 Research
 Open access
 Published:
Secret key rate bounds for quantum key distribution with faulty active phase randomization
EPJ Quantum Technology volume 10, Article number: 53 (2023)
Abstract
Decoystate quantum key distribution (QKD) is undoubtedly the most efficient solution to handle multiphoton signals emitted by laser sources, and provides the same secret key rate scaling as ideal singlephoton sources. It requires, however, that the phase of each emitted pulse is uniformly random. This might be difficult to guarantee in practice, due to inevitable device imperfections and/or the use of an external phase modulator for phase randomization in an active setup, which limits the possible selected phases to a finite set. Here, we investigate the security of decoystate QKD when the phase is actively randomized by faulty devices, and show that this technique is quite robust to deviations from the ideal uniformly random scenario. For this, we combine a novel parameter estimation technique based on semidefinite programming, with the use of basis mismatched events, to tightly estimate the parameters that determine the achievable secret key rate. In doing so, we demonstrate that our analysis can significantly outperform previous results that address more restricted scenarios.
1 Introduction
Quantum key distribution (QKD) is a method for securely establishing symmetric cryptographic keys between two distant parties (socalled Alice and Bob) [1–3]. Its security is based on principles of quantum mechanics, such as the nocloning theorem [4], which guarantee that any attempt by an eavesdropper (Eve) to learn information about the distributed key inevitably introduces detectable errors. Importantly, when combined with the onetimepad encryption scheme [5], QKD provides informationtheoretically secure communications.
The field of QKD has made much progress in recent years, both theoretically and experimentally, leading to the first deployments of metropolitan and intercity QKD networks [6–9]. Despite these remarkable achievements, there are still certain challenges that need to be overcome for the widespread adoption of this technology. One of these challenges is to close the existing security gap between theory and practice. This is so because QKD security proofs, typically consider assumptions that the actual experimental implementations do not satisfy. Such discrepancies could create security loopholes or socalled side channels, which might be exploited by Eve to compromise the security of the generated key without being detected.
Indeed, practical QKD transmitters usually emit phaserandomized weak coherent pulses (PRWCPs) generated by laser sources. These pulses might contain more than one photon prepared in the same quantum state. In this scenario, Eve is no longer limited by the nocloning theorem, because multiphoton signals provide her with perfect copies of the signal photon. As a result, it can be shown that the secret key rate of the BB84 protocol [10] with PRWCPs scales quadratically with the system’s transmittance due to the photonnumbersplitting (PNS) attack [11, 12]. This attack provides Eve with full information about the part of the key generated with the multiphoton pulses, without introducing any error.
To overcome this limitation, the most efficient solution today is undoubtedly the decoystate method [13–15], in which Alice varies at random the intensity of the PRWCPs that she sends to Bob. This allows them to better estimate the behavior of the quantum channel. Indeed, using the observed measurement statistics associated to different intensity settings, Alice and Bob can tightly estimate the yield and phase error rate of the singlephoton pulses, from which the secret key is actually distilled. As a result, the decoystate method delivers a secret key rate that scales linearly with the channel transmittance [13–16], matching the scaling achievable with ideal singlephoton sources. This technique has been extensively demonstrated in multiple recent experiments [17–23], including satellite links [24, 25] and the use of photonic integrated circuits [26–29]. Also, decoystate QKD setups are currently offered commercially by several companies [30–34], which highlights its importance.
Importantly, standard decoystate security proofs assume perfect phase randomization, i.e., that the phase, θ, of each generated WCP is uniformly random in \([0,2\pi )\). That is, its probability density function (PDF), \(g(\theta )\), should satisfy \(g(\theta )=1/2\pi \). However, none of the two main methods used today to generate PRWCPs, namely passive and active, fulfill this condition exactly. In the passive scheme a technique known as gainswitching is used to effectively turn the laser on and off between pulses. However, in these configurations [20, 22, 23, 35–38], device imperfections can prevent the phases θ from being uniformly distributed. In the active scheme [26, 27, 39, 40], an external phase modulator is used to imprint one of N possible random values to the phase of each pulse, such that only a discrete number of phases is selected. Both scenarios violate a crucial assumption of the decoystate technique.
The security of QKD with imperfect passive phase randomization has, under certain assumptions, been recently demonstrated in [41]. This analysis however, is not applicable to the numerous existing active setups that rely on an external phase modulator for phase randomization .^{Footnote 1} The security of the latter approach has been analyzed in [42] (see also [43]), but these works restrict themselves to the case in which the discrete random phases are evenly distributed in \([0,2\pi )\), i.e., they assume that \(g(\theta )\) satisfies
where \(\delta (x)\) represents the Dirac delta function, and \(\theta _{k}=2 \pi k/N\), with N being the total number of selected phases. Under this assumption, [42] shows that it is possible to approximate the secret key rate achievable in the ideal situation where \(g(\theta )=1/2\pi \), with around \(N=10\) random phases. While this result is remarkable, in practice, inevitable imperfections of the phase modulator and electronic noise might prevent the phases θ from being exactly evenly distributed, thus invalidating the application of the results presented in [42] to a real setup.
The main contributions of this paper are as follows. First, we introduce an analysis that can be applied in the more realistic and practical scenario in which \(g(\theta )\) is an arbitrary PDF, due to imperfections in the active phase randomization process, and we provide asymptotic secret key rates for this general situation, thus filling an important gap in the literature.
Second, we show that this analysis can be applied in the scenario in which the PDF \(g(\theta )\) is not fully characterized. This feature significantly simplifies the applicability of our results to a practical setup, where an accurate characterization of the PDF describing the phase might be challenging.
Third, we make a noteworthy finding regarding the utilization of basis mismatched events which are typically discarded in QKD security analyses, including that in [42]. The use of basis mismatched events is already known to provide a keyrate advantage in the presence of bitandbasis encoding flaws [44] but here, we show that they can also be advantageous in the presence of imperfections due to a faulty phase randomization process. We believe that this additional result is highly nontrivial as intuitively the decoy state method has no relation with the state preparation flaw in encoding the bit information.
Fourth, when considering the ideal discretephaserandomization case described by Eq. (1), our analysis delivers considerably higher secret key rates than those provided by the seminal work in [42], or to put it in other words, it requires to spend fewer random bits for phase selection to achieve an equivalent performance.
As a side remark, we note that our results are also useful for other quantum communication schemes that go beyond QKD and employ laser sources, as they often rely on decoystates with active phase randomization.
Finally, it is worth mentioning that, although, for simplicity, in our derivations we consider collective attacks, our analysis can be lifted to general attacks by applying the extension of the quantum de Finetti theorem [45] to infinitelydimensional systems [46]. Because of this, the asymptotic key rates that we derive in this paper are also valid against general attacks.
The paper is organized as follows. In Sect. 2.1, we describe the quantum states emitted by Alice when θ follows an arbitrary PDF, \(g(\theta )\). Then, in Sect. 2.2 we introduce the decoystate protocol considered, together with its asymptotic secret key rate formula. Next, in Sect. 2.3, we present the parameter estimation technique based on SDP, as well as on the use of basis mismatched events, to calculate the different parameters required to evaluate the secret key rate. Then, in Sect. 3 we simulate the achievable secret key rate for various functions \(g(\theta )\) of practical interest, both for the cases in which this function is fully (or only partially) characterized. Section 4 concludes the paper with a summary. The paper includes as well some Appendixes with additional calculations.
2 Methods
2.1 Phase randomization with an arbitrary \(g(\theta )\)
In this section, we describe the quantum states emitted by Alice when each of them has a phase θ that follows an arbitrary PDF, \(g(\theta )\).
In particular, a WCP of intensity μ and phase θ can be written in terms of the Fock basis as
where \(n\rangle \) represents a Fock state with n photons.
If Alice selects the phase θ of each generated signal independently and at random according to \(g(\theta )\), its state is simply given by
with \({\hat{P}}(\phi \rangle )=\phi \rangle \langle \phi \).
Any quantum state can always be diagonalised in a certain orthonormal basis. For the states given by Eq. (3), we shall denote the elements of such basis by \(\psi _{n, \mu , g(\theta )}\rangle \), since, in general, they might depend on both the intensity μ and the function \(g(\theta )\). Here, the subscript n simply identifies the different elements of the basis, which are not necessarily the Fock states. This means, in particular, that we can rewrite the states given by Eq. (3) as follows
where the coefficients \(p_{n \mu , g(\theta )}\geq{}0\) satisfy \(\sum_{n=0}^{\infty} p_{n \mu , g(\theta )}=1\). That is, these coefficients can be interpreted as the probability with which, in a certain time instance, Alice emits the state \(\psi _{n, \mu , g(\theta )}\rangle \), given that she chose the intensity μ and θ follows the PDF \(g(\theta )\).
