Higher-rate relativistic quantum key distribution

One of the major problems in the field of quantum key distribution (QKD) is the low key rates at which the systems operate. The reasons for this are the processes used to ensure the key distribution itself: sifting, parameter estimation, key reconciliation, and privacy amplification. So, this reduction in the rate of communication is inherent to all existing quantum key distribution schemes. This paper is concerned with proposing a solution to mitigate the rate reduction of the so-called relativistic QKD. To mitigate the reduction, we introduce a modified relativistic QKD protocol, which is based on Mach–Zehnder interferometer being used as a probabilistic basis selection system (basis misalignment occurs between the parties in approximately half of the transferred qubits). The interferometric scheme allows the participating parties to correlate the mutual unbiased bases (MUBs) chosen by them. In this regard, a qubit could be used to transfer more than one bit of information. To be precise, by implementing the proposed interferometric scheme into a relativistic QKD protocol, a qubit is able to transfer two bits of information. This results in achieving a protocol, which is characterized with a greater rate of communication, two times greater than the usual rate. The modified protocol is proven to be secure against intercept-resend and collective attacks.


Methods
In this section, we present an interferometric scheme (practical scheme) that is used for a basis of the key distribution proposed later on. The scheme consists of a Mach-Zehnder interferometer (MZI) involving phase shifts at its arms 4,41 . The following notation is used hereafter: |z+� and |z−� represent the eigenstates of the Z operator (rectilinear polarization operator or σ z operator); |x+� and |x−� represent the eigenstates of the X operator (diagonal polarization operator or σ x operator). As is known, the eigenstates of a given operator form a basis: the states |z+� and |z−� form the so-called Z basis, whereas the states |x+� and |x−� form the so-called X basis. We should note that the two bases are interconnected through the following relations In terms of polarization, the states |z+� and |z−� respectively correspond to vertical and horizontal polarizations, whereas the states |x+� and |x−� respectively correspond to diagonal and off-diagonal polarizations. Now we consider the Mach-Zehnder interferometer depicted in Fig. 1. Compared to the interferometer of Ref. 46 , the present scheme involves phase shifts (PSA and PSB), one at each arm of the interferometer 4,41 . The phase shifts are used to control the output at which a given input system q goes through. Note that each phase shift can take only two values (90-deg or 270-deg). The current interferometric scheme resembles that of Ref. 4 . As pointed out and thoroughly explained in Refs. 41,46 , when PSA = PSB (or there are no phase shifts in the scheme) the input qubit q goes through the upper output (X-basis output of the scheme, see Fig. 1). Otherwise (when PSA = PSB), the qubit goes through the lower output (Z-basis output). We should note that the global phase of the output qubit q is neglected, because it does not play a role in a measurement procedure after all. A given measurement system (X-basis or Z-basis system) consists of polarization beam splitter and two detectors, which distinguish the orthogonal states of a given basis.
By means of the presented interferometric scheme, Alice communicates two-bit messages (key words) per qubit to Bob: four qubit states of q (eigenstates of X basis and eigenstates of Z basis) are used to convey information. More details on the process of transferring messages (key bits) are given in the next section.

Results
Key distribution scheme. To begin the key distribution, Alice prepares a random sequence of qubits q i , using states |z+� , |z−� , |x+� , and |x−� to represent the messages 00, 01, 10, and 11, respectively. She then puts the systems through the Mach-Zehnder interferometer (MZI) presented in Fig. 1. Alice performs a phase shift (operator) PSA on each quantum system (qubit) q : the phase shift is chosen at random regardless of the q i state. Next the quantum systems travel to the Bob's side of the interferometer. He performs a phase shift PSB of either 90-or 270-deg in a random manner. Based on the phase shifts PSA and PSB, the quantum systems take one of the two possible outputs of the MZI: if PSA = PSB a qubit goes through the X-basis output, otherwise a qubit goes through the Z-basis output. Bob records the measurement result of each qubit (Bob determines the detector, which registers a click, when a given qubit is measured). Next Bob announces over an authenticated public classical channel his phase shifts PSB i . The reason why Bob chooses at random his phase shifts is the fact that he will subsequently announce them over a public classical channel. Since the choice of phase shifts by Bob are random and independent of Alice, the public announcement does not leak information to an eavesdropper, because no relevant information is revealed about the bases and states of the transferred/received qubits. Information would leak only if, for instance, Bob announces the phase shifts together with his measurement results.
