Introduction

Our society is based on the continuous exchange of billions of data, and most of them travel in optical fibres. Nonetheless, most of the exchanged data are not protected against upcoming threats, i.e., new algorithms able to break current cyphers and the expected availability of quantum computers1. A quantum computer is a machine based on the laws of quantum physics, which will be able to crack some of the current cryptosystems, whose security relies on the limited computational power of an eavesdropper2. As derived by Shannon, a way to achieve information theoretical secure communications is to use One-Time-Pad encryption, which requires a pre-shared key of the same size as the message to be sent3. However, other symmetric key algorithms based on computationally hard problems are also used, such as the Advanced Encryption Standard, since they require keys of constant length (e.g. 128 or 256 bits)4. The symmetric key used by these cryptosystems must be exchanged between the two parties, and this is usually achieved through public-key algorithms, two of the most widely used being the Rivest–Shamir–Adler and the elliptic curve cryptography5,6,7. A quantum computer can however break both algorithms, leaving the task of distributing keys to either post-quantum cryptography8 or to alternative methods such as quantum cryptography. Within the latter, quantum key distribution (QKD) addresses this challenge by relying on the laws of quantum physics to provide the required information-theoretic security9. During the last 30 years, multiple demonstrations of free-space, underwater and fibre-based QKD systems have shown the feasibility of such a technology10,11,12,13,14,15,16. Nevertheless, multiple factors are limiting the global deployment of QKD systems: the low information rate, the short propagation distance and the compatibility with the existing network infrastructure. Indeed, most of QKD implementations have been realised in low noise environments (e.g. dark fibres), attesting to the difficulty of integration with the bright signals used in classical communications17,18,19,20,21,22,23. In this work, we show how to overcome the low rate and compatibility limitations by exploiting a 37-core multicore fibre (MCF) as a technology for quantum communications24. This technology allows for efficient key generation, enabling the highest secret key rate presented to date. Moreover, we co-propagate in all the 37 cores simultaneously a high-speed classical signal, showing that the quantum communication is only weakly perturbed by it, paving the way for a full-fleshed implementation in current communication infrastructures.