For instance, in the ideal scenario where \(g(\theta )\) is uniformly random in \([0,2\pi )\), the emitted signals are a Poisson mixture of Fock states given by
i.e. \(p_{n \mu , 1/2\pi}=e^{\mu}\mu ^{n}/(n!)\) and \(\psi _{n, \mu , 1/2\pi}\rangle =n\rangle \).
2.2 Protocol description and key generation rate
For concreteness, we shall assume that Alice and Bob implement a decoystate BB84 scheme with three different intensity settings \(\{s, \nu , \omega \}\) in each basis, with \(s>\nu >\omega \geq{}0\). Moreover, we consider that they generate secret key only from those events in which both of them select the Z basis and Alice chooses the signal intensity setting s. This is the most typical configuration of the decoystate BB84 protocol. We remark, however, that the analysis below could be straightforwardly adapted to other protocol configurations, or to other combinations of intensity settings.
In each round of the protocol, Alice probabilistically chooses a bit value \(b\in \{0,1\}\) with probability \(p_{b}=1/2\), a basis \(\alpha \in \{Z,X\}\) with probability \(p_{\alpha}\), an intensity value \(\mu \in \{s, \nu , \omega \}\) with probability \(p_{\mu}\), and a random phase θ according to the PDF given by \(g(\theta )\). Then, she generates a WCP of intensity μ and phase θ, \(\sqrt{\mu}e^{i \theta}\rangle \), and applies an operation that encodes her bit and basis choices b and α into the pulse. From Eve’s perspective, these states are described by Eq. (4) due to her ignorance about the selected phase θ. On the receiving side, Bob measures each arriving signal using a basis \(\alpha \in \{Z,X\}\), which he selects with probability \(p_{\alpha}\). We shall assume the basis independent detection efficiency condition throughout the paper. That is, the probability that Bob obtains a conclusive measurement outcome does not depend on his basis choice.
Once the quantum communication phase of the protocol ends, Alice and Bob broadcast (via an authenticated classical channel) both the intensity and basis settings selected for each detected signal. The results related to those detected signals in which both of them used the Z basis with intensity setting s constitute the sifted key. For the detected rounds in which Bob chose the X basis, Alice reveals her bit values b and Bob announces his corresponding measurement outcomes. This data is used for parameter estimation, i.e., to determine the relevant quantities needed to evaluate the secret key rate formula. Finally, Alice and Bob apply error correction and privacy amplification to the sifted key to obtain a final secret key, following the standard postprocessing procedure in QKD [1–3]. For a more detailed description of the protocol steps of a decoystate BB84 scheme, we refer the reader to e.g. [16].
In the ideal scenario where \(g(\theta )=1/2\pi \), Alice’s state preparation process is equivalent to emitting Fock states \(n\rangle \) with a Poisson distribution of mean equal to the intensity setting μ selected, as shown by Eq. (5). In this situation, both the singlephoton and vacuum pulses with the intensity setting s contribute to secret bits [47]. The multiphoton signals are insecure due to the PNS attack. Similarly, when θ follows an arbitrary PDF, \(g(\theta )\), and Alice chooses the intensity setting μ, from Eq. (4) we have that her state preparation process is equivalent to generating pure states \(\psi _{n, \mu , g(\theta )}\rangle \) with probability \(p_{n \mu , g(\theta )}\). The closer the function \(g(\theta )\) is to a uniform distribution, the closer the signals (probabilities) \(\psi _{n, \mu , g(\theta )}\rangle \) (\(p_{n \mu , g(\theta )}\)) are to the Fock states \(n\rangle \) (probabilities \(e^{\mu}\mu ^{n}/n!\)). In this scenario, Alice and Bob can in principle distill secret bits from any \(\psi _{n, \mu , g(\theta )}\rangle \) with \(\mu =s\), though the main contribution would mainly arise from those with indexes \(n=0,1\), which are the ones closer to vacuum and singlephoton pulses. These are the contributions that we consider below. Indeed, for the examples studied in Sect. 3, we have tested numerically that the improvement in key rate that can be obtained when considering \(n>1\) is negligible.
This means that, in this imperfect state preparation scenario, the asymptotic secret key rate formula for the decoystate BB84 protocol considered can be written as [15, 47, 48]
where \(Y_{n, s, g(\theta )}^{Z}\) denotes the yield associated to the state \(\psi _{n, s, g(\theta )}\rangle \) encoded (and measured) in the Z basis, i.e., the probability that Bob observes a detection click in his measurement apparatus conditioned on Alice and Bob selecting the Z basis and Alice preparing the state \(\psi _{n, s, g(\theta )}\rangle \); the parameter \(e_{n, s, g(\theta )}\) represents the phase error rate of these latter signals; \(h(x)=x\log _{2}{(x)}(1x)\log _{2}{(1x)}\) is the binary Shannon entropy function; the quantity f is the efficiency of the error correction protocol; \(Q_{s, g(\theta )}^{Z}\) is the overall gain of the signals emitted conditioned on Alice selecting the intensity s and Alice and Bob choosing the Z basis, i.e., the probability that Bob observes a detection click conditioned on Alice sending him such signals; and \(E_{s, g(\theta )}^{Z}\) is the overall quantum bit error rate (QBER) associated to these latter signals. Moreover, in Eq. (6), the superscript L (U) refers to a (an) lower (upper) bound.
The quantities \(Q_{s, g(\theta )}^{Z}\) and \(E_{s, g(\theta )}^{Z}\) are directly observed in the experiment. In principle, the probabilities \(p_{n s, g(\theta )}\) could also be known, and depend on the state preparation process. However, in practice it might be difficult to find their value analytically. Instead, in the next section we present a simple method to obtain a lower bound, \(p_{n s, g(\theta )}^{\mathrm{L}}\), on these quantities. There, we also explain how to estimate the parameters \(Y_{n, s, g(\theta )}^{Z, \mathrm{L}}\) and \(e_{n, s, g(\theta )}^{\mathrm{U}}\), with \(n=0,1\), which are needed to evaluate Eq. (6).
2.3 Parameter estimation
The parameter estimation procedure presented here is an adaptation of the one very recently introduced in [41] in the context of phase correlations in a passive randomization setup. For simplicity, below we introduce the main results and refer the reader to Appendixes A and B for the detailed derivations.
2.3.1 Lower bound on the yields \(Y_{n, s, g(\theta )}^{Z}\)
In Appendix A it is shown that a lower bound on the yields \(Y_{n, s, g(\theta )}^{Z}\) can be obtained by solving the following SDP:^{Footnote 2}
The states \(\psi _{n, s, g(\theta )}\rangle \) and \(\rho ^{\mu}_{[g(\theta )]}\) are known in principle but inaccessible and depend on the intensity setting selected by Alice and on the function \(g(\theta )\). Also, as already mentioned, the gains \(Q_{\mu , g(\theta )}^{Z}\) are directly observed experimentally in a realization of the protocol. That is, the only unknown in Eq. (7) is the positive semidefinite operator \(J_{Z}\) over which the minimization takes place. Let \(J_{Z}^{*}\) denote the solution to the SDP given by Eq. (7). Then, we find that
2.3.2 Upper bound on the phaseerror rates \(e_{n, s, g(\theta )}\)
The phaseerror rates, \(e_{n, s, g(\theta )}\), are defined by means of a virtual protocol [49]. For this, we shall consider the standard assumption in which the efficiency of Bob’s measurement is independent of his basis choice. Then, for those rounds in which both Alice and Bob select the Z basis and Alice generates the nth eigenstate \(\psi _{n, s, g(\theta )}\rangle \), we can equivalently describe her state preparation process as follows. First, she prepares the following bipartite entangled state
where \(\hat{V}_{b_{\alpha}}\), with \(b=0,1\) and \(\alpha \in \{Z,X\}\), denotes the encoding operation corresponding to the α basis and the bit value b. Although our analysis is valid for any \(\{\hat{V}_{b_{\alpha}}\}\), for simplicity, in our simulations, we assume that these operators, are ideal BB84 encoding operators, given by \(\hat{V}_{0_{Z}}n\rangle =n\rangle 0\rangle , \hat{V}_{1_{Z}}n \rangle =0\rangle n\rangle \),
We note that these operators are independent of the physical degree of freedom used for the encoding. For example, in a timebin encoding setup, the first ket would represent the early time bin, and the second ket would represent the late time bin; while in a polarizationencoding setup, the first ket would represent the horizontallypolarized mode, and the second ket would represent the verticallypolarized mode.