Based on PSB i , PSA i , and the bases of the qubits prepared by her, Alice decides which quantum systems should be discarded due to basis misalignment (a sifting process is conducted). The decision is made in terms of the following requirement Here BASIS i stands for a bit, which reflects the basis of a qubit q i : qubit in a Z basis → BASIS i = 0; qubit in a X basis → BASIS i = 1. In this expression, PSA i and PSB i takes the following binary values: PSA i = PSB i = 0 when 90-deg phase shift is performed; PSA i = PSB i = 1 when 270-deg phase shift is performed. If the above (2) Mach-Zehnder interferometer used to transfer two-bit message via a single qubit system. PSA phase shift possessed by Alice, PSB phase shift possessed by Bob, q input qubit state, BS beam splitter, M mirror, Z Z-basis measurement system, X X-basis measurement system. www.nature.com/scientificreports/ requirement is met, Alice and Bob do not discard the measurement result of a given qubit system q i . In this case, 50% of the initial qubits are discarded (as in the case of standard, original QKD). However, the remaining qubits (50%) carry twice the amount of bits compared to the original scheme. This is so, because each qubit could be in either of four qubit states: |z+� , |z−� , |x+� , |x−�.
In order to show that the above sifting process does not leak information to the eavesdropper, a mathematical analysis is presented. The analysis examines the amount of information that an eavesdropper gathers when certain information (random variable) is publicly announced. We consider two cases in the analysis: (1) a random variable, which is not related to the bases of the transferred qubits, is publicly announced; and (2) a random variable, which is related to the bases of the transferred qubits, is publicly announced. Note that case (1) reflects the process of Bob's announcing phase shifts. In order to quantify the amount of information, which Eve obtains when public announcement is conducted, we utilize the concept of mutual information 47 Case (1). In this expression, V is a variable playing the role of the bases in which the qubits are prepared and W is a variable playing the role of the phase shifts announced by Bob (V: v ∈ {0,1}: 0 → Z basis, 1 → X basis; W: w ∈ {0,1}: 0 → PSB = 90-deg, 1 → PSB = 270-deg). We know from above that both V and W are chosen at random so that H(V) = H(W) = 1 (this implies Pr(V = v) = Pr(W = w) = 0.5). H(V) = H(W) = 1 also shows that the bases of the qubits and the phase shifts are truly random from Eve's standpoint. We now need to determine H(V|W). It is given by where As described above, the variables V and W are independent (Note: They are chosen from two different persons and for the sake of two different processes (preparation of qubits and phase shifting)). This implies that Pr(V = v|W = w) = Pr(V = v) . Therefore, Eq. (5) transforms into and has the value of This leads to Taking into account the result of the last expression and that H(V) is equal to unity (H(V) = 1), we obtain for the mutual information: which means that Eve does not gain information about the bases of the transferred qubits given that Bob announces his phase shifts.
Case (2). We consider the case when a given random variable U (U: u ∈ {0,1}), which is related to the bases of the transferred qubits (related to variable V, see the previous case for reference), is publicly announced. Suppose that V and U are completely correlated: if V: v = 0, then for sure U: u = 0. As with the previous scenario, Pr(V = v) = 0.5. Also, from the correlation just mentioned, we infer that Pr(U = u) = 0.5. The complete correlation between V and U leads to the result Pr(V = v|U = u) = 1. This comes from the fact that we always have V = v (e.g., v = 0) whenever U = u (when u = 0). Taking this into account, we obtain for H(V |U = u): This result, in turn, leads to       We can interpret I(V; U) = 1 as that the eavesdropper is aware of the bases in which the transferred qubits q i are prepared, regardless of the information announced by Bob about his phase shifts provided that U is an additionally announced information. The current scenario demonstrates that the information about the basis of a transferred qubit state is solely contained in the correlation between U and V. Therefore, a publicly announced random variable, which is not related (or correlated) to V (bases of the qubits), does not leak information to the eavesdropper.
