High-dimensional quantum key distribution implemented with biphotons

We present a high-dimensional measurement device-independent (MDI) quantum key distribution (QKD) protocol employing biphotons to encode information. We exploit the biphotons as qutrits to improve the tolerance to error rate. Qutrits have a larger quantum system; hence they carry more bits of classical information and have improved robustness against eavesdropping compared to qubits. Notably, our proposed protocol is independent of measurement devices, thus eliminating the possibility of side-channel attacks. Also, we employ the finite key analysis approach to study the performance of our proposed protocol under realistic conditions where finite resources are used. Furthermore, we simulated the secret key rate for the proposed protocol in terms of the transmission distance for different fixed amounts of signals. The results prove that this protocol achieves a considerable secret key rate for a moderate transmission distance of 90 km by using \documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$10^{16}$$\end{document}1016 signals. Moreover, the expected secret key rate was simulated to examine our protocol’s performance at various intrinsic error rate values, \documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$Q=(0.3\%,0.6\%,1\%)$$\end{document}Q=(0.3%,0.6%,1%) caused by misalignment and instability due to the optical system. These results show that reasonable key rates are achieved with a minimum data size of about \documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$10^{14}$$\end{document}1014 signals which are realizable with the current technology. Thus, implementing MDI-QKD using finite resources while allowing intrinsic errors due to the optical system makes a giant step forward toward realizing practical QKD implementations.

Quantum key distribution (QKD) is a procedure for establishing symmetric cryptographic keys between legitimate participants by distributing quantum states 1 . In principle, QKD provides information-theoretic security, guaranteed by quantum mechanical laws 2 . Notably, QKD has developed from mere theoretical security proofs to commercial applications over the past two decades. However, practical QKD has yet to attain its full deployment owing to security lapses in the theoretical security proofs that arise from certain assumptions about the sources or devices belonging to Alice and Bob 3 . For example, QKD protocols depend on trusted device scenarios, i.e., it is assumed that no information is leaked from the transmitters or the senders, which is very challenging to guarantee in practice. This creates a gap between theory and experimental implementations, opens loopholes, and leads to various possible attacks on the QKD systems 4 . Moreover, during implementations, QKD protocols depend on trusted device scenarios, and this assumption allows the protocols to achieve effective rates. Unfortunately, this provides an opportunity for harmful attacks, such as the side-channel attacks 5 . As a result, besides the enormous theoretical and experimental quantum cryptography progress, some work remains before fully deploying QKD in commercial applications. Hence, the device-independent (DI) QKD provides an improved security degree compared to conventional QKD schemes by lessening the number of assumptions required concerning the physical devices used 6 .
The security of the DI-QKD depends on the violation of Bell inequalities 7 . However, the DI-QKD needs the loophole-free Bell experiments, making it impossible to realize using existing technologies. Recent demonstrations of various attacks highlight this on practical QKD systems 5 . As a result, the measurement deviceindependent (MDI) QKD provides an improved practical solution intrinsically insensitive to entire attacks caused by side channels. These attacks target a measurement device and remove the detection-associated security loopholes 8,9 . Furthermore, the participating parties are connected by an untrusted relay for an MDI-QKD, leading to a considerable gain in transmission distances compared to the traditional QKD schemes. Thus, this makes these set-ups ideally suitable for quantum networks. Moreover, some experimental demonstrations using