Next, she measures her ancilla system A in Eq. (9) in the orthonormal basis \(\{0_{Z}\rangle , 1_{Z}\rangle \}\) to learn the bit value encoded, and sends the other system to Bob, who measures it in the Z basis.
In this situation, the phaseerror rate \(e_{n, s, g(\theta )}\) corresponds to the bit error rate that Alice and Bob would observe if Alice (Bob) instead performed an X basis measurement on the ancilla system A (arriving signal). If Alice performs a X basis measurement on her system A, this is equivalent to emitting the states
with probability \(p^{\mathrm{virtual}}_{\Delta , n, s, g(\theta )}=\\bar{\lambda}^{ \mathrm{virtual}}_{\Delta , n, s, g(\theta )}\rangle \^{2}\), where \(\Delta \in \{0,1\}\) and \(\Delta _{X}\rangle = [0_{Z}\rangle +(1)^{\Delta}1_{Z} \rangle ] / \sqrt{2}\). Let \(Y_{\Delta , n, s, g(\theta )}^{ (\Delta \oplus 1)_{X}, \mathrm{virtual}}\) denote the probability that Bob obtains the measurement outcome \((\Delta \oplus 1)_{X}\) when he performs an X basis measurement on the arriving signal conditioned on Alice emitting the state \(\lambda ^{\mathrm{virtual}}_{ \Delta , n, s, g(\theta )}\rangle \). That is, this event corresponds to a phase error. Then, the phase error rate \(e_{n, s, g(\theta )}\) can be written as
In Appendix A, it is shown that an upper bound on the quantity \(p^{\mathrm{virtual}}_{\Delta , n, s, g(\theta )}Y_{\Delta , n, s, g( \theta )}^{ (\Delta \oplus 1)_{X}, \mathrm{virtual}}\) can be obtained by solving the following SDP:
where \(\rho ^{\mu}_{[g(\theta )]}\) is given by Eq. (4), and \(Q_{\mu , g(\theta ), b_{\alpha}}^{(\Delta \oplus 1)_{X}}\) denotes the probability that Bob observes the result \((\Delta \oplus 1)_{X}\) with his X basis measurement given that Alice chose the intensity setting μ, the basis α, the bit value b, and the phases θ follow the PDF \(g(\theta )\). We note that Eq. (13) includes constraints provided by basis mismatched events [44] in which Alice prepares the signals in the Z basis and Bob measures them in the X basis, which may result in a tighter estimation. This is because, in general, \(\lambda _{\Delta , n, s, g(\theta )}^{\text{virtual}}\rangle \neq \hat{V}_{\Delta _{X}}\psi _{n, s, g(\theta )}\rangle \), and \({\hat{P}}(\lambda ^{\text{virtual}}_{\Delta , n,s, g(\theta )})\) may be better approximated by an operatorform linear combination of both Zencoded and Xencoded states, rather than just the latter.
Importantly, the states \(\bar{\lambda}^{\text{virtual}}_{\Delta , n, s, g(\theta )}\rangle \) and \(\rho ^{\mu}_{[g(\theta )]}\), as well as the operators \(\hat{V}_{b_{\alpha}}\), are known and depend on Alice’s state preparation process. The gains \(Q_{\mu , g(\theta ), b_{\alpha}}^{(\Delta \oplus 1)_{X}}\) are directly observed in a realization of the protocol. That is, the only unknown in Eq. (13) is the positive semidefinite operator L over which the maximization takes place.
Let \(L_{(\Delta \oplus 1)_{X}}^{*}\) denote the solution to the SDP given by Eq. (13). Then, we have that
That is,
2.3.3 Solving Eqs. (7)–(13) numerically
Solving numerically the SDPs presented above is difficult for two main reasons. Firstly, they are infinitely dimensional, because the states \(\rho ^{\mu}_{[g(\theta )]}\) are infinitedimensional. Secondly, this also renders the calculation of the eigendecomposition of \(\rho ^{\mu}_{[g(\theta )]}\) given by Eq. (4) a difficult task. To overcome these two limitations, we follow a technique recently introduced in [50] (see also [51]), which consists in projecting the states \(\rho ^{\mu}_{[g(\theta )]}\) onto a finitedimensional subspace that contains up to M photons. We shall denote the projected states as
where \(\Pi _{M}=\sum_{n=0}^{M}{n}\rangle \langle{n}\) denotes the projector onto the Mphoton subspace, being \({n}\rangle \) a Fock state. In doing so, now the eigendecomposition of \(\rho ^{\mu}_{[g(\theta )], M}\) can be easily obtained numerically. For later convenience, we will denote the eigendecomposition of the numerator of the right hand side of Eq. (16) as
Importantly, this technique also allows to transform the infinitedimensional SDPs given by Eqs. (7)–(13) onto finitedimensional SDPs that can be solved numerically. The resulting SDPs and their derivation are provided in Appendix B.
2.3.4 Lower bound on the probabilities \(p_{n s, g(\theta )}\)
As explained in the previous subsection, because the states \(\rho ^{\mu}_{[g(\theta )]}\) are infinitedimensional, it might be difficult to calculate their eigendecomposition, and thus the probabilities \(p_{n s, g(\theta )}\). Instead, here we provide a lower bound on these probabilities based on the eigendecomposition given by Eq. (17). In particular, in Appendix B it is shown that
with \(\epsilon _{s}=2 \sqrt{1\operatorname{Tr} [\Pi _{M} \rho ^{s}_{[g( \theta )]} \Pi _{M} ]}\).
3 Results
In this section, we now evaluate the secret key rate obtainable for various examples of functions \(g(\theta )\). For illustration purposes, we consider three main scenarios, depending on whether or not the function \(g(\theta )\) is fully characterized. Also, for the simulations, we consider a simple channel model whose transmission efficiency is given by \(10^{\frac{\gamma}{10}}\), where γ (measured in dB) represents the overall system loss, i.e., it also includes the effect of the finite detection efficiency of Bob’s detectors. Moreover, for simplicity, we disregard any misalignment effect, and assume that the only source of errors are the dark counts of Bob’s detectors, whose probability is set to \(p_{d}=10^{8}\) [23, 52]. In addition, as already mentioned, we consider that the BB84 encoding operators are ideal even though the analysis presented here is applicable if this condition is not met, and we take an error correction efficiency \(f=1.16\).
To obtain the bounds \(Y_{n, s, g(\theta )}^{Z, \mathrm{L}}\) and \(e_{n, s, g(\theta )}^{\mathrm{U}}\) we use the finitedimensional versions of the SDPs above, which are presented in Appendix B. Note that, the resulting secret key rate is an increasing function of M. However, the time required to numerically solve such SDPs grows rapidly with this parameter. For this reason, we have set a sufficiently large M so that an increase in this parameter would result in a negligible improvement of the secret key rate as tested numerically. The effect that the parameter M has in the secret key rate, is studied in Appendix D.
3.1 Fullycharacterized \(g(\theta )\)
Here, we consider the scenario in which the function \(g(\theta )\) is completely characterized, and we evaluate two specific examples of practical interest. The first example corresponds to the scenario given by Eq. (1), which has been considered in [42], while the second example can be interpreted as a noisy version of the first one.
