Discrete-variable quantum key distribution with homodyne detection
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
Discrete-variable quantum key distribution with homodyne
detection
Ignatius W. Primaatmaja1 , Cassey C. Liang2 , Gong Zhang2 , Jing Yan Haw2 , Chao Wang2 , and
Charles C.-W. Lim1,2
1 Centre for Quantum Technologies, National University of Singapore, 117543, Singapore
2 Department of Electrical & Computer Engineering, National University of Singapore, 117583, Singapore
Most quantum key distribution (QKD) pro- detectors can be readily integrated into a photonic
tocols can be classified as either a discrete- integrated circuit [6–9], which holds great promise for
variable (DV) protocol or continuous-variable monolithic CMOS-compatible fabrication and large-
(CV) protocol, based on how classical infor- scale integrated quantum networks.
arXiv:2109.00492v4 [quant-ph] 27 Dec 2021
mation is being encoded and decoded. We Like DV-QKD, the current research trend of CV-
propose a protocol that combines the best QKD is focused on closing the gaps between the-
of both worlds—the simplicity of quantum ory and experiment. One prominent example is the
state preparation in DV-QKD together with GG02 protocol proposed by Grosshans and Grang-
the cost-effective and high-bandwidth of ho- ier [10], which requires two key assumptions: (1) the
modyne detectors used in CV-QKD. Our pro- users are able to perform ideal Gaussian modulation
posed protocol has two highly practical fea- and that (2) their local oscillators (LOs) are coordi-
tures: (1) it does not require the honest par- nated/calibrated (in terms of relative phase and wave-
ties to share the same reference phase (as re- length). While in theory these conditions are well de-
quired in CV-QKD) and (2) the selection of fined and understood, their practical implementations
decoding basis can be performed after mea- are not straightforward. Indeed, in the case of the
surement. We also prove the security of the first assumption, one would need an infinite amount
proposed protocol in the asymptotic limit un- of randomness to simulate the required Gaussian dis-
der the assumption of collective attacks. Our tribution, which is clearly not possible in practice.
simulation suggests that the protocol is suit- To overcome this gap, one solution is to consider the
able for secure and high-speed practical key discrete approximation of Gaussian modulation [11],
distribution over metropolitan distances. or alternatively, discrete-modulated CV-QKD proto-
cols based on constellations of coherent states (or
displaced thermal states) [12–22]. Moreover, work-
1 Introduction ing with discrete modulation protocols has another
advantage, in that could significantly reduce the im-
Quantum key distribution (QKD) provides an
plementation complexity and computational resources
information-theoretic method to exchange secret keys
required by the classical post-processing layer [5, 14–
between distant parties, whose security is promised by
16, 23, 24].
the laws of quantum mechanics [1–3]. Based on how
classical information is being encoded and decoded, For the second assumption, one can try to dis-
QKD can be divided into two broad protocol cate- tribute a common LO together with the quantum
gories, namely, discrete-variable (DV) protocols and signals using time/polarisation-division multiplexing,
continuous-variable (CV) protocols. In the former, an approach commonly known as the transmitted LO
the information is typically encoded into discrete op- scheme. However, this approach is not entirely secure
tical modes of a single photon, e.g., polarisation or as it has been shown that the transmitted LO’s in-
time bin. In this case, single-photon detectors are tensity can be manipulated to break the security of
normally used to perform decoding. In the latter, the protocol [33–35]. A good solution is to use the
quantum states are described in an optical domain so-called local LO scheme, where the LOs are pre-
where the eigenstates are continuous and have infinite pared independently [31, 32, 36]. Here, the relative
dimension [4, 5], e.g., using Gaussian optical states. phase between signal and LO has to be tracked and
One of the key benefits of CV-QKD is the use of ho- corrected accordingly [31, 32, 36–40] , with the help
modyne detectors, which possess appealing features of pilot pulses acting as a phase reference. As such,
like high quantum efficiency, cost-effectiveness, and the scheme is immune against side-channel attacks on
room-temperature operation. Moreover, homodyne the transmitted LO. In addition, it could reduce the
power requirement for transmitted LO and bypass the
Ignatius W. Primaatmaja: ign.william@gmail.com
excess noises caused by the transmission of a strong
Charles C.-W. Lim: charles.lim@nus.edu.sg
LO (which was needed previously). However, the lo-
Accepted in Quantum 2021-12-24, click title to verify. Published under CC-BY 4.0. 1Protocol class modulation type detector type pilot pulse maximum
requirement transmission distance [2]
Standard DV-QKD discrete single-photon detector 7 long (>100km)
Gaussian-modulated CV-QKD continuous homodyne/heterodyne 3 mid
Discrete-modulated CV-QKD discrete homodyne/heterodyne 3 mid
DV-QKD with homodyne detection discrete homodyne/heterodyne 7 metropolitan (For X-basis:
0, (|q0 |, |q1 | ≥ τ ) ∧ (sign(q0 ) = sign(q1 ))
1, (|q |, |q | ≥ τ ) ∧ (sign(q ) 6= sign(q ))
0 1 0 1
b= ,
?, (|q0 | ≥ τ, |q1 | < τ ) ∨ (|q0 | < τ, |q1 | ≥ τ )
∅, |q0 |, |q1 | < τ
Figure 1: Schematic setup of the protocol. Alice pre-
pares time-phase BB84 states from phase-randomised coher- where τ is the threshold value that is fixed before
ent states using a set of intensity modulator (IM), phase mod- executing the protocol. When B ∈ {0, 1}, we
ulator (PM) and variable optical attenuator (ATTN). After
say that the outcome is conclusive. On the other
the quantum channel, Bob performed a phase-randomised
hand, when B =?, we say that the outcome is
quadrature measurement upon the input states using an in-
dependent local oscillator (LO) with a balanced homodyne inconclusive and when B = ∅, we say that there
detector (BHD). OSC: oscilloscope. is no-click.
4. Parameter estimation: For each round, if B =?
Fig. 1. The protocol runs as follows: or B = ∅, Bob will reveal qβ (for each β) and ask
Alice to reveal her bit value A. Furthermore, if
1. State preparation: For each round, Alice Alice chooses the X-basis or µ 6= µ0 , she would
randomly chooses an intensity setting µ ∈ also reveal her bit value A and ask Bob to reveal
{µ0 , µ1 , µ2 , µ3 } with their corresponding proba- his decoded bit B and his measurement outcome
bility pµi and a basis X ∈ {Z, X} with proba- qβ . After that, Alice would randomly sample a
bility {pZ , 1 − pZ } respectively. In this protocol, few of the remaining rounds where she reveals
keys are only generated when µ = µ0 and X = Z. her bit value A and asks Bob to reveals his bit
Next, she chooses a bit value A ∈ {0, 1} with value B and his measurement outcome qβ . The
uniform probability. Based on these choices, she remaining rounds are used as their raw keys.
would then prepare a phase-randomised coherent
From these announcements, for each intensity
state with intensity µ in the appropriate optical
setting µi and basis choice x, they can estimate
mode. Finally, she sends the prepared states to
the gain, i.e., the probability of obtaining con-
Bob via an untrusted quantum channel.
clusive outcome conditioned on Alice’s intensity
2. Measurement: Bob performs homodyne mea-
setting and basis choice
surement on the state that he receives using a
local oscillator with a random global phase (the Qxµi = Pr[B ∈ {0, 1}|µ = µi , X = x],
phase of the local oscillator for the ‘late’ pulse
as well as the quantum bit-error rate (QBER)
is the same as the one for the ‘early’ pulse). He
records the outcome of the homodyne measure- Eµxi = Pr[A 6= B|µ = µi , X = x, B ∈ {0, 1}],
ment for the ‘early’ time-bin (denoted by q0 ) and
and the more fine-grained behaviour, i.e., the set
for the ‘late’ time-bin (denoted
√ by q1 ). He also
of conditional probabilities
calculates q± = (q0 ± q1 )/ 2.
