Introduction

Quantum key distribution (QKD) is a procedure for establishing symmetric cryptographic keys between legitimate participants by distributing quantum states1. In principle, QKD provides information-theoretic security, guaranteed by quantum mechanical laws2. Notably, QKD has developed from mere theoretical security proofs to commercial applications over the past two decades. However, practical QKD has yet to attain its full deployment owing to security lapses in the theoretical security proofs that arise from certain assumptions about the sources or devices belonging to Alice and Bob3. For example, QKD protocols depend on trusted device scenarios, i.e., it is assumed that no information is leaked from the transmitters or the senders, which is very challenging to guarantee in practice. This creates a gap between theory and experimental implementations, opens loopholes, and leads to various possible attacks on the QKD systems4. Moreover, during implementations, QKD protocols depend on trusted device scenarios, and this assumption allows the protocols to achieve effective rates. Unfortunately, this provides an opportunity for harmful attacks, such as the side-channel attacks5. As a result, besides the enormous theoretical and experimental quantum cryptography progress, some work remains before fully deploying QKD in commercial applications. Hence, the device-independent (DI) QKD provides an improved security degree compared to conventional QKD schemes by lessening the number of assumptions required concerning the physical devices used6.

The security of the DI-QKD depends on the violation of Bell inequalities7. However, the DI-QKD needs the loophole-free Bell experiments, making it impossible to realize using existing technologies. Recent demonstrations of various attacks highlight this on practical QKD systems5. As a result, the measurement device-independent (MDI) QKD provides an improved practical solution intrinsically insensitive to entire attacks caused by side channels. These attacks target a measurement device and remove the detection-associated security loopholes8,9. Furthermore, the participating parties are connected by an untrusted relay for an MDI-QKD, leading to a considerable gain in transmission distances compared to the traditional QKD schemes. Thus, this makes these set-ups ideally suitable for quantum networks. Moreover, some experimental demonstrations using MDI-QKD have been conducted in Refs.10,11. However, the practical MDI-QKD still experiences relatively low key rates compared to the conventional BB84 protocol due to the requirement of Bell-state measurements. Apart from these advances, adopting QKD widely has been a challenge, and it has been demonstrated that large-scale deployment will likely require chip-based devices for improved performance, miniaturization, and enhanced functionality12,13,14,15,16,17,18. Most significantly, these integrated photonic chips offer numerous benefits such as low cost, low power consumption, and well-established batch fabrication techniques19.

To encode information in a QKD protocol, the parties must choose a certain degree of freedom, for instance, polarization or phase properties of single-photon as quantum states1,20. This means one classical bit of information is encoded onto each quantum state, resulting in limited secret key rates21. As a result, high dimensional encoding presents a promising solution to address the limitation of low secret key rates in QKD22. High dimensional quantum systems allow the communicating parties in QKD to encode information beyond one bit per signal23. The secret key rate, which may be limited by inevitable factors such as losses in the channel, and source and detector flaws, can be significantly improved by high-dimensional encoding where each photon can encode up to \({\text {log}}_{2}d > 1\) bits. This allows a considerable amount of information to be sent in a given transmission of the signal in the channel. Notably, previous studies indicate that the resistance to noise of the protocols increases when one increases the dimension, both for one-way24,25,26 and two-way post-processing27. Furthermore, compared to qubit operations, high dimensional quantum states are robust against noise due to the background and hacking attacks24.

Qudits have been proven to be robust against quantum cloning compared to their qubit counterparts28. Thus, they are an excellent illustration of the effectiveness of high-dimensional quantum systems since they lead to higher error thresholds making it challenging for the eavesdropper to intercept a high-dimensional QKD scheme. Owing to this, the merits of several degrees of freedom have been examined for high dimensional QKD, which includes position-momentum29, orbital angular momentum23,30,31,32,33 and time energy34,35,36,37,38,39,40,41 and MDI-QKDs employing high-dimensional quantum states42,43,44. Another approach to realizing high dimensional encoding is using biphotons corresponding to a pair of indistinguishable photons with qutrit (i.e., a three-level quantum system) representation. Biphotons or pairs of entangled photons form a two-photon light and constitute one of the most critical states of light in recent quantum information and quantum optics45,46. The generation, manipulation, and detection procedures for single-mode biphoton beams with linear optics have been demonstrated in Refs.47,48,49.