Protocol definition
Biphotons. The pure polarization state for a single-mode biphoton field is expressed according to the following 45,47 : where c i = |c i |e iφ i are complex amplitudes. The notation |n h , n v � represents a state that consists of n photons in the horizontal (h) mode as well as n photons in the vertical (v) polarization mode. Therefore, from Eq. (1), we can observe that a biphoton has a three-level quantum system (qutrit) representation, hence its use for ternary quantum information encoding. To realize the QKD protocol, one needs at least two mutually unbiased bases (MUB) from available d + 1 MUBs. The two orthonormal bases M 1 = |φ� i , where i ∈ {0, 1, 2} and M 2 = | � j , where j ∈ {0, 1, 2} for a 3-dimensional Hilbert space H 3 are considered mutually unbiased when all pairs of basis vectors |φ� i and | � j satisfies For biphotons, the standard basis is expressed in terms of the orthonormal states |α� = |2, 0� , |β� = |0, 2� and |γ � = |1, 1� . The states |2, 0� and |0, 2� represent type-I phase matching, while |1, 1� corresponds to type II phase matching, and one can obtain these biphoton fields through spontaneous parametric down-conversion (SPDC respectively. The states are prepared using a Mach-Zehnder interferometer consisting of 3 arms and appropriate non-linear crystals in each arm. This is illustrated in Fig. 1. The laser beam is pumped onto a non-symmetric beamsplitter that transmits two-thirds of the beam through the interferometer's long arm and reflects the other beam via the short arm. The beam in the long arm is pumped towards the type I non-linear crystals for generating states |2, 0� and |0, 2� resulting in a superposition Figure 1. Mach-Zehnder interferometer set up used by Alice and Bob for biphoton state preparation. The laser beam is pumped towards a non-symmetric beam-splitter that transmits 2/3 and reflects 1/3 of the beam through the long and short arms. The ( /2) i represents the halve wave plates for manipulating the amplitude, c i of the states. The phase shifters (PS. 1 and PS. 2) introduce relative phases between the states. The DM denotes the dichroic mirror, which transmits two biphotons created using type I non-linear crystals from the long arm of the interferometer and reflect the pump from the short arm towards the type II non-linear crystal for the creation of state |1, 1�.  31 representing the relative phase between the states realized through phase shifters. The half-wave plate is used for manipulating the amplitudes of these states. A cut-off flitter is employed to remove the pump. After passing through the filter, the states arrive at the piezoelectric translator, where the phase shift, φ 2 , is introduced between the superposition of states defined in Eq. (12) and the state |1, 1� . The reflected beam traveling through the short arm is guided towards the half-wave plate to control the amplitude corresponding to the state |1, 1� . The pump is reflected at the dichroic mirror towards the type II non-linear crystals to create the state |1, 1� . The type I biphotons from the long arm of the interferometer is transmitted via the dichroic mirror. Thus, at the interferometer's output, we have the superposition of three basic states in Eq. (1), which are then propagated through the insecure channel to the measurement site. Different states from two mutually unbiased bases are produced by adjusting the phase shifters and halve wave plates according to Table 1.

