Improving the Performance of Practical Decoy-State Measurement-Device-Independent Quantum Key Distribution with Biased Basis Choice
Zhang Chun-Hui, Zhang Chun-Mei, Wang Qin
Institute of Signal Processing Transmission, Nanjing University of Posts and Telecommunications, Nanjing 210003, China Key Lab of Broadband Wireless Communication and Sensor Network Technology, Nanjing University of Posts and Telecommunications, Ministry of Education, Nanjing 210003, China

 

† Corresponding author. E-mail: qinw@njupt.edu.cn

Supported by the National Key Research and Development Program of China under Grant Nos. 2018YFA0306400, 2017YFA0304100, the National Natural Science Foundation of China under Grants Nos. 61475197, 61590932, 11774180, 61705110, the Natural Science Foundation of the Jiangsu Higher Education Institutions under Grant Nos. 15KJA120002, 17KJB140016, the Outstanding Youth Project of Jiangsu Province through Grant No. BK20150039, the Natural Science Foundation of Jiangsu Province under Grant No. BK20170902, the Postgraduate Research and Practice Innovation Program of Jiangsu Province

Abstract
Abstract

Statistical fluctuations are unavoidable in realistic quantum key distribution (QKD) due to finite-size effect. Based on the four-intensity proposal on measurement-device-independent QKD (MDI-QKD) in [Phys. Rev. A 93 (2016) 042324], we particularly analyze the scenario that only three intensities are used, namely a three-intensity decoy-state MDI-QKD with biased basis choice. After performing full parameter optimization method, simulations results demonstrate that this scenario can obtain distinct enhancement compared with the conventional unbiased three-intensity decoy-state method, e.g. Xu et al.’s [Phys. Rev. A 89 (2014) 052333]. Furthermore, results also show that it works more efficiently by using HSPS than using WCS at longer transmission distance.

1 Introduction

Based on the laws of quantum mechanics, quantum key distribution (QKD) in principle can possess unconditional security, which permits two legitimate users, usually called Alice and Bob, to share secret keys.[1] To date, many security proofs have been given by established models.[210] However, a malicious eavesdropper (Eve) can still make use of loopholes existing in practical QKD devices, launch specific attacks and crack them.[1114] To solve those problems, various protocols have been put forward, such as the decoy-state method,[1517] the measurement-device-independent QKD (MDI-QKD),[1819] the device-independent QKD,[2021] or the round-robin differential phase shift (RRDPS) protocol,[2223] etc. Among them, the decoy-state method can close those loopholes caused by imperfect light sources,[2427] and the MDI-QKD protocol can get rid of all side-channel attacks directed on detecting devices. The combination of the decoy-state method and the MDI-QKD protocol seems to contain the highest level of security within current technology, and thus has been extensively studied.[2842]

In real-life implementations of decoy-state MDI-QKD, the finite-size effect has to be taken into account due to finite number of pulses used, which significantly depresses the performance of practical QKD. Till today, different approaches have been reported to improve it,[32,34] in which the four-intensity proposal with biased basis choice[34] is the most promising method, significantly improving the performance of MDI-QKD. Here in this paper, we simplified the four-intensity proposal[34] into a biased three-intensity decoy-state MDI-QKD scheme. Moreover, we use two mostly used light sources, e.g., the weak coherent source (WCS) and the heralded single-photon source (HSPS), as examples and carry out corresponding numerical simulations. After performing full parameter optimization, we demonstrate that, especially with HSPS, this scheme can achieve substantial improvement in both the key generation rate and the secure transmission distance compared with former three-intensity decoy-state MDI-QKD.[32]

The article is organized as follows: First, three-intensity decoy-state MDI-QKD with biased basis choice is introduced in Sec. 2; Second, corresponding numerical simulations are carried out in Sec. 3; Finally, discussions and conclusions are given in Sec. 4.

2 The Biased Three-Intensity Decoy-State MDI-QKD

Here, the three-intensity decoy-state method with biased basis choice in MDI-QKD is described as follows:

(i) Alice (Bob) randomly prepares signal state ρμ in Z, and X bases with certain probabilities.

(ii) Alice (Bob) prepares decoy state ρv only in X basis.

(iii) When preparing vacuum state ρo, Alice (Bob) does not choose any basis.

