Improving the performance of practical decoy-state quantum key distribution with advantage distillation technology

Quantum key distribution (QKD) provides a promising solution for sharing information-theoretic secret keys between two remote legitimate parties. To improve the maximal transmission distance and the maximal error rate tolerance, we apply the advantage distillation technology to analyze the security of practical decoy-state QKD systems. Based on the practical experimental parameters, the device-dependent QKD protocols and the measurement-device-independent QKD protocols have been respectively analyzed, and our analysis results demonstrate that the advantage distillation technology can significantly improve the performance of various QKD protocols. In the four-state and six-state device-dependent QKD protocols, we prove that the maximal transmission distance can be improved from 142 km to 180 km and from 146 km to 187 km respectively. In the four-state and six-state measurement-device-independent QKD protocols, we prove that the maximal transmission distance can be improved from 195 km to 273 km and from 200 km to 282 km respectively. Advantage distillation technology increases the collection between raw keys in quantum key distribution systems. Combining a decoy state method with advantage distillation technology, the authors demonstrate improved maximal transmission distance and tolerable background error rates.


Q
uantum key distribution (QKD) 1,2 is the art of sharing the information-theoretic secure key between two different remote parties Alice and Bob, while the eavesdropper Eve cannot get the secret key information even if she has unlimited computation and storage power [3][4][5] .The practical QKD system includes four steps to generate the final secret key.In the first step, Alice randomly chooses two classical bits to modulate a singlephoton quantum state in two bases, which will be sent to Bob through a public quantum channel.In Bob's side, he randomly chooses a basis to measure the received quantum states.In the second step, Alice and Bob publicly exchange the basis information with an authenticated classical channel, and they only retain those events with the same basis, which is called the raw key.In the third step, they apply the advantage distillation technology to increase the correlation between their raw key, thus they can get an advantage over Eve.In the fourth step, they perform the error correction and privacy amplification to generate the final secret key.Note that the third step may be omitted if the quantum bit error rate (QBER) is small in practical QKD systems, where the advantage distillation technology may have no advantage to increase the correlation.However, in the case of eavesdropping or long transmission distance, QBER will become higher, which will severely reduce the final secret key.Luckily, the advantage distillation technology can be adopted to improve the secret key rate in QKD.
The advantage distillation technology was firstly proposed in the classical cryptography theory 6 , which was then utilized in the device-dependent QKD (DD-QKD) protocol [7][8][9] and deviceindependent (DI) QKD protocol 10 respectively.By considering the single-photon state modulation, the security of different QKD protocols has been proved with and without the advantage distillation technology respectively 7,8,11,12 , and the analysis results demonstrate that the advantage distillation technology can improve the error tolerance of different QKD protocols.However, practical QKD systems are usually based on weak coherent sources, the multi-photon events of which may introduce the photon number splitting attack 13,14 .Fortunately, the decoy-state method [15][16][17] can be applied to detect this attack, which has been a routine in practical QKD systems.More recently, some statistical fluctuation analysis methods have been proposed to account for the finite-size key effects on the achievable secret key generation rate [18][19][20][21] .
In practical decoy-state QKD implementations, there are two important questions to be solved.One is how to increase the transmission distance without quantum repeaters, and the other is how to increase the tolerable background error rate.Since the practical quantum repeater technology is still immature until now, measurement-device-independent-QKD (MDI-QKD) protocols 22,23 have been proposed to increase the transmission distance, which require the optical interference device in the middle of the quantum channel.More recently, to beat the Pirandola-Laurenza-Ottaviani-Banchi (PLOB) bound 24 , twin-field QKD 25 was proposed.However, new QKD protocols usually need to change the hardware devices in the first step, which cannot be directly applied in the established QKD systems.
In this paper, to solve these questions, we apply the repetition-code based advantage distillation technology in decoy-state DD-QKD and MDI-QKD protocols respectively.By applying the practical DD-QKD experimental parameters 26 , we prove that, for the four-state and sixstate DD-QKD protocols, the maximal transmission distance can be improved from 142 km to 180 km and from 146 km to 187 km respectively, and the maximal tolerable background error rate can be improved from 6.2% to 16.4% and from 7% to 21.8% respectively.By applying the practical MDI-QKD experimental parameters 18,27 , we prove that, for the four-state and six-state MDI-QKD protocols, the maximal transmission distance can be improved from 195 km to 273 km and from 200 km to 282 km respectively, and the maximal tolerable background error rate can be improved from 4.5% to 14% and from 4.9% to 18% respectively.The analysis results demonstrate that the advantage distillation technology can significantly improve the maximal transmission distance and the maximal tolerable background error rate in different QKD systems.More importantly, the advantage distillation technology does not change the hardware devices about the quantum state preparation and measurement, which can be directly applied to current QKD systems [28][29][30] .