Results

MCF for quantum communications

Space division multiplexing (SDM) in optical fibre, i.e., communication through distinct and parallel cores/modes in multicore and few-modes fibres, will play a fundamental role in future classical communications, both for solving the future capacity crunch and for reducing the overall power budget, thus decreasing the total power consumption25,26,27. As reported in Fig. 1a, through SDM the achievable rate of an N-core MCF corresponds theoretically to N times the achievable rate of a single mode fibre28. To achieve these high rates, a low cross-talk between the different channels is of extreme importance for SDM schemes. Indeed, cross-talk is the measure of the leakage from one channel to another, leading therefore to a larger insertion loss in the former and, more importantly, to an extra noise source in the latter. As an example, high-speed classical communication at \(10.16\) Pbit s\({}^{-1}\) has been demonstrated thanks to SDM combined with dense wavelength division multiplexing, polarisation modulation and advanced coding29. Likewise, both multicore and few-mode fibres have been exploited for encoding and transmitting high-dimensional (Hi-D) quantum states30,31,32. In particular, the cores or the modes of these special fibres have been used to increase the dimensionality of the Hilbert space, thus allowing higher photon information efficiency. Although Hi-D quantum states are suitable for high rate quantum communications, in specific channel conditions (low noise channel), it was experimentally demonstrated that SDM is suitable for very high rate secure communications33. The principle is based on the concatenation of parallel keys acquired in each core/mode as shown in Fig. 1b33. As a support of this statement, Fig. 2 shows a theoretical analysis of the secret key rate as a function of the error rate for Hi-D and parallel encoding when assuming transmission in a lossy bosonic Gaussian channel (e.g. a fibre link)28. As a matter of fact, in the low noise regime, the performance achieved by Hi-D protocols is lower compared to the one obtained with the multiplexing of parallel encoding (SDM). Note that, similarly to SDM in classical communications, the generation of parallel keys is achieved when each core/mode is used to transmit independent quantum states. The receiver measures each core/mode individually and then after distillation and reconciliation processes a longer key is available between the two users. In our demonstration we used a 37-core MCF to implement a proof-of-concept experiment where 37 parallel keys, generated in independent cores, are combined. Table 1 compares this work achievements with state-of-the-art experiments of discrete variable QKD implementations, with or without co-propagation of classical data rate. Details regarding the protocols used, the channel length/loss and the detectors schemes are also included. As reported in Fig. 3a continuous wave laser operating at 1550 nm (100 GHz dense wavelength division multiplexing channel C33) followed by an intensity and a phase modulator is used to implement a three states time-bin protocol, at 595 MHz repetition rate, with 1-decoy state method in finite key regime12,34,35. The intensity modulators are used to carve the pulses and to obtain the two (signal and decoy) intensity levels. We implemented a 1 decoy state protocol, instead of the more common 2 decoy states, because on one side it has been demonstrated that using just 1 decoy does not affect the final system performance (in some cases it even improves them)34 and on the other side it is easier to implement, in the sense that one intensity modulator driven by a square 2-level signal suffices. The phase modulator is only used for phase randomisation, and it can easily be removed from the setup if a phase-randomised pulsed laser is used as source (i.e., a laser in which the current is switched off between pulses). Cascaded beam splitters allow us to divide the signal in 37 different channels and, after being attenuated, these weak signals are injected at the same time each in a different core of the 7.9 km MCF, which has an average loss of 3.75 dB including fan-in/fan-out devices. This particular MCF presents extremely low cross-talk between different cores thanks to its heterogeneous structure, i.e., its particular arrangement of three core types which have different refractive indeces (see Supplementary Note 1 for further details). At the receiver’s side, Bob measures each core independently (one at a time): photons are detected with superconducting nanowire single photon detectors (SNSPDs)36 and acquired by a time-tagger unit. Note that this experiment represents a proof-of-concept realisation. Indeed, in a real implemented system 37 different random sources, transmitters and receivers are required to generate uncorrelated valid keys. More precisely, our implementation would require three intensity modulators (two for pulse carving and one for decoy modulation), one phase modulator and a random source per transmitter, leading to a total of 37 random sources, 111 intensity modulators and 37 phase modulators. Regarding the receiver, 37 unbalanced interferometers and \((4+1)\times 37=185\) SNSPDs would be needed. Indeed, in the experiment we used four detectors for the first basis and one for the second (see Methods for further details on the experimental setup). On-chip integration of the numerous components seems therefore to be necessary, a solution that is examined in the discussion paragraph. In Fig. 4a the secret key rate and the quantum bit error rate (QBER) produced per core are reported. Each point is acquired for 5 min of measurement. A total of \(105.7\) Mbit s\({}^{-1}\)\(\pm\) 162 kbit s\({}^{-1}\) is expected to be achieved in the experiment combining all the 37 cores, with a block size of 5.67 Gbit for the finite key analysis (see Supplementary Note 2 for the secret key rate analysis). We chose this specific block size as it corresponds to the overall detection events in the computational basis over a period of 30 s, meaning that the acquisition time of our block is exactly 30 s. Note that the secret key rate per core shown in Fig. 4a is obtained only from each core raw key through finite key analysis34,35,37, meaning that error correction and privacy amplification effects are taken into account but not actually implemented and that the obtained key rates also consider fluctuations given by the finite statistics. These rates show an average of 2.86 Mbit s\({}^{-1}\)\(\pm\) 4.37 kbit s\({}^{-1}\) leading to a total multiplexed rate of 105.7 Mbit s\({}^{-1}\). The confidence intervals we refer to are derived from the measurements done in the 37 cores of the fibre. In addition, we use a variable optical attenuator to simulate a longer transmission link and study the scalability of the quantum system. The results are reported in Fig. 4b attesting a channel loss limit of approximately 47 dB (\(\approx\)170 km assuming a MCF average loss coefficient of 0.27 dB/km per core and a constant 1.6 dB of total fan-in/fan-out losses24). In this analysis, the block size is fixed to a value of 5.67 Gbit for all points except the last one, thus the block acquisition time increases with the channel losses. To make sure the acquisition time is no longer than 1 day, the block size is reduced to 1 Gbit in the case of the last point (at a channel loss of 45.75 dB).