It is different from the normal three-intensity decoy-state MDI-QKD protocol,[43] such as Xu et al.’s method,[32] as shown in Table 1. In this scheme, the redundancy on preparing states in Z basis for the decoy states is removed.

Table 1

The difference on preparing states between normal 3-intensity decoy-state method and ours in MDI-QKD. The “-” here denotes that Alice (Bob) does not need to choose X basis or Z basis for vacuum state.

.

In a three-intensity decoy-state MDI-QKD protocol, Alice and Bob individually prepare their light pulses into three different states, i.e., the vacuum state (ρo = |0⟩ ⟨0|), the decoy state (ρv) and the signal state (ρμ). In the photon-number space, the vacuum, decoy and signal states of Alice and Bob can be written as

where|n⟩ is an n-photon state; the subscript A or B each denotes Alice or Bob; () corresponds to the photon-number distribution of source lA(rB) at Alice’s (Bob’s) side, (l, r = o,v,μ). For any light sources with convex photon-number distribution functions, , , , for n ≥ 0, and for n ≥ 2, they satisfy the condition:[36]

When Alice sends pulses with state ρlA and Bob sends pulses with state ρrB, the average counting rate (Slr) and quantum-bit errors (Tlr : SlrElr) at the untrustworthy third party (UTP)’s side can be expressed as:

where Yjk and ejk each denotes the yield and the error rate when Alice sends a j-photon state and Bob sends a k-photon state, Elr corresponds to the average quantum-bit error-rate (QBER), and the notation lr here indicates the two-pulse source when Alice uses source lA and Bob uses source rB to generate a pulse pair.

Evidently, it is hard to give precise estimation for the yield of two-single-photon pulses in Z basis () by employing only the observed data in Z basis, since no decoy pulses have been prepared in Z basis. Interestingly, Ref. [34] has provided a theorem: The yield of two-single-photon pulses in all bases (X and Z) can be tightly lower bounded by using the observed data in the X basis. It has also given a detailed proof for this theorem. Note that Ref. [34] implements four-intensity decoy states, while we need only three different intensities in the simplified scheme. It can not only simplify the complexity of the QKD system, but also reduce the cost of random numbers by using three-intensity decoy-states instead of using four-intensity decoy states in practical QKD system.

To avoid redundancy, hereafter, we just borrow the conclusive result from Ref. [34] and use the observed data in X basis to estimate the lower bound of . Then we can obtain:[3132]

where

The phase-flip error-rate of the two-single-photon pulses in Z basis can be upper bounded by the quantum-bit error-rate (QBER) of the two-single-photon pulses in X basis, given by:[3132]

The and (l,r = o,v,μ) in Eqs. (5)–(7) have been defined as:

where γ is a constant coefficient depending on the failure probability ε; refers to the number of pulse-pairs when Alice sends state ρlA and Bob sends state ρrB both in X basis. Here for simplification, we consider the finite-size effect with the standard statistical fluctuations,[28] but it would not influence the main conclusion even with other analysis methods, such as the Chernoff bound method.[44]

With the above formulae, we can calculate the final secure key rate as:[32]

where pμA (pμB) denotes the probability that Alice (Bob) chooses state ρμA (ρμB), and pZ|μA (pZ|μB) corresponds to the probability that Alice (Bob) sends pulses with state ρμA (ρμB) in Z basis; f is the inefficiency of error correction, here we reasonably assume f = 1.16;[19,32]H2(p) is the binary Shannon information function, defined as H2(p) : = −p log2(p) − (1 − p) log2(1 − p); and each denotes the average counting rate and the average QBER in Z basis.

3 Numerical Simulations

In this section, we employ two kinds of light sources, i.e., the WCS and the HSPS, as examples to investigate the performance of our method and the representative decoy-state MDI-QKD scheme,[32] both carrying out the full parameter optimization method presented in Ref. [32].

As we know, a WCS usually possesses a poissonian photon-number distribution:[28]

and an HSPS follows a subpossonian photon-number distribution:[30]

where μ represents the average photon number per pulse, |n⟩ denotes an n-photon state, ηA and dA each corresponds to the detection efficiency and dark count rate of Alice (or Bob)’s local detector in HSPS.