Results
Decoy-state device-dependent QKD with advantage distillation.In practical DD-QKD systems, phase-randomized weak coherent sources, which can be seen as a mixture of photonnumber states, are usually applied to modulate quantum states.However, the multi-photon states can be utilized by Eve to launch the photon number splitting attack.Fortunately, the decoy-state method can be applied to estimate the single-photon counting rate and error rate.By considering the weak coherent pulse with the mean photon number μ, the secret key rate can be estimated with the GLLP (Gottesman-Lo-Lütkenhaus-Preskill) 31 formula where P 1 is the single-photon probability in Alice's signal states, Y 1 is the single-photon counting rate and Q μ is the total counting rate of signal states.E is Eve's ancillary state, S(A|E) = S(A, E) − S(E), H(A|B) = H(A, B) − H(B), HðxÞ ¼ Àx logðxÞ À ð1 À xÞ log ð1 À xÞ and SðρÞ ¼ À tr ðρ log ρÞ are the entropy functions.S(A|E) single photon is the conditional entropy by considering the single-photon state preparation in Alice's side.
Based on the entanglement distillation and purification technology, S(A|E) single photon can be restricted by S(A|E) single photon ≥ 1 − H(e 1 ), where e 1 is the single-photon error rate.Note that S(A|E) single photon can also be analyzed with the information-theoretical security analysis method, where the detailed explanation is given in the Methods section.Since only the single-photon pulses can be used to generate the final secret key, we can apply the entanglement based QKD protocol to analyze the final secret key rate.In the entanglement based QKD protocol, Alice prepares quantum state 1 ffiffi 2 p ð 00 j i þ 11 j iÞ and sends the second particle to Bob.After quantum channel transmission, Alice and Bob share quantum state 2 p ð 01 j iÀ 10 j iÞ (see the Methods section for details).Correspondingly, the relationship between λ i (i = 0, 1, 2, 3) and the single-photon error rate in different bases can be analyzed, where the four-state DD-QKD protocol satisfies and the six-state DD-QKD protocol satisfies 1 , e x 1 and e y 1 are the single-photon error rates in the Z basis f 0 j ih0j; j1i 1 h jg, the X basis f 0 j i 0 h j x ; 1 j i 1 h j x g, and the Y basis f 0 j i 0 h j y ; 1 j i 1 h j y g, where 0 Based on decoystate technology, e z 1 , e x 1 and e y 1 can be accurately estimated, so that the constraints of λ i (i = 0, 1, 2, 3) can be obtained.
In the advantage distillation protocol 5 , Alice and Bob split their raw key into blocks of b bits {x 0 , x 1 , . . .Thus, only the events that all of the b pulses are single-photon states can be used to generate the final secret key, the probability of which is given by Y . Combining this advantage distillation technology with the information-theoretical security analysis method, the GLLP secret key rate formula can be modified with the following inequality SðAjEÞ single photon À HðAjBÞ where is the successful probability of the advantage distillation protocol, E μ is the error rate of signal states, S(A|E) single photon can be estimated with the following inequality see the Methods section for details).The modified key rate formula can be explained from two aspects.First, since the quantum channel can be controlled by Eve, she can choose the optimal parameters λ i (i = 0, 1, 2, 3) to reduce the key rate.Secondly, the advantage distillation protocol can be controlled by Alice and Bob, so they can choose the optimal advantage distillation parameter b to increase the key rate.
In the error correction step, all of errors should be corrected by Alice and Bob, thus H(A|B) can be estimated by the following inequality is the error rate value after the advantage distillation step, f > 1 is the error correction efficiency.Since Eve can get all of the classical information transmitted in the classical channel, fHð Ẽμ Þ demonstrates the maximal key information leaked to Eve in the error correction step.Finally, the final secret key rate can be estimated with the following optimization method max b min λ 0 ;λ 1 ;λ where Y 1 , e x 1 , e y 1 and e z 1 can be estimated with the decoy-state method (see the Methods section for details).By applying the DD-QKD experimental parameters 26 listed in Table 1, we analyze the secret key rate of the four-state DD-QKD protocol with and without advantage distillation technology, and the corresponding results are shown in Fig. 1.
As shown in Fig. 1, when the optimal b value satisfies b > 1, the advantage distillation technology can significantly improve the performance of practical QKD systems, which extends the maximal transmission distance from 142 km to 180 km.On the other side, the calculation results demonstrate that the maximal tolerable background error rate e Det can be improved from 6.2% to 16.4% by adopting the advantage distillation technology.In particular, the maximal transmission distance can be improved from 0 km to 175 km when e Det = 6.3%.