3.1.1 Ideal discrete phase randomization
The results are shown in Fig. 1 for different values of the total number of random phases N selected by Alice. In particular, the solid lines in the figure have been obtained using the parameter estimation procedure presented in Sect. 2.3 based on SDP and the use of basis mismatched events. If we discard these latter events, the obtainable key rate decreases, as illustrated by the dasheddot lines. Finally, the dotted lines correspond to the analysis in [42]. For completeness, this latter approach is summarized in Appendix E. In the first two cases, for simplicity, we set the intensity settings to the possibly suboptimal values \(\omega =0\), \(\nu =s/5\) and we optimize s as a function of the overall system loss γ, while in the later case we set \(\omega =0\) and optimize both ν and s as a function of γ (which provides the optimal solution for this approach). Importantly, despite this fact, Fig. 1 shows that the use of SDP and basis mismatched events significantly improve the secret key rate when compared to the results in [42]. Furthermore, we find that the improvement of using basis mismatched events is more advantageous when N is small. Indeed, when \(N\geq 5\), this enhancement in performance is almost negligible. This is expected as basis mismatched events do not improve the estimation in the case of ideal continuous phase randomization, i.e., in the limit \(N\rightarrow \infty \). On the other hand, when N is small, the eigenstates \(\psi _{n, s, g(\theta )}\rangle \) for \(n=0,1\) deviate more from a perfect Fock state, meaning that the virtual states \(\lambda ^{\mathrm{virtual}}_{ \Delta , n, s, g(\theta )}\rangle \) deviate more from the Xencoded states \(\hat{V}_{\Delta _{X}}\psi _{n, s, g(\theta )}\rangle \) and thus basis mismatched events provide a tighter estimation.
Note that, as shown in Fig. 2, when \(N\geq 6\), the improvement in the secret key rate that can be obtained by further increasing the value of N decelerates. Hence, it seems that a value of around \(N=8\) might be a good practical compromise, as this configuration requires only three random bits per pulse to select the random phase. As in the previous figure, here we set the intensities to \(\{s, s/5, 0\}\) and optimize s as a function of the overall system loss to simplify the numerics. This is done for both the ideal PRWCP scenario and for the different values of N to ensure a fear comparison between both scenarios.
3.1.2 Noisy discrete phase randomization
Here we consider the situation in which the actual phase encoded by Alice in each emitted pulse follows a certain PDF around the selected discrete value \(\theta _{k}=2 \pi k/N\). This might happen due to device imperfections of the phase modulator or the electronics that control it. For concreteness and illustration purposes, we shall assume that this PDF is a truncated Gaussian distribution, though we remark that our analysis can be applied to any given distribution. A truncated Gaussian distribution has the form
when the phase θ is in the interval \(\lambda _{k}<\theta <\Lambda _{k}\), and zero otherwise. The functions \(\phi (x; \gamma , \sigma ^{2} )\) and \(\Phi (x; \gamma , \sigma ^{2} )\) in Eq. (19) are, respectively, given by
That is, in this scenario the function \(g(\theta )\) has the following form
for certain parameters \(\theta _{k}\), \(\sigma _{k}\), \(\lambda _{k}\) and \(\Lambda _{k}\).
In the limit when the standard deviations \(\sigma _{k} \to 0\) ∀k, Eq. (21) converges to the PDF given by Eq. (1), because in that regime each truncated Gaussian distribution approaches the Dirac delta function. On the other hand, when \(\sigma _{k} \to \infty \), and given that the concatenation of the truncation intervals defined by \(\lambda _{k}\) and \(\Lambda _{k}\) allow the phase to take any value within the range of \([0,2\pi )\) but do not overlap each other, Eq. (21) converges to the PDF of a uniform distribution in \([0,2\pi )\). Importantly, this means that the achievable secret key rate will increase with higher values of \(\sigma _{k}\), or, to put it in other words, when the uncertainty about the phase actually imprinted by Alice on each of her prepared signals increases, given that \(g(\theta )\) is completely characterized.
The simulation results are shown in Fig. 3, which presents a comparison between the achievable secret key rate for two different values of the standard deviations \(\sigma _{k}\), which, for simplicity, are assumed to be equal for all k. As expected, the larger the value of \(\sigma _{k}\) is, the higher the resulting secret key rate, regardless of the number N of random phases selected by Alice, though the improvement is more relevant when N is small. For simplicity and due to the lack of experimental data, Fig. 3 assumes that \(\lambda _{k}=\theta _{k}3\sigma _{k}\) and \(\Lambda _{k}=\theta _{k}+3\sigma _{k}\). Moreover, like in the previous example, we set \(\omega =0\), \(\nu =s/5\) and we optimize s as a function of the overall system loss.
3.2 Partiallycharacterized \(g(\theta )\)
Here, we now consider the scenario in which only partial information about the function \(g(\theta )\) is known. In particular, and for illustration purposes, we shall assume that the actual phase encoded by Alice in each emitted pulse could be any phase within a certain interval around the selected discrete value \(\theta _{k}=2 \pi k/N\), but its precise PDF \(g(\theta )\) is unknown. Precisely, let \(\delta _{\text{max}}\) denote the maximum possible deviation between the actual selected phase \(\theta _{k}\) and the actual imprinted phase, which we shall denote by \(\hat{\theta}_{k}\). That is, we assume that the actual imprinted phase lies in the interval \(\hat{\theta}_{k}\in [\theta _{k}\delta _{\text{max}},\theta _{k}+ \delta _{\text{max}}]\), and we conservatively take the combination of values \(\hat{\theta}_{k}\) for all k that minimizes the secret key rate following the analysis presented in Appendix C.
The results are illustrated in Fig. 4, as a function of the total number of phases N selected by Alice and the value of the maximum deviation \(\delta _{\text{max}}\). Like in the previous examples, for simplicity, we fix \(\omega =0\), \(\nu =s/5\) and we optimize s as a function of the overall system loss. As expected, the larger the value of \(\delta _{\text{max}}\) is, the lower the resulting secret key rate.
Also, from Fig. 4 we see that for higher values of \(\delta _{\text{max}}\), the secret key rate becomes less sensitive to the parameter N. Indeed, when \(\delta _{\text{max}}=10^{1}\), the achievable secret key rate for the cases \(N=3, 4, 5\) essentially overlap each other, which is the leftmost curve. This seems to be due to the fact that a significant increase in \(\delta _{\text{max}}\) allows in principle for some phases to lie close to each other, or even become identical if this parameter is large enough. Under this situation, the increase of N does not help to improve the performance, as the effective randomness remains almost the same.
4 Conclusion
In this paper we have considered the security of decoystate quantum key distribution (QKD) when the phase of each generated signal is not uniformly random, as requested by the theory, but follows an arbitrary, continuous or discrete, probability density function (PDF). This might happen due to the presence of device imperfections in the phaserandomization process, and/or due to the use of an external phase modulator to imprint the random phases on the generated pulses, which limits the possible selected phases to a finite set.
Our analysis combines a novel parameter estimation technique, based on semidefinite programming, with the use of basis mismatched events, to tightly estimate the relevant parameters that are needed to evaluate the achievable secret key rate. In doing so, we have shown that decoystate QKD is rather robust to faulty phaserandomization, particularly when the PDF that governs the random phases is wellcharacterized. Moreover, our results significantly outperform those of previous works while being also more general, in the sense that they can handle more realistic and practical scenarios.
This work might be relevant as well to other quantum communication protocols beyond QKD that use laser sources and decoy states.
Data availability
Not applicable.
Code availability
The code is available upon request from the authors.
Notes
This is because the analysis in [41] requires that there is a known nonzero parameter q such that \(g(\theta ) \geq q\) for all \(\theta \in [0,2\pi )\). In the case of active phase randomization, only a discrete number of phases is selected, and therefore there might be many values \(\theta \in [0,2\pi )\) such that \(g(\theta ) =0\).
From this point on, if we have two operators, say A and B by \(A\leq B\) we mean that \(BA\geq 0\), i.e. that \(BA\) is a positive semidefinite operator.
Abbreviations
 QKD:

quantum key distribution
 GLLP:

Gottesman, Lo, Lütkenhaus and Preskill
 SDP:

Semidefinite programming
 LP:

linear programming
 PRWCP:

phaserandomized weak coherent pulse
 PDF:

probability density function
References
Xu F, Ma X, Zhang Q, Lo HK, Pan JW. Secure quantum key distribution with realistic devices. Rev Mod Phys. 2020;92:025002. https://doi.org/10.1103/RevModPhys.92.025002.
Pirandola S, Andersen UL, Banchi L, Berta M, Bunandar D, Colbeck R et al.. Advances in quantum cryptography. Adv Opt Photonics. 2020;12(4):1012. https://doi.org/10.1364/aop.361502.
Lo HK, Curty M, Tamaki K. Secure quantum key distribution. Nat Photonics. 2014;8(8):595–604. https://doi.org/10.1038/nphoton.2014.149.
Wootters WK, Zurek WH. A single quantum cannot be cloned. Nature. 1982;299:802–3. https://doi.org/10.1038/299802a0.