We propose an MDI-QKD protocol that encodes information on qutrit states by exploiting the polarization state of single-mode biphoton field. Using biphotons as qutrits enhances the attainable secret key rate and security due to improved information capacity per photon and the high noise tolerance45. To examine the practicality of the proposed protocol, we investigate the finite-key bounds against the general attacks based on entropic uncertainty relations. Moreover, this security analysis pertains to the implementation using the decoy states. This enables the proposed protocol to be secure against Photon-Number-Splitting (PNS) attacks1. For the finite-key study, the statistical fluctuations are catered by leveraging the large deviation theory, particularly the multiplicative Chernoff bound50. This bound provides the tightest bounds on estimated parameters for the high-loss regime. More recently, a similar work on three-dimensional MDI-QKD was proposed by Jo et al.51. Their proposed protocol exploits the time bin entangled qutrit states to encode information and employs a tripartite qutrit discrimination setup. The setup relies on a tritter and non-destructive photon number measurements to filter the states for Bell state measurements. Conversely, our proposed MDI-QKD protocol utilizes the Mach Zehnder interferometer to generate biphoton states and the Brown Twiss schemes to achieve Bell state measurements. While the scheme in Ref.51 is more efficient in terms of fewer resources used in Charlie’s measurement site; it involves non-destructive measurements, which may open up a possibility of side-channel attacks. Another noticeable difference is that our work considers finite key analysis and studies the performance of the qutrit MDI-QKD under realistic conditions by determining the key rate as a function of transmission distance. The work in Ref.51 only provides tolerable error bounds that allow one to distill a secure key. Therefore, apart from this introduction, the following section describes the proposed protocol, while the next section provides the security proof based on the entropic uncertainty principle. After that, we simulate the performance of our protocol to demonstrate its feasibility and conclude this paper.

Protocol definition

Biphotons

The pure polarization state for a single-mode biphoton field is expressed according to the following45,47:

$$\begin{aligned} |\Phi \rangle =c_{1}|2,0\rangle +c_{2}|1,1\rangle +c_{3}|0,2\rangle , \end{aligned}$$
(1)

where \(c_{i}=|c_{i}|e^{i\phi _{i}}\) are complex amplitudes. The notation \(|n_{h},n_{v}\rangle\) represents a state that consists of n photons in the horizontal (h) mode as well as n photons in the vertical (v) polarization mode. Therefore, from Eq. (1), we can observe that a biphoton has a three-level quantum system (qutrit) representation, hence its use for ternary quantum information encoding. To realize the QKD protocol, one needs at least two mutually unbiased bases (MUB) from available \(d+1\) MUBs. The two orthonormal bases \({\mathscr {M}}_{1}=|\phi \rangle _{i}\), where \(i \in \{0,1,2\}\) and \({\mathscr {M}}_{2}=|\Phi \rangle _{j}\), where \(j \in \{0,1,2\}\) for a 3-dimensional Hilbert space \({\mathscr {H}}_{3}\) are considered mutually unbiased when all pairs of basis vectors \(|\phi \rangle _{i}\) and \(|\Phi \rangle _{j}\) satisfies

$$\begin{aligned} |\langle \phi _{i}|\Phi _{j} \rangle |^{2}=\frac{1}{3}. \end{aligned}$$
(2)

For biphotons, the standard basis is expressed in terms of the orthonormal states \(|\alpha \rangle =|2,0\rangle\), \(|\beta \rangle =|0,2\rangle\) and \(|\gamma \rangle =|1,1\rangle\). The states \(|2,0\rangle\) and \(|0,2\rangle\) represent type-I phase matching, while \(|1,1\rangle\) corresponds to type II phase matching, and one can obtain these biphoton fields through spontaneous parametric down-conversion (SPDC). The other three MUBs are realized from the superposition of the basis vectors as follows

$$\begin{aligned} |\acute{\alpha }\rangle&=\frac{1}{\sqrt{3}}(|\alpha \rangle +|\beta \rangle +|\gamma \rangle )\end{aligned}$$
(3)
$$\begin{aligned} |\acute{\beta }\rangle&=\frac{1}{\sqrt{3}}(|\alpha \rangle +\omega |\beta \rangle +\omega ^{2}|\gamma \rangle )\end{aligned}$$
(4)
$$\begin{aligned} |\acute{\gamma }\rangle&=\frac{1}{\sqrt{3}}(|\alpha \rangle +\omega ^{2}|\beta \rangle +\omega |\gamma \rangle ), \end{aligned}$$
(5)
$$\begin{aligned} |\bar{\alpha }\rangle&=\frac{1}{\sqrt{3}}(|\alpha \rangle +|\beta \rangle +\omega |\gamma \rangle )\end{aligned}$$
(6)
$$\begin{aligned} |\bar{\beta }\rangle&=\frac{1}{\sqrt{3}}(|\alpha \rangle +\omega |\beta \rangle +|\gamma \rangle )\end{aligned}$$
(7)
$$\begin{aligned} |\bar{\gamma }\rangle&=\frac{1}{\sqrt{3}}(\omega | \alpha \rangle +|\beta \rangle +|\gamma \rangle ), \end{aligned}$$
(8)

