Experimental realization of equiangular three-state quantum key distribution

Quantum key distribution using three states in equiangular configuration combines a security threshold comparable with the one of the Bennett-Brassard 1984 protocol and a quantum bit error rate (QBER) estimation that does not need to reveal part of the key. We implement an entanglement-based version of the Renes 2004 protocol, using only passive optic elements in a linear scheme for the positive-operator valued measure (POVM), generating an asymptotic secure key rate of more than 10 kbit/s, with a mean QBER of 1.6%. We then demonstrate its security in the case of finite key and evaluate the key rate for both collective and general attacks.

. This operation corresponds to the random preparation, with equal probability, of one of the three states {|ψ 1 〉 , |ψ 2 〉 , |ψ 3 〉 }, as in the prepare-and-measurement scheme of the R04 described in 9,16 . Bob performs his measurements in the same POVM as Alice {Π i }. After all measurements, Bob and Alice compare the instants of their events, keeping only those where both have a detection within a fixed coincidence window.
Even if they have already exchanged all symbols, Alice and Bob do not share any bit string yet, because each state can mean both 0 or 1. Alice uses a QRNG to choose the bit value for each symbol. The combination of the state and the bit value unambiguously determines the set S i used for that event (for example, if Alice sends |ψ 2 〉 and the QRNG gives 1, the set used for that event is S 1 ). For each event, Alice tells Bob the corresponding set by sending him the value of the index i. Bob uses i to associate ψ ⊥ 2 (for i = 1), ψ ⊥ 3 (for i = 2), and ψ ⊥ 1 (for i = 3) with bit 0, and ψ ⊥ 1 (for i = 1), ψ ⊥ 2 (for i = 2), and ψ ⊥ 3 (for i = 3) with bit 1. All other combinations are marked as inconclusive, since Bob is not able to determine the state sent by Alice. Bob tells Alice which events are inconclusive and they both discard them. They then estimate the quantum bit error rate (QBER) from the fraction of where the first element of each set corresponds to bit 0 and the second to bit 1. The POVM is implemented by using a partially polarizing beam-splitter (pPBS), a half-wave plate (HWP) at 22.5° and a polarizing beam-splitter (PBS).
Scientific RepoRts | 6:30089 | DOI: 10.1038/srep30089 inconclusive events 8,9 , and use this information to distill the key using error correction and privacy amplification 17 . Setup. The experimental setup is shown in Fig. 2. Entangled photon pairs are produced by using a 30 mm periodically poled potassium titanyl phosphate (PPKTP) crystal in a polarization-based Sagnac interferometer 18,19 . The source is pumped with a continuous wave (CW) laser at 404.5 nm, with a power of 3.5 mW. The down-converted photons have a central wavelength of 809 nm, with 0.2 nm full width at half maximum (FWHM), and are collected into single-mode fibres. In this configuration, the setup has a mean coincidence rate of 29 kHz, with a 5% heralding ratio. The fraction of multi-pair over one-pair events, measured by putting one output of the source into a Hanbury-Brown-Twiss interferometer, is ~ 3.10 −3 . Among these events, only those which are partially correlated in the polarization degree of freedom are exploitable by Eve through the photon number splitting (PNS) attack 11 . The ratio of the number of these events to all multi-pair ones is ζ , where τ c = 8 ps is the coherence time of down-converted photons and Δ t = 1.5 ns is the coincidence window. The fraction of correlated multi-photon events over the total number of detection events is ∼ 1.5 · 10 −5 , thus the information leaked to Eve is negligible. A set of two quarter-wave plates (QWP) and one half-wave plate (HWP) is placed at the exit of the fibre at Bob's side in order to compensate polarization rotations induced by fibre birefringence.
The receiving apparatus implementing the POVM {Π i } consists of a partially polarizing beam-splitter (pPBS), that completely transmits the horizontal polarization and has a reflectivity of 66.7% for the vertical polarization, followed by a HWP at θ = 22.5° and a polarizing beam-splitter (PBS). Given an arbitrary input state |φ〉 = α|H〉 + β|V〉 , with |α| 2 + |β| 2 = 1, the pPBS routes it to detector 1 with probability β = P 1 2 3 2 . The s t at e at t h e t r a n s m i t t i n g o u t p u t o f t h e p P B S , α β + H V 1 3 , i s t r a n s f o r m e d i nt o It is easy to check that the above probabilities can be also written as : then, the above described apparatus implements the POVM {Π i }. Photons are detected using silicon single photon counting modules (SPCM), characterized by a dead time of 21 ns and a jitter of ~ 800 ps FWHM. Detection events are time-tagged with a resolution of 81 ps.