Fig. 1
figure 1

Multicore fibres applications. a Single mode fibre and multicore fibre. The fundamental rate-loss law in a single mode fibre is defined by the limit \(X=-{\mathrm{log}}_{2}(1-\eta )\), where \(\eta\) is the bosonic Gaussian channel transmissivity28. In the case of a multicore fibre (MCF), the total rate is \({\rm{Rat{e}}}_{{\rm{MCF}}}={\rm{N}}X\), where N is the number of cores. b Multiplexing of the quantum keys. Parallel keys are generated in each core of the multicore fibre. After a multiplexing procedure \(N\) keys are united in a longer key

Fig. 2
figure 2

Simulation of the normalised secret key rate as a function of the intrinsic error for parallel (Par.) and high-dimensional (Hi-D) encoding. Different colours represent the number of spatial modes used from \(N=2\) (light-grey) to \(N=32\) (orange). In the Hi-D case (dashed-lines) a multicore or few-mode fibres is used to encode the quantum states. A BB84 decoy states protocol with two mutually unbiased bases is implemented for the simulations58. Parameters used are fibre link \(d=7.9\) km (loss \(=3.75\) dB), detectors efficiency \({\eta }_{{\rm{d}}}=0.6\), receiver efficiency \({\eta }_{{\rm{bob}}}=0.85\). In the parallel encoding scheme (full-lines), the same protocol, with same parameters, is used for all the different modes or cores independently. The shown secret key rate is normalised on the system repetition rate \(\nu\)

Table 1 Comparison with state of the art experiments
Fig. 3
figure 3

Scheme of the experiment. A continuous wave laser at 1550 nm (100 GHz dense wavelength division multiplexed channel C33) is used for the quantum channel (QC). An intensity modulator (IM) is used for carving the optical pulses and to implement the decoy state method. A phase modulator (PM) is used to phase randomise the pulses. At the same time a different continuous wave laser at 1558 nm (100 GHz dense wavelength division multiplexed channel C23) followed by an intensity modulator, controlled by a bit pattern generator, allows a classical channel (CC) with on-off keying modulation at 10 Gbit s\({}^{-1}\). Through a beam combiner the quantum and classical signals are combined. Cascaded beam splitters (cBS) (two beam splitters 1 \(\times\) 5 and four beam splitters 1 \(\times\) 8) are used to divide the two signals into 37 cores. The multicore fibre is 7.9 km long and presents slightly different losses between cores. Each core is then received independently and routed to a wavelength division multiplexing (WDM) filter, used to separate the classical and the quantum signals. The classical signal is received by a photodetector (PD) and controlled by an error analyser. The quantum signal is then measured in two mutually unbiased bases (computational and Fourier bases). A 10 dB beam splitter (BS) is used to divide the two bases: in the computational we only require to measure the time of arrival with a single photon detector (SPD), while in the Fourier basis we use a delay line interferometer (DLI) to detect the phase difference between two pulses (a second SPD is connected to one output of the DLI). All the electrical outputs are collected by a time tagging unit and analysed by a computer. In the case of the transmission of only the quantum signals, the classical laser was removed in the transmitter and the WDM filter was removed from the receiver

Fig. 4
figure 4

Quantum transmission. a Secret key rate (R\({}_{{\rm{sk}}}\)), quantum bit error rate (QBER) and upper bound on the phase error (\({\phi }_{Z}^{u}\)) per core. Red dots represent the secret key rate for each core. The variations are due to different losses of the cores and the slightly different measured values of QBER and visibility. An average value of 2.86 Mbit s\({}^{-1}\)\(\pm\) 4.37 kbit s\({}^{-1}\) is measured. Blue diamonds are the QBER of the quantum signals with an average value of 0.67% \(\pm\) 0.0038%, while yellow triangles show the upper bound on the phase error, presenting an average of 3.18% \(\pm\) 0.014%. Uncertainty values, computed as standard error of the mean, are not displayed as error bars are covered by the markers. b Total secret key rate as a function of channel loss. The red circle is the overall secret key obtained after propagation through the 7.9 km link multicore fibre (MCF): a total of 105.7 Mbit s\({}^{-1}\)\(\pm\) 162 kbit s\({}^{-1}\) can be achieved through a space division multiplexing scheme over the 37-cores. Light-blue circles are the overall secret key rates expected when the channel is composed by the multicore fibre followed by a variable attenuator to emulate further losses