In this way, by the above analysis, we show that the phase shift PSB of Bob, being an independent random variable, does not give information to third parties about the bases of transferred qubit states (correspondingly, a part of a message transferred by each qubit). Therefore, knowing only the phase shifts of Bob, Eve cannot determine whether PSA i = PSB i or PSA i = PSB i , i.e., whether q i is prepared in X basis or q i is prepared in Z basis. Being unaware of the basis of a qubit, Eve is also ignorant of the state of this qubit-this is a result of the fact that she cannot perform an appropriate measurement on the qubit in order to determine its actual state.
In the next lines, for the sake of clarity, we work out an example of transferring messages via several quantum systems by means of the interferometric scheme proposed above. The example demonstrates how a sifted key is obtained in a quantum key distribution using the scheme of concern. Suppose Alice intends to send to Bob the following sequence of quantum states, which correspond to the following two-bit symbols.
Note that not all of the two-bit symbols will be properly decoded by Bob. In other words, some of the symbols will be discarded. The two-bit symbols, correspondingly the qubit states, are prepared by way of a random choice. Next Alice sends the states through the interferometric scheme of Fig. 1. Alice at random chooses to perform the following PSA phase shifts: Suppose Bob at random chooses the following PSB phase shifts, which are applied at the lower arm of the interferometer: According to the description above, if PSA i = PSB i a qubit goes through the upper output, otherwise it goes through the lower output. In this regard, we have in the example that q 0 , q 1 , q 3 and q 4 leave the interferometer through the upper output (X-basis measurement system), whereas q 2 leaves the interferometer through the lower output (Z-basis measurement system). This implies that q 0 , q 2 , and q 4 will be measured in appropriate bases, while the other quantum systems will be measured in inappropriate bases. Bob publicly announces the following binary string, whose elements correspond to the PSB phase shifts he chose Using this string (corresponding to the phase shifts of Bob), her phase shifts (PSA i ), and the bases of her initial states, Alice determines if each qubit q i (detected by Bob) satisfies Eq. (2). We should note that the string BASIS is comprised of the following bits, taking into account the states of q i prepared by Alice, As mentioned above, an element of the string BASIS (BASIS i ) has a value of 0 if a qubit q i is prepared in Z basis and a value of 1 if a qubit is prepared in X basis. This is reflected in the above table. Now we present a table that depicts a binary string D, whose elements D i show if each qubit q i satisfies Eq. (2) (D i = 1 → q i satisfies Eq. (2); D i = 0 → q i does not satisfy Eq. (2): 11 01 00 01 10. www.nature.com/scientificreports/ In order to be as clear as possible in terms of this process (the process is actually a sifting procedure), we in detail determine the values of D i . Based on the values of D i , Alice and Bob discard (sift) certain quantum systems (D i = 1 → q i remains; D i = 0 → q i is discarded). As is known from above, PSA 0 = 0 (corresponding to 90-deg), PSB 0 = 0, and BASIS 0 = 1. Substituting the values of these quantities in Eq. (2), we obtain This implies that D 0 = 1, that is, the first received qubit satisfies Eq. (2). Taking into account the remaining values (i = 1,2,3,4) of PSA i , PSB i , and BASIS i , we have for the remaining elements D i : Alice publicly announces the string D. In this way, Alice informs Bob about the quantum systems that should be sifted (discarded). As a result, only the two-bit messages transferred by q 0 , q 2 , and q 4 remain: q 0 → 11, q 2 → 00, q 4 → 10, see the beginning of the example for reference. These two-bit messages form the so-called sifted key.

Relativistic QKD protocol.