At the same time, we adopt the DD-QKD parameters 26 listed in Table 1 to analyze the six-state DD-QKD protocol with and without advantage distillation technology, and the corresponding results are shown in Fig. 2.
From the calculation results, we find that the maximal transmission distance can be improved from 146 km to 187 km, the maximal tolerable background error rate e Det can be improved from 7% to 21.8%, and the maximal transmission distance can be improved from 0 km to 182 km if the background error rate is e Det = 7.1%.The analysis results demonstrate that the advantage distillation technology can efficiently improve the transmission distance and error tolerance compared with the no advantage distillation case.Moreover, compared with the four-state DD-QKD protocol, the six-state DD-QKD protocol has more superiority both in the transmission distance and the background error rate tolerance.
Decoy-state measurement-device-dependent QKD with advantage distillation.More interestingly, the advantage distillation technology can also be applied to the MDI-QKD protocol.Different from the DD-QKD protocol, the MDI-QKD protocol requires both Alice and Bob to prepare the singlephoton state to generate the secret key, and the secret key rate can be estimated with the following optimization method max b min λ 0 ;λ 1 ;λ 11 and e z 11 can be estimated with the decoy-state method (see the Methods section for details).By applying the MDI-QKD experimental parameters 18,27 listed in Table 1, we analyze the secret key rate of the four-state MDI-QKD protocol with and without advantage distillation technology, and the corresponding results are shown in Fig. 3.
As illustrated in Fig. 3, we find that the maximal transmission distance can be improved from 195 km to 273 km, the maximal tolerable background error rate e Det can be improved from 4.5% to 14%, and the maximal transmission distance can be improved from 0 km to 260 km when e Det = 4.6%.The analysis results demonstrate that the advantage distillation technology can significantly improve  Table 1 Experimental parameters of numerical simulations for device-independent quantum key distribution (DD-QKD) and measurement-device-independent quantum key distribution (MDI-QKD) protocols, including the loss coefficient of the standard fiber link α, the detection efficiency of single-photon detectors η D , the probability that a photon hit the erroneous detector e Det , the dark count rate of single-photon detectors Y 0 , and the error correction efficiency f, which are from Ref. 26 and Refs.Moreover, the mean photon number of the signal states μ is also listed here.
the transmission distance and error tolerance compared with the no advantage distillation case.Similarly, we adopt the MDI-QKD experimental parameters 18,27 listed in Table 1 to analyze the six-state MDI-QKD protocol with and without advantage distillation technology, and the corresponding results are shown in Fig. 4.
From the calculation results, we find that the maximal transmission distance can be improved from 200 km to 282 km, and the maximal tolerable background error rate e Det can be improved from 4.9% to 18%, and the maximal transmission distance can be improved from 0 km to 270 km when e Det = 5%.Compared with the four-state MDI-QKD protocol, the six-state MDI-QKD protocol has more advantage both in the transmission distance and the background error rate tolerance.Moreover, we also plot the PLOB bound 24 in Fig. 4, and the performance of sixstate MDI-QKD with advantage distillation is obviously lower than the PLOB bound.Fortunately, the twin-field QKD protocol 25 proposed recently can surpass the PLOB bound.The advantage distillation method developed in this paper can also be extended to twin-field QKD 25 to further improve its performance, and we will leave this as future research.
Finite key security analysis.In practical QKD systems, the generated secret key is finite, thus how to prove security of QKD with the advantage distillation technology in finite-key scenarios is an important question.Since the advantage distillation technology only modifies the classical post-processing step, we can simply analyze the finite key length with the existed methods.More precisely, based on the quantum asymptotic equipartition property 32,33 and the leftover hash lemma 5,34 , the secret key rate with the DD-QKD protocol can be given by e R decoy ≥ max b min λ 0 ;λ 1 ;λ where n is the raw key length before the advantage distillation step, H max ðAjEÞ is the conditional max-entropy function 5 , H and the final secret parameter can be given by ε ε pa þ 2ε min .Note that the the secret key rate with the MDI-QKD protocol can be analyzed similarly.In the practical experimental realization, the QBER value and the count rate value also have statistical fluctuations, which can be analyzed by applying the Chernoff bound and the Hoeffding inequality 20,21 .However, we should emphasize that the advantage distillation technology reduces the length of the raw key when b > 1, thus it has larger statistical error to analyze the security of QKD protocols with finite resources.