Coexistence of classical and quantum communications

One of the main challenges of current quantum communications is related to its integration with the existing network infrastructures. Indeed, the majority of deployed quantum links are implemented with dark fibres17. However, to make quantum communications cost-effective and to allow a faster deployment of this technology, the same infrastructure should be shared between classical and quantum signals. To demonstrate the full compatibility of our QKD system, each of the 37 cores was shared between the quantum and a fast optical classical channel. The quantum states, at 1550 nm, are prepared by cascaded intensity and phase modulators as reported in Fig. 3 and previously explained. The classical signal is created by a continuous wave laser working at \(1558\) nm (100 GHz dense wavelength division multiplexing channel C23) and then modulated by an intensity modulator with a \(10\) Gbit s\({}^{-1}\) on-off keying format. After the propagation through the 7.9 km MCF, a wavelength division multiplexing (WDM) filter separates the classical from the quantum signal. The quantum signal is measured with single photon detectors (SPDs), whereas the classical light is received by a pre-amplified direct-detection receiver and analysed by an error analyser. Further details of the experimental setup are reported in the Methods. Figure 5a shows the measured secret key rate per core acquired during the simultaneous co-propagation of the classical channel at 10 Gbit s\({}^{-1}\) (with bit error rate BER \(<\) 1E-9) in all the 37 cores. The average secret key rate per core is 1.7 Mbit s\({}^{-1}\)\(\pm\) 2.72 kbit s\({}^{-1}\) yielding a total rate of 62.8 Mbit s\({}^{-1}\)\(\pm\) 100 kbit s\({}^{-1}\). The block size used corresponds to 30 s acquisition in this configuration, i.e., 3.58 Gbit (a lower value than the one used in the only quantum scenario, due to the extra filter insertion loss at Bob’s side). Figure 5a also shows the measured bit error rate both for classical and quantum channels with an average BER of 2.4E-10 and QBER of 0.82% \(\pm\) 0.0028%, respectively. Finally, the upper bounds derived for the phase error (\({\phi }_{Z}^{u}\)) are reported, with an average of 3.57 \(\pm\) 0.015%. As a stability investigation, we measure the system performances (secret key rate, QBER and \({\phi }_{Z}^{u}\)) on the core with the highest cross-talk (central core, number 37), with all the other cores lighted up, over a period of 30 min. The results are presented in Fig. 5b. The overall performance is stable during the long measurement period, with an average secret key rate of 1.52 Mbit s\({}^{-1}\)\(\pm\) 1.95 kbit s\({}^{-1}\), an average QBER of 0.88% \(\pm\) 0.0023% and an average \({\phi }_{Z}^{u}\) of 3.54% \(\pm\) 0.014%. The system is not actively stabilised and this performance can therefore be considered representative for future practical applications. During the 30 min measurement, a total key of approximately 60 Gbit is generated from the 37 cores, assuming similar statistics from all other cores. This value is lower than the expected secret key rate that could be obtained (i.e., \(1.52\ {\rm{Mbit}}\ {{\rm{s}}}^{-1}\times 37\times 30\ \min \approx 101.2\; {\rm{Gbit}}\)); the only reason is that our real-time QBER analysis is done by the same software interface that collects the detection events, and it therefore requires to shortly stop the photon acquisition. However, this could be easily improved with the use of two distinct software interfaces, which would lead to the expected secret key rate value.

Fig. 5
figure 5

Quantum and classical transmission. a Secret key rate, bit error rate (BER), quantum bit error rate (QBER) and upper bound on the phase error (\({\phi }_{Z}^{u}\)) per core with co-propagating classical signals. Red dots represent the secret key rate per core. Blue diamonds and green downwards triangles are are the QBER and BER of the quantum and classical signals respectively. Yellow upwards triangles show the upper bound on the phase error. An average value of 1.7 Mbit s\({}^{-1}\)\(\pm\) 2.72 kbit s\({}^{-1}\), 0.82% \(\pm\) 0.0028% and 2.4E-10 was measured for the secret key rate, QBER and BER, respectively, while the upper bounds on the phase error show an average of 3.57% \(\pm\) 0.015%. Uncertainty values, computed as standard error of the mean, are not displayed as error bars are covered by the markers. b Secret key rate, QBER and upper bound on the phase error as a function of time. Red dots are the secret key rate measured in core number 37 for 30 min. Blue diamonds are the observed QBER in the same core and amount of time and yellow triangles the obtained upper bounds on the phase error. Average values of 1.52 Mbit s\({}^{-1}\)\(\pm\) 1.95 kbit s\({}^{-1}\) with 0.88% \(\pm\) 0.0023% QBER and 3.54% \(\pm\) 0.014% \({\phi }_{Z}^{u}\) is achieved. A total amount of 60 Gbit can thus be created over the multicore fibre in 30 min of measurement