In this section, we introduce a relativistic quantum key distribution protocol, which could be regarded as a modified version of the scheme in Ref. 42 or that of Ref. 43 . The proposed protocol requires one-photon source and completely synchronized clocks being at the disposal of both sender and recipient (Alice and Bob). A schematic description of the novel relativistic protocol is shown in Fig. 2. The distance L between the beam splitter of Alice and the beam splitter of Bob is preliminary, publicly known. The proposed protocol makes use of the interferometric scheme introduced above. The protocol is characterized with the following steps: (1) At time t A (t = 0) Alice prepares single-photon qubit states q i ( q i ∈ { |z+�,|z−�,|x+�,|x−� }) and puts the system into her beam splitter (into the interferometric scheme). As in Refs. 42,43 , the instant t A is regarded as the beginning of the protocol. After passing the beam splitter, the quantum system jumps over into a superpositional state of the interferometer. The superposition is a combination of the states in the lower and upper arms of the interferometer: ( q where the phase of the second state reflects the 90-deg change in the path direction (a direction towards the mirror M) 46 .
(2) Alice at random performs a phase shift PSA of either 90-deg or 270-deg, see section "Key distribution scheme" for a reference. B Bob measures the state q i via either X-basis or Z-basis measurement system. He records the measurement outcomes. Note that Bob discards the measurements of qubits, which take place latter than t ′′ B . He regards the retarded qubits as counterfied (or eavesdropped). (6) Next Bob announces the phase shifts PSB i performed on each q i and the qubits being retarded. (7) As described above, Alice decides which non-retarded qubits q i are further discarded. The decisions are taken according to Eq. (2). She informs Bob about her decisions. (8) Parameter estimation is carried out by Alice and Bob. They sacrifice part of the quantum systems in order to evaluate the quantum bit error rate of the communication channel. If the error rate exceeds a pre- www.nature.com/scientificreports/ liminary determined threshold, Alice and Bob terminate the current session and start over the protocol. Otherwise, they proceed forward. (9) Alice and Bob conduct the so-called error reconciliation process 44 . (10) Alice and Bob conduct the so-called privacy amplification process 45 .

Discussion
In this section, we discuss the security and performance of the protocol proposed in the previous lines. Also, we propose a practical implementation of the proposed protocol, which makes use of weak coherent pulses. Security analysis. We analyze the security of the proposed protocol in terms of several attacks 15,43 : (i) intercept-resend attack, (ii) intercept-resend attack with preliminary prepared state, (iii) collective attack.
(i) Because the initial state q is spread over the space-time ( q is divided into q l and q u ), the eavesdropper needs to have an access to both q l and q u in order to acquire the actual state of the qubit q . For this purpose, Eve is required to utilize a receiving side of the interferometric scheme introduced above, as shown in Fig. 2, in order to recombine q l and q u into q . By doing so, Eve disturbs the initial path of q l . Also, performing a measurement on q leads to disturbance of the space-time path of q u , too.
Given that a measurement is conducted, the q u resent by Eve will not reach Bob's beam splitter at a correct time. This results in erroneous interference at time t ′ B . This holds for the q l as well. It is possible for q l to reach Bob's beam splitter at time t ′ B (if and only if Z E measurement is conducted), but this partial state will interfere with nothing-it will be the only partial state that will reach Bob's beam splitter at time t ′ B . In this case, the beam splitter outputs a qubit in an erroneous path ( X B or Z B ) with probability of 1/2, as described in Ref. 46 . In the case of X E measurement, both q l and q u resent by Eve cannot reach Bob's beam splitter at the correct time. This results in conducting no measurement at Bob's side. Bob interprets such an absence of measurement as an act of eavesdropping. Therefore, Eve disturbs the quantum system q by performing measurement and the disturbance is completely detectable by Alice and Bob.