For each β ∈ {0, 1, +, −}, he maps the continuous G(b|a,x)
µi = Pr[B = b|µ = µi , A = a, X = x].
outcome qβ into a discrete bin νβ . If the size of They could also estimate the probability of ob-
the bin is δ, then for all ν ∈ Z, we denote the taining discretised bin νβ = ν, conditioned on
interval [νδ, (ν + 1)δ) by Iν . Bob has νβ = ν if Alice’s basis choice, bit value and intensity set-
and only if qβ ∈ Iν . ting
(Remark: In practice, the outcome qβ is already β
Wν|µi ,a,x
= Pr[νβ = ν|µ = µi , A = a, X = x].
digitised. In this case, νβ can be seen as an ad-
ditional coarse-graining.) Lastly, Bob could estimate the average value of
They repeat Step 1 and 2 for N times. qβ2 conditioned on Alice’s basis choice, bit value
3. Basis and intensity announcement and decoding: and intensity settings. They can then calculate
For all the rounds, Alice declares her basis choice (β,a,x) hqβ2 iµi ,a,x − 1
x and her intensity setting µ. Finally, depend- ωi = .
2
ing on Alice’s basis choice, Bob assign his bit
value B = b according to the following decoding If these estimated quantities lie within the tol-
scheme: erated intervals that are fixed before executing
protocol, then they continue to the next step of
For Z-basis:
the protocol, else, they abort the protocol.
0, |q0 | ≥ τ, |q1 | < τ
5. Classical post-processing: Alice and Bob will em-
1, |q0 | < τ, |q1 | ≥ τ
b= . ploy a reverse-reconciliation error-correction pro-
?, |q0 |, |q1 | ≥ τ tocol as well as privacy amplification to obtain a
|q0 |, |q1 | < τ
∅, pair of identical and secret key.
Accepted in Quantum 2021-12-24, click title to verify. Published under CC-BY 4.0. 33 Security analysis side-information that Eve has in the actual protocol
would be the same as the ones she holds in the virtual
In this section, we analyse the security of our proposed protocol.
protocol. To simplify the analysis, in this work, we as- In the actual protocol, Alice utilises a phase-
sume that Eve performs collective attacks (when she randomised laser which emits Poissonian mixture of
attacks identically and independently in each round) photon number states. For a given intensity set-
and we restrict our analysis to the asymptotic limit ting µ, she emits n-photons with probability pn|µ =
(when N → ∞). We leave the security analysis e−µ µn /n!. To convert this to an entanglement-based
against the general attacks in the finite-key setting protocol, we could replace this source with the follow-
for future work. ing entangled state which Alice prepares with proba-
Furthermore, throughout this paper, we are work- bility pn|µ
ing in the device-dependent setting. More precisely,
we assume that Alice’s source will emit the exact √ p
|Φn iXAA0 = pZ |ZiX ΦZ
n AA0
+ 1 − pZ |XiX ΦX
n AA0
,
states that are specified by the protocol. As such,
we have to assume that sufficient isolation and filter- where {|ZiX , |XiX } are orthogonal states that encode
ing are provided to prevent side-channel attacks such Alice’s basis choice and
as the Trojan horse attacks or leakages through other n n
degrees-of-freedom. If such side-channels are present, |0iA |0Z iA0 + |1iA |1Z iA0
ΦZ
n AA0
= √
one could adopt the techniques from Refs. [43–45] to 2
n n (3)
take those side-channels into account in the security |0iA |0X iA0 + |1iA |1X iA0
analysis. On Bob’s side, in analysing the security of ΦX
n AA0
= √ .
2
the protocol, we assume that Bob is performing a
shot-noise-limited balanced homodyne measurement Here, the states {|0iA , |1iA } are orthogonal states
and any imperfections therein are well characterised. that encode her bit value. On the other hand,
n n n n
It is also important to ensure that any detector vul- {|0Z iA0 , |1Z iA0 , |0X iA0 , |1X iA0 } are n-photon BB84
nerabilities (such as the one demonstrated in Ref. [46]) states. More precisely, denoting the vacuum state as
are appropriately addressed. |vi and defining the orthogonal annihilation opera-
Since we have limited our analysis to the asymptotic tors â0 and â1 such that [â0 , â†1 ] = 0, for j ∈ {0, 1},
limit, we could neglect statistical fluctuations in the we have
parameter estimation as well as we can consider the
case where pZ → 1 and the fraction of rounds used n (â†j )n
|jZ iA0 = √ |vi ,
for parameter estimation can be taken to be almost n!
zero. The asymptotic secret key rate R of the protocol (4)
n (â + (−1)j â†1 )n
†
under these assumptions are given by the Devetak- |jX iA0 = 0 √ |vi .
Winter bound [47] 2n n!
n n
h Hence, |0Z iA0 and |1Z iA0 are Fock states in the â0
n n
R= pZ pµ0 QZ
µ0 H(B|E, X = Z, µ = µ0 , B ∈ {0, 1}) and â1 mode, meanwhile |0X iA0 and |1X iA0 are Fock
i states in the â+ and â− mode, respectively.
− H(B|A, X = Z, µ = µ0 , B ∈ {0, 1}) , (1) Next, Alice sends the quantum system A0 to Bob
via an untrusted quantum channel and then measures
where QZ µ0 is the gain, conditioned on µ = µ0 and X = the register X and A in their corresponding standard
Z and H(·) denotes the von Neumann entropy. The basis. This is equivalent to Alice randomly choosing
first term quantifies Eve’s uncertainty about Bob’s her basis and bit value from the appropriate probabil-
bit values whereas the second term quantifies Alice’s ity distributions. One could see that by projecting the
uncertainty about Bob’s bit value. The latter can be systems X and A to the appropriate states, we get the
bounded in terms of the QBER same signal states that we have in the actual prepare-
and-measure protocol (for a given photon number n).
H(B|A, X = Z, µ = µ0 , B ∈ {0, 1}) ≤ h2 EµZ0 , (2)
(n)
We can then describe Eve’s attack by a map EA0 →B .
In passing, we remark that since Alice sends states
where h2 (x) = −x log2 (x) − (1 − x) log2 (1 − x) is the
that are block diagonal in the photon number ba-
binary entropy function.