and

$$\begin{aligned} |\tilde{\alpha }\rangle&=\frac{1}{\sqrt{3}}(|\alpha \rangle +|\beta \rangle +\omega ^{2}|\gamma \rangle )\end{aligned}$$
(9)
$$\begin{aligned} |\tilde{\beta }\rangle&=\frac{1}{\sqrt{3}}(|\alpha \rangle +\omega ^{2}|\beta \rangle +|\gamma \rangle )\end{aligned}$$
(10)
$$\begin{aligned} |\tilde{\gamma }\rangle&=\frac{1}{\sqrt{3}}(\omega ^{2}|\alpha \rangle +|\beta \rangle +|\gamma \rangle ), \end{aligned}$$
(11)

where \(\omega =\exp (i2\pi /2)\). In our scenario, to realize high dimensional encoding with biphotons, we propose an MDI-QKD protocol exploiting two Fourier transformed bases, \({\mathscr {M}}_{1}=\{|\acute{\alpha }\rangle ,|\acute{\beta }\rangle ,|\acute{\gamma }\rangle \}\) and \({\mathscr {M}}_{2}=\{|\bar{\alpha }\rangle ,|\bar{\beta }\rangle ,|\bar{\gamma }\rangle \}\).

Preparation of states

Alice (Bob) starts by randomly preparing qutrit states from two mutually unbiased bases \({\mathscr {M}}_{1}=\{|\acute{\alpha }\rangle ,|\acute{\beta }\rangle ,|\acute{\gamma }\rangle \}\) and \({\mathscr {M}}_{2}=\{|\bar{\alpha }\rangle ,|\bar{\beta }\rangle ,|\bar{\gamma }\rangle \}\). The biphoton states \(\{|\acute{\alpha }\rangle ,|\bar{\alpha }\rangle \}\), \(\{|\acute{\beta }\rangle ,|\bar{\beta }\rangle \}\) and \(\{|\acute{\gamma }\rangle ,|\bar{\gamma }\rangle \}\) are assigned bit values 0, 1 and 2, (the value 2 is converted to binary digit during sifting to obtain two bits per signal) respectively. The states are prepared using a Mach–Zehnder interferometer consisting of 3 arms and appropriate non-linear crystals in each arm. This is illustrated in Fig. 1.

Figure 1
figure 1

Mach–Zehnder interferometer set up used by Alice and Bob for biphoton state preparation. The laser beam is pumped towards a non-symmetric beam-splitter that transmits 2/3 and reflects 1/3 of the beam through the long and short arms. The \((\lambda /2)_{i}\) represents the halve wave plates for manipulating the amplitude, \(c_{i}\) of the states. The phase shifters (PS. 1 and PS. 2) introduce relative phases between the states. The DM denotes the dichroic mirror, which transmits two biphotons created using type I non-linear crystals from the long arm of the interferometer and reflect the pump from the short arm towards the type II non-linear crystal for the creation of state \(|1,1\rangle\).

Full size image

The laser beam is pumped onto a non-symmetric beamsplitter that transmits two-thirds of the beam through the interferometer’s long arm and reflects the other beam via the short arm. The beam in the long arm is pumped towards the type I non-linear crystals for generating states \(|2,0\rangle\) and \(|0,2\rangle\) resulting in a superposition

$$\begin{aligned} |\Phi \rangle =c_{1}|2,0\rangle +e^{i\phi _{31}} c_{3}|0,2\rangle , \end{aligned}$$
(12)

with \(e^{i\phi _{31}}\) representing the relative phase between the states realized through phase shifters. The half-wave plate is used for manipulating the amplitudes of these states. A cut-off flitter is employed to remove the pump. After passing through the filter, the states arrive at the piezoelectric translator, where the phase shift, \(\phi _{2}\), is introduced between the superposition of states defined in Eq. (12) and the state \(|1,1\rangle\). The reflected beam traveling through the short arm is guided towards the half-wave plate to control the amplitude corresponding to the state \(|1,1\rangle\). The pump is reflected at the dichroic mirror towards the type II non-linear crystals to create the state \(|1,1\rangle\). The type I biphotons from the long arm of the interferometer is transmitted via the dichroic mirror. Thus, at the interferometer’s output, we have the superposition of three basic states in Eq. (1), which are then propagated through the insecure channel to the measurement site. Different states from two mutually unbiased bases are produced by adjusting the phase shifters and halve wave plates according to Table 1.