(ii) In this attack, the eavesdropper prepares a qubit q e ( q e ∈ { |z+�,|z−�,|x+�,|x−�}), whose state is randomly chosen. Eve also intercepts the Alice's qubit q by using a receiving side of the interferometric scheme. On intercepting the qubit q , Eve sends q e to Bob via a transmitting side of the interferometric scheme (she uses the same setup as Alice). In this case, a proper interference always occurs at time t ′ B . However, the interference could be that of an incorrect state of q e , because Eve's qubit has no correlation to the Alice's qubit. This results in disturbing the quantum channel between Alice and Bob. In other words, Eve causes error in the initial state of Alice's qubit q . The probability of error is 3/4-in only 1/4 of the cases Eve correctly guesses the initial state of Alice's qubit. In this way, Alice and Bob can detect the presence of Eve during the parameter estimation procedure (evaluating the error rate of the channel). (iii) In the collective attack, the eavesdropper appends an ancilla |a� to the Alice's qubit q in order to gain information about the state of q in an unhindered manner. To do so, Eve performs a unitary operator on the system q |a� so that the ancilla gets changed according to the state of q . As described in Ref. 15 , such a unitary operation is the so-called CNOT gate, which flips the ancilla state if q is in |z−� state. However, the CNOT gate is appropriate only in the case when q is prepared in either |z+� or |z−� (in Z basis). In the case when q is prepared in the X basis, the CNOT gate sets the ancilla in a superposition(|z+� + |z−�)/ √ 2 , which gives information about q if and only if the ancilla is measured in the X basis. We have the same picture when a CNOT gate in terms of the X basis is constructed and used during this attack. The problem of this kind of attack is that the eavesdropper needs to correctly guess the basis in which the state of q is prepared. As mentioned above, the random guess leads to presenting an error in the state of q with certain probability. During the parameter estimation process (see section Relativistic QKD Protocol), Alice and Bob can detect the errors induced by Eve when the collective attack being launched. Therefore, the presence of an eavesdropper is detectable during this attack, too.
In the next lines, we present in more details the relativistic security of the proposed protocol against the attacks concerned above, which are called intercepting attacks hereafter. For the sake of the analysis, Fig. 3 is presented. We assume that the measurement systems are assumed to be located maximally close to the corresponding beam splitters. That is why we omit displaying the measurement systems in Fig. 3.
As is known, the velocity of light c is a constant regardless of one's frame of reference [48][49][50] . Taking a look at Fig. 1, this implies that a photon transmitted from Alice's beam splitter (at t A ) should reach Bob's beam splitter at time provided that an eavesdropper does not intercept the particle. This holds for a photon travelling through the lower arm of the interferometric scheme. In the case when the photon takes the path of the upper arm, it arrived at Bob's beam splitter at time T u = t ′ B − t A and traverse a distance of L u = c(t ′ . As could be readily seen, both upper and lower paths of the photon are characterized with the same space-time features (distance L = L l = L u and time interval T = T l = T u ).
If an eavesdropper intercepts a photon, as shown in Fig. 1, she slightly alters particle's path. Intercepting a particle, Eve causes a change in trajectory, which moves a lower path particle into the upper path. If Eve tries to maintain the relativistic characteristics of the scheme, she somehow needs to return a measured particle (for instance, particle measured in the Z basis) back at the lower path at time t ′′ E . Another solution to this problem is to generate (or prepare in a certain state) a particle at t ′′ E after the measurement of the original particle. According to relativity, the two cases are impossible. This is pictorially illustrated in Fig. 3. In the figure, two paths are presented: (green)-this is the natural path of an interfering qubit, which travel along the lower path of the www.nature.com/scientificreports/ interferometric scheme; (red)-this is the path taken by an interfering qubit when Eve launches intercepting attack. First, it is impossible for Eve to move a particle from the measurement systems to the lower path of the Alice-Bob interferometer. As can be seen from Fig. 3, the particle needs to travel at speed exceeding c (the slope of the displacement (receiving BS to transmitting BS of Eve) is of space-like type). Second, it is impossible for Eve to prepare a particle at one location in a state conditioned on a measurement taking part at another location, given that the two events (preparation and measurement) occur at the same time. In this case, the information obtained from the measurement, which is necessary for preparing a state at another location) should travel at a speed exceeding that of light. As is known, the latter is impossible according to the relativistic principles. The above analysis could be mathematically verified as follows. Intercepting the interferometric communication between Alice and Bob, Eve introduces longer space-time path of the interfering qubits. For instance, as shown in Fig. 3, the distance of the lower interferometric path L l gets longer when interception occurs. In this way, Bob receives retarded detection counts, which reveals the presence of Eve. In order to show that L l (displayed in green color in Fig. 3) gets longer, we calculate its counterpart L ′ l (displayed in red color), which is the path involving the interception. The distance L ′ l is the following In the last equation, there is a term of singularity ((t ′ E − t ′ E )c), which we omit in the comparison between L l and L ′ l . The term of singularity appears to be a manifestation of instantaneous displacement of an object from one point to another, which is a concept prohibited by the theory of relativity. This verifies the analysis in the above lines about the impossibility of Eve to prepare a duplicate qubit of the intercepted (measured) one. We now find the difference between L l and L ′ l : Fig. 3 for reference. The above result shows that the interception path L ′ l is longer than the natural path L l of interferometric scheme shared between Alice and Bob. In this way, we mathematically prove that Bob will always received a retarded qubit (detector count) if an intercepting attack is launched.