sis, Eve could in principle perform a photon number
measurement without perturbing the states that Al-
3.1 Virtual entanglement-based protocol ice sends. Hence, the map may, in general, depend on
(n)
As such, our task is to find a lower bound on the the emitted photon number n. The channel EA0 →B
first term of (1). To that end, we consider a virtual would then map the pure state |Φn ihΦn |XAA0 to a
(n)
entanglement-based protocol which, from the point- mixed state ρXAB . Since Eve is free to subtract/add
of-view of Eve, is indistinguishable from the actual photons from/to the channel, the number of photons
protocol. In other words, the classical and quantum that Bob receive may differ from the one emitted from
Accepted in Quantum 2021-12-24, click title to verify. Published under CC-BY 4.0. 4Alice’s source. Thus, the system B, in general, lives We can simplify the summation in Eq. (9). Making
in an infinite-dimensional Hilbert space. On the other use of the Kronecker delta in the summation, we have
hand, since Alice’s virtual systems X and A are stored
securely in her lab, we have the following constraint: Π(q0 , q1 )
X∞ X m X
m
(n) (n) = ψk0 (q0 )ψl0 (q0 )
ρXA = TrB [ρXAB ] = TrA0 [|Φn ihΦn |XAA0 ] (5)
m=0 k0 =0 l0 =0
Finally, upon receiving system B, Bob performs ho- ψm−k0 (q1 )ψm−l0 (q1 ) |k0 , m − k0 ihl0 , m − l0 |
modyne detection on it. The rest of the protocol (Step ∞
X
3 to Step 5) is identical to the actual protocol de- =: Π(m) (q0 , q1 ). (10)
scribed in Section 2. m=0
Now, denoting the total photon number m = k0 +
3.2 State and measurements: block-diagonal k1 = l0 + l1 , due to the block-diagonal structure, we
structure have
∞
Now, we turn our attention to Bob’s measurement. Π(q0 , q1 ) =
X
Pm Π(q0 , q1 )Pm
For simplicity, we shall consider the case in which Bob m=0
possesses an ideal homodyne detector. As we shall see X∞
in the Appendix A, the same conclusion could be de- = Pm Π(m) (q0 , q1 )Pm (11)
rived when he uses an imperfect homodyne detector. m=0
Since Bob randomises the global phase of his LO,
his measurement would be block-diagonal in the pho- where Pm is the projection to the m-photon sub-
ton number basis. To see this, for a given value of space (the space in which Bob receives a total
q0 and q1 and LO phase ϕ, Bob’s POVM element for of m-photons). In other words, we could inter-
those particular outcomes is given by pret Bob’s measurement as a virtual photon num-
ber measurement followed by a reduced measurement
Z
dϕ 2π Π(m) (q0 , q1 ) = Pm Π(q0 , q1 )Pm which lives in the m-
Π(q0 , q1 ) = |q0 (ϕ)ihq0 (ϕ)| ⊗ |q1 (ϕ)ihq1 (ϕ)| , photon subspace.
0 2π
(6) Since Bob’s measurement is indistinguishable to the
where |qj (ϕ)i is the eigenstate of the quadrature op- virtual measurement that we have just described, Eve
erator is not penalised if she performs the projection herself.
Hence, without loss of generality, we can consider the
Q̂(j)
ϕ = âj e
−iϕ
+ â†j eiϕ .
state shared by Alice and Bob has the following block-
We could re-write |qj (ϕ)i in the photon number ba- diagonal structure
sis [48] ∞
(n) (m,n)
M
∞
ρXAB = ρ̃XAB (12)
m=0
X
−imϕ
|qj (ϕ)i = ψm (qj )e |mi , (7)
m=0 (m,n)
where ρ̃XAB is a (sub-normalised) state with Bob re-
where {|mi}m are Fock states and ceiving m photons distributed across the two temporal
modes when Alice sends n photons. If the normalised
√ −q2 /4 (m,n) (m,n)
1 version of ρ̃XAB is denoted by ρXAB , we have
ψm (qj ) = p √ Hm (qj / 2)e j (8)
2m m! 2π (m,n) (m,n)
ρ̃XAB = qm|n ρXAB , (13)
is the wavefunction of the Fock state |mi in coordinate
representation. Then, we could perform the integra- with a normalisation factor qm|n . The normalisation
tion in Eq. (6) to obtain the block-diagonal structure factor qm|n can therefore be interpreted as the prob-
ability of Bob receiving m-photons, conditioned on
∞
X Alice sending n-photons. Importantly, we can find
Π(q0 , q1 ) = ψk0 (q0 )ψl0 (q0 )ψk1 (q1 )ψl1 (q1 ) upper and lower bounds on qm|n using a variant of
k0 ,k1 ,l0 ,l1 =0 decoy-state method proposed in Ref. [41] which we
δk0 +k1 ,l0 +l1 |k0 , k1 ihl0 , l1 | , (9) will discuss in Section 3.4.
where we used the following identity 3.3 Refined Pinsker’s inequality
Z 2π
dϕ −i(k0 +k1 −l0 −l1 )ϕ Now, to bound Eve’s uncertainty about Bob’s mea-
e = δk0 +k1 ,l0 +l1 .
0 2π surement results, we want to find a lower bound to
Accepted in Quantum 2021-12-24, click title to verify. Published under CC-BY 4.0. 5h i
(n)
the conditional von Neumann entropy H(B|E, X = T σABR , we have
Z, µ = µ0 , B ∈ {0, 1}). We have
1
Vn = min Tr[Y1 + Y2 ]
(n)
Y1 ,Y2 ,ρXAB 2
H(B|E, X = Z, µ = µ0 , B ∈ {0, 1})
Y1 Λ
≥ H(B|E, X = Z, µ = µ0 , B ∈ {0, 1}, N, M), s.t. 0,
Λ† Y2
h i (16)
(n)
Tr ρXAB = 1,
where N and M denotes the input and output photon
number, respectively. We could further lower bound (n) (n)
TrB [ρXAB ] = ρXA ,
the above by (n)
ρXAB ∈ Sn ,
where Sn is the set of density matrices that could
QZ
µ0 H(B|E, X = Z, µ = µ0 , B ∈ {0, 1}, N, M) reproduce the statistics observed in the parameter es-
X
≥ pn|µ0 qm≤n|n sm≤n|n H(B|E, N = n, PS), timation step. The set Sn can be characterised by
(n)
n functions that are linear in ρXAB . We have
h i p
(m≤n) (n) x (b|a,x)
Tr |xihx| ⊗ |aiha| ⊗ Mb|x ρXAB = Γm≤n ,
where qm≤n|n = Pr[M ≤ n|N = n], sm≤n|n = i p2
Pr[B ∈ {0, 1}|M ≤ n, N = n] and for brevity, we call
h
(n) x (a,x)
Tr |xihx| ⊗ |aiha| ⊗ Pm ρXAB = q ,
the event (X = Z, µ = µ0 , B ∈ {0, 1}, M ≤ N) as 2 m|n
‘postselected’ (in short, PS). (17)
In passing, we remark that the honest parties do for all values of (a, b, x, n) and for all m ≤ n, where
(b|a,x)
not postselect on rounds in which M ≤ N (i.e., rounds Γm≤n = Pr[B = b, M ≤ n|A = a, X = x, N = n],
in which the number of photons that Bob receives is (a,x)
qm|n = Pr[M = m|A = a, X = x, N = n] and Mb|x
(m≤n)
not more than the one prepared by Alice). In the
is Bob’s measurement operators (for the space M ≤ n)
protocol, neither Alice nor Bob know the number of
obtained by integrating m≤n Π(m) (q0 , q1 ) over the
P
photons that they prepare or receive. The only post-
appropriate intervals defined by the decoding scheme
selection that is being performed in the protocol is
mentioned in Section 2. The operator Pm denotes the
with respect to whether Bob’s measurement outcome
projector on the m-photon subspace of Bob’s system.
is conclusive. However, one can conservatively extract
The constraints (17) is a characterisation of the set
secrecy from rounds in which M ≤ N and compute the (b|a,x)
conditional entropy based on this event. The effect is Sn . However, Γm≤n and qm|n are not directly ob-
identical to a hypothetical scenario where Alice and served in the experiment. Fortunately, it is possible
Bob perform non-demolition photon number measure- to establish upper and lower bounds on them by us-
ment on their optical systems and postselecting on the ing a variant of the decoy-state method [41, 42] (Sec-
event in which M ≤ N. tion 3.4). For now, it suffices to assume that one can
obtain bounds of the type
Following the argument from Ref. [49], we can lower
(b|a,x),L (b|a,x) (b|a,x),U
bound H(B|E, N = n, PS) as Γm≤n ≤ Γm≤n ≤ Γm≤n ,
(a,x),L (a,x) (a,x),U
(18)
qm|n ≤ qm|n ≤ qm|n .