Vernam GS. Cipher printing telegraph systems for secret wire and radio telegraphic communications. Trans Am Inst Electr Eng. 1926;XLV:295–301. https://doi.org/10.1109/TAIEE.1926.5061224.
Sasaki M, Fujiwara M, Ishizuka H, Klaus W, Wakui K, Takeoka M et al.. Field test of quantum key distribution in the Tokyo QKD network. Opt Express. 2011;19(11):10387. https://doi.org/10.1364/oe.19.010387.
Stucki D, Legré M, Buntschu F, Clausen B, Felber N, Gisin N et al.. Longterm performance of the SwissQuantum quantum key distribution network in a field environment. New J Phys. 2011;13(12):123001. https://doi.org/10.1088/13672630/13/12/123001.
Dynes JF, Wonfor A, Tam WWS, Sharpe AW, Takahashi R, Lucamarini M et al.. Cambridge quantum network. npj Quantum Inf. 2019;5(1):101. https://doi.org/10.1038/s4153401902214.
Chen YA, Zhang Q, Chen TY, Cai WQ, Liao SK, Zhang J et al.. An integrated spacetoground quantum communication network over 4,600 kilometres. Nature. 2021;589:214–9. https://doi.org/10.1038/s41586020030938.
Bennett CH, Brassard G. Quantum cryptography: public key distribution and coin tossing. In: Proceedings of IEEE international conference on computers, systems, and signal processing. 1984. p. 175–9.
Huttner B, Imoto N, Gisin N, Mor T. Quantum cryptography with coherent states. Phys Rev A. 1995;51:1863–9. https://doi.org/10.1103/PhysRevA.51.1863.
Brassard G, Lütkenhaus N, Mor T, Sanders BC. Limitations on practical quantum cryptography. Phys Rev Lett. 2000;85:1330. https://doi.org/10.1103/PhysRevLett.85.1330.
Hwang WY. Quantum key distribution with high loss: toward global secure communication. Phys Rev Lett. 2003;91(5):057901. https://doi.org/10.1103/physrevlett.91.057901.
Wang XB. Beating the photonnumbersplitting attack in practical quantum cryptography. Phys Rev Lett. 2005;94(23):230503. https://doi.org/10.1103/physrevlett.94.230503.
Lo HK, Ma X, Decoy CK. State quantum key distribution. Phys Rev Lett. 2005;94(23):230504. https://doi.org/10.1103/physrevlett.94.230504.
Lim CCW, Curty M, Walenta N, Xu F, Concise ZH. Security bounds for practical decoystate quantum key distribution. Phys Rev A. 2014;89:022307. https://doi.org/10.1103/physreva.89.022307.
Zhao Y, Qi B, Ma X, Lo HK, Qian L. Experimental quantum key distribution with decoy states. Phys Rev Lett. 2006;96:70502. https://doi.org/10.1103/PhysRevLett.96.070502.
Rosenberg D, Harrington JW, Rice PR, Hiskett PA, Peterson CG, Hughes RJ et al.. Longdistance decoystate quantum key distribution in optical fiber. Phys Rev Lett. 2007;98:10503. https://doi.org/10.1103/physrevlett.98.010503.
SchmittManderbach T, Weier H, Fürst M, Ursin R, Tiefenbacher F, Scheidl T et al.. Experimental demonstration of freespace decoystate quantum key distribution over 144 km. Phys Rev Lett. 2007;98:10504. https://doi.org/10.1103/PhysRevLett.98.010504.
Liu Y, Chen TY, Wang J, Cai WQ, Wan X, Chen LK et al.. Decoystate quantum key distribution with polarized photons over 200 km. Opt Express. 2010;18:8587–94. https://doi.org/10.1364/OE.18.008587.
Fröhlich B, Lucamarini M, Dynes JF, Comandar LC, Tam WWS, Plews A et al.. Longdistance quantum key distribution secure against coherent attacks. Optica. 2017;4(1):163–7. https://doi.org/10.1364/OPTICA.4.000163.
Yuan Z, Murakami A, Kujiraoka M, Lucamarini M, Tanizawa Y, Sato H et al.. 10Mb/s quantum key distribution. J Lightwave Technol. 2018;36:3427–33. https://doi.org/10.1109/jlt.2018.2843136.
Boaron A, Boso G, Rusca D, Vulliez C, Autebert C, Caloz M et al.. Secure quantum key distribution over 421 km of optical fiber. Phys Rev Lett. 2018;121:190502. https://doi.org/10.1103/PhysRevLett.121.190502.
Liao SK, Cai WQ, Liu WY, Zhang L, Li Y, Ren JG et al.. Satellitetoground quantum key distribution. Nature. 2017;549(7670):43–7. https://doi.org/10.1038/nature23655.
Liao SK, Cai WQ, Handsteiner J, Liu B, Yin J, Zhang L et al.. Satelliterelayed intercontinental quantum network. Phys Rev Lett. 2018;120:030501. https://doi.org/10.1103/PhysRevLett.120.030501.
Sibson P, Erven C, Godfrey M, Miki S, Yamashita T, Fujiwara M et al.. Chipbased quantum key distribution. Nat Commun. 2017;8:13984. https://doi.org/10.1038/ncomms13984.
Bunandar D, Lentine A, Lee C, Cai H, Long CM, Boynton N et al.. Metropolitan quantum key distribution with silicon photonics. Phys Rev X. 2018;8:021009. https://doi.org/10.1103/PhysRevX.8.021009.
Paraïso TK, De Marco I, Roger T, Marangon DG, Dynes JF, Lucamarini M et al.. A modulatorfree quantum key distribution transmitter chip. npj Quantum Inf. 2019;5:42. https://doi.org/10.1038/s4153401901587.
Marco ID, Woodward RI, Roberts GL, Paraïso TK, Roger T, Sanzaro M et al.. Realtime operation of a multirate, multiprotocol quantum key distribution transmitter. Optica. 2021;8(6):911–5. https://doi.org/10.1364/OPTICA.423517.
ID Quantique SA. https://www.idquantique.com/.
Toshiba Europe Limited. https://www.global.toshiba/ww/productssolutions/securityict/qkd.html.
QuantumCTek Co., Ltd. http://www.quantuminfo.com/English/.
ThinkQuantum S.R.L. https://www.thinkquantum.com.
Quantum Telecommunications Italy S.R.L. https://www.qticompany.com.
Yuan ZL, Sharpe AW, Shields AJ. Unconditionally secure oneway quantum key distribution using decoy pulses. Appl Phys Lett. 2007;90:011118. https://doi.org/10.1063/1.2430685.
Dixon AR, Yuan ZL, Dynes JF, Sharpe AW, Shields AJ. Gigahertz decoy quantum key distribution with 1 Mbit/s secure key rate. Opt Express. 2008;16:18790. https://doi.org/10.1364/OE.16.018790.
Lucamarini M, Patel KA, Dynes JF, Fröhlich B, Sharpe AW, Dixon AR et al.. Efficient decoystate quantum key distribution with quantified security. Opt Express. 2013;21:21. https://doi.org/10.1364/oe.21.024550.
Valivarthi R, Zhou Q, John C, Marsili F, Verma VB, Shaw MD et al.. A costeffective measurementdeviceindependent quantum key distribution system for quantum networks. Quantum Sci Technol. 2017. 2:04LT01. https://doi.org/10.1088/20589565/aa8790.
Zhao Y, Qi B, Lo HK. Experimental quantum key distribution with active phase randomization. Appl Phys Lett. 2007;90(4):044106. https://doi.org/10.1063/1.2432296.
Sun SH, Liang LM. Experimental demonstration of an active phase randomization and monitor module for quantum key distribution. Appl Phys Lett. 2012;101:071107. https://doi.org/10.1063/1.4746402.
CurrásLorenzo G, Tamaki K, Curty M. Security of decoystate quantum key distribution with imperfect phase randomization. Preprint. 2022. arXiv:2210.08183.
Cao Z, Zhang Z, Lo HK, Ma X. Discretephaserandomized coherent state source and its application in quantum key distribution. New J Phys. 2015;17(5):053014. https://doi.org/10.1088/13672630/17/5/053014.
CurrásLorenzo G, Wooltorton L, TwinField RM. Quantum key distribution with fully discrete phase randomization. Phys Rev Appl. 2021;15:014016. https://doi.org/10.1103/PhysRevApplied.15.014016.