The only solution for Eve is to preliminary prepare at random a state (particle) and at time t ′′ E put it through the interferometer, which she shares with Bob. However, being unaware of the particle state transferred by Alice, Eve could prepare her particle in a wrong state (also choose a wrong phase shift PSE at Eve-Bob interferometer) and thus cause an erroneous detection, which reveals her presence.
In the previous lines, we show that any action of the eavesdropper is detectable by Alice and Bob in some instant of the quantum key distribution protocol by using either space-time features or uncertainty principle of quantum mechanics or single-particle interference phenomenon. Therefore, we can point out the following features being the tools in discovering the presence of third parties in the course of any intercept-resend attack launched against the relativistic protocol proposed herein: Any disturbance in the original space-time path of a qubit system is detectable-an interception (measurement), which requires the completion of photon's interference process, certainly forces the photon to deviate from its space-time path. In this way, the arriving time of the photon at Bob's side is delayed. By means of this delay, Bob is capable of detecting the presence of an eavesdropper. Any pre-interference measurement is not allowed-measurement conducted before the receiving beam splitter (second beam splitter of an interferometer, see Fig. 2) causes destruction of the interference phenomenon. The destruction leads to randomness in the output path of the beam splitter. The randomness, in turn, gives rise to errors in the detection step (quantum states are directed towards erroneous detection system).
Any attempt of gaining information out of a qubit with the help of ancilla is not allowed-in this case, the eavesdropper needs to choose a correct polarization basis of the ancilla in order both to gain information and not to disturb the state of the intercepted qubit. www.nature.com/scientificreports/ So, it is possible for an eavesdropper to gather information about the sifted key, but at the cost of revealing her presence.
Performance analysis. The performance of the transfer stage of a protocol is in principle characterized by the data transfer rate and size of the established sifted key. Note that the rate is measured in [bits/qubit] and the size in [bits]. In the following lines, we evaluate the value of the rate for the proposed relativistic protocol. We also compare the latter to the values of the existing protocols of the same kind (Refs. 42,43 ).
The data transfer rate of a quantum key distribution protocol is expressed as where n is the size of the sifted key, whereas q is the amount of transferred qubits. In the proposed protocol, the amount of relevant qubits is q 2 given that Alice and Bob have destructive (inappropriate) misalignment in their phase shifts in one half of the transferred qubits. By relevant we mean qubits, which take part in establishing the so-called sifted key. Knowing from the above sections that each relevant qubit transfers a two-bit message (two key bits), we obtain for the size of the sifted key: n = 2( q 2 ) = q. Taking into account Eq. (15), the rate R gets the value of Note that in defining the rate R we neglect the presence of an eavesdropper so that we do not take into account the qubits, whose space-time paths are disturbed.
