfections in detection, Eve has the opportunity to implement various attack schemes.Even though [55,56] have provided a purification scheme for single-photon entanglement regarding phase noise, the reality is more complicated.Alice and Bob's extractable fully secure key rate has a lower bound given by [25,51,57] where I (A : B) = H (A) − H (A|B) is the mutual information between Alice and Bob, which is equal to 1 − H (e), and χ (AB : E) the Holevo quantity between Eve and Alice and Bob after the ordinal numbers i, j have been announced publicly, here, the quantity H (e) is the amount of information loss due to bit flipping errors, and χ (AB : E) is the maximum amount of information Eve obtains from ρ AB at a given error rate e, and for values of i, j and φ a , φ b .There are two kinds of attack schemes on Alice and Bob that Eve could implement; they correspond to the two Holevo quantities χ (AB : E).One is a collective attack in which Eve correlates her system with the joint system of Alice and Bob and produces a total quantum state ρ ABE .Because Eve has no information about Alice and Bob's measurement settings or their key bits, their joint states can be written in tensor product form where c is the index labeling Eve's state |c , and p (c) the probability of ρ c AB .From Alice and Bob's point of view, the reduced quantum states sent to them by Charlie is In this protocol, Eve can not get any information about the measurement settings, so she can't control the measurement process effectively.Her only freedom is to generate the joint quantum state, in which the results of Alice and Bob's reduced states are consistent with predictions from theory, taking into account the imperfections in the equipment.
For an evenly distributed error in the ZY plane, the state ρ AB is written where I is the identity density matrix with . We find that the maximum violation of the CHSH-Bell inequality is S = 2 √ 2 (1 − 2e).In SEPM-QKD, after announcing the values of i, j and φ a , φ b , we have Eve's state is the probability of κ a and κ b conditional on Eve's state |c .With the values of i, j, the mutual information between Eve and Alice and Bob due to Eve's collective attack is We readily find that χ 1 (AB : E) ≤ 2e, which means that whenever Alice and Bob negotiate a bit of information, Eve can successfully steal 2e bit of information.Because we have H (e) ≥ 2e for e ≤ 0.5, thus here we can reasonably set χ 1 (AB : E) to H (e). Next, we examine the scope of the Bell-inequality verification.Assume that Eve intercepts the single-photon entangled state and induce a certain amount of error rate.The maximum error rate that Bell inequality tolerates is 14.6%, which is larger than 11% [4], the maximum error rate that Alice and Bob can tolerate in extracting finite information against Eve's collective attacks.Therefore, violation tests of Bell's inequality violation are a feasible scheme for monitoring Eve's collective attack.The other possible attack scenario for Eve is the beamsplitting (BS) attack, in which the loss of a single-photon entangled state in optical channels can be considered to be stored by Eve and measured after Alice and Bo have announced publicly their measurement basis and random phase.Thus, the BS attack is an individual attack that is independent of a collective attack and can not be found with Bell's inequality tests.Considering channel loss, the single-photon state between Alice, Bob, and Eve is written which is a single-photon multi-mode asymmetric Wstate [58,59], where ) is the state responsible for channel loss, which is assumed to be stored by Eve, whose system is entangled with the systems of Alice and Bob.Suppose Eve uses weak coherent light of the same intensity as Alice and Bob to measure the wave state.After Alice and Bob announce their random phases φ a , φ b as well as the ordinal numbers i, j of the single-photon detectors, for a given channel transmittance η and local coherent field amplitude γ, the maximum information that Eve can gain from Alice and Bob is where the quantity p (η, γ) is the normalized probability that Eve uses to guess the key of Alice and Bob; its expression is Now, if the BS attack is not considered, the key rate in Eq. ( 8) is found to be equal to the amount of entanglement that can be distilled between Alice and Bob.This security proof is equivalent to the security proof of BB84 QKD based on entanglement purification [3,4].The loss of these two parts of the information corresponds to an error correction and private amplification in postprocessing.After considering Eve's two attack schemes, the lost information for private amplification should be recalibrated.