Table 1 The parameter settings for biphoton states from two mutually unbiased bases used in our QKD scheme.
Full size table

Measurement

Charlie allows the biphotons from Alice and Bob to interfere in a symmetric beam-splitter upon receiving the states. As a result, the Hong Ou Mandel effect occurs (see Fig. 2). The beam-splitter action can be described as follows. Let us assume Alice’s biphoton state at the input arm of the beam-splitter is denoted by \(|\psi \rangle _{1}\), then its transformation can be described as

$$\begin{aligned} a^{\dagger }_{1}|\psi \rangle _{1}\rightarrow \frac{1}{\sqrt{2}}(|\psi \rangle _{3}+|\overline{\psi }\rangle _{4}). \end{aligned}$$
(13)

Similarly if Bob’s state at the input arm is \(|\acute{\psi }\rangle _{2}\) then the action of the beam-splitter is described as

$$\begin{aligned} a_{2}^{\dagger }|\acute{\psi }\rangle _{2}\rightarrow \frac{1}{\sqrt{2}}(|\overline{\acute{\psi }}\rangle _{3}-|\acute{\psi }\rangle _{4}), \end{aligned}$$
(14)

where \(a^{\dagger }_{i}\) denotes the creation operator and \(|\bar{x}\rangle\) is the reflected state. The overall beam-splitter transformations are described as

$$\begin{aligned} |\psi \rangle _{1}|\acute{\psi }\rangle _{2}&\xrightarrow {BS}\frac{1}{\sqrt{2}}(|\psi \rangle _{3}+|\overline{\psi }\rangle _{4})\otimes \frac{1}{\sqrt{2}} (|\overline{\acute{\psi }}\rangle _{3}-|\acute{\psi }\rangle _{4}) \\&=\frac{1}{\sqrt{2}}(|\psi \rangle _{3}|\overline{\acute{\psi }}\rangle _{3}-|\psi \rangle _{3}|\acute{\psi }\rangle _{4} +|\overline{\psi }\rangle _{4}|\overline{\acute{\psi }}\rangle _{3}-|\overline{\psi }\rangle _{4}|\acute{\psi }\rangle _{4}) \\&=\frac{1}{\sqrt{2}}(|\Psi ^{+}\rangle +|\Psi ^{-}\rangle ) \end{aligned}$$
(15)

where

$$\begin{aligned} |\Psi ^{+}\rangle =\frac{1}{\sqrt{2}}(|\psi \rangle _{3}|\overline{\acute{\psi }}\rangle _{3} -|\overline{\psi }\rangle _{4}|\acute{\psi }\rangle _{4}) \end{aligned}$$
(16)

and

$$\begin{aligned} |\Psi ^{-}\rangle =\frac{1}{\sqrt{2}}(|\overline{\psi }\rangle _{4} |\overline{\acute{\psi }}\rangle _{3}-|\psi \rangle _{3}|\acute{\psi }\rangle _{4}). \end{aligned}$$
(17)

The subscripts 1, 2, and 3, 4 denote a beam-splitter’s input and output ports, respectively. According to the Hong Ou Mandel interference, identical photons will leave the beam-splitter from a similar output port, and distinguishable photons from both input ports of the beam-splitter will exit in both output ports. Let Alice and Bob choose a similar biphoton states \(|\acute{\alpha }_{A}\rangle\) and \(|\acute{\alpha }_{B}\rangle\), respectively. Therefore, based on the Hong Ou Mandel interference, the state \(|\Psi ^{-}\rangle\) in Eq. (17) will disappear, and the resultant state is

$$\begin{aligned} |\Psi ^{+}\rangle =\frac{1}{\sqrt{2}}(|\acute{\alpha }_{A}\rangle _{3}|\overline{\acute{\alpha }_{B}}\rangle _{3} -|\overline{\acute{\alpha }_{B}}\rangle _{4}|\acute{\alpha }_{A}\rangle _{4}). \end{aligned}$$
(18)
Figure 2
figure 2

The generic measurement set up for our proposed MDI-QKD. Alice and Bob start by preparing the biphoton states from two mutually unbiased bases and send them through the unsecured channel to Charlie. Charlie allows the states to interfere in the symmetric beam-splitter (BS) upon receiving the states. The photons are directed towards the tritter and eventually detected in the Brown Twiss scheme (mode sorter).