In order to assess the performance of the proposed protocol, we compare it to its standard counterparts: the schemes introduced in Refs. 42,43 . To do so, we need to determine both rate and sifted-key size of the standard relativistic QKD protocols introduced in Refs. 42,43 . In Refs. 42,43 , Alice and Bob discard one half of the transferred qubits q due to choice of uncertain (inappropriate) measurements 43 or choice of inappropriate phase shifts 42 by Bob. So, the relevant amount of qubits are q 2 . Also, according to 42,43 each qubit transfers one bit of information (one key bit). This results in establishing a sifted key of size n = 1( q 2 ) = q 2 . In this regard, the rate of the standard relativistic protocols is To summarize the comparison between the proposed and standard relativistic protocols, we present Table 1 in which the rates and sifted-key sizes of these protocols are collated. In this way, we show that the performance of the proposed protocol exceeds twice the performance of the standard relativistic QKD protocols. In this connection, the proposed protocol could be regarded as an enhanced version of the standard ones. Implementation with weak pulses. In section "Relativistic QKD protocol", we propose a single-photon model for establishing secret cryptographic keys between two parties. We should note that a protocol implementation with weak coherent pulses (WCP) is feasible. A possible WCP implementation of the relativistic protocol is the scheme introduced in Ref. 51 (named 4 + 2 Protocol), as we bring slight changes into it. We now introduce a WCP scheme for the relativistic protocol proposed in this article, which is an adaptation of the "4 + 2 Protocol" realization.
The WCP implementation of the proposed relativistic protocol is characterized with the schematic illustrated in Fig. 4. Compared to Ref. 51 , the novel scheme involves two phase shifts, two additional detectors, and two additional polarization beam splitters. Also, the polarization beam splitter in the beginning of the interferometer is controllable. This implies that the device is tuned to perform eigenstates discrimination in any polarization basis. In the proposed scheme, cPBS is used to discriminate both the eigenstates of the X basis (xPBS) and the eigenstates of the Z basis (zPBS). At the input of the interferometric scheme, two orthogonal WCP states are fed: |α� and |β� . As in Ref. 51 , the state |β� is a reference state and |α� is a signal state. Another modification is the fact that the WCP states, which are used in the scheme, could reside in either of the polarization states: { |V � = |z+�,|H� = |z−�,|D� = |x+�,|A� = |x−� }. In other words, |α� ∈ { |α V �,|α H �,|α D �,|α A � } and |β� ∈ { |β V �,|β H �,|β D �,|β A � }. In the scheme, the signal state |α� carries two-bit messages: |α V � = 00, |α H � = 01, |α D � = 10, and |α A � = 11. Alice simultaneously sends out the two orthogonal polarization states. At the sending side, the states are separated by the controllable polarization beam splitter (cPBS). The state |β� , which is directed along the lower arm of |β� and e iφ α results in a click at either X-basis measurement system (D2 or D3) or Z-basis measurement system (D4 or D5). The latter is noted in Ref. 51 : BS2 is used to discriminate |α� and |−α� . In the context of Fig. 4, if the signal state is of the form e iπ α = |−α� ( φ = 180-deg), a count occur in the Z measurement basis; in the other case ( φ = 0-deg), a count occurs in the X measurement basis. In other words, this feature of the scheme is used to discriminate Z and X measurement bases. If there is no count at neither of the detectors, Bob considers the case as a measurement with an inconclusive result. In turn, D1 is used as a reference, whichindicates when a relevant measurement should be expected at the upper detectors. In other words, as mentioned in Ref. 51 , this detector is used as a trigger for the other two detectors. A requirement of this scheme is that an eavesdropper should send a |β� state even though she obtains an inconclusive result in her measurement. As noted in Ref. 51 , this will result in random counts in the detectors, i.e., the presence of the eavesdropper becomes detectable. In order to perform the proposed relativistic protocol, Bob announces his phase shifts to Alice. Then, based on Bob's phase shifts, her phase shifts, and bases (phase encoding) of the transferred WCPs, Alice determines via Eq.