(n) 1 − Vn
H(B|E, N = n, PS) ≥ pPS 1 − h2 , (14)
By replacing the equality constraints (17) by the
2
inequality constraints (18), we construct a set Sn0 such
that Sn ⊂ Sn0 . Hence, this provides a relaxation for
(n)
where pPS = Pr[B ∈ {0, 1}, M ≤ N|N = n, X = Z, µ = µ0 ] the SDP (16) that would yield a valid lower bound on
and Vn .
h i Unfortunately, even the relaxed SDP is still compu-
(n)
Vn = σABR − T σABR
(n)
, (15) tationally intractable due to Bob’s system being infi-
1 nite dimensional. However, we shall prove that with-
out loss of generality, one could consider a state with
with T is the pinching channel associated to Bob’s finite rank and hence reduces the infinite-dimensional
(n) SDP into a finite-dimensional one.
measurement, and σABR is the Naimark’s dilated
state, when postselected on the conclusive event B ∈ To that end, suppose that ρopt is an optimiser of the
(n)
{0, 1} and M ≤ n. The explicit form of the state σABR infinite-dimensional SDP. As mentioned previously,
is derived in Appendix B. without loss of generality, we can consider states that
are block-diagonal in the photon number basis. As
Hence, our task is to find a lower bound on such, we can write ρopt as
the trace-norm Vn . This can be formulated as a
(n) (m≤n) (m>n)
semidefinite program (SDP). Denoting Λ := σABR − ρopt = qm≤n|n ρopt ⊕ qm>n|n ρopt , (19)
Accepted in Quantum 2021-12-24, click title to verify. Published under CC-BY 4.0. 6(m≤n)
where the state ρopt lives in the subspace where settings and observing how the resulting statistics de-
Bob’s photon number is m ≤ n whereas the state pend on the intensity settings, Alice and Bob could
(m>n) estimate the channel behaviour and its input-output
ρopt lives in the m > n subspace. Then, qm≤n|n
gives the probability of obtaining m ≤ n whereas photon number distribution.
(b|a,x)
qm>n|n gives the probability of obtaining m > n, Now, consider the behaviour, Gµi , that Alice
both conditioned on Alice sending n-photons. Clearly, and Bob estimate during the protocol. We can expand
(m≤n) the behaviour in terms of the n-photon behaviours
ρopt is finite-dimensional.
Now, consider the map G (n) that corresponds to the ∞
X
(n) (n)
postselection in the protocol, i.e., G (n) [ρXAB ] = σABR . Gµ(b|a,x)
i
= pn|µi Γ(b|a,x)
n , (22)
Since we only consider secrecy when M ≤ N, if Alice n=0
emits n photons, we have G (n) [ρm>n ] = 0 for any (b|a,x)
state ρm>n that lives in the m > n subspace. Then, where Γn = Pr[B = b|A = a, X = x, N = n]. One
(b|a,x)
consider the state could obtain an upper and lower bound on Γn via
(m≤n)
the standard decoy-state method [42]. For example,
ρ0opt = qm≤n|n ρopt ⊕ qm>n|n . (20) if we are interested in N = n0 , one can formulate the
following linear program (LP)
By construction, if ρopt ∈ Sn0 , we also have ρ0opt ∈ Sn0
since the constraints only depend on the part of the max/min Γn0
(b|a,x)
states where m ≤ n. Secondly, we have G (n) [ρopt ] = {Γn
(b|a,x)
}n
G (n) [ρ0opt ], which implies that the two states share the X
same optimal value of Vn . This implies that there s.t. pn|µi Γ(b|a,x)
n = G(b|a,x)
µi ∀µi , (23)
exists a finite-dimensional optimiser for the infinite- n
dimensional SDP. Hence, without loss of generality, 0 ≤ Γ(b|a,x)
n ≤1 ∀n.
we can consider a finite-dimensional version of the
The above LP involves infinitely many variables
SDP (16). In particular, if the m Pn≤ n subspace has {Γn
(b|a,x)
}n . However, using the fact that 0 ≤
a dimension of dim(Hm≤n ) = m=0 (m + 1), it is (b|a,x)
sufficient to consider the dimension of Bob’s system to Γn ≤ 1 for all n > nmax , we can consider a photon
be dB = dim(Hm≤n ) + 1. Hence, taking into account number cutoff nmax and relax the problem
the relaxation and the dimension reduction, we have (b|a,x)
the following SDP: max/min Γn0
(b|a,x)
{Γn }n
1 nX
max
Vn = min Tr[Y1 + Y2 ]
(n)
Y1 ,Y2 ,ρXAB 2 s.t. pn|µi Γ(b|a,x)
n ≤ Gµ(b|a,x)
i
∀µi
n=0
Y1 Λ nX
s.t. 0, max
Λ† Y2 pn|µi Γ(b|a,x) ≥ Gµ(b|a,x)
h i n i
(n) n=0
Tr ρXAB = 1, (21) !
nX
max
(n) (n) − 1− pn|µi ∀µi
TrB [ρXAB ] = ρXA ,
(n) n=0
ρXAB ∈ Sn0 ,
0 ≤ Γn(b|a,x) ≤ 1 ∀n ∈ {0, ..., nmax }.
(n)
dim ρB = dim(Hm≤n ) + 1. (24)
Note that, in our relaxation, we have enlarged the
3.4 Estimating the channel behaviour and its feasible region of the original LP such that we obtain
input-output photon number distribution a valid lower and upper bounds on Γn0
(b|a,x)
.
To formulate the SDP (21), we need a characteri- In turn, we can also use the law of total probability
(b|a,x)
sation of the set Sn0 as linear functions of the state to expand Γn and obtain
(n)
ρXAB . As discussed in the previous section, this can ∞
(a,x)
X
be done if we have lower and upper bounds as writ- Γ(b|a,x)
n = (b|a,x)
qm|n γm,n , (25)
ten in Eq. (18). We will find these bounds using the m=0
decoy-state method [42]. (b|a,x)
Recall that Alice prepares phase-randomised co- where γm,n = Pr[B = b|N = n, M = m, A = a, X = x].
herent states which are Poissonian mixtures of Fock Then, we have
states. Assuming that the phase-randomisation is (b|a,x)
X (a,x)
(b|a,x)
Γm≤n = qm|n γm,n
done properly, given a Fock state, Eve would not be
m≤n
able to deduce the intensity setting that Alice chose.
(a,x)
X
As such, Eve’s attack must not depend on Alice’s in- = Γ(b|a,x)
n − (b|a,x)
qm|n γm,n (26)
tensity setting µ. Hence, by using different intensity m>n
Accepted in Quantum 2021-12-24, click title to verify. Published under CC-BY 4.0. 7(b|a,x)
Using 0 ≤ γm,n ≤ 1, we have an upper and lower One could also consider the square of the quadrature
(b|a,x) operator
bound on Γm≤n
2 2
(b|a,x)
Γm≤n ≤ Γ(b|a,x)
n (27) Q̂(β)
ϕ = âβ2 e−2iϕ + â†β e2iϕ +â†β âβ +âβ â†β . (32)
(b|a,x) (a,x)
Γm≤n ≥ Γ(b|a,x)
n − 1 − qm≤n|n (28)
Then randomising the phase, we get
(a,x) P (a,x) 2π
where qm≤n|n = m≤n qm|n .
Z
dϕ (β) 2
Q̂ϕ = â†β âβ + âβ â†β = 2â†β âβ + 1. (33)
Therefore, our remaining task is to find upper and 0 2π
(a,x)
lower bounds on the conditional probabilities qm|n .