Data acquisition.
A two-hour continuous run of the apparatus has led to the exchange of about 10 9 symbols within a coincidence window of 1.5 ns. The events can be described as pairs (Ai, Bj), with i the number of the detector clicking at Alice's side and j the one at Bob's side. Event distribution is shown in Table 1 and Fig. 3. After the collection of all data, a QRNG 20 is used to generate the bit value for each symbol. Coincidence events are then analyzed using the sifting procedure summarized in Table 2. The events of the form (Ai, Bi) are bit errors, while the others are either a "good" conclusive or an inconclusive result according to Alice's choice. The string of conclusive results gives the sifted key, from which a secret key can be distilled using classical post-processing.
Secret key rate. Post-processing consists of a series of passages that transform a partially correlated, partially secret key into a new one Eve has negligible information of 16,17 . The effect of these tasks is a reduction of the number of bits and can be quantified using the secret fraction r, defined as the ratio between secure and conclusive bits 16 . In the asymptotic limit of infinitely long key, the key fraction of the R04 is given by 9 is the binary entropy, Q is the QBER, and f EC = 1.1 is the efficiency of the error correction protocol 21 . The number of secure bits is given by N conc r and, dividing it by the exposure time, the secret key rate is obtained. Figure 4 shows the behavior of the QBER and of the key rate during a two-hour acquisition. The slight reduction in the sifted key rate is probably due to a misalignment in the fibre coupling of the entangled source. The losses can be estimated from the ratio of coincidences over single counts. The measured 5% heralding efficiency corresponds to a total loss level of13 dB, with a contribution of1.5 dB due to the POVM. The QBER is estimated as , where I is the fraction of inconclusive results 9 . The QBER remains almost constant at a level below 2% for all the acquisition, thus confirming the stability of both the source and the POVM {Π i } during the acquisition. The visibility of the source in two mutually unbiased bases at the exit of the Sagnac interferometer, before fibre injection, has been measured to be between 97% and 98%: then the measured QBER level can be attributed almost completely to the source. A small contribution to the QBER is due to the small imbalances between the  In a real scenario, the number of exchanged signals is always finite and the security analysis must take this fact into account. The finite key analysis of the R04 protocol is very similar to the one of the PBC00 10 , the only substantial difference lying in the estimation of the bit error rate. The PBC00 estimates it by comparing part of the sifted key through the public channel, while the R04 use the fraction of inconclusive results. The method is based on the fact that the choice between "good" conclusive and inconclusive results is given by a random event at Alice's side after the exchange of all the qubits, therefore Eve has no way of differentiate between the two and their number is approximately equal 9 . Defining I the fraction of inconclusive results, the fraction of "good" conclusive ones can be written as (1 − Q)(1 − I). Using the Hoeffding bound 22 , the following inequality is valid with probability at  The security parameter of the obtained key is = + + + : where the terms in the right side of the sum are the security parameters for parameter estimation, min-entropy calculation, error correction, and privacy amplification respectively 17 . This result can be extended to the case of general attacks by exploiting the postselection technique 12 , giving 10  . Figure 5 shows the secret key fraction of the R04 protocol in the finite key scenario. For each point, both the QBER and the number of conclusive events is evaluated on the first N exchanged symbols. The secret key fraction is calculated by using equations (5) and (6). For collective attacks, the chosen security parameter is  = ⋅ − 4 10 col 10 , with ε ε ε ε = = = = − 10 EC PA PE 10 . The same value has been chosen for gen  , therefore the term r col of equation (6)  . The plots show that at least 10 4 -10 5 signals are necessary to exchange a key, while already N = 10 6 (slightly more than half a minute at 29 kHz) gives a reasonable key fraction. The difference between the key fraction for collective and general attacks is more marked for lower values of N and tends to disappear for large number of exchanged symbols, where both approach the asymptotic key fraction.

Discussion
In this work, we demonstrated the experimental feasibility of the equiangular three state QKD protocol R04. We showed that the scheme proposed by 15 Saunders et al. for the POVM is suitable for applications in Quantum Key Distribution. State preparation was simplified by using an entanglement-based version of the protocol, with the same POVM at both Alice's and Bob's side. We also showed that the estimation of the bit error rate from inconclusive results is feasible in the finite key scenario. The implemented scheme was demonstrated to be stable and highly reliable, allowing a two-hour data acquisition without any significative change in the QBER value. The performance of the protocol is comparable with the BB84, despite the less efficient parameter estimation, both in the asymptotic limit and for finite key. Its simpler receiving apparatus, requiring only three single photon detectors, makes it a valid alternative to current implementations of QKD based on the BB84 protocol. Finally, this work extends the experimental investigation of equiangular spherical codes to a still uncovered area of quantum information: quantum key distribution.