Full size image
Figure 3
figure 3

Illustration of the measurement set up at Charlie’s site. The incoming biphotons interfere in the beam-splitter (BS) and exit through either of two output ports towards the two non-symmetric beam-splitter (NPBS), where they are further split into three channels and directed towards the tritter. The tritter setup shown in the upper left is a three-input-output port splitter. It comprises three conventional beam-splitters (BS), four-phase shifters (PS), and a mirror. The output ports of the tritter are linked with three Brown Twiss schemes for detecting the three basic states \(|\alpha \rangle\), \(|\beta \rangle\), and \(|\gamma \rangle\). Each Brown Twiss scheme consists of a non-symmetric beam-splitter (NPBS), wave plates (WP), polarization analyser (A), and detectors (D\({\textbf{P}}_{i}\)) where \({\textbf{P}} \in \{H,V\}\) represents polarization mode and subscript i denotes single photons forming biphotons. The abbreviation c.c corresponds to coincident counting or detection.

Full size image

Therefore, identical biphotons will always appear in the same output arm of BS (3rd arm or 4th arm). Otherwise, if Alice and Bob prepare opposite biphotons, both \(|\Psi ^{-}\rangle\) and \(|\Psi ^{-}\rangle\) will exist, and there is a non-zero probability that the biphotons will exit at both output arms of the BS. The photons that exit the beam-splitter are transmitted toward the three input-output ports beam-splitter (tritter). The photons are directed toward the two non-polarizing beam-splitters to separate them into three channels from each output of the symmetric beam-splitter connected to each input of the two tritters (see Fig. 3). The probability of photons exiting through any of the output ports of the tritter is governed by the unitary matrix

$$\begin{aligned} {\mathscr {U}}=\frac{1}{\sqrt{3}} \begin{pmatrix} 1 &{} 1 &{} 1 \\ 1 &{} e^{i2\pi /3} &{} e^{i4\pi /3} \\ 1 &{} e^{i4\pi /3} &{} e^{i8\pi /3} \end{pmatrix}. \end{aligned}$$
(19)

In a case where each input of the tritter is injected with biphoton state, the resultant output state after the evolution induced by \({\mathscr {U}}\) is given by

$$\begin{aligned} |1,1,1\rangle \xrightarrow {{\mathscr {U}}} \sqrt{\frac{2}{3}}|3,0,0\rangle -\frac{1}{\sqrt{3}}|1,1,1\rangle , \end{aligned}$$
(20)

where \(|1,1,1\rangle\) corresponds to one biphoton state in each input or output of the tritter, and \(|3,0,0\rangle\) represents three biphoton states exiting through one output port and no photons in the other two output ports. The output ports of each tritter are linked with three biphoton mode sorters. At the output of each tritter, the biphoton states from Alice and Bob, are directed towards the Brown Twiss schemes which are tuned to measure the standard basis biphoton modes \(|\alpha \rangle\), \(|\beta \rangle\) and \(|\gamma \rangle\). Each Brown Twiss scheme made up of polarization filters in the arms. The filters comprise a pair of phase-plates and a polarization analyzer used to realize the polarization states of single-photons creating the biphoton. Each Brown Twiss scheme is tuned to detect a certain polarization state of biphoton by setting wave plates (\(\lambda /4\) plate, \(\lambda /2\) plate) to angle positions that realize desired polarization and setting polarization analyser to allow the desired polarization to pass through. Different angle settings for wave plates are shown in Table 2. When a Brown Twiss scheme is tuned to the settings for detection of specific polarization states, the orthogonal biphoton states cannot result in coincidence detection. For instance, in the Brown Twiss scheme used to detect \(|\beta \rangle\) biphoton mode, there are two detectors for the horizontal polarization contributions from Alice and Bob’s biphoton states which are labelled as \(D_{HA}\) and \(D_{HB}\). Furthermore, there are two detectors for measuring the vertical polarization contributions of biphoton states from Alice and Bob labelled as \(D_{VA}\) and \(D_{VB}\) as shown in Fig. 3. Similarly, appropriate parameters are set in the filters of both arms of the Brown Twiss scheme for detecting other states to allow coincidence detection. Note that states prepared by Alice and Bob are a superposition of the three basic states \(|\alpha \rangle\), \(|\beta \rangle\) and \(|\gamma \rangle\). Therefore, a successful Bell state measurement in the Brown Twiss scheme corresponds to the observation of precisely 12 detectors being triggered; for instance, \(D_{H1A}\), \(D_{H1B}\), \(D_{H2A}\) and \(D_{H2B}\) (associated with \(|\alpha \rangle _{L}\) biphoton mode), \(D_{H3A}\), \(D_{H3B}\), \(D_{V4A}\) and \(D_{V4B}\) (associated with \(|\beta \rangle _{L}\) biphoton mode) and \(D_{V5A}\), \(D_{V5B}\), \(D_{V6A}\) and \(D_{V6B}\) (associated with \(|\gamma \rangle _{L}\) biphoton mode). These measurement results can be simplified in terms of Bell measurements as \(\frac{1}{\sqrt{2}}(D_{\alpha _{L}}D_{\beta _{L}}D_{\gamma _{L}}+D_{\alpha _{R}}D_{\beta _{R}}D_{\gamma _{R}})\) which represent a click in detectors on the left-hand side for \(|\alpha \rangle\), \(|\beta \rangle\) and \(|\gamma \rangle\) modes (i.e.,\(D_{\alpha _{L}}\) denotes coincidence detection in detectors of \(|\alpha \rangle\) mode) or a click on the right-hand side for \(|\alpha \rangle\), \(|\beta \rangle\) and \(|\gamma \rangle\) modes detectors. A conclusive result is given by click in detectors of the mode sorters on the left-hand side or the right-hand side only. The other Bell state measurements result in inconclusive measurement results, e.g., \(\frac{1}{\sqrt{2}}(D_{\alpha _{L}}D_{\beta _{L}}D_{\gamma _{R}}+D_{\alpha _{R}}D_{\beta _{R}}D_{\gamma _{L}})\). The results are provided in Table 3.