Here, we use the linear programming method pro- Since â†β âβ is the number operator for the mode âβ ,
posed in Ref. [41]. then
Suppose that Bob receives m-photons in mode âβ , (β,a,x) hqβ2 iµi ,a,x − 1
ωi =
if he measures the quadrature Q̂ϕ = âβ e−iϕ + â†β eiϕ
(β)
2
using a LO with randomised phase, the probability of is the mean photon number in mode âβ that Bob re-
obtaining an outcome ν that lies within the interval (β,a,x)
ceives. Suppose we are interested in bounding qm|n
Iν is given by
for M = m0 and N = n0 . Then we can consider the
Z (ν+1)δ following LP:
β 2
Cν|m = dq |ψm (q)| . (29)
νδ
(β,a,x)
Let |mβ i be the state with photon number m, all in min qm0 |n0
(β,a,x)
{qm|n }m,n
the mode âβ , i.e.,
(β,a,x)
X β β
m s.t. pn|µi qm|n Cν|m = Wν|µi ,a,x
, ∀µi , ν
â†β n,m
|mβ i = √ |vi . X (β,a,x) (β,a,x)
n! pn|µi qm|n m = ωi , ∀µi
n,m
Then, we have |mβ ihmβ | 1m . As such, we have (β,a,x)
0 ≤ qm|n ≤ 1, ∀m, n
(β,a,x) (a,x) X (β,a,x)
qm|n ≤ qm|n , (30) qm|n = 1, ∀n.
m
(β,a,x)
where qm|n = Pr[M = m, mode = âβ |N = n, A = a, X = x]. (34)
(a,x)
For upper bounds, we can trivially use qm|n ≤ 1. Again, this LP involves infinitely many variables
Using the chain rule and the law of total probability, which make it intractable. To get a valid relax-
we can then write ation, we choose some cutoffs nmax and mmax (for
∞
∞ X n and m, respectively). Then, we use the fact that
(β,a,x) (β,a,x)
β
X β
Wν|µi ,a,x
= pn|µi qm|n Cν|m . (31) 0 ≤ qm|n ≤ 1 to relax the LP to
n=0 m=0
(β,a,x)
min qm0 |n0
(β,a,x)
{qm|n }m,n
nX
max mmax
(β,a,x)
X β β
s.t. pn|µi qm|n Cν|m ≤ Wν|µi ,a,x
, ∀µi , ν
n=0 m=0
nX
!
max mmax nX
max
(β,a,x) (β,a,x) (35)
X
pn|µi qm|n (mmax + 1 − m) ≥ (mmax + 1) pn|µi − ωi , ∀µi
n=0 m=0 n=0
(β,a,x)
0 ≤ qm|n ≤ 1, ∀m ∈ {0, ..., mmax }, n ∈ {0, ..., nmax }
m max
(β,a,x)
X
qm|n ≤ 1, ∀n ∈ {0, ..., nmax },
m=0
In practice, we only impose the first constraint ditions that the original feasible points must satisfy,
for ν ∈ {νmin , ..., νmax } for some cutoffs νmin and the bounds that we obtain from the relaxed LP (35)
νmax . Since the relaxed constraints are necessary con- (β,a,x)
are valid lower bounds on qm|n . One could also find
Accepted in Quantum 2021-12-24, click title to verify. Published under CC-BY 4.0. 8(a,x) (a,x) (a,x)
a lower bound on qm≤n|n by changing the objective we let θ0 = θglobal and θ1 = θglobal + θrel since
Pn
function in (35) to m=0 qm|n .
(β,a,x) the phase of the early temporal mode is always ran-
domised. The magnitude |α0 | and |α1 | are determined
To summarise, we could find a characterisation to
by the intensity setting µ as well as Alice’s random
the set of feasible density matrices Sn0 in terms of lin-
(n) inputs (a, x). We have
ear functions of the state ρXAB . To this end, we need
(b|a,x) (a,x) Z
to find bounds on Γm≤n and qm|n . To bound the lat-
G(b|a,x)
µi = dq0 dq1
(β,a,x) (a,x)
ter, we use the fact that qm|n ≤ qm|n ≤ 1. We can, I(b,x)
2π
(a,x,µ) √ (a,x,µ) √
(β,a,x)
Z
in turn, find a lower bound on qm|n using the LP dϕ
f (q0 , q1 |α0 η, α1 η, ϕ) (38)
(a,x) 0 2π
(35). Using a similar LP, we can also bound qm≤n|n .
(b|a,x) where the integration over q0 and q1 is carried out over
On the other hand, to bound Γm≤n , we need to first
(b|a,x)
intervals that depend on b and x as determined by
find bounds on Γn . To do that, we can use the the decoding functions. Since both the global phase
standard decoy-state method. This can be done by θglobal and the local oscillator phase are randomised
formulating a LP as shown in (24). Then, we can and the PDF only depends on their difference, we
plug in these bounds, together with the lower bound would observe the same statistics if we fix the global
(a,x)
on qm≤n|n , to Eqs. (27) and (28). Finally, since we phase θglobal and only randomise the phase of the local
have characterised Sn0 as constraints that are linear in oscillator ϕ.
(n) β
the state ρXAB , we can efficiently solve the SDP (21) Similarly, we can calculate Wν|µ i ,a,x
using
using standard SDP solvers 1 .
(ν+1)δ 2π
√
Z Z
β dϕ
Wν|µi ,a,x
= f (q|Kβ,a,x µi η, ϕ), dq
νδ 0 2π
4 Simulation (39)
where we have [â(a,x) , â†β ] = Kβ,a,x 1 and â(a,x) is the
To simulate the performance of the protocol, we as- mode associated to A = a and X = x and âβ is the
sume that the loss in the channel can be modelled by mode associated to β.
a beam-splitter of transmittivity η with Using this model, we first plot the secret key rate
η = ηdet 10−ξLAB /10 (36) against the distance between Alice and Bob assuming
a perfect detection efficiency ηdet . In our simulation,
where ηdet is the effective efficiency of the homodyne we consider the case where Alice and Bob only extract
detector, ξ is the fiber loss coefficient in dB/km (for secrecy from n = 0, 1, 2. The result is plotted in Fig. 2.
standard fiber, ξ = 0.2 dB/km for telecom wave-
length) and LAB is the distance between Alice’s and
Bob’s lab. 100% detector efficiency
-1
10
The probability density function (PDF) for homo-
dyne measurement of a (single-mode) coherent state
key rate (bits/channel use)
|αi with local oscillator’s phase ϕ is given by
-2
−(q − 2|α| cos(θ − ϕ))2 10
1
f (q|α, ϕ) = √ exp
2π 2
where θ = arg(α) is the phase of the coherent
-3
state. Therefore, given the multimode coherent state 10
with infinitely many
|α0 i |α1 i, we have decoy states
f (q0 , q1 |α0 , α1 , ϕ) 4 intensity protocol
-4
−(q0 − 2|α0 | cos(θ0 − ϕ))2
1 10
= exp 0 5 10 15 20
2π 2 distance (km)
−(q1 − 2|α1 | cos(θ1 − ϕ))2
exp (37) Figure 2: Key rate vs distance between Alice and Bob for
2 100% detector efficiency. We compare the performance
of our proposed four intensity protocol against the case in
(b|a,x)
To simulate the statistics Gµi , we first notice which we use infinitely many decoy states (such that Alice
√
that the channel maps |αk | → |αk | η. Furthermore, (a,x) (b|a,x)
and Bob could characterise qm|n and Γm≤n exactly instead
1 For example, the results we obtained in Section 4 are ob-
of bounding them).
tained by solving the SDP and LP using the solver MOSEK [50]
via CVX [51], a package for specifying convex optimisation As one can see, in the short distance regime (.
problems. 5 km), the four-intensity protocol is almost optimal.
Accepted in Quantum 2021-12-24, click title to verify. Published under CC-BY 4.0. 9distance parameters
(km) µ0 µ1 µ2 µ3 τ
0 1.200 2.3 × 10−3 5.0 × 10−4 1.0 × 10−4 1.600
5 0.974 2.6 × 10−3 5.2 × 10−4 1.0 × 10−4 1.999
10 0.568 1.8 × 10−3 2.7 × 10−4 1.0 × 10−4 2.193
15 0.347 2.1 × 10−3 3.0 × 10−4 1.0 × 10−4 3.314
Table 2: Protocol parameters used in the trusted detector efficiency scenario in Fig. 3. Here, we fix the lowest intensity
µ3 and heuristically optimise the other parameters using a grid search optimisation.