Discussion

MCFs represent the new frontier of optical communication, which in classical communications can be used for high capacity transmission and energy saving reasons. The major improvement over bundles of single mode fibres is given by space saving: standard fibres have one core in a 125 \(\mu\)m cladding diameter, while MCFs have several cores in a comparable cladding size. In applications where space is limited, such as data centres, the use of MCFs over bundles of single mode fibres is considered as a good candidate38. Moreover, in less than 10 years of development the fabrication of MCFs has already reached performances (such as the loss in dB/km) comparable to those of standard single mode fibres39,40. As a new application of MCFs for quantum communications, we devise a parallel QKD system that opens up the possibility of generating secret keys achieving the highest secret key generation rate of \(105.7\) Mbit s\({}^{-1}\). This result is achievable using a protocol that requires only few standard optics components, i.e., a simple and straightforward setup. It also requires the modulation and detection of only three states, instead of the usual four that constitute the two full mutually unbiased bases, which means that in principle only two SPDs are required. Moreover, it is known from the literature that the modulation, stabilisation and detection of superposition states (those in the Fourier basis) are more challenging30,31,35: hence the use of this three states protocol results in a further simplification of the system. Finally, our analysis is carried out in the finite key regime, with a block size corresponding to the actual sifted rate over 30 s (meaning that the time acquisition of our block is exactly 30 s). Hence, our performance metrics are close to a realistic implementation scenario. Concerning the co-propagation of quantum and classical channels, the reduction in secret key rate compared to the only quantum scenario is mainly caused by the insertion loss of the WDM filter at the output of each core. By adding approximately 3 dB of extra loss at receiver side, the photons arriving at Bob’s detector and composing the raw rate are almost halved, which is then reflected by the final secret key rate. Indeed, from the simulations shown in Fig. 4b, the expected key rate that can be extracted at 6.75 dB loss is 59.7 Mbit s\({}^{-1}\), certifying that the lower key rate is only due to a more lossy receiver and not from remaining leakage or corrupted channel performance due to the classical co-propagating signals. To be noted that the protocol implemented in our work is a discrete variable (DV) modulation system. Usually QKD using squeezed states and homodyne detection, i.e., with a continuous variable (CV) modulation, is thought to be a promising candidate for practical quantum-cryptography implementations, due to its compatibility with existing telecom equipment and high detection efficiencies. However, with this proof-of-concept experiment we prove that the coexistence of classical and quantum communications within the same spatial channels in a DV system is indeed feasible, showing that both DV and CV modulations can be considered telecom compatible. Actually, with an expected secret key generation rate of 62.8 Mbit s\({}^{-1}\), we are able to surpass any state of the art experiment (generating secret keys of at least one order of magnitude less), based either on DV41,42,43,44 or on CV QKD45,46,47,48. Furthermore, in its present configuration, the fibre length was limited to 7.9 km, but longer transmission distances are expected to be achievable as long as the power coming from the classical channel can be effectively filtered out while being sufficient for a low BER detection. In this work, the WDM filter used at the fibre output has a finite extinction ratio between channels of approximately 80 dB; thus, adjusting the input power of the classical channel such that the received power per core is around −34 dBm makes the power leakage unobservable on the quantum channel, i.e., the QBER takes values similar to those it has during the quantum-only transmission (see Supplementary Note 3). Indeed, a received classical power of −34 dBm per core is enough for our setup to achieve 10 Gbit s\({}^{-1}\) communications with BER always lower than 10\({}^{-9}\); hence, in this configuration, transmitting at the full typical 0 dBm launch power is unnecessary for error-free detection. As a further matter a real implementation of the system should be addressed: in particular, the ability to generate independent keys requires multiple intensity and phase modulators. In fact, a real deployment of this technology for quantum (and classical) communications requires independent data to be prepared and sent through the fibre. This can be achieved using either conventional wavelength and space multiplexing technology in fibre or photonic integration, since several devices can be integrated onto the same chip. Fast and reliable photonic integrated circuits are already commercially available for classical communications, while quantum integrated photonics is a rapidly growing field20,30,49,50,51,52,53. At the same time, to achieve a very high rate for quantum communication, SNSPDs or fast gated InGaAs SPDs are needed. Some preliminary demonstrations guarantee the high compatibility of cryogenic temperature for optical receiver and photonic integrated circuits54,55. By combining integrated modulators and detectors on a photonic integrated circuit, an all-optical commercial system with high rate quantum and classical channels can be achieved. Finally, as a future perspective, to further boost the secret key rate a combined approach between SDM and WDM can be considered as already demonstrated for classical communications25,26,27.