Measurement.
Charlie allows the biphotons from Alice and Bob to interfere in a symmetric beam-splitter upon receiving the states. As a result, the Hong Ou Mandel effect occurs (see Fig. 2). The beam-splitter action can be described as follows.Let us assume Alice's biphoton state at the input arm of the beam-splitter is denoted by |ψ� 1 , then its transformation can be described as Similarly if Bob's state at the input arm is |ψ� 2 then the action of the beam-splitter is described as where a † i denotes the creation operator and |x� is the reflected state. The overall beam-splitter transformations are described as (12) |�� = c 1 |2, 0� + e iφ 31 c 3 |0, 2�, Table 1. The parameter settings for biphoton states from two mutually unbiased bases used in our QKD scheme. The complex amplitudes |c i | are realized through the use of half-wave plates. The φ i are realized by use of phase shifters.
State The subscripts 1, 2, and 3, 4 denote a beam-splitter's input and output ports, respectively. According to the Hong Ou Mandel interference, identical photons will leave the beam-splitter from a similar output port, and distinguishable photons from both input ports of the beam-splitter will exit in both output ports. Let Alice and Bob choose a similar biphoton states |ά A � and |ά B � , respectively. Therefore, based on the Hong Ou Mandel interference, the state | − � in Eq. (17) will disappear, and the resultant state is Therefore, identical biphotons will always appear in the same output arm of BS (3rd arm or 4th arm). Otherwise, if Alice and Bob prepare opposite biphotons, both | − � and | − � will exist, and there is a non-zero probability that the biphotons will exit at both output arms of the BS. The photons that exit the beam-splitter are transmitted toward the three input-output ports beam-splitter (tritter). The photons are directed toward the two non-polarizing beam-splitters to separate them into three channels from each output of the symmetric beam-splitter connected to each input of the two tritters (see Fig. 3). The probability of photons exiting through any of the output ports of the tritter is governed by the unitary matrix In a case where each input of the tritter is injected with biphoton state, the resultant output state after the evolution induced by U is given by where |1, 1, 1� corresponds to one biphoton state in each input or output of the tritter, and |3, 0, 0� represents three biphoton states exiting through one output port and no photons in the other two output ports. The output ports of each tritter are linked with three biphoton mode sorters. At the output of each tritter, the biphoton states from Alice and Bob, are directed towards the Brown Twiss schemes which are tuned to measure the standard basis biphoton modes |α� , |β� and |γ � . Each Brown Twiss scheme made up of polarization filters in the arms. The filters comprise a pair of phase-plates and a polarization analyzer used to realize the polarization states of singlephotons creating the biphoton. Each Brown Twiss scheme is tuned to detect a certain polarization state of biphoton by setting wave plates ( /4 plate, /2 plate) to angle positions that realize desired polarization and setting polarization analyser to allow the desired polarization to pass through. Different angle settings for wave plates are shown in Table 2. When a Brown Twiss scheme is tuned to the settings for detection of specific polarization states, the orthogonal biphoton states cannot result in coincidence detection. For instance, in the Brown Twiss scheme used to detect |β� biphoton mode, there are two detectors for the horizontal polarization contributions from Alice and Bob's biphoton states which are labelled as D HA and D HB . Furthermore, there are two detectors for measuring the vertical polarization contributions of biphoton states from Alice and Bob labelled as D VA and D VB as shown in Fig. 3. Similarly, appropriate parameters are set in the filters of both arms of the Brown Twiss scheme for detecting other states to allow coincidence detection. Note that states prepared by Alice and Bob are a superposition of the three basic states |α� , |β� and |γ � . Therefore, a successful Bell state measurement in the Brown Twiss scheme corresponds to the observation of precisely 12 detectors being triggered; for instance, D H1A , D H1B , D H2A and D H2B (associated with |α� L biphoton mode), D H3A , D H3B , D V 4A and D V 4B (associated with |β� L biphoton mode) and D V 5A , D V 5B , D V 6A and D V 6B (associated with |γ � L biphoton mode). These measurement results can be simplified in terms of Bell measurements as 1 which represent a click in detectors on the left-hand side for |α� , |β� and |γ � modes (i.e.,D α L denotes coincidence detection in detectors of |α� mode) or a click on the right-hand side for |α� , |β� and |γ � modes detectors. A conclusive result is given by click in detectors of the mode sorters on the left-hand side or the right-hand side only. .
. The results are provided in Table 3.
Sifting. Alice and Bob post select states prepared using the same basis when Charlie reports a conclusive event and discards the rest of the data. A conclusive event corresponds to a case where there is a coincidence detection in three Brown Twiss schemes (linked to the same tritter) for three different basis states |α� , |β� and |γ � . This occurs when Alice and Bob have prepared the same biphoton state. We define the set K comprising of biphoton signals if Alice and Bob selected the key basis M 1 and Charlie gets a successful measurement. Similarly, C is a set of post-selected signals from measurement basis M 2 , which are used for monitoring the presence of an adversary. The protocol repeats the first steps until the sifting conditions |K| ≥ n and |C | ≥ m are met for all N signals prepared by Alice and Bob.
Parameter estimation. The participating parties, Alice and Bob, make use of the random bits obtained from K to create a raw key consisting of bit strings K A and K B . Then, they compute the average error 1 Error correction. The information reconciliation scheme is performed, which leaks at least leak EC bits of classical error-correction data. Alice evaluates a bit string (i.e., a hash) measuring length log 2 (1/ε cor ) using a random universal 2 hash function to K A . Then, Alice transmits the choice of the function, including the hash to the receiver, Bob. When the hash of K B does not match the hash of K A , the protocol is aborted.
Privacy amplification. During this step, Alice uses a random universal 2 hash function for extracting the length ℓ bits of secret key S A from K A . Bob exploits a similar hash function for extracting the key S B of length ℓ from K B .