However, as the distance between Alice and Bob in- To illustrate the range of parameters that are used
creases, the gap between the four-intensity proto- in the simulation of Fig. 3 with trusted detector effi-
col and the infinite decoy-state protocol increases as ciency, we present the heuristically optimised protocol
well. From our numerical investigation, this is mainly parameters for selected transmission distances in Ta-
caused by the two-photon decoy-state bounds which ble. 2
tend to be loose as the loss increases. One possible
way to circumvent this is to increase the number of
decoy states. 5 Discussion
To assess the practicality of the protocol, we also
perform a simulation for the case when Bob does not As we can see from Section 4, our protocol is suitable
use a perfect homodyne measurement. Such imperfec- for high-speed QKD across metropolitan distances.
tions may include imperfect quantum efficiency and This feature is shared with the protocol proposed in
electronic noise. However, following the argument of Ref. [30]. Furthermore, some aspects of the security
Ref. [52], one could see an independent Gaussian elec- analysis presented in this work could also be adapted
tronic noise as an additional loss. As such, in our sim- to Ref. [30]’s protocol with some minor adjustments.
ulation, we assume that Bob has a lossy homodyne For example, one could also apply the SDP formu-
detector with an effective efficiency of the homodyne lation from the refined Pinsker’s inequality presented
detector ηdet = 72%. The result is shown in Fig. 3. in Section 3.3 and the channel estimation technique
described in Section 3.4 to analyse the security of
-1
72% detector efficiency Ref. [30]’s protocol. Nevertheless, the dimension re-
10
duction used in this work relies heavily on the block-
trusted detector efficiency
diagonal structure of the measurement that Bob per-
untrusted detector efficiency
forms. As such, to prove the security of Ref. [30]’s
key rate (bits/channel use)
-2
10 protocol, one might need to use other methods of re-
ducing Bob’s dimension. For example, one can use
the technique presented recently in Ref. [18].
-3
10 Next, we also remark that while our security anal-
ysis involved some dimension reduction on Bob’s sys-
tem, this dimension reduction is done by deriving
10
-4 necessary conditions that any feasible solution to
the original infinite-dimensional optimisation problem
must satisfy. This results in a relaxation where the
-5 feasible region of the relaxed optimisation problem
10
0 5 10 15 contains the feasible region of the original optimisa-
distance (km)
tion problem. Furthermore, due to the block-diagonal
Figure 3: Key rate vs distance between Alice and Bob structure of Bob’s measurement, we could show that
for 72% detector efficiency. We compare the performance without loss of generality, it is sufficient to consider
of our proposed four-intensity protocol under the trusted de- finite-dimensional states. This is not the case for the
tector efficiency scenario against the scenario in which the security analyses presented in Ref. [15, 16]. In those
detector loss is attributed to Eve. cases, one could obtain a valid lower bound on the
secret key rate by further adopting the technique of
As one can see from Fig. 3, by trusting the detector Ref. [18], but at a price of some correction term due
imperfection, we can increase the key rate for a given to the cutoffs.
distance and improve the robustness of the protocol It is also remarkable that our dimension reduction
against loss. However, the protocol could not tolerate bares some resemblance with the technique presented
high loss even when the effective detector efficiency is in Ref. [53]. Similar to what we have done here, the
trusted. authors of Ref. [53] leveraged on the block-diagonal
Accepted in Quantum 2021-12-24, click title to verify. Published under CC-BY 4.0. 10structure of the measurement and argue that one can 6 Conclusion reduce the analysis to finite dimensional convex opti- misation problem. To summarise the argument, they In conclusion, we have proposed a QKD protocol formulated the so-called flag-state squasher which is a which shares the features of discrete and continuous quantum channel that maps the infinite-dimensional variable protocols. A key advantage of our protocol quantum state to a finite-dimensional one. Then, one over most existing CV-QKD protocols is that the need can modify the measurement operators such that they for a common phase reference between Alice and Bob only span the finite-dimensional subspace in which is now completely eliminated, which greatly simplifies the squashed state lives. Furthermore, for any state the system configuration. with the block-diagonal structure in the photon num- We then analyse the security of the protocol under ber basis, applying the modified measurement on the the assumption of collective attacks and in the asymp- squashed state is equivalent to applying the original totic limit. To bound Eve’s uncertainty about the key, measurement to the original state. we adopt the refined Pinsker’s inequality proposed in While our method also exploits the fact that the Ref. [49] and the channel estimation technique pre- measurements are block-diagonal in the photon num- sented in Ref. [41]. Our security analysis framework ber basis, our argument to reduce the dimension of allows us to work in the trusted device scenario which the optimisation problem is different from the method permits us to incorporate characterised device imper- presented in Ref. [53]. To be precise, the constraints fections (such as limited detector efficiency) into our that we use in our optimisation are based on the security analysis. bounds on the statistics for the case in which Bob From our simulation, we find that the protocol sup- does not receive more photons than the ones pre- ports high key generation rate, especially in the low pared by Alice. Then, we argue that there exists a loss regime. For instance, operating at a repetition finite-dimensional state that is an optimal solution rate of 1 GHz would amount to an asymptotic secret to our optimisation problem. In contrast, Ref. [53] key rate of about 6.9 Mbit/s at 5 km assuming an formulated the constraints based on the statistics of effective detector efficiency of 72%. While its perfor- the full infinite-dimensional measurements and hence, mance is not as robust to loss as compared to DV- they have to construct the flag-state squasher to ac- QKD protocols, it shows promising potential for ap- count for the contribution of the higher photon num- plications in metropolitan-distance QKD as it could ber subspace. potentially distribute keys across 15 km with a real- Finally, while we propose a protocol with reverse istic detector efficiency. reconciliation in this work, one could also consider performing direct reconciliation. However, our initial findings show that the variant with direct reconcilia- tion has less robustness against loss compared to our Acknowledgement proposed protocol. However, interestingly, the direct reconciliation protocol could also extract randomness We would like to thank Xiao Jie Tan for his contri- from the multiphoton components of the weak coher- bution in studying the direct reconciliation version of ent pulse, as long as the photon number is preserved in this protocol. We would also like to thank Bing Qi, the channel. When the photon number is preserved, René Schwonnek, Wen Yu Kon, and Emilien Lavie we know that Eve is not performing photon-number- for helpful discussion. We acknowledge funding sup- splitting attack and our method allows Alice and Bob port from the National Research Foundation of Sin- to bound the probability that the photon number is gapore (NRF) Fellowship grant (NRFF11-2019-0001) preserved, i.e., qn|n , thanks to the homodyne detec- and NRF Quantum Engineering Programme 1.0 grant tion with a random LO phase. (QEP-P2) and the Centre for Quantum Technologies. Accepted in Quantum 2021-12-24, click title to verify. Published under CC-BY 4.0. 11
A Non-ideal homodyne detector
A.1 POVM element
In the Section 3 of the main text, we have assumed that the homodyne detection that we use is an ideal homodyne
detector with 100% quantum efficiency and no additional electronic noise. To account for the imperfection in
the homodyne detector, it is sufficient to consider imperfect quantum efficiency detector since electronic noise
is equivalent to optical loss after re-calibration of the vacuum noise [52]. Alternatively, one could also use the
model presented in Ref. [17].