Tamaki K, Curty M, Kato G, Lo HK, Azuma K. Losstolerant quantum cryptography with imperfect sources. Phys Rev A. 2014;90:052314. https://doi.org/10.1103/PhysRevA.90.052314.
Renner R, Cirac JI. de Finetti representation theorem for infinitedimensional quantum systems and applications to quantum cryptography. Phys Rev Lett. 2009;102:110504. https://doi.org/10.1103/PhysRevLett.102.110504.
Renner R. Symmetry of large physical systems implies independence of subsystems. Nat Phys. 2007;3(9):645–9. https://doi.org/10.1038/nphys684.
Lo HK. Getting something out of nothing. Quantum Inf Comput. 2005;5:413–8. https://doi.org/10.26421/QIC5.4510.
Gottesman D, Lo HK, Lütkenhaus N, Preskill J. Security of quantum key distribution with imperfect devices. Quantum Inf Comput. 2004;4:325–60. https://doi.org/10.26421/QIC4.51.
Koashi M. Simple security proof of quantum key distribution based on complementarity. New J Phys. 2009;8:045018. https://doi.org/10.1088/13672630/11/4/045018.
Shlok N. Decoystate quantum key distribution with arbitrary phase mixtures and phase correlations.
Upadhyaya T, Himbeeck T, Lin J, Lütkenhaus N. Dimension reduction in quantum key distribution for continuous and discretevariable protocols. PRX Quantum. 2021;2:020325. https://doi.org/10.1103/PRXQuantum.2.020325.
Yin HL, Chen TY, Yu ZW, Liu H, You LX, Zhou YH et al.. Measurementdeviceindependent quantum key distribution over a 404 km optical fiber. Phys Rev Lett. 2016;117:190501. https://doi.org/10.1103/PhysRevLett.117.190501.
Lo HK, Preskill J. Security of quantum key distribution using weak coherent states with nonrandom phases. Quantum Inf Comput. 2007;8:431–58. https://doi.org/10.26421/QIC7.562.
Pereira M, Kate G, Mizutani A, Curty M, Tamaki K. Quantum key distribution with correlated sources. Sci Adv. 2020;6:eaaz4487. https://doi.org/10.1126/sciadv.aaz4487.
Winter A. Coding theorem and strong converse for quantum channels. IEEE Trans Inf Theory. 1999;45(7):2481–5. https://doi.org/10.1109/18.796385.
Farenick D, Bures RM. Contractive channels on operator algebras. NY J Math. 2017;23:1369–93.
Funding
This work was supported by Cisco Systems Inc., the Galician Regional Government (consolidation of Research Units: AtlantTIC), the Spanish Ministry of Economy and Competitiveness (MINECO), the Fondo Europeo de Desarrollo Regional (FEDER) through the grant No. PID2020118178RBC21, MICIN with funding from the European Union NextGenerationEU (PRTRC17.I1) and the Galician Regional Government with own funding through the “Planes Complementarios de I + D + I con las Comunidades Autónomas” in Quantum Communication, the European Union’s Horizon Europe Framework Programme under the Marie SkłodowskaCurie Grant No. 101072637 (Project QSI) and the project “Quantum Security Networks Partnership” (QSNP, grant agreement No 101114043). X.S. acknowledges support from an FPI predoctoral scholarship granted by the Spanish Ministry of Science and Innovation. G.C.L. acknowledges support from JSPS Postdoctoral Fellowships for Research in Japan. K.T. acknowledges support from JSPS KAKENHI Grant Number JP18H05237.
Author information
Authors and Affiliations
Contributions
M.C. identified the need for the research project, and all authors conceived the fundamental idea behind the parameter estimation technique. X.S. performed the calculations and the numerical simulations with inputs from G.C.L. X.S. wrote the manuscript, and all authors contributed towards improving it and checking the validity of the results.
Corresponding author
Ethics declarations
Ethics approval and consent to participate
Not applicable.
Consent for publication
All authors consent to the publication of this manuscript.
Competing interests
The authors declare no competing interests.
Additional information
Publisher’s Note
Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
Appendices
Appendix A: Derivation of the SDPs given by Eqs. (7)–(13)
In this Appendix, we follow a similar approach to the one in [41] to derive the infinitedimensional SDPs presented in Eqs. (7)–(13) of the main text, under the assumption of collective attacks. We recall that these infinitedimensional SDP’s cannot be solved numerically and a further dimensionreduction step is needed (see Appendix B).
Let Ω denote a quantum channel (or the action of Eve) that acts independently on each optical pulse emitted by Alice. Also, let us assume that in a certain round, Bob measures the incoming signal with a positive operator valued measure (POVM) that contains the element Π. In this scenario, the probability that Bob obtains the outcome associated with the element Π given that Alice sends him a quantum state σ can be expressed as
where \(\Omega (\sigma )\) represents the action of Ω on σ, \(\{A_{k} \}\) denotes the set of Kraus operators corresponding to the operatorsum representation of the channel Ω, and
Bob measures the incoming signals in either the Z or the X basis. Let us denote the POVM elements corresponding to each of these two measurements by \(\{\Pi _{0_{Z}}, \Pi _{1_{Z}}, \Pi _{f} \}\) and \(\{\Pi _{0_{X}}, \Pi _{1_{X}}, \Pi _{f} \}\), respectively. That is, \(\Pi _{b_{\alpha}}\) represents the POVM element associated to the outcome b in the basis α, with \(\alpha \in \{Z,X\}\), and \(\Pi _{f}\) represents the POVM element associated to an inconclusive outcome. Note that here we are implicitly considering the basisindependent detection efficiency assumption, which means that the POVM element \(\Pi _{f}\) is equal for both basis. Let \(\Pi _{d}=\mathbb{I}\Pi _{f}=\Pi _{0_{Z}}+\Pi _{1_{Z}}=\Pi _{0_{X}}+ \Pi _{1_{X}}\) denote the operator associated to a conclusive outcome at Bob’s side. Then, after substituting in Eq. (A.1) the state σ with Alice’s emitted state when she chooses the Z basis,
and the operator Π with \(\Pi _{d}\), we obtain
with \(H=\sum_{k} A_{k}^{\dagger} \Pi _{d} A_{k}\), and the operator \(J_{Z}\) satisfying
Finally, by taking into account that the yield associated to the states \(\psi _{n, s, g(\theta )}\rangle \) encoded in the Z basis is given by
with
we obtain the SDP presented in Eq. (7).
Regarding the SDP given by Eq. (13) to estimate the phase error rate, we note that the numerator of Eq. (12), can be expressed as
where \(0 \leq L_{(\Delta \oplus 1)_{X}}=\sum_{k} A_{k}^{\dagger} \Pi _{( \Delta \oplus 1)_{X}} A_{k} \leq \mathbb{I}\) according to Eq. (A.1), and \(\bar{\lambda}^{\mathrm{virtual}}_{\Delta , n, s, g(\theta )} \rangle =\sqrt{p^{\mathrm{virtual}}_{\Delta , n, s, g(\theta )}} \lambda ^{\mathrm{virtual}}_{ \Delta , n, s, g(\theta )}\rangle \).
By using again Eq. (A.1), we have that the gains \(Q_{\mu , g(\theta ), b_{\alpha}}^{(\Delta \oplus 1)_{X}}\) can be expressed as
Putting it all together, we find that the SDP presented in Eq. (13) of the main text, provides an upper bound on \(p^{\mathrm{virtual}}_{\Delta , n, s, g(\theta )}Y_{\Delta , n, s, g( \theta )}^{(\Delta \oplus 1)_{X},\mathrm{virtual}}\).
Appendix B: Finitedimensional SDPs when \(g(\theta )\) is fully characterized
2.1 B.1 Lower bound on the yields \(Y_{n, s, g(\theta )}^{Z}\)
In this Appendix, we show how to obtain a finitedimensional relaxation of the SDP given by Eq. (7) to find a lower bound on the yields \(Y_{n, s, g(\theta )}^{Z}\). For this, we follow again the approach presented in [41, 50]. The key idea is rather simple: instead of considering the infinitedimensional state \(\rho ^{\mu}_{[g(\theta )]}\) given by Eq. (4), we employ a projection \(\rho _{[g(\theta )], M}^{\mu}\) of this state onto a finitedimensional subspace with up to M photons (see Eq. (16)), and then we relax the original constraints of the SDP accordingly.