Table 2 The parameter settings for wave plates in the Brown Twiss schemes.
Full size table
Table 3 The possible Bell state measurement results in the Brown Twiss scheme mode sorting.
Full size table

Sifting

Alice and Bob post select states prepared using the same basis when Charlie reports a conclusive event and discards the rest of the data. A conclusive event corresponds to a case where there is a coincidence detection in three Brown Twiss schemes (linked to the same tritter) for three different basis states \(|\alpha \rangle\), \(|\beta \rangle\) and \(|\gamma \rangle\). This occurs when Alice and Bob have prepared the same biphoton state. We define the set \({\mathscr {K}}\) comprising of biphoton signals if Alice and Bob selected the key basis \({\mathscr {M}}_{1}\) and Charlie gets a successful measurement. Similarly, \({\mathscr {C}}\) is a set of post-selected signals from measurement basis \({\mathscr {M}}_{2}\), which are used for monitoring the presence of an adversary. The protocol repeats the first steps until the sifting conditions \(|{\mathscr {K}}| \ge n\) and \(|{\mathscr {C}}| \ge m\) are met for all N signals prepared by Alice and Bob.

Parameter estimation

The participating parties, Alice and Bob, make use of the random bits obtained from \({\mathscr {K}}\) to create a raw key consisting of bit strings \({\textsf{K}}_{A}\) and \({\textsf{K}}_{B}\). Then, they compute the average error \(\frac{1}{|{\mathscr {C}}|} \sum a_{i}\oplus b_{i}\) where \(a_{i}\) and \(b_{i}\) are Alice and Bob’s bit values.

Error correction

The information reconciliation scheme is performed, which leaks at least \({\text {leak}}_{EC}\) bits of classical error-correction data. Alice evaluates a bit string (i.e., a hash) measuring length \(\log _{2}(1/\varepsilon _{\textrm{cor}})\) using a random \({\text {universal}}_{2}\) hash function to \({\textsf{K}}_{A}\). Then, Alice transmits the choice of the function, including the hash to the receiver, Bob. When the hash of \({\textsf{K}}_{B}\) does not match the hash of \({\textsf{K}}_{A}\), the protocol is aborted.

Privacy amplification

During this step, Alice uses a random \({\text {universal}}_{2}\) hash function for extracting the length \(\ell\) bits of secret key \({\textsf{S}}_{A}\) from \({\textsf{K}}_{A}\). Bob exploits a similar hash function for extracting the key \({\textsf{S}}_{B}\) of length \(\ell\) from \({\textsf{K}}_{B}\).