In conclusion, we demonstrate through a proof-of-concept experiment that with SDM in a 37-core fibre it is possible to reach a quantum key generation rate of 105.7 Mbit s\({}^{-1}\) and, at the same time, the co-propagation of a reliable and error-free classical optical signal at 370 Gbit s\({}^{-1}\) is also feasible. By exploiting the hitherto most advanced MCF, we are able to overcome previous implementations paving the way for new quantum applications and for a faster deployment of quantum communications.

Methods

Experimental setup and electronic design

Here we describe the setup reported in Supplementary Fig. 1 and used to perform the experiment. To prepare a train of modulated weak coherent pulses, Alice (the transmitter) carves with two cascaded intensity modulators the time-encoded pulses from a tunable continuous wave laser, emitting at \(1550\) nm (only one intensity modulator is reported in Supplementary Fig. 1 for simplicity). The two cascaded intensity modulators are needed to enhance the extinction ratio of the weak coherent pulses. A third intensity modulator is used to implement the decoy state technique. The optical signal is then sent through a phase modulator which is used to phase randomise the quantum states. Subsequently, a variable optical attenuator is used to reach the quantum regime with a mean photon number of \({\mu }_{1}\approx 0.11\) (for the signal intensity) and \({\mu }_{2}\approx 0.07\) (for the decoy intensity) photon/pulse at the input of each core (\({P}_{QA}\approx\) −81 dBm in Supplementary Fig. 1). At Alice’s side, four electrical outputs generated by a field programmable gate array are used to drive the three intensity modulators and for the synchronisation signal. The phase modulator is driven by a digital-to-analog converter which uses 8 bit to obtain \({2}^{8}-1\) different phase values. The repetition frequency is \(\nu =595\) MHz, the electrical pulse width is approximately \(100\) ps, whereas the obtained optical pulse width is around \(150\) ps. For the classical signal, an intensity modulator allows on-off keying modulation at \(10\) Gbit/s of light coming from a second laser emitting at \(1558\) nm. The quantum and classical signals are combined with a beam combiner. Cascaded beam splitters (two 1 \(\times\) 5 and four 1 \(\times\) 8) are used to split the combined signal in 37 in order to couple them into the 37 cores. The fibre is a 7.9 km long heterogeneous MCF, i.e., it has three different types of cores with three different refractive indeces to decrease the inter-core cross-talks24 (the measured cross-talk is shown in Supplementary Fig. 2). At the receiver side (Bob’s side), each core output is analysed consecutively (one by one): a wavelength division multiplexing filter separates the classical from the quantum signals (100 GHz dense wavelength division multiplexing channel C23 and 100 GHz dense wavelength division multiplexing channel C33, respectively). The classical signal, after being amplified and the out-of-band noise filtered out by an optical bandpass filter, is received by a photodetector and characterised by an error analyser. The classical receiver performance in terms of BER for different optical received power values is shown in Supplementary Fig. 3: with this receiver implementation a received optical power of −34 dBm is enough to obtain BER values always lower than 10\({}^{-9}\). Regarding the quantum channel, it is measured in the \({\bf{X}}\) and \({\bf{Z}}\) bases. A 10 dB beam splitter divides the two measurements. To maximise the key generation rate, the quantum signal in the \({\bf{Z}}\) basis is further divided by a beam splitter 1 \(\times\) 4 and connected to four different SNSPDs. This was necessary to avoid the detectors saturation regime, as it would lead to both a lower count rate and a higher QBER, due to the finite dead time of the devices and to the afterpulse effect respectively. In the \({\bf{X}}\) basis a single SNSPD, placed at one output of a delay line interferometer, is used to collect the photons. We implemented a free-space delay line interferometer, sitting on a damped optical table and enclosed in a box to increase stability and to minimise coupling of light from the room. A piezoelectric actuator on a mirror was used to finely tune the interference, in order to achieve high visibility. The visibility of the interferometer is shown in Supplementary Fig. 4. All the electrical outputs are collected by a time tagging unit and analysed by a computer. As a final comment, during the post-processing analysis the received clicks were temporally filtered: this was done to reduce the number of errors coming from detectors dark counts (and cross-talk in the case of co-propagating classical signals). The filters width in time was chosen such that the click rate after filtering was unchanged from the one obtained before filtering (the temporal pulse shape was all included in the filter) for all cases except from the point with largest attenuation, where the filters were chosen to be narrower to reduce even more the probability of dark counts and therefore increase the signal-to-noise ratio (see Supplementary Table 1 for the actual values used).