We begin by briefly introducing some helpful results for this purpose. The first one is a direct consequence of the CauchySchwarz inequality in Hilbert spaces [53, 54], which allows to relate the quantities \(\operatorname{Tr}[\sigma H]\) and \(\operatorname{Tr}[\rho H]\), with \(0 \leq H \leq \mathbb{I}\), as a function of the fidelity between the states σ and ρ,
In particular, it states that
with the functions \(G_{\pm}(y, z)\) being defined as
and
with \(g_{\pm}(y, z)=y+(1z)(12 y) \pm 2 \sqrt{z(1z) y(1y)}\).
The remaining results we use, i.e. Eqs. (B.5)–(B.6)–(B.7)–(B.8) below, have been derived in [41, 50, 55]. In particular, we have that
where the coefficients \(q_{ns,g(\theta )}\) are given in Eq. (17). Also, we have that the quantities \(\vert p_{n \mid \mu , g(\theta )}q_{n \mid \mu ,g(\theta )} \vert \) can be upper bounded as
Finally, the fidelity \(F ({\hat{P}}(\varphi _{n,\mu ,g(\theta )}\rangle ),{\hat{P}}( \psi _{n,\mu ,g(\theta )}\rangle ) )=\langle \varphi _{n,\mu ,g( \theta )}\psi _{n,\mu ,g(\theta )}\rangle ^{2}\) satisfies
with
Then, from Eqs. (8)–(B.2)–(B.7) we have that
where \(J_{Z}^{*}\) is the solution to the SDP presented in Eq. (7), and we have used the fact that \(G_{}\) is increasing with respect to its second argument. Since \(G_{}(y,z)\) is decreasing with respect to its first argument, one can lower bound Eq. (B.9) by finding a lower bound on its first argument.
From Eq. (B.2), we have that
with the operator \(J_{Z}\) defined in Eq. (7). Here, since the states \(\rho _{[g(\theta )],M}^{\mu}\) are finite dimensional, the calculation of \(\operatorname{Tr} [\rho _{[g(\theta )],M}^{\mu} J_{Z} ]\) can be restricted to operators \(J_{Z}\) that act on their finite subspace. Putting it all together, we find that a lower bound on \(Y_{n, s, g(\theta )}^{Z}\) can be obtained by solving the following finitedimensional SDP program
That is, we have that
with \(J_{Z}^{**}\) being the solution to the SDP in Eq. (B.11), and \(J_{Z}^{*}\) the solution to Eq. (7). This holds because the constrains in Eq. (B.11) are looser than those in Eq. (7).
Finally, by combining Eq. (B.9) with Eq. (B.12) we have that
The lower bound \({\tilde{Y}}_{n, s, g(\theta )}^{Z, {\mathrm{L}}}\) is the one we use in our simulations in Sect. 3.1.
2.2 B.2 Upper bound on the phaseerror rates \(e_{n, s, g(\theta )}\)
In this Appendix, we show how to estimate an upper bound on \(e_{n, s, g(\theta )}\) by using a finitedimensional SDP. To do so, let us also define the operator
where \(L_{(\Delta \oplus 1)_{X}}^{*}\) denotes the solution to the SDP given by Eq. (13), so that
Now, let us define the finitedimensional state
and the unnormalized states \(\bar{\lambda}^{\mathrm{virtual},M}_{ \Delta , n, s, g(\theta )} \rangle \) as
Then, we have that
where we have used Eq. (B.7) and the fact that \(\hat{V}_{0 Z}^{\dagger} \hat{V}_{0 Z}=\hat{V}_{1 Z}^{\dagger} \hat{V}_{1 Z} = \mathbb{I}\). Now, by applying the CauchySchwarz constraint given by Eq. (B.2), and taking into account the fact that \(G_{+}(y,z)\) is a decreasing function with respect to its second argument, we find that
Importantly, since \(G_{+}(y,z)\) is an increasing function with respect to its first argument, one can upper bound the previous equation by finding an upper bound on its first argument. Moreover, since the states \(\Psi ^{Z, M}_{n, s, g(\theta )}\rangle \) are finite dimensional, one can restrict the optimization search to operators L that act on the corresponding finite subspace. In particular, we have that
where \(L_{(\Delta \oplus 1)_{X}}^{**}\) is the solution to the finitedimensional SDP presented below.
Likewise, the constraints in Eq. (13) can be relaxed by using essentially the same techniques discussed in Appendix B.1. In doing so, we find that an upper bound on \(\operatorname{Tr} [{\hat{P}}(\bar{ \lambda}^{\text{virtual}, M}_{ \Delta , n, s, g(\theta )}\rangle ) L_{(\Delta \oplus 1)_{X}} ]\) can be found by solving the following SDP
where \(F^{\text{proj}}_{\mu ,g(\theta )}\) is given by Eq. (B.5).
Let \(L_{(\Delta \oplus 1)_{X},}^{**}\) denote the operator that maximizes the SDP given by Eq. (B.21), then
This is the upper bound that we use in our simulations in Sect. 3.1.
Appendix C: Finitedimensional SDPs when \(g(\theta )\) is partially characterized
Here, we consider the scenario studied in Sect. 3.2, i.e., when the actual imprinted phases lies in certain intervals \(\hat{\theta}_{k}\in [\theta _{k}\delta _{\text{max}},\theta _{k}+ \delta _{\text{max}}]\), with \(\theta _{k}=2 \pi k/N\), and the exact form of \(g(\theta )\) is unknown.
A direct solution to this case could be found as follows. First, one defines a dense grid with p discrete values within each interval, and then one follows essentially the approach in Sect. 3.1.1 for each possible combination of these discrete phases from the different intervals. The secret key rate would then correspond to the worst case scenario, i.e., the one that minimizes it among all possible combinations. The main drawback of this approach is, however, that the number of SDPs that needs to be solved grows very rapidly, as \(\propto p^{N}\).
Instead, here we introduce a much simpler approach based on a modified version of the SDPs presented in Eqs. (B.11)–(B.21). In particular, let \(f(\theta )\) denote the PDF associated to the ideal discrete phase randomization scenario given by Eq. (1), and let \(\rho ^{\mu}_{[f(\theta )], M}\) be the finitedimensional state obtained by projecting \(\rho ^{\mu}_{[f(\theta )]}\) onto the subspace that contains up to M photons. Also, let \(\rho ^{\mu}_{[g(\theta )]}\) denote the state actually emitted by Alice in the scenario described above, i.e., when \(g(\theta )\) is partially characterized. Then, we can bound the fidelity between \(\rho ^{\mu}_{[g(\theta )]}\) and \(\rho ^{\mu}_{[f(\theta )], M}\) by means of the Bures distance, which is defined as [56]
for any state ρ and σ. This distance satisfies the triangle inequality [56], which means that
We now compute the fidelities that correspond to the Bures distances \(d_{B} (\rho ^{\mu}_{[f(\theta )]}, \rho ^{\mu}_{[f(\theta )], M})\) and \(d_{B}(\rho ^{\mu}_{[g(\theta )]}, \rho ^{\mu}_{[f(\theta )]})\) so that, via Eq. (C.1), we can obtain the necessary fidelity bound with Eq. (C.2).
In particular, from Eq. (B.5), we have that \(F(\rho ^{\mu}_{[f(\theta )]}, \rho ^{\mu}_{[f(\theta )], M})=F^{ \text{proj}}_{\mu ,f(\theta )}\). The fidelity \(F(\rho ^{\mu}_{g(\theta )}, \rho ^{\mu}_{[f(\theta )]})\), on the other hand, can be computed by considering the following purifications of the states \(\rho ^{\mu}_{[f(\theta )]}\) and \(\rho ^{\mu}_{[g(\theta )]}\), respectively,
We find, therefore, that
where in the first inequality we have used the fact that the states on the right hand side are a purification of those on the left hand side; in the first equality we have taken into account that the phases \(\phi _{k}\) in Eq. (C.3) can be chosen so that they cancel the phase of the inner product, and in the second inequality we have used the fact that \(\delta _{k}\leq \delta _{\text{max}}\) ∀k.