Conclusions
Improvements on the maximal transmission distance and the maximal error rate tolerance are two important topics of analyzing the security of practical QKD systems.By combining the advantage distillation technology with the decoy-state method, we prove that both the maximal transmission distance and the maximal tolerable error rate can be sharply improved in different DD-QKD and MDI-QKD protocols.More importantly, the advantage distillation technology does not change the quantum step of a practical QKD system.It only modifies the classical postprocessing step, so it can be conveniently applied to various practical QKD systems.In the future research, it will be interesting to experimentally realize the advantage distillation technology in different QKD systems.

Methods
Single-photon QKD with advantage distillation.In the four-state or six-state DD-QKD protocol, Alice and Bob randomly prepare and measure the quantum state in the two-dimensional Hilbert spaces.By applying the entanglement based protocol, we assume that Alice prepares the quantum state 1 ffiffi 2 p ð 00 j iþ 11 j iÞ and sends the second particle to Bob, then Alice and Bob take inputs from fourdimensional Hilbert spaces H A ⊗ H B to apply binary measurements.By considering the four-state and six-state QKD protocols, it has been proved that Eve's general attack can be reduced to the Pauli attack 5,11 , which can be described by the classical probability theory.After quantum channel transmission, Alice and Bob share the following quantum state where Obviously, the single-photon error rates in the Z basis f 0 j ih0j; j1i 1 h jg, the X basis f 0 j ih0j x ; j1i 1 h j x g, and the Y basis f 0 j ih0j y ; j1i 1 h j y g are constrained by 1 , and λ 1 þ λ 2 ¼ e y 1 respectively.Since Eve holds the purified system of σ AB , we have the following pure state σ ABE on where the reduced density operator σ AE and σ E can be respectively given by Note that the quantum channel can be controlled by Eve, she can choose the optimal parameters λ i (i = 0, 1, 2, 3) to reduce the secret key rate as long as λ i is constrained by the QBER in different bases.Based on the this state preparation, the secret key rate can be given by 5 R ≥ min λ 0 ;λ 1 ;λ 2 ;λ 3 ½SðAjEÞ À HðAjBÞ where H(A|B) = H(λ 0 + λ 1 ) demonstrates that Z basis is used for generating the final secret key.
To improve the maximal tolerable QBER, the advantage distillation technology based on the repetition code protocol has been proposed 5 .In the repetition code protocol, Alice and Bob split their raw key into blocks of b bits {x 0 , x 1 , . . .x b−1 } and {y 0 , y 1 , . . .y b−1 } respectively.Alice privately generates a random bit c ∈ {0, 1}, and sends the message m = {m 0 , m 1 , . . ., m b−1 } = {x 0 ⊕ c, x 1 ⊕ c, . . .x b−1 ⊕ c} to Bob through an authenticated classical channel.They accept the block if and only if {m 0 ⊕ y 0 , m 1 ⊕ y 1 , . . ., m b−1 ⊕ y b−1 } equals {0, 0, . . ., 0} or {1, 1, . . ., 1}, and then keep the first bit x 0 and y 0 as the raw key.That is, if all bits in {x 0 , x 1 , . . .x b−1 } and {y 0 , y 1 , . . .y b−1 } are completely the same or different, Alice and Bob will obtain a raw key bit, the corresponding successful probability of which is given by We emphasize that the successful probability p succ can be further improved if Alice and Bob iteratively repeat the advantage distillation protocol on very small blocks.Consequently, the practical QBER value in the Z basis can be reduced from λ 2 + λ 3 to ðλ 2 þλ 3 Þ b p succ , and the quantum state shared between Alice and Bob can be given by 5 Based on the state preparation σAB and the advantage distillation parameter b, the secret key rate R can be modified as the following inequality Note that the advantage distillation protocol can be controlled by Alice and Bob, so they can choose the optimal advantage distillation parameter b to improve the secret key rate.
Security analysis of decoy-state QKD.Firstly, we consider the security analysis of decoy-state QKD without advantage distillation.Combining Eq. ( 13) with the decoy-state method [15][16][17] , the secret key rate with DD-QKD system can be given by where P 1 is the single-photon probability in Alice's signal states, Y 1 is the singlephoton counting rate, Q μ and E μ denote the counting rate and error rate of signal states, Inspired by the information-theoretical security analysis method given by 5 , S(A|E) single photon can be estimated with the following inequality where λ i (i = 0, 1, 2, 3) can be characterized with the following equations ð20Þ where e z 1 , e x 1 and e y 1 are the single-photon error rates in the Z, X and Y bases, which can be estimated with the decoy-state method.
Similarly, by considering the Bell state measurement outcome 1 ffiffi 2 p ð 00 j iþ 11 j iÞ in Charlie's side, the secret key rate with decoy-state MDI-QKD system can be given by R 0 decoy ≥ min λ 0 ;λ 1 ;λ 2 ;λ 3 Q μμ where P 11 is the probability of both Alice and Bob's signal states emitting singlephoton events, Y 11 is the counting rate of both Alice and Bob transmitting singlephoton states, and Q μμ (E μμ ) is the counting rate (error rate) of Alice and Bob's signal states.Similarly, λ i (i = 0, 1, 2, 3) can be characterized with the following equations ð22Þ where e z 11 , e x 11 and e y 11 are the single-photon error rates in the Z, X and Y bases, which can be estimated with decoy-state method.Note that the other three Bell states measurement outcomes can be analyzed similarly.
As for the security analysis of decoy-state with advantage distillation which has been given in Section II, we will not repeated it here.
Simulation method of decoy-state QKD with advantage distillation.To simulate the performance of decoy-state QKD with advantage distillation, we adopt infinite decoy states to precisely estimate channel parameters.Briefly, combining Eq. ( 18) with the advantage distillation method [7][8][9] , the secret key rate with the DD-QKD system can be given in Eq. ( 5).Combining Eq. ( 21) with the advantage distillation method [7][8][9] , the secret key rate with the MDI-QKD system can be given in Eq. ( 6).Compared with the secret key rate without advantage distillation, only the events that all of the b pulses are single-photon states can be used to generate the final secret key, thus the advantage distillation parameter b should be optimized to maximize the final secret key.
By applying the practical DD-QKD experimental parameters 26 listed in Table 1, the secret key rate of decoy-state DD-QKD with advantage distillation can be easily estimated.Similarly, by adopting the simulation model in 36 (see Eqs. ( 2)-( 7) in 36 for details), the secret key rate of decoy-state MDI-QKD with advantage distillation can be easily estimated.