To simplify the numerical simulation, here we assume the symmetrical case, i.e., the UTP is located in the middle between Alice and Bob, and has identical detectors (with the same dark count rates and detection efficiencies). Besides, Alice and Bob possess the same optical and QKD systems. For the case of using HSPS, Alice and Bob own the same local detectors. Then we have, for all n, and pvA = pvB = pv, pμA = pμB = pμ, pZ|μA = pZ|μB = pZ|μ. Moreover, when accounting for statistical fluctuations, we reasonably set the confidence interval as γ = 5.3, corresponding to a failure probability of 10−7.[30,32] We use the same experimental parameters as in Ref. [32] in our simulation, as listed in Table 2.

Table 2

The systematic parameters used in our numerical simulations. α represents the loss coefficient of standard commercial single-mode fibers; e0 denotes the error rate of vacuum pulses; ed refers to the misalignment probability of the whole optical system; ηd and Y0 each corresponds to the detection efficiency and the dark count rate of detectors at the UTP’s side; ηA and dA are the detection efficiency and the dark count rate of the commercial silicon detector at Alice (or Bob)’s side when applying HSPS.

.

In the following, for a fair comparison, we use the same full parameter optimization method presented in Ref. [32], i.e., the local search algorithm (LSA), for both Xu et al.’s method and our method, which includes the intensities of the signal states (μ) and the decoy states (v), the probabilities of choosing different intensities (pμ, pv) and the probabilities of choosing different bases in corresponding intensities (pX|μ, pX|v in Xu et al.’s method, and pX|μ in ours). Corresponding simulation results are displayed out in Figs. 14.

Fig. 1 (Color online) Asymptotic comparison of the final key generation rate between Xu et al.’s work and our work. (a) The absolute values of the final key rates with logarithm scale: W0 (H0) refers to the results of using standard three-intensity decoy-state MDI-QKD with WCS (HSPS) without considering statistical fluctuations; W1 (H1) represents the results of employing Xu et al.’s three-intensity decoy-state MDI-QKD with WCS (HSPS) by accounting for statistical fluctuations; W2 (H2) corresponds to applying our method with WCS (HSPS) when taking statistical fluctuations into account. (b) The relative values of final key generation rates. We set N = 1025 for the both cases when accounting for statistical fluctuations.

In order to show the consistence of the scheme with other former work, we calculate the final key generation rate of using this method and Xu et al.’s work[32] when both taking statistical fluctuations into account, while setting the number of pulses with a very large value, e.g., N = 1025. Moreover, we also calculate the key generation rate of using standard three-intensity decoy-state MDI-QKD without considering statistical fluctuations, as shown in Fig. 1. We can see from Fig. 1(a) that when the number of pulses is very large, e.g., N = 1025, both our method (W2 (H2)) and Xu et al.’s work (W1 (H1)) approach very closely to the ideal case of without accounting for statistical fluctuations (W0 (H0)). Moreover, in order to illustrate it more clearly, we also display the relative key rate in Fig. 1(b). It denotes the ratio of the key rate between using practical three-intensity decoy-state methods and corresponding asymptotic case of using infinite number of pulses, which again verifies the the consistence of our method with Xu et al.’s work. Below we also give analytical explanations on it.

In the limit N → ∞, the density matrices satisfy , which means the quantum states of two-single-photon pulses in X basis or Z basis are completely the same. Then, the counting rates of two-single-photon pulses satisfy . Besides, in Eqs. (4)–(7), and . As a result, the key rates of both our method and Xu et al.’s work approach very closely to the ideal case of without accounting for statistical fluctuations.

In Fig. 2, we do comparison on the contributions of two-single-photon pulses, i.e., its conditional counting rate () and the phase-flip error-rate () between Xu et al.’s work[32] and our method using either WCS or HSPS. Here the data size of the pulse number is reasonably set as N = 1011. We can see from Figs. 2(a) and 2(b) that, both methods present comparable values of . While for the values of , our method presents much lower values than the former as shown in Figs. 2(c) and 2(d). Obviously, our method can achieve more precise estimation for compared with Xu et al.’s work. Because we have removed the redundancy on preparing states in Z basis for the decoy states and without influencing the security. Then there will be more data in X basis to be applied to estimate the value of . Correspondingly, our method will suffer less finite-size effect and can thus show significant enhancement in both the key generation rate and the secure transmission distance compared with Xu et al.’s work.[32]

Fig. 2 (Color online) Comparisons of the two-single-photon-pulse contributions between Xu et al.’s work and ours. (a) and (c) correspond to the results of using WCS, while (b) and (d) denote using HSPS. W1 (H1) refers to implementing Xu et al.’s three-intensity decoy-state method, and W2 (H2) represents applying our method. Here we reasonably set the number of pulses as N = 1011.

