Realizing the measure-device-independent quantum-key-distribution with passive heralded-single photon sources

In this paper, we put forward a new approach towards realizing measurement-device-independent quantum key distribution with passive heralded single-photon sources. In this approach, both Alice and Bob prepare the parametric down-conversion source, where the heralding photons are labeled according to different types of clicks from the local detectors, and the heralded ones can correspondingly be marked with different tags at the receiver’s side. Then one can obtain four sets of data through using only one-intensity of pump light by observing different kinds of clicks of local detectors. By employing the newest formulae to do parameter estimation, we could achieve very precise prediction for the two-single-photon pulse contribution. Furthermore, by carrying out corresponding numerical simulations, we compare the new method with other practical schemes of measurement-device-independent quantum key distribution. We demonstrate that our new proposed passive scheme can exhibit remarkable improvement over the conventional three-intensity decoy-state measurement-device-independent quantum key distribution with either heralded single-photon sources or weak coherent sources. Besides, it does not need intensity modulation and can thus diminish source-error defects existing in several other active decoy-state methods. Therefore, if taking intensity modulating errors into account, our new method will show even more brilliant performance.

into different species, so that we can possess many input parameters and carry out very accurate estimations for the two-single-photon pulse contributions.
The paper is organized as follow: At the beginning, we present the core idea on how to generate the passive heralded single-photon sources; Second, we propose to implement the passive heralded single-photon sources into the MDI-QKD; Third, we carry out corresponding numerical simulations and compare its performance with other often used decoy-state proposals, e.g., the standard three-intensity decoy-state MDI-QKD using either the HSPS or the WCS. Finally, a summary and outlook are given at the end of the paper.

The passive heralded single-photon sources
Normally, the HSPS can be generated from the parametric down-conversation (PDC) process, which can be either a thermal or poissonian distribution 12 . For simplicity, here we use the poissonian distributed PDC source as an example to describe the scheme. (In the case of thermal distribution, it will show similar behavior). The PDC process can generate a squeezed two-mode field, each denoted as the idler mode (I mode) and the signal mode (S mode) individually. The two-mode field can be written as: Ψ = ∑ = ∞ n n P n IS 0 n I S , where |n〉 represents an n-photon state, µ = µ µ − P e ( ) n n ! n , and μ is the average photon number per time slot. In most former HSPS schemes, the idler mode is often locally detected with a photon diode at the sender's side, and the signal mode is encoded with useful information and sent to the receiver through the quantum channel. Meanwhile, the sender delivers a synchronization signal to the receiver whenever the local phot-diode clicks. This is the so-called HSPS. However, below we will configure the devices in a different manner.
The schematic setup of our new scheme on generating the passive HSPS is shown in Fig. 1, where the most important change is to split the idler mode into two paths and then send each into a local single-photon detector (A 1 and A 2 ) separately. In all, the click events in the two local detectors may consist of four kinds of possibilities, each denoted as X i (i = 1, 2, 3, 4): (1) Non-clicking; (2) Only one clicking at A 1 ; (3) Only one clicking at A 2 ; (4) Clicking at both A 1 and A 2 .
We define P n X i as the probability of the X i events occurring if given an n-photon state in the idler mode. Then the signal state will be projected into ρ = ∑f n n P n n X i (un-normalized), where f n is the photon-number distribution in the S mode. In the following, let's derive the construction of the X i event. To simplify the description, let's begin with perfect detector efficiency for A 1 and A 2 , and we will deal a bit later in the manuscript with non-unity detector efficiency by assuming "imaginary beam splitters".
First, we denote P s s as the probability of the X i event occurring given a s s 1 2 projection state. For a vacuum projection state, the corresponding local detector will click with a probability of d i (the dark count rate), and non-clicking with a probability of (1 − d i ). While for a non-vacuum projection state, the local detector will surely click with 100% probability. We can then list all the probabilities of the four (X i ) events taking place as shown in Table 1.
Second, we define P s s n 1 2 as the probability of projecting an n-photon state into state s s 1 2 . For an n-photon number state, after passing through a beam-splitter (BS) in the idler mode, it is changed into: where the right side of the equation follows a binomial distribution, and C n k is the binomial coefficient, defined as = − C : ; T 2 represents the transmission efficiency of the BS, denoted as t; R 2 corresponds to the reflection efficiency, denoted as (1 − t).
As illustrated in Fig. 1, after the first BS we combine the coupling efficiency and detection efficiency in each path, and treat it as the transmission efficiency (η i , i = 1, 2) of an imaginary beam-splitter (IBS), and the loss corresponds to the reflection efficiency (1 − η i ). After passing through the two IBSs, only the transmitted photons are collected. Now the state can be expressed as: . Then we can get the corresponding projection probability as: For any input n-photon state, the probability of occurring the X i heralding event can be written as: The corresponding heralded signal state is : n s s n s s s s n , , 2 12 where the analysis of P s s can be found in Table 1, and P s s n 1 2 has been formulated in Eq. (3). Now with the above, we can do the calculation for any X i event and any quantum efficiency.
In the following, we will denote the above X 1 , X 2 and X 3 events as the x, y and z state respectively. Correspondingly, in the photon-number space, we have ρ = ∑ ξ ξ P n n n n , with = ξ P f P n n n x i , (ξ = x, y, z). According to Eqs (1-5), we get the simplified photon-number distribution for the x, y and z state as (1 ) With the conditions above, we get the following inequalities: For further discussion, we define another useful quantity See the "Proof " section for the detailed proof. With the two inequalities, one can directly apply Wang's formulas for the yield and phase-flip rate of single-photon pairs in ref. 25.