Now, to model the imperfect quantum efficiency, we model the realistic homodyne detector using a virtual
beam-splitter with transmittivity ηdet , followed by an ideal quadrature measurement. Suppose the incoming
signal mode is associated to the annihilation operator â and the other input mode (the vacuum mode) to the
beam-splitter is associated to the annihilation operator b̂. Let the output mode of the beam-splitter in which
the ideal quadrature measurement is performed be denoted by â0 . Then we have
√
â0 = ηdet â + 1 − ηdet b̂
p
(40)
and
0 √ p
Q̂(a
ϕ
)
= ηdet Q̂(a)
ϕ + 1 − ηdet Q̂(b)
ϕ , (41)
(a )
where Q̂ϕ j = âj e−iϕ + â†j eiϕ is the quadrature operator in mode âj with local oscillator phase ϕ. Now, the
ideal POVM element Πϕ (q) can be written as
Z
Πϕ (q) = |q(ϕ)ihq(ϕ)| = dq 0 δ(q − q 0 ) |q 0 (ϕ)ihq 0 (ϕ)| , (42)
where δ(·) is the Dirac’s delta function. Recalling the following identity
Z
0 1 0
δ(q − q ) = dλ eiλ(q−q ) , (43)
2π
and then using the spectral decomposition of the quadrature operator, we can write the ideal POVM element
as Z
1
Πϕ (q) = dλ eiλ(Q̂ϕ −q) . (44)
2π
Applying the above relation to the quadrature measurement in mode â0 , we have
√
Z Z
1 0) 1 √
iλ(Q̂(a −q) (a) (b)
ϕ
Πηdet (q) = dλ e ϕ = dλ eiλ( ηdet Q̂ϕ −q) hv| eiλ 1−ηdet Q̂ϕ |vi (45)
2π 2π
by tracing over the mode b̂. After using spectral decomposition again (for quadrature operators in mode â and
b̂), we have
√
Z Z Z
1 √
ϕ iλ( ηdet q 0 −q) 0 0 2
Πηdet (q) = dλ dx e |q (ϕ)ihq (ϕ)| dy eiλ 1−ηdet y |ψ0 (y)| , (46)
2π
where the projector |q 0 (ϕ)ihq 0 (ϕ)| is the quadrature projection for mode â and ψ0 (y) is the wavefunction of the
vacuum state. Performing the integration over y, we have
√
2
λ (1 − ηdet )
Z
2
dy eiλ 1−ηdet y |ψ0 (y)| = exp − . (47)
2
Now, performing the integration over λ, we have
√
( ηdet q 0 − q)2
Z r
√ 0 2 2π
dλ eiλ( ηdet q −q) e−λ (1−ηdet )/2 = exp − . (48)
1 − ηdet 2(1 − ηdet )
Hence, finally we obtain
√
(q − ηdet q 0 )2
Z
1
Πϕ
ηdet (q) = dq 0 p exp − |q 0 (ϕ)ihq 0 (ϕ)| , (49)
2π(1 − ηdet ) 2(1 − ηdet )
i.e., a convolution of the ideal POVM element with a Gaussian function.
Accepted in Quantum 2021-12-24, click title to verify. Published under CC-BY 4.0. 12A.2 Block-diagonal structure
A crucial element of our security proof is the argument that Bob’s measurement is block-diagonal in the photon
number basis. Here, we will show that the same structure is still preserved when we have imperfect detector.
Given the expression for the POVM element derived in the previous section, we can also obtain the POVM
element for the quadrature measurement in the early and late time-bins
√
(q0 − ηdet q00 )2
Z
1 0
ϕ
Πηdet (q0 , q1 ) = dq0 exp − |q00 (ϕ)ihq00 (ϕ)| ⊗
2π(1 − ηdet ) 2(1 − ηdet )
√
(q1 − ηdet q10 )2
Z
dq10 exp − |q10 (ϕ)ihq10 (ϕ)| . (50)
2(1 − ηdet )
Taking into account phase randomisation, we have
Z
1
Πηdet (q0 , q1 ) = dϕ Πϕ
ηdet (q0 , q1 ). (51)
2π
To see that the block-diagonal structure is preserved, observe that only the projectors depend on ϕ while the
exponential terms do not. As such, we could switch the order of the integration and perform the integration
over ϕ before performing the convolutions. However, the integration over ϕ is exactly the same as the one we
did in (9) and hence the block-diagonal structure is preserved.
A.3 Energy measurement
(a0 )
Our model for imperfect homodyne detector (41) allows us to relate the observed homodyne measurement Q̂ϕ
(a)
to an ideal quadrature measurement in the signal mode Q̂ϕ . If one is interested in the number of photons in
the signal mode, we have to calculate the expectation value of the number operator in mode â, i.e., N̂ (a) = ↠â.
To that end, consider the number operator in mode â0
0 √ √
N̂ (a ) = â0† â0 = ( ηdet â + 1 − ηdet b̂)† ( ηdet â + 1 − ηdet b̂)
p p
p (52)
= ηdet ↠â + (1 − ηdet )b̂† b̂ + ηdet (1 − ηdet )(↠b̂ + âb̂† ).
Since the input state in mode b̂ is the vacuum state, we have
0
hN̂ (a ) i = ηdet hN̂ (a) i (53)
and since
0 hqβ2 iµ=µi − 1
hN̂ (a ) iµ=µi = , (54)
2
we have
hqβ2 iµ=µi − 1
ωi := hN̂ (a) iµ=µi = , (55)
2ηdet
where Z
dϕ (a0 ) 2
hqβ2 iµ=µi = Q̂ϕ (56)
2π µ=µi
is the observed mean-square quadrature measurement when Alice chooses intensity µ = µi .
A.4 Probability distribution of the discretised quadrature measurement
Finally, the imperfect detection efficiency would affect the probability distribution of the discretised quadrature
measurement of Fock states |mi. Suppose Bob receives the Fock state |mi in the signal mode â0β , for each β,
the observed probability distribution would be given by
β
X m β,ideal
Cν|m = (1 − ηdet )m−k ηdet
k
Cν|k , (57)
k
k≤m
where Z (ν+1)δ
β,ideal 2
Cν|k = dq|ψk (q)| (58)
νδ
is the probability of the outcome of the ideal quadrature measurement on the Fock state |ki to be inside interval
Iν .
Accepted in Quantum 2021-12-24, click title to verify. Published under CC-BY 4.0. 13B Postselection map and pinching channel
In this section, we will derive the expression for the postselected state and the pinched state which are needed
to apply the refined Pinsker’s inequality. To define the postselection map G (n) and pinching channel T , it is
convenient to implement the channels in terms of isometries. Note that all the calculations done in this section
are conditioned on Alice preparing N = n photons as well as her choosing the signal intensity µ = µ0 .
First, the untrusted quantum channels can be thought of as isometries UA0 →BEM that maps the system A0
to B and E where E is held by Eve and M is the classical register that stores the number of photons that Bob
receives X√
n
UA0 →BEM : |ax iA0 → qm|n φma,x,n BE |miM , (59)
m
where a ∈ {0, 1}, x ∈ {X, Z} and qm|n is the probability that Bob receives m photons conditioned on Alice
sending n photons. The state { φm a,x,n BE }a,x,n,m are entangled states shared by Bob and Eve. In passing, we
remark that by tracing out the systems E and M, we should recover the completely-positive and trace-preserving
(n)
(CPTP) map EA0 →B
Now, using Naimark’s dilation, Bob’s measurement can also be thought of as an isometry VXBEM→XRBEM
X
VXBEM→XRBEM : |xiX φma,x,n BE |miM → |xiX |biR Ω̃b,m
a,x,n BE |miM , (60)
b
where the measurement outcome B can be obtained
n by performing
o projective measurements {|bihb|}b on the
b,m
ancilla system R. The sub-normalised states Ω̃a,x,n BE are given by
a,x,n,m,b
q
(m)
Ω̃b,m
a,x,n BE
= Mb|x ⊗ 1E φm
a,x,n BE
, (61)
(m)
with Mb|x is the POVM element of Bob’s measurement in the m-photon subspace.