Figure 3 shows comparisons of the final key generation rate between our method and Xu et al.’s method using either WCS or HSPS and considering different data sizes. Figures 3(a) and 3(b) refer to the absolute key generation rates with logarithmic coordinate, while Figs. 3(c) and 3(d) correspond to the relative values with linear scale. Obviously, our method can drastically improve the key generation rate compared with Xu et al.’s work using either WCS or HSPS. And the smaller data size, the more distinct enhancement we can achieve. Moreover, our method applying HSPS works more efficiently than using WCS. For example, at the data size of N = 1011 and at the distance of 100 km, there is no key can be generated by using WCS, while a relative high key rate can still be obtained by applying HSPS. Moreover, when both using HSPS, we can get more than 40% enhancement in the key generation rate at the data size of N = 1012, and 300% enhancement at N = 1011 when compared with Xu et al.’s method. Those enhancements can be attributed to two inherent merits of HSPS: (i) The neglectable dark count rate; (ii) The significantly lower probability for events with two photons presenting on the same side of the beam-splitter during Bell-projection measurements.

Fig. 3 (Color online) Comparisons of the final key generation rate between Xu et al.’s method and ours. (a) and (c) correspond to the results of using WCS, while (b) and (d) refer to using HSPS. W1 (H1) represents the results of applying Xu et al.’s method, and W2 (H2) denotes using our method. Moreover, from the left to the right, the numbers of pulses are set from 1011 to 1012.
Fig. 4 (Color online) Comparisons of the final key generation rate between Xu et al.’s method and ours by applying the Chernoff bound analysis. (a) displays the absolute key generation rates with logarithmic coordinate, and (b) exhibits the relative values with linear scale. W1 (H1) represents the results of Xu et al.’s method, and W2 (H2) denotes ours. Here the number of pulses is reasonably set at N = 1011.

Moreover, to demonstrate that the merits of the present scheme will not change even when the Chernoff bound[44] is applied in analyzing statistical fluctuations, we plot Fig. 4 by implementing the Chernoff bound method on the above two schemes. Here the data size is reasonably set N = 1011. The absolute values and the relative values are respectively shown in Figs. 4(a) and 4(b). Obviously, we can find the same trends as in Fig. 3.

4 Conclusions

In conclusion, we have applied the idea of biased basis choice in Ref. [34] into the three-intensity decoy-state MDI-QKD scheme and carried out full parameter optimization on it. Compared with Xu et al.’s three-intensity scheme,[34] here the main difference is that the decoy pulses only prepared in X basis, which leads to more data in X basis for estimating the quantum-bit error-rate of two-single-photon pulses accurately. Therefore, this method suffers less finite-size effect during parameter estimations and can achieve better performance in the key distillation. Furthermore, numerical simulation results show that this method works more efficiently by using HSPS than using WCS at longer transmission distance. This attributes to the negligible dark count rate in HSPS, and dramatically lower probability for events with two photons presenting on the same side of the beam-splitter in HSPS than in WCS. In addition, this method can be easily realized with current technology, and thus looks very promising in the implementation of the quantum communication.