V. SIMULATION AND DISCUSSION
Next, we simulate the distance-dependent key rate in a real situation.Among all the successful detection events, there are three kinds of false detection events, which constitute the detection error rate e.These events come from dark counting of detectors, phase insensitive interference, and phase misalignment.For all single-photon detectors with the same dark count rate p dark , the rate of successful detection events p r,dark and false detection events p e,dark caused by dark counting are both equal to 2p 2 dark .For the joint measurement of wave states, there is a small portion of detection events stemming from phase-insensitive interference, a HOM-type of interference.The rate for joint HOM interference is p HOM = γ After taking into account all practical factors, such as error correction and privacy amplification, we obtain a final lower bound of the key rate of where Q = p dark +p HOM +p d is the rate of the joint measurement of the wave states, η = exp (−α f x) the channel transmittance with α f the coefficient of absorption and x the transmission distance, and f the inefficiency of error correction, which always takes the value between 1.2 and 2 in accordance with the error correction protocol [26].In this formula, we have assumed the transmittance of the optical fibers, the amplitude of the local oscillator fields, and the detector efficiency are the same for Alice and Bob.
The simulation results of our SEPM-QKD under different intensities of local coherent fields is shown in Fig. 2. The coefficient of transmission loss for the optical fiber at 1550 nm is β l = 0.2dB/km and the coefficient of absorption is α f = (β l ln 10) /10.Also, the detection efficiency at this frequency η d is 14.5% for a commercial single-photon detector, the dark count rate is p dark = 8×10 −8 for all detectors, and the misalignment error e d is 1.5% [34], the value for the inefficiency of error correction is set at f = 1.2 [26].From this figure, the key rate is seen to that the key rate decrease as the intensity of the local coherent light field decreases; because the probability of successful joint detection events is lower as the amplitude γ decreases.However, the communication distance shows an opposite trend in its dependence on intensity.When the value of γ is less than 0.005, the communication distance exceeds 420 km, which is larger than most reported fiber-based repeater-free QKD protocols.The dependence of the communication distance on the amplitude γ arises from the false detection of phase insensitive joint counts p HOM , which is proportional to the square of the light intensity, yielding γ 4 .For a specified QKD protocol, the communication distance is a compromise between the signal rate and the error rate.
As the amplitude γ decreases, the phase-insensitive joint count-induced error plays little role in the key distillation.Therefore, a longer communication distance obtains.
Here, we make a clear comparison between different QKD protocols (Fig. 3), in which γ = 0.002 is chosen for the SEPM-QKD scheme.For traditional single-photon based BB84-and MDI-QKD schemes, their key rate obey the well-known linear bound by Pirandola et al. (PLOB bound) [31].However, we see that, like PM-QKD, SEPM-QKD displays a quadratic increase in the key rate with respect to the communication distance.When the communication distance is larger than 340 km, the key rate of SEPM-QKD surpasses that of BB84 and MDI-QKD.Furthermore, the communication distance of SEPM-QKD is larger than 490 km with γ = 0.002 compared with 450 km reported for PM-QKD.For short communication distances, the key rate of SEPM-QKD is always less than that of PM-QKD.This is because the average intensity of the coherent light in SEPM-QKD is far lower than that in PM-QKD.

VI. CONCLUSION
We have reported a phase matching QKD based on single-photon entanglement.This SEPM-QKD is a timereversed version of TF-QKD, in which the secret key is encoded in wave space characterized by the phase value.Measurement settings in SEPM-QKD, like quantum keys, are encoded in the phase of the locally coherent state, so the detection loophole is closed.This contrasts that for conventional DI-QKD.For a given light source intensity, just like TF-QKD, SEPM-QKD improves the bound of key rate from O to O √ η .A communication distance of 490 km can be achieved with γ equal to 0.002, which is larger than all reported fiber-based QKD schemes.By comparison with single-photon QKD schemes, we found that in SEPM-QKD and TF-QKD the wave state can be used as a new information carrier that has different properties due to interference-induced detection enhancement, which allows photons to travel in fibers with a higher transmittance over longer communication distance.In the future, we wish to reduce the impact of the phase-insensitive coincidence counting rate on the key rate and to improve the key rate and communication distance of SEPM-QKD.

4 η 2 d / 4 8 .FIG. 2 .
FIG. 2. Simulation of SEPM-QKD under intensities of local coherent light.The key rate decreases with increasing attenuation of the coherent light intensity whereas the communication distance increases as the attenuation increases.

FIG. 3 .
FIG.3.Key rate comparison between different QKD protocols.The simulation results of the other QKD are taken from Ref.[34].Compared with single-photon based BB84and MDI-QKD schemes which obey the linear bound by Pirandola et al. (PLOB bound)[31], SEPM-QKD has the same √ η dependence on communication distance as PM-QKD.For γ = 0.002, the communication distance of SEPM-QKD is larger than all previous QDK schemes.
σ Y and then prepares the corresponding weak coherent state γe i(φa+kaπ) .Simultaneously, Bob generates a weak coherent state γe