Since the function \(g(\theta )\) is unknown, we do not have access to the exact form of the eigenvectors \({\varphi _{n,s,[g(\theta )]}}\rangle \) of \(\rho _{[g(\theta )],M}^{s}\) which are needed to solve the relevant finitedimensional SDP, but we can lower bound the value of \(\operatorname{Tr}[{\hat{P}}({\varphi _{n,s,[g(\theta )]}}\rangle )J_{Z}]\), with \(0 \leq J_{Z} \leq \mathbb{I}\), by employing the CauchySchwartz constraint presented in Eq. (B.2). Precisely, we have that
where \({\varphi _{n,s,[f(\theta )]}}\rangle \) are the eigenvectors of \(\rho _{[f(\theta )],M}^{s}\), and the value of \(F({\varphi _{n,s,[g(\theta )]}}\rangle , {\varphi _{n,s,[f(\theta )]}}\rangle )\) is calcuated numerically as explained below.
With these considerations, we can now find a lower bound on the yields \(Y_{n, s, g(\theta )}^{Z}\). For this, we first solve the following optimization problem to find the operator \(J^{**}_{\text{z}}\) that minimizes its objective function
Following Eq. (C.5), we now define
Finally, by using the arguments introduced in Appendix B.1, we obtain that a lower bound on \(Y_{n, s, g(\theta )}^{Z}\) is given by
Note that, since we do not know which values of \(\hat{\theta}_{k}\) result in the set of states \({\varphi _{n,s,[g(\theta )]}}\rangle \) that minimizes the key rate, we find the worst case scenario numerically. To do so, we implement a Montecarlo simulation by considering a dense grid of values in \(\theta _{k}\pm \delta _{\text{max}}\) for every k and we find the combination of \(\hat{\theta}_{k}\) that minimizes Eq. (C.8) (which includes the fidelity in Eq. (C.7)). This allow us to find the desired lower bound with arbitrary precision. Also, note that the number of SDPs that need to be solved grows very rapidly in the case of the direct solution mentioned at the beginning of this section. With this approach, this problem has been circumvented by reducing it to a simple calculation of the fidelities, which makes it computationally much faster, despite possibly providing looser bounds.
Regarding the estimation of an upper bound on the phase error rate, we follow the same procedure described in Appendix B.2. In doing so, we first solve the following finitedimensional SDP,
where \(Q_{\mu , b_{\alpha}}^{(\Delta \oplus 1)_{X}}\) represents the observed rate at which Bob obtains the result \((\Delta \oplus 1)_{X}\) conditioned on Alice choosing the intensity setting μ, the basis α, the bit value b and Bob choosing the X basis. Now, similarly to Eq. (C.7), we define
where \(L^{**}_{(\Delta \oplus 1)_{X}}\) is the solution to Eq. (C.9). This way, we obtain that the phase error rate \(e_{n, s, g(\theta )}\) is upper bounded by
where again, we use the combination of \(\hat{\theta}_{k}\) that maximizes Eq. (C.11) to obtain the relevant upper bound.
The bounds \(\tilde{Y}_{n, s, g(\theta )}^{Z, L}\) and \({\tilde{e}}_{n, s, g(\theta )}^{\mathrm{U}}\) are used in the simulations presented in Sect. 3.2.
As shown in Fig. 4, higher values of \(\delta _{\text{max}}\) result in an almost negligible impact of the parameter N on the secret key rate, as explained in the main text.
Appendix D: Influence of the parameter M in the secret key rate
As stated in the main text, the secret key rate is an increasing function of the size of the finite dimensional SDP, denoted by M. However, the computational time for solving these SDPs significantly increases with higher values of M. In this Appendix we briefly explore how the size of the SDP impacts the secret key rate. Figure 5 displays the secret key rate for a case involving 8 random phases, showcasing changes as M varies. It is evident from the figure that selecting a small \(M<8\) results in a considerable drop in performance. Nevertheless, when \(M>8\) the key rate appears to saturate and the improvement that we can get by enlarging M is negligible. Hence, in the figures presented in the main text, for each N, we choose an M such that, further increases offer only marginal improvements in the secret key rate. This leads us to select different M values depending on N, as less random phases require smaller SDPs to fulfill the condition above.
Appendix E: Parameter estimation procedure based on linear programming
For completeness, in this Appendix we summarize the parameter estimation technique presented in [42], using linear programming, to evaluate the case of perfect discrete phase randomization for the protocol described in Sect. 2.2.
In particular, given that the PDF follows Eq. (1), which we will denote as \(f(\theta )\) as in the previous Appendix and \(N \geq 1\), a purification of Alice’s emitted states can be expressed as
where the second equality corresponds to the Schmidt decomposition. Note that in Eq. (E.1) we consider unnormalized states, which we will do throughout this Appendix for convenience. The states \({j}\rangle _{A}\) can be interpreted as a quantum coin with N random outputs, while the states \(\beta ^{\mu}_{j}\rangle \) are given by
By using Eq. (2), these latter states can be rewritten as
Indeed, it is easy to show that when N is large, \(\beta ^{\mu}_{j}\rangle \) approaches a Fock state with j photons.
If Alice measures her ancilla system A from the state \(\psi ^{\mu ,N}_{[f(\theta )]}\rangle \) in the basis \(\{{j}\rangle _{A}\}\), she obtains the result j with probability \(P^{\mu}_{j}\) given by
Ref. [42] employs the Gottesman, Lo, Lütkenhaus and Preskill (GLLP) security analysis [48], which needs to determine the basis dependence \(\Delta ^{\mu}_{j}\) of the source, which is closely related to the fidelity \(F^{\mu}_{j}\) between the states in the X and Z basis. Precisely, let us define
where \(Y^{Z}_{j,\mu , f(\theta )}\) refers to the yield that corresponds to the states \(\beta ^{\mu}_{j}\rangle \) encoded in the Z basis, and the fidelity \(F^{\mu}_{j}\) can be bounded by
Moreover, since \(\vert \beta _{j}^{\mu} \rangle \neq \vert \beta _{j}^{\gamma} \rangle \) when \(\mu \neq \gamma \), one can relate the yields and bit error rates associated to different intensity settings as follows [48]
where \(e^{b}_{j,\mu , f(\theta )}\) denotes the bit error rate corresponding to the states \(\beta _{j}^{\mu}\rangle \), i.e., the probability that Alice and Bob obtain different results when they use the same basis and Alice emits the state \(\beta _{j}^{\mu}\rangle \). The parameter \(F_{\mu \gamma}\), on the other hand, is given by
The phase error rate \(e_{j,\mu ,g(\theta )}\) in the Z basis can be upper bounded by means of the bit error rate \(e_{j,\mu , g(\theta )}^{b}\) in the X basis and the basis dependence parameter \(\Delta ^{\mu}_{j}\) as [53]
where we have included the superscript X in the bit error rate to emphasize that it refers to that in the X basis.
Putting it all together, we have that a lower bound on the yields \(Y^{Z}_{j,s, f(\theta )}\) encoded in the Z basis can be estimated with the following linear program
Similarly, an upper bound on the bit error rate \(e_{j,\mu , g(\theta )}^{b, X}\) can be calculated with the following linear program
where \(\xi ^{X}_{j,s, f(\theta )}=e^{b, X}_{j,s, f(\theta )} Y^{X}_{j,s, f( \theta )}\). In particular, let \(\xi ^{X*}_{j,s, f(\theta )}\) denote the solution to the linear program above, then we have that
where \(Y^{X, {\mathrm{L}}}_{j,s, f(\theta )}\) represents a lower bound on the yield \(Y^{X}_{j,s, f(\theta )}\) in the X basis. This quantity can be calculated with the linear program given by Eq. (E.11) by simply replacing the superscript Z with X.
Finally, one can calculate the phase error rate \(e_{j,\mu ,f(\theta )}\) in the Z basis by means of Eq. (E.10), after replacing \(e_{j,\mu , f(\theta )}^{b, X}\) with its upper bound and \(\Delta ^{\mu}_{j}\) with the upper bound obtained after replacing a lower bound for the yield in Eq. (E.6). Importantly, with this approach there is no need to make a projection onto a finite dimensional subspace. This means that when evaluating the secret key rate formula given by Eq. (6), the probabilities \(p^{L}_{n\mid s, f(\theta )}\) are directly given by \(P^{\mu}_{j}\) as defined in Eq. (E.4).
Rights and permissions
Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article’s Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article’s Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/.
About this article
Cite this article
Sixto, X., CurrásLorenzo, G., Tamaki, K. et al. Secret key rate bounds for quantum key distribution with faulty active phase randomization. EPJ Quantum Technol. 10, 53 (2023). https://doi.org/10.1140/epjqt/s40507023002100
Received:
Accepted:
Published:
DOI: https://doi.org/10.1140/epjqt/s40507023002100