Implementing the passive HSPS into the MDI-QKD
The MDI-QKD was designed to remove all possible side-channel attacks and show attractive performance in real-life implementation. In MDI-QKD, both Alice and Bob send signals to an untrusted third party (UTP), Charlie. After a Bell state measurement, Charlie announces whether the measurement is successful. Then the successful event will be employed for key distribution. In order to make the MDI-QKD more practical, usually a decoy-state method is implemented in parallel. In most other schemes, it requires both Alice and Bob to randomly modulate their signal light into different intensities, and then do estimations with corresponding successful events. While here in our new scheme, only one-intensity signal light is applied at either Alice or Bob's side, and then process parameter estimations by considering different counting events conditional on case X i (i = 1, 2, 3, i.e., x, y and z state) as introduced above. The schematic experimental setup of the scheme is shown in Fig. 2.
In fact, the security of our proposal is equivalent to the processes as following: First, both Alice and Bob send out all heralded signal pulses (signal mode), and the UTP records all the successful counting events by do projecting measurement; Second, Alice and Bob start to send out heralding signals from local detectors, and correspondingly the UTP can divide all the successful counting events into different species (signal states or decoy states) and marked with different tags; Third, the UTP announce the tags of each successful event, and the legitimate users apply corresponding bit-flip operations and get the raw keys; Moreover, error correction and privacy amplification processes are carried out; Finally, people carry out parameter estimation processes. From the above, we find that during the signal transmission Eve is unable to judge which is the signal state and which is the decoy state, and has to apply the same attack strategy on all the pulses (signal state and decoy state), and his eavesdropping will certainly be discovered by the legitimate users by error tests.
In this scheme, for simplicity, we assume both Alice and Bob possess the same passive setup for signal generation. Then each of them can send out signals with x, y and z state individually. Whenever Alice sends out an α state and Bob sends out a β, with α, β ∈ (x, y, z), the average counting rate ( α β Q , W ) and the mean quantum-bit , can be written as:   (9) and (10), we can immediately get the lower-bound of the counting rate for the two-single-photon pulses (Y L 11 ) as L 11 Similarly, we can get the upper bound of the quantum-bit error-rate for the two-single-photon pulses (e U 11 ) 25 : where γ = P P P G(1, 2, 3) z z z 1 2 3 , for ξ ∈ (x, y, z), , . In the new scheme, the Z-basis is used for key generation, and the X-basis is for error testing. From Eqs (14) and (15), we can obtain the lower-bound for the yield of two-single-photon pulses in the Z basis (Y Z L 11 , ) and the upper-bound for the quantum-bit error-rate of two-single-photon pulses in the X basis (e X U 11 , ). Moreover, the average counting rate and the mean quantum-bit error-rate can be observed experimentally. With all the above, we can calculate the secure key generation rate with the following formula: where f is the error correction efficiency, and here we take f = 1.16 16 . To simplify the calculation, we only use the y and z state for the key distillation. In fact, all the four kinds of events (X i , i = 1, 2, 3, 4) can be used to distill the final keys. That means the performance of the new scheme should be even better when taking all the successful events into consideration.