For the postselection process, we consider the isometry WXR→XRC where the system C is the classical register
that indicates whether the state will be kept or discarded in the postselection process
|XiX |biR → |XiX |biR |discardiC ∀b
WXR→XRC : |ZiX |biR → |ZiX |biR |discardiC if B ∈ {∅, ?} . (62)
|ZiX |biR → |ZiX |biR |keepiC if B ∈ {0, 1}
P
Note that applying the isometries and then projecting to the projector |keepihkeep|C and m≤n |mihm|M and
followed by tracing out the irrelevant systems is equivalent to the postselection map G (n) . Doing the projection,
we get
X 1 X X ED 0
qm|n pZ |ZihZ|X ⊗ |aiha0 |A ⊗ |bihb0 |R ⊗ Ω̃b,m
a,Z,n Ω̃ba0,m
,Z,n
2 0 0 BE (63)
m≤n a,a b,b ∈{0,1}
⊗ |mihm|M ⊗ |keepihkeep|C ,
and tracing out the systems that are either held by Eve or announced during the protocol, namely E, X, C and
M, the final state is given by
(n)
X X q
(m)
(m,n)
q
(m)
σ̃ABR = 1A ⊗ Mb|Z ρ̃Z 1A ⊗ Mb0 |Z ⊗ |bihb0 |R , (64)
m≤n b,b0 ∈{0,1}
where h i
(m,n) (m,n)
ρ̃Z = TrX (|ZihZ|X ⊗ 1AB ) ρ̃XAB (|ZihZ|X ⊗ 1AB ) (65)
is the (sub-normalised) state conditioned on Z-basis and m photons are received by Bob and Alice prepares n
(n)
photons. To normalise the final state, we need to divide σ̃ABR by the appropriate factor, namely
(n)
X
pPS = pZ · qm|n · Pr[b ∈ {0, 1}|M = m, N = n, X = Z]. (66)
m≤n
Accepted in Quantum 2021-12-24, click title to verify. Published under CC-BY 4.0. 14Then, denoting
(n)
(n) σ̃ABR
σABR = (n)
(67)
pPS
as the normalised postselected state, we have
h i
(n) (n) (n) (n)
G (n) ρXAB = σ̃ABR = pPS · σABR , (68)
and since the measurement on R is projective, the pinched state can be obtain by
h i
(n) (n)
T σABR = (1AB ⊗ |0ih0|R )σABR (1AB ⊗ |0ih0|R )
(69)
(n)
+ (1AB ⊗ |1ih1|R ) σABR (1AB ⊗ |1ih1|R ) .
References
[1] Valerio Scarani, Helle Bechmann-Pasquinucci, Nicolas J. Cerf, Miloslav Dušek, Norbert Lütkenhaus, and
Momtchil Peev. The security of practical quantum key distribution. Rev. Mod. Phys., 81:1301–1350, Sep
2009. DOI: 10.1103/RevModPhys.81.1301. URL https://doi.org/10.1103/RevModPhys.81.1301.
[2] Feihu Xu, Xiongfeng Ma, Qiang Zhang, Hoi-Kwong Lo, and Jian-Wei Pan. Secure quantum key distribution
with realistic devices. Rev. Mod. Phys., 92:025002, May 2020. DOI: 10.1103/RevModPhys.92.025002. URL
https://doi.org/10.1103/RevModPhys.92.025002.
[3] Stefano Pirandola, Ulrik L Andersen, Leonardo Banchi, Mario Berta, Darius Bunandar, Roger Colbeck,
Dirk Englund, Tobias Gehring, Cosmo Lupo, Carlo Ottaviani, et al. Advances in quantum cryptography.
Advances in Optics and Photonics, 12(4):1012–1236, 2020. DOI: 10.1364/AOP.361502. URL https://
doi.org/10.1364/AOP.361502.
[4] A. I. Lvovsky and M. G. Raymer. Continuous-variable optical quantum-state tomography. Rev. Mod. Phys.,
81(1):299–332, 2009. DOI: 10.1103/RevModPhys.81.299. URL https://doi.org/10.1103/RevModPhys.
81.299.
[5] Christian Weedbrook, Stefano Pirandola, Raúl García-Patrón, Nicolas J. Cerf, Timothy C. Ralph, Jeffrey H.
Shapiro, and Seth Lloyd. Gaussian quantum information. Rev. Mod. Phys., 84(2):621–669, 2012. DOI:
10.1103/RevModPhys.84.621. URL https://doi.org/10.1103/RevModPhys.84.621.
[6] G. Zhang, J. Y. Haw, H. Cai, F. Xu, S. M. Assad, J. F. Fitzsimons, X. Zhou, Y. Zhang, S. Yu, J. Wu,
W. Ser, L. C. Kwek, and A. Q. Liu. An integrated silicon photonic chip platform for continuous-variable
quantum key distribution. Nat. Photonics, 13:839–842, 2019. DOI: 10.1038/s41566-019-0504-5. URL
https://doi.org/10.1038/s41566-019-0504-5.
[7] Francesco Raffaelli, Giacomo Ferranti, Dylan H. Mahler, Philip Sibson, Jake E. Kennard, Alberto San-
tamato, Gary Sinclair, Damien Bonneau, Mark G. Thompson, and Jonathan C. F. Matthews. A ho-
modyne detector integrated onto a photonic chip for measuring quantum states and generating ran-
dom numbers. Quantum Sci. Technol., 3(2):025003, 2018. DOI: 10.1088/2058-9565/aaa38f. URL
https://doi.org/10.1088/2058-9565/aaa38f.
[8] Joel F Tasker, Jonathan Frazer, Giacomo Ferranti, Euan J Allen, Léandre F Brunel, Sébastien Tanzilli,
Virginia D’Auria, and Jonathan CF Matthews. Silicon photonics interfaced with integrated electronics for 9
GHz measurement of squeezed light. Nature Photonics, 15:11–15, 2020. DOI: 10.1038/s41566-020-00715-5.
URL https://doi.org/10.1038/s41566-020-00715-5.
[9] Cédric Bruynsteen, Michael Vanhoecke, Johan Bauwelinck, and Xin Yin. Integrated balanced homo-
dyne photonic–electronic detector for beyond 20 GHz shot-noise-limited measurements. Optica, 8(9):1146,
September 2021. ISSN 2334-2536. DOI: 10.1364/OPTICA.420973. URL https://doi.org/10.1364/
OPTICA.420973.
[10] Frédéric Grosshans, Gilles Van Assche, Jérôme Wenger, Rosa Brouri, Nicolas J. Cerf, and Philippe Grangier.
Quantum key distribution using Gaussian-modulated coherent states. Nature, 421:238–241, 2003. DOI:
10.1038/nature01289. URL https://doi.org/10.1038/nature01289.
[11] Eneet Kaur, Saikat Guha, and Mark M. Wilde. Asymptotic security of discrete-modulation protocols for
continuous-variable quantum key distribution. Phys. Rev. A, 103:012412, Jan 2021. DOI: 10.1103/Phys-
RevA.103.012412. URL https://doi.org/10.1103/PhysRevA.103.012412.
[12] Yi-Bo Zhao, Matthias Heid, Johannes Rigas, and Norbert Lütkenhaus. Asymptotic security of binary
modulated continuous-variable quantum key distribution under collective attacks. Phys. Rev. A, 79:012307,
Jan 2009. DOI: 10.1103/PhysRevA.79.012307. URL https://doi.org/10.1103/PhysRevA.79.012307.
Accepted in Quantum 2021-12-24, click title to verify. Published under CC-BY 4.0. 15You can also read