Security analysis

We consider the realistic scenarios where participating parties exchange finite signals N and determine the statistical fluctuations of finite-size key effects. The security analysis follows the proofs provided in Refs.52,53,54,55,56 based on a universally composable framework. The protocol creates a pair of key bit strings \({{\textsf{S}}_{{\textsf{A}}}}\) for Alice and \({{\textsf{S}}_{{\textsf{B}}}}\) for Bob. These key bit strings measure length \(\ell\) and must satisfy the correctness and secrecy requirements so that the protocol can be considered secure. Based on the composability requirement, the QKD protocol is considered to be correct when \({{\textsf{S}}_{{\textsf{A}}}}={{\textsf{S}}_\mathsf {{B}}}\) for any eavesdropping attack. Thus, the \(\varepsilon _{cor}\)-correct protocol differs from a correct one according to the error probability, \(\varepsilon _{\text {cor}}\), where \({\text {Pr}}[{{\textsf{S}}_{{\textsf{A}}}}\ne {{\textsf{S}}_{{\textsf{B}}}}] \le \varepsilon _{\text {cor}}\). Therefore, the CQ state, \(\rho _{{{\textsf{S}}_{\textsf{A}}}E}\) is \(\Delta\)-secret when

$$\begin{aligned} \min _{\rho _E}\frac{1}{2}||\rho _{{{\textsf{S}}_{{\textsf{A}}}}E}-\rho _U\otimes \rho _E||_1\le \Delta , \end{aligned}$$
(21)

where \(\rho _{{{\textsf{S}}_{{\textsf{A}}}}E}\) is the classical-quantum (CQ) state, which represents the correlation between Alice’s key bit string \(S_A\) and Eve’s quantum state \(\rho _E\), and \(\rho _U\) corresponds to the completely mixed state on the key space.

Since we consider signals generated using spontaneous parametric down-conversion (SPDC) sources that sometimes emit at least one photon pair, our protocol is susceptible to photon number splitting (PNS) attacks. Therefore, we apply the decoy states technique analysis. With the decoy-state approach, Alice prepares photons at random by using the three different intensities \((\mu , \nu , \omega )\) with \(\mu\) denoting the signal state intensity, \(\nu\) for decoy states, and \(\omega\) represents the vacuum states57. These intensities are generally chosen according to the following probabilities \(P_{\mu }>P_{\nu }>P_{\omega }\) whereby \(P_{\mu }, P_{\nu }\), and \(P_{\omega }\) represent signal, decoy and vacuum states. Accordingly, signal states attained with the intensity \(\mu\) are utilized to generate the final secure key. Finally, the decoy-states acquired based on intensity \(\nu\) are used to bound the knowledge of Eve about the key. Therefore, the key rate of the \(\varepsilon _{\text {sec}}+\varepsilon _{cor}\)-MDI protocol with biphotons is expressed as

$$\begin{aligned} \frac{\ell }{N_{\text {total}}}=q\Bigg [Q_{\mu _{a}\mu _{b},{\mathscr {M}}_{1}}^{1,1} (\log _{2}3-h_{3}(e_{{\mathscr {M}}_{2}}^{1,1U}))-{\text {leak}}_{EC}-{\text {log}}_{2}\frac{2}{\varepsilon _{\text {cor}}} -2{\text {log}}_{2}\frac{4}{\varepsilon _{\text {sec}}}\Bigg ], \end{aligned}$$
(22)

with \(q=\frac{N_{\mu }p_{\kappa }^{2}}{N_{\text {total}}}\), \(N_{\mu }\) represents the amount of detected signals prepared according to the intensity \(\mu\). In contrast, \(p_{\kappa }\) denotes the probability of measuring in the key basis \({\mathscr {M}}_{1}\) and \(N_{\text {total}}\) is the total amount of exchanged signals. The term \(Q_{\mu _{a}\mu _{b},{\mathscr {M}}_{1}}^{1,1}\) represents the gain of biphotons prepared by Alice and Bob in the key basis \({\mathscr {M}}_{1}\) with intensities \(\mu _{a}\) and \(\mu _{b}\), respectively. Accordingly, the term \(e_{{\mathscr {M}}_{2}}^{1,1U}\) denotes the upper bound on the error rate emanating from single-photon components in the non-key basis \({\mathscr {M}}_{2}\) and \({\text {leak}}_{\textrm{EC}}\) represents the quantity of information leaked to Eve in the error correction step which equals to \(N_{\mu }f_{\textrm{EC}}h_{3}(E_{\mu _{a}\mu _{b}{\mathscr {M}}_{1}})\). Here f denotes the efficiency due to error correction and \(h_{3}(x)\) is the entropy corresponding to three-dimensional quantum states given by \(h_{3}(x)=-x{\text {log}}_{2}(\frac{x}{2})-(1-x){\text {log}}_{2}(1-x)\). Finally, the correction terms \(\log _{2}(1/\varepsilon _{\textrm{cor}})\) and \(2\log _{2}(4/\varepsilon _{\textrm{sec}})\) correspond to the bits of information lost through computation of universal hash function during error correction step and the privacy amplification. The applicable parameters in Eq. (22) are derived in Appendix A.