Security analysis
We consider the realistic scenarios where participating parties exchange finite signals N and determine the statistical fluctuations of finite-size key effects. The security analysis follows the proofs provided in Refs. 52-56 based on a universally composable framework. The protocol creates a pair of key bit strings S A for Alice and S B for Bob. These key bit strings measure length ℓ and must satisfy the correctness and secrecy requirements so that the protocol can be considered secure. Based on the composability requirement, the QKD protocol is considered to be correct when S A = S B for any eavesdropping attack. Thus, the ε cor -correct protocol differs from a correct one according to the error probability, ε cor , where Pr[S A � = S B ] ≤ ε cor . Therefore, the CQ state, ρ S A E is -secret when where ρ S A E is the classical-quantum (CQ) state, which represents the correlation between Alice's key bit string S A and Eve's quantum state ρ E , and ρ U corresponds to the completely mixed state on the key space.
Since we consider signals generated using spontaneous parametric down-conversion (SPDC) sources that sometimes emit at least one photon pair, our protocol is susceptible to photon number splitting (PNS) attacks. Therefore, we apply the decoy states technique analysis. With the decoy-state approach, Alice prepares photons at random by using the three different intensities (µ, ν, ω) with µ denoting the signal state intensity, ν for decoy states, and ω represents the vacuum states 57 . These intensities are generally chosen according to the following probabilities P µ > P ν > P ω whereby P µ , P ν , and P ω represent signal, decoy and vacuum states. Accordingly, signal states attained with the intensity µ are utilized to generate the final secure key. Finally, the decoy-states acquired based on intensity ν are used to bound the knowledge of Eve about the key. Therefore, the key rate of the ε sec + ε cor -MDI protocol with biphotons is expressed as with q = N µ p 2 κ N total , N µ represents the amount of detected signals prepared according to the intensity µ . In contrast, p κ denotes the probability of measuring in the key basis M 1 and N total is the total amount of exchanged signals. The term Q 1,1 µ a µ b ,M 1 represents the gain of biphotons prepared by Alice and Bob in the key basis M 1 with intensities µ a and µ b , respectively. Accordingly, the term e 1,1U M 2 denotes the upper bound on the error rate emanating from single-photon components in the non-key basis M 2 and leak EC represents the quantity of information leaked to Eve in the error correction step which equals to N µ f EC h 3 (E µ a µ b M 1 ) . Here f denotes the efficiency  x) . Finally, the correction terms log 2 (1/ε cor ) and 2 log 2 (4/ε sec ) correspond to the bits of information lost through computation of universal hash function during error correction step and the privacy amplification. The applicable parameters in Eq. (22) are derived in Appendix A.

Simulation results
We present the analysis of the behavior of the secret key rate in Eq. (22). The simulation results correspond to a fibre-based QKD scheme where the expected key rate is maximized by using the following experimental values where fiber loss coefficient 0.2 dB/km, detector efficiency η = 14.5% , single-photon detector dark count rate P d = 1.7 × 10 −6 , error correction efficiency f EC = 1.22 , signal states mean photon number µ = 0.6 and optimal probability p z for the key basis is 0.95 Ref. 58 . Figure 4 depicts the expected secret key rate corresponding to each pulse (i.e., ℓ/N ) in terms of the transmission distance between the participating parties, Alice and Bob, for various amounts of signals N. The simulation result demonstrates the feasibility of our proposed protocol in the finite-key regime. Notably, we obtain a fairly reasonable transmission distance of 90 km with realistic 10 16 photon signals. For comparison purposes, we provide the plot for key rate against transmission distance for our proposed biphoton MDI-QKD and the qubitbased MDI-QKD 55 in Fig. 5. The results indicate that qubit-based MDI-QKD slightly outperforms our proposed biphoton QKD in terms of maximum transmission and achievable key rates. However, it is worth highlighting that the biphoton MDI-QKD provides a higher bit error rate tolerance compared to the qubit-based MDI-QKD. For example, it has previously been demonstrated in Ref. 45,59 that biphoton-based QKD protocols can tolerate an error rate of about 17.7% to distill a secure key. In contrast, the best qubit-based one-way QKD can only tolerate up to 14.1% in the error rate 45 . Therefore, we highlight that owing to its ability to tolerate a higher quantum bit error rate, the biphoton MDI-QKD can still be considered a reliable candidate for key distribution purposes, particularly over short transmission distances with low losses in the channel. Notably, we remark that the means to create and detect biphoton optical fields have long been successfully investigated 47,60-62 . Furthermore, using comparable schemes the experimental results show that the biphoton states can be realized with high fidelity that ranged from 98.3 % to 99.8%, clearly demonstrating the feasibility of biphoton QKD. Most significantly, the advent of superconducting nanowire single-photon detectors has demonstrated detection efficiency of about 93% 63 . Thus, by harnessing these new technologies, the detection inefficiencies contributed by our detection system, which detectors in our scheme could contribute, can be drastically reduced, resulting in improved key rates. In Fig. 6, we present the performance expected secret key rate (per pulse) ℓ/N given as a function of the number of signals N for various values of the intrinsic error rate: Q = (0.3%, 0.6%, 1%) owing to the misalignment and the optical system's instability at a distance of 50 km. We show that a minimum data size of about 10 14 signals (attainable current hardware in practical QKD systems) is required to produce a provably secure secret key.