(2) which WCPs should be sifted (discarded) due to basis misalignment. This is the same procedure of sifting that was introduced in section "Key distribution scheme". Next Alice publicly announces her sifting decisions and thus informs Bob about the WCPs having to be discarded. In this way, Alice and Bob obtain sifted key, which should be entirely correlated. Hereafter, parameter estimation, key reconciliation, and privacy amplification are perform by the two parties, as described in "Relativistic QKD protocol".
We should note that the measurements conducted by Bob are time-sensitive, as in the original one-photon scheme of the proposed relativistic QKD: in order to meet relativistic conditions 42,43 , a WCP should be measured at a certain time t ′′ B (see Fig. 1). Otherwise, a measurement is considered as inconclusive. For the sake of clarity, an example, which shows the establishment of sifted key via the introduced WCP scheme, is presented. Suppose Alice generates the following two-bit symbols According to this sequence, Alice prepares the following WCPs where |Q� encompasses the pair ( |α�,|β� ). The last row indicates the bases of the states (0 → Z basis; 1 → X basis). Alice sends to Bob these states via the interferometric scheme presented in Fig. 4. Alice chooses at random her phase shifts PSA i :  www.nature.com/scientificreports/ Based on the phase shifts of Alice and Bob, the |α� states interfere with |β� states in a way that the following detectors click The case in which one or another detector is involved in the measurement process indicates that the measurement result is a probabilistic variable having uniform distribution. Note that in such cases, the recipient receives erroneous states (messages). Bob publicly announces his phase shifts PSB i . Based on |Q� i , PSA i , and PSB i , Alice determines via Eq. (2) which WCPs should be sifted (discarded) due to basis misalignment. In the example, Alice informs Bob that |Q� 2 and |Q� 4 should be discarded (reason: uncorrelated bases are chosen by Alice and Bob). In this regards, the sifted key is formed by |Q� 0 , |Q� 1 , |Q� 3 , and |Q� 5 . It has the form The above example shows that it is possible to construct a WCP scheme, which is able to implement the proposed relativistic protocol. As shown above, the introduced interferometer enables a transfer of two-bit message (via one use of the scheme) in the case of quantum key distribution scenario. Also, it enables a sifting procedure, which is the same as that proposed in section "Key distribution scheme". These features of the WCP scheme imply that this implementation could be assumed to be identical to the single-photon scheme described in Fig. 1.

Summary
In summary, the paper reports an one-photon relativistic quantum key distribution protocol that is based on using an interferometric scheme (Mach-Zehnder interferometer) to transfer data (key bits) from one party to another. To be utilized in a key distribution system, the interferometer includes phase shift at each of its arms: one phase shift is controlled by the sender, whereas the other phase shift is controlled by the recipient. The proposed protocol takes as a basis the standard relativistic QKD protocols 42,43 . As shown above, the interferometric-based relativistic protocol is able to transfer two-bit messages via a single photon, i.e., its rate is twice the rate of the standard schemes, where a photon transfers just one bit. This results in obtaining greater size of the sifted key that is established during the protocol. This contribution follows from the usage of an one-photon interferometer, which is transformed into a basis selection scheme by introducing phase shifts at its arms and distinct basis measurement system at each output (X-basis measurement system at one output; Z-basis measurement system at the other output). Based on the phase shifts values, it is possible for correlated message transfer, which uses more than one basis, to be realized, as verified in the previous sections of this work. An analysis in terms of the security of the proposed protocol is put forward. It verifies the security against three attacks: intercept-resend attack, intercept-resend attack with preliminary prepared state, and collective attack. We quantitatively show that the novel relativistic protocol doubles the performance of its standard counterparts. The performance takes into account the rate of data transfer (in [bits/qubit]) and the size of the sifted key (in bits) established in the protocol. This conclusion is derived from comparing the characteristics of novel and standard protocols, as depicted in Table 1. A practical implementation of the proposed protocol is presented. The implementation is based on transferring weak coherent pulses via an interferometric scheme, which could discriminate two phase-encoding bases. This practical scheme is an adaptation of the scheme proposed in Ref. 51 ; only slight changes are introduced in the way of applying phase shifts and sifting coherent states, which are uncorrelated between Alice and Bob.