Simulation results

We present the analysis of the behavior of the secret key rate in Eq. (22). The simulation results correspond to a fibre-based QKD scheme where the expected key rate is maximized by using the following experimental values where fiber loss coefficient 0.2 dB/km, detector efficiency \(\eta =14.5\%\), single-photon detector dark count rate \(P_d=1.7\times 10^{-6}\), error correction efficiency \(f_{EC}=1.22\), signal states mean photon number \(\mu =0.6\) and optimal probability \(p_{z}\) for the key basis is 0.95 Ref.58.

Figure 4
figure 4

Illustration of the secret key rate (in logarithmic scale) in terms of the transmission distance (km), for a fixed amount of signals \(N=10^{12}\), \(N=10^{13}\), \(N=10^{14}\) and \(N=10^{16}\).

Full size image

Figure 4 depicts the expected secret key rate corresponding to each pulse (i.e., \(\ell /N\)) in terms of the transmission distance between the participating parties, Alice and Bob, for various amounts of signals N. The simulation result demonstrates the feasibility of our proposed protocol in the finite-key regime. Notably, we obtain a fairly reasonable transmission distance of 90 km with realistic \(10^{16}\) photon signals. For comparison purposes, we provide the plot for key rate against transmission distance for our proposed biphoton MDI-QKD and the qubit-based MDI-QKD55 in Fig. 5. The results indicate that qubit-based MDI-QKD slightly outperforms our proposed biphoton QKD in terms of maximum transmission and achievable key rates. However, it is worth highlighting that the biphoton MDI-QKD provides a higher bit error rate tolerance compared to the qubit-based MDI-QKD. For example, it has previously been demonstrated in Ref.45,59 that biphoton-based QKD protocols can tolerate an error rate of about 17.7% to distill a secure key. In contrast, the best qubit-based one-way QKD can only tolerate up to 14.1% in the error rate45. Therefore, we highlight that owing to its ability to tolerate a higher quantum bit error rate, the biphoton MDI-QKD can still be considered a reliable candidate for key distribution purposes, particularly over short transmission distances with low losses in the channel. Notably, we remark that the means to create and detect biphoton optical fields have long been successfully investigated47,60,61,62. Furthermore, using comparable schemes the experimental results show that the biphoton states can be realized with high fidelity that ranged from 98.3 % to 99.8%, clearly demonstrating the feasibility of biphoton QKD. Most significantly, the advent of superconducting nanowire single-photon detectors has demonstrated detection efficiency of about 93%63. Thus, by harnessing these new technologies, the detection inefficiencies contributed by our detection system, which detectors in our scheme could contribute, can be drastically reduced, resulting in improved key rates. In Fig. 6, we present the performance expected secret key rate (per pulse) \(\ell /N\) given as a function of the number of signals N for various values of the intrinsic error rate: \(Q=(0.3\%,0.6\%, 1\%)\) owing to the misalignment and the optical system’s instability at a distance of 50 km. We show that a minimum data size of about \(10^{14}\) signals (attainable current hardware in practical QKD systems) is required to produce a provably secure secret key.

Figure 5
figure 5

Illustration of the secret key rate (in logarithmic scale) in terms of the transmission distance (km) for our proposed biphoton MDI-QKD and the qubit-based MDI-QKD proposed in Ref.55 for a fixed amount of signals \(N=10^{16}\).

Full size image
Figure 6
figure 6

The secret key rate (in logarithmic scale) in terms of the number of signals N, for intrinsic misalignment errors \(0.3\%\), \(0.6\%\), and \(1\%\).

Full size image

Conclusion

We presented a high-dimensional QKD protocol employing biphotons to encode information. The biphotons were exploited as qutrits to improve the secret key rate. This is because qutrits carry more bits of classical information and have improved robustness against eavesdropping compared to qubits. Moreover, the secret key rate for the MDI-QKD proposed protocol was simulated regarding the transmission distance for different fixed amounts of signals. These results prove that this protocol achieves a considerable secret key rate for a moderate transmission distance of 90 km by using \(10^{16}\) signals. Also, the expected secret key rate was simulated to examine our protocol’s performance at various intrinsic error rate values, \(Q=(0.3\%,0.6\%,1\%)\) caused by misalignment and instability due to the optical system. These results show that reasonable key rates are achieved with a minimum data size of about \(10^{14}\) signals which are realizable with the current technology. Therefore, the proposed protocol is crucial for realizing practical QKD implementations.