Conclusion
We presented a high-dimensional QKD protocol employing biphotons to encode information. The biphotons were exploited as qutrits to improve the secret key rate. This is because qutrits carry more bits of classical information and have improved robustness against eavesdropping compared to qubits. Moreover, the secret key rate for the MDI-QKD proposed protocol was simulated regarding the transmission distance for different fixed amounts of signals. These results prove that this protocol achieves a considerable secret key rate for a moderate transmission distance of 90 km by using 10 16 signals. Also, the expected secret key rate was simulated to examine our protocol's performance at various intrinsic error rate values, Q = (0.3%, 0.6%, 1%) caused by misalignment and instability due to the optical system. These results show that reasonable key rates are achieved with a minimum data size of about 10 14 signals which are realizable with the current technology. Therefore, the proposed protocol is crucial for realizing practical QKD implementations.

Data availability
The datasets generated during and/or analysed during the current study are available from the corresponding author on reasonable request.

States sent by Alice and Bob
Charlie's measurement results , and D V 6B correspond to detectors for measuring vertically polarized states in the Brown Twiss scheme. Therefore, the overall yield is given by From these results, the gain for states prepared from key basis comprising of n-photon pairs is given by where P(n a ) and P(n b ) denotes the probabilities for Alice and Bob's SPDC sources to emit n a -photon and n b -photon pairs. This probability is expressed as The gain corresponding to single-photon contributions is then given by In addition, we have the overall gain expressed as and the QBER, E µ a µ b ,M 1 is expressed as where the error rate of the n-photon pairs from Alice and Bob, e n,n is expressed as The error rate for the n-photon pair corresponding to the state |α� given by The error rates e β n and e γ n associated with the detection of states |β� and |γ � , respectively are analogously obtained as Finally, the upper bound on the error rate measured in the complimentary basis used to approximate the phase error rate on the key basis is given by Y n,n = Y α n,n Y β n,n Y γ n,n .
(27) Q n,n µ a µ b ,M 1 = Y n,n P(n a )P(n b ), e n,n = e α n,n + e β n,n + e γ n,n .

B: Secrecy
Let the system Ẽ represent information collected by Eve on Alice and Bob's bit strings K A and K B , respectively, up to the error correction step. By applying the privacy amplification based on the universal class-two hash function, we generate a -secret key of length ℓ , and where H ε min (K A |Ẽ) represents the smooth min-entropy, which corresponds to the average probability which an adversary guesses K A correctly using an optimal strategy through having an access to Ẽ . Let v = 1 2 2 ℓ−H ε min (K A |Ẽ) , then the secret key length, ℓ is given by During error correction, Alice and Bob reveal bits of information equals to leak EC + log 2 2 ε cor to an eavesdropper. Therefore, we have that where E is Eve's information prior to error correction step. Since our analysis is based on decoy states, K A can be written in terms of K 1 A K m A and this represents the bit strings owing to single photons and multi-photons events. Through using the generalized chain rule for smooth entropies, we have that and here the second inequality is based on the fact that H δ 3 min (K m A |E) ≥ 0 . Next, we provide bound for H δ 1 Twissmin (K 1 A |K m A E) by using the uncertainty relations for the smooth entropies. To achieve this, we use a gendankenexperiment where Alice and Bob prepare all their states in the basis M 2 even when they choose the M 1 basis. In this hypothetical protocol, the bit strings obtained from measurements in the complementary basis, C A and C B of length ℓ replace the keys K A and K B . The smooth min-entropy is expressed as where n 1,1µ = N µ p 2 κ Q 1,1 µ a µ b M 1 denotes the sifted raw key size obtained from the single photon occurances. Finally, we combine all the terms which represent errors for min-entropies and error probabilities due to parameter estimation discussed in previous section. Thus, the secrecy is given by Here, ε 1 and ε 2 represent error probabilities for estimating the single photon events as well as the phase error rate. The error term is set to a common value ε and ε sec = 8ε . The final key length ℓ is obtained using the results from Eqs. (40) to (42) and invoking the secrecy requirement from Eqs. (43) in (39). Then, the final derived formula is written as Y L 1,1 = P(µ a |2)P(µ b |2)[Q νaν b ,M2 − P(ν a |0)P(ν b |0)Y 0 ] − P(ν a |2)P(ν b |2)[Q µaµ b ,M1 − P(µ a |0)P(µ b |0)Y 0 ] P(µ a |2)P(µ b |2)P(ν a |1)P(ν b |1) − P(µ a |1)P(µ b |1)P(ν a |2)P(ν b |2) .