Fig. 1
Fig. 1 Results of the four-state device-dependent quantum key distribution (DD-QKD) protocol with and without advantage distillation.a The relationship between the transmission distance and the secret key rate, the blue line is the secret key rate without advantage distillation (b = 1), while the red line is the secret key rate with the advantage distillation technology (b > 1).b The relationship between the transmission distance and the optimal b values, the advantage distillation technology (b > 1) can improve the secret key rate when the transmission distance is larger than 132 km.

Fig. 2
Fig. 2 Results of six-state device-dependent quantum key distribution (DD-QKD) protocol with and without advantage distillation.a The relationship between the transmission distance and the secret key rate, the blue line is the secret key rate without advantage distillation (b = 1), while the red line is the secret key rate with the advantage distillation technology (b > 1).b The relationship between the transmission distance and the optimal b values, the advantage distillation technology (b > 1) can improve the secret key rate when the transmission distance is larger than 134 km.

Fig. 3
Fig.3Results of four-state measurement-device-independent quantum key distribution (MDI-QKD) protocol with and without advantage distillation.a The relationship between the transmission distance and the secret key rate, the blue line is the secret key rate without advantage distillation (b = 1), while the red line is the secret key rate with the advantage distillation technology (b > 1).b The relationship between the transmission distance and the optimal b values, the advantage distillation technology (b > 1) can improve the secret key rate when the transmission distance is larger than 185 km.

Fig. 4
Fig. 4 Results of six-state measurement-device-independent quantum key distribution (MDI-QKD) protocol with and without advantage distillation.a The relationship between the transmission distance and the secret key rate, the blue line is the secret key rate without advantage distillation (b = 1), the red line is the secret key rate with the advantage distillation technology (b > 1), and the green line is the Pirandola-Laurenza-Ottaviani-Banchi (PLOB) bound.b The relationship between the transmission distance and the optimal b values, the advantage distillation technology (b > 1) can improve the secret key rate when the transmission distance is larger than 189 km.

Àαl 10 η¼ e y 1 ¼ e z 1 ¼ 0 :
D , Y 1 = Y 0 + η, e x 1 5Y 0 þe Det η Y 1 Y 11 is the counting rate of both Alice and Bob transmitting single-photon states, Q μμ (E μμ ) is the counting rate (error rate) of Alice and Bob's signal states, e z 11 , e x 11 are the single-photon error rate in the Z, X and Y bases respectively.Note that, Y 11 , e x 11 , e where P 11 is the probability of both Alice and Bob's signal states emitting single-photon events, 18,27respectively.