Numerical simulation
With the formulae above, we can perform a numerical simulation for our new passive scheme on the decoy-state MDI-QKD, and further compare its performance with other practical methods, e.g. the conventional three-intensity decoy-state MDI-QKD using either WCS or HSPS 17,22 . In real-life experiment, the average gains and the average quantum-bit error-rates can be directly measured. While in numerical simulations, we should use a reasonable model to predict what should probably be observed in experiment. By referring the linear model in ref. 19, we can give a prediction for the probably observed values of the gains and the quantum-bit error-rates. For fair comparison, we assume the same parameters as in refs 16 and 18 in our simulation, see Table 2.
In the source generation part, the non-degenerate parametric down-conversion process is often used to generate non-degenerated photon pairs, e.g., one is within the telecommunication wavelength range suitable for fiber transmission, and the other is within the visible wavelength range, convenient for detection. Therefore, it is reasonable to assume the local detectors with a detection efficiency of 75%, and a dark count rate of 10 −6 (commercial products SPCM-NIR-16 or SPCM-AQRH-16 APD) 25 . Corresponding simulation results have been displayed in Figs 3, 4, 5 and 6.
In Fig. 3, we compare the estimation value for the quantum-bit error-rate of two-single-photon pulses (e X 11 ) among our new scheme (H 1 ), the conventional three-intensity decoy-state MDI-QKD using HSPSs (H 3 ) 22 and the standard three-intensity decoy-state MDI-QKD using WCSs (W 3 ) 17 . We can find from Fig. 3 that, our new scheme shows significantly lower bound of the e 11 than the other two schemes, which is on one hand due to the many kinds of successful counting events, and on the other hand owning to the usage of the newest estimating formula, Eq. (15).
The comparison of Y 11 in the Z basis between the above three methods is shown in Fig. 4. The conventional three-intensity decoy-state MDI-QKD using the HSPS (H 3 ) and using the WCS (W 3 ) shows a similar level of Y Z 11 . In contrast to them, the new proposed passive MDI-QKD (H 1 ) obviously exhibits higher values.
In Fig. 5, we show a comparison for the optimal intensity of the signal state (μ) for different kinds of methods. Compared with the other two lines (W 3 and H 3 ), our new passive scheme (H 1 ) presents superior values from the beginning to the end.
Moreover, we show a comparison for the key generation rate (R) for our new passive scheme(H 1 ), for the standard three-intensity decoy-state MDI-QKD using HSPSs (H 3 ), and for the conventional three-intensity decoy-state MDI-QKD using WCSs (W 3 ), see Fig. 6(a). Compared with the other two proposals, the performance η C d C e d e 0 γ 14.5% 3.0 × 10 −6 1.5% 0.5 0.2 dB/km Table 2. Parameters values for simulations. η C and d C are the detection efficiency and dark count rate at the UTP's side; e d is the probability that the survived photon hits the wrong detector, which is independent of the transmission distance, and e 0 is the error rate of dark count; γ is the channel loss constant. of our new scheme has drastically improved both the transmission distance and the final key generation rate. For a more vivid comparison, we also calculate the relative key generation rate between our new passive scheme and the other two three-intensity decoy-state methods, see the left and right axes in Fig. 6(b), respectively. We find that compared with the standard three-intensity decoy-state MDI-QKD using HSPSs, our new passive scheme can obtain more than five times enhancement in the key generation rate at long distances (> 200 km). While compared with the conventional three-intensity decoy-state MDI-QKD using WCSs, it can exhibit more than 100% enhancement in the key generation rate, and achieve more than 100 km longer transmission distance.

Conclusion
In summary, we have introduced a new protocol for the measurement-device-independent quantum-keydistribution with heralded single-photon sources involving only one-intensity decoy state. The key features are: At the source generation part, we split the triggering signals and send into different local detectors. By recording different kinds of detection events in the local detectors, we can divide the triggered events into different species at the receiver's side. Moreover, during parameter estimations, we have implemented the newest formulae, i.e., Eqs (14) and (15) to give an upper or lower bound for the counting rate and the quantum-bit error-rate of two-single-photon pulses. Consequently, we obtain many input parameters and can do very accurate estimations for the two-single-photon pulse contributions. Furthermore, by carry out corresponding numerical calculations, we compare the new scheme with other often used three-intensity decoy-state methods, demonstrating that the new proposed approach could exhibit outstanding performance among those compared.
Besides, we should declare that if we take the source errors into consideration, the new proposed passive scheme will exhibit even predominant capability than those active decoy-state methods. Because no intensity modulator is applied in our new scheme, and thus avoids source uncertainties. These unfortunately exist in other  two-, three-, or four-intensity decoy-state methods. Therefore, it may be a promising candidate for the implementation of quantum key distribution in the near future.
In addition, we have noted that recently a new novel four-intensity decoy-state protocol [Phys. Rev. A 93, 042324 (2016)] have been proposed by Wang et al. 29 , which shows excellent performance when accounting for statistical fluctuation and using biased basis. It should be interesting to implement their method into our present passive scheme which deserves further study in our future research.

Proof
In order to demonstrate inequality (10), which states that ⩾ G i j k ( , , ) 0, when − − ⩾ ⩾ k j j i 0, we recall that the Vandermonde determinant defined as satisfies V n > 0 for any 0 < γ 1 < γ 2 < ··· < γ n , which follows from V n = Π i<j (γ j − γ i ). Now we establish the result which will be used in deriving inequality (10) satisfies D n > 0 for any 0 < γ 1 < γ 2 < ··· < γ n and λ λ λ To establish this, we proceed by induction method. First, it is clear that D 1 > 0. Now assume that D n−1 > 0, we will show that D n > 0. Note that in order to show that D n > 0, we may assume without loss of generality that λ 1 = 0, and only consider D n of the following form We will show that D n > 0 for λ λ λ < < <  ⩽ 0 which is positive by assumption.
With the above preparation, we proceed to prove inequality (10). As introduced above, in the new passive decoy-state scheme, Bob's counting events can be divided into four species by conditioning them on Alice's heralding events X i , (i = 1, 2, 3 and 4). The first three have been denoted as states x, y and z respectively, and their photon-number distribution can be written as in Eq. (6). By substituting Eq. (6) into condition (10), we obtain