Reference
[1] Bennett C. H. Brassard G. Proceedings of IEEE International Conference on Computers, Systems, and Signal Processing Bangalore India 1984 175 179
[2] Huttner B. Imoto N. Gisin N. Mor T. Phys. Rev. A 51 1995 1863
[3] Yuen H. P. Quantum Semiclassic. Opt. 8 1996 939
[4] Brassard G. Lütkenhaus N. Mor T. Sanders B. C. Phys. Rev. Lett. 85 2000 1330
[5] Lütkenhaus N. Jahma M. New J. Phys. 4 2002 44
[6] Lütkenhaus N. Phys. Rev. A 61 2000 052304
[7] Fung C. H. F. Qi B. Tamaki K. Lo H. K. Phys. Rev. A 75 2007 032314
[8] Qi B. Fung C. H. F. Lo H. K. Ma X. Quantum Inf. Comput. 7 2007 73
[9] Zhao Y. Fung C. H. F Qi B. et al. Phys. Rev. A 78 2008 042333
[10] Jain N. Wittmann C. Lydersen L. et al. Phys. Rev. Lett. 107 2011 110501
[11] Lydersen L. Wiechers C. Wittmann C. et al. Nat. Photon 4 2010 686
[12] Gerhardt I. Liu Q. Lamas-Linares A. et al. Nat. Commun. 2 2011 349
[13] Li H. W. Wang S. Huang J. Z. et al. Phys. Rev. A 84 2011 062308
[14] Bugge A. N. Sauge S. Ghazali A. M. M. et al. Phys. Rev. Lett. 112 2014 070503
[15] Hwang W. Y. Phys. Rev. Lett. 91 2003 057901
[16] Wang X. B. Phys. Rev. Lett. 94 2005 230503
[17] Lo H. K. Ma X. Chen K. Phys. Rev. Lett. 94 2005 230504
[18] Braunstein S. L. Pirandola S. Phys. Rev. Lett. 108 2012 130502
[19] Lo H. K. Curty M. Qi B. Phys. Rev. Lett. 108 2012 130503
[20] Acín A. Gisin N. Masanes L. Phys. Rev. Lett. 97 2006 120405
[21] Acín A. Brunner N. Gisin N. et al. Phys. Rev. Lett. 98 2007 230501
[22] Sasaki T. Yamamoto Y. Koashi M. Nature 509 2014 475
[23] Wang S. Yin Z. Q. Chen W. et al. Nat. Photon. 9 2015 832
[24] Ma X. Qi B. Zhao Y. Lo H. K. Phys. Rev. A 72 2005 012326
[25] Wang Q. Wang X. B. Guo G. C. Phys. Rev. A 75 2007 012312
[26] Wang Q. Chen W. Xavier G. et al. Phys. Rev. Lett. 100 2008 090501
[27] Zhang C. H. Luo S. L. Guo G. C. Wang Q. Phys. Rev. A 92 2015 022332
[28] Ma X. Fung C. H. F. Razavi M. Phys. Rev. A 86 2012 052305
[29] Li M. Zhang C. M. Yin Z. Q. et al. Opt. Lett. 39 2014 880
[30] Wang Q. Wang X. B. Phys. Rev. A 88 2013 052332
[31] Wang Q. Wang X. B. Sci. Rep. 4 2014 4612
[32] Xu F. Xu H. Lo H. K. Phys. Rev. A 89 2014 052333
[33] Wang Q. Zhang C. H. Luo S. L. Guo G. C. Quantum Inf. Process. 15 2016 3785
[34] Zhou Y. H. Yu Z. W. Wang X. B. Phys. Rev. A 93 2016 042324
[35] Zhang C. M. Zhu J. R. Wang Q. Phys. Rev. A 95 2017 032309
[36] Yu Z. W. Zhou Y. H. Wang X. B. Phys. Rev. A 88 2013 062339
[37] Rubenok A. Slater J. A. Chan P. et al. Phys. Rev. Lett. 111 2013 130501
[38] Liu Y. Chen T. Y. Wang L. J. et al. Phys. Rev. Lett. 111 2013 130502
[39] Ferreira da Silva T. Vitoreti D. Xavier G. B. et al. Phys. Rev. A 88 2013 052303
[40] Wang C. Song X. T. Yin Z. Q. et al. Phys. Rev. Lett. 115 2015 160502
[41] Yin H. L. Chen T. Y. Yu Z. W. et al. Phys. Rev. Lett. 117 2016 190501
[42] Comandar L. C. Lucamarini M. Fröhlich B. et al. Nat. Photon. 10 2016 312
[43] In normal three-intensity decoy-state MDI-QKD protocol, Alice and Bob each prepares the decoy and the signal states in both X basis and Z basis, where the Z basis is used for secure key distillation and the X basis for error test only. Thus the yield of two-single-photon pulses can be estimated with the observed data in Z basis while the phase-flip error-rate of two-single-photon pulses estimated by the observed data in X basis.
[44] Curty M. Xu F. Cui W. et al. Nat. Commun. 5 2014 3732