Finite-size analysis of unidimensional continuous-variable quantum key distribution under realistic conditions

Pu Wang; Xuyang Wang; Junqi Li; Yongmin Li

doi:10.1364/OE.25.027995

1. Introduction

Quantum key distribution (QKD) allows two remote and legal parties, Alice and Bob, to share a common secret key in a quantum channel, which is assumed to be controlled by a potential eavesdropper Eve, and an authenticated classical channel [1,2]. As a safe and advanced communication method, its security is based on the basic principles of quantum mechanics. Unlike discrete-variable QKD, continuous-variable (CV) QKD encodes the information into continuous-spectrum quantum observables and utilizes homodyne detectors instead of single-photon detectors. During the past decade, the theory and technology of CV QKD have undergone rapid development [3–28]. It is known that CV QKD protocols based on non-classical states demonstrate better performance than those based on coherent states. However, as the coherent state is easier to generate and only requires classical telecom technologies, coherent state based protocols have developed rapidly. Prototype machines have been developed, and several field tests have been completed [29–31]. It is believed that protocols based on coherent states can be used in practical applications in near future.

A further simplified unidimensional (UD) CV QKD protocol based on coherent states has recently been proposed [32]. Nearly simultaneously to this development, UD CV QKD was realized experimentally [33,34]. This asymmetric UD coherent state protocol allows the sender, Alice, to use one modulator instead of two, thereby reducing the complexity and cost of Alice’s apparatus. However, all previous works failed to take into account the finite-size effects, which are critical to the practical security of the QKD system.

In this paper, we mainly analyze the UD CV QKD protocol in a finite size scenario under realistic conditions. Firstly, in order to lay a good foundation, an introduction to the UD protocol under realistic conditions is presented. The analytic expression for the symplectic eigenvalues, which are used to calculate the secret key rate, is derived in order to significantly reduce the calculation time. Next, the dependence of the asymptotic secret key rate on realistic parameters, which will provide a useful guide for parameter selection, is investigated. When the amount of data samples used for parameter estimation is large in the finite size scenario, the secret key rate will approach the asymptotic secret key rate.

Unlike with the symmetrical (SY) coherent state protocol [7, 13], in the UD protocol we must estimate the transmission efficiency and excess noise of one quadrature, as well as the variance of the other quadrature. It is well known that the larger the amount of data samples used for parameter estimation, the weaker the finite size effect [35]. However, taking into consideration the real-time and stability of the QKD system, taking a longer period of time to increase the total number of samples is not necessarily beneficial. In order to distill the largest secret key rate from a limited total number of samples, a method is proposed to subdivide the data samples with an optimal ratio. After comparison, we can see that the UD protocol can achieve similar performance to its SY counterpart under realistic conditions, when the excess noise is low and number of samples is large. In particular, when the amount of data samples is large, the superiority of the UD protocol in data processing emerges.

In Sec. II, the UD CV QKD protocol under realistic conditions is presented, and the security under collective attack is analyzed using the entanglement-based (EB) scheme. Section III provides the numerical analysis of the secret key rate, depending on realistic parameters such as the reconciliation efficiency, detection efficiency, and electronic noise. Section IV presents the method of calculating the optimal ratio to divide the data samples in order to achieve the largest secret key rate under Gaussian collective attack in a finite size scenario. Finally, Section V presents the conclusions.

2. Unidimensional protocol under realistic conditions

2.1 An introduction to unidimensional protocol schemes

The prepare-and-measure (PM) scheme is shown in Fig. 1(a). The sender, Alice, displaces independent coherent states produced by a laser to a Gaussian distribution in the amplitude or phase quadrature, using one amplitude or phase modulator with a modulation variance $V_{M}$ . Note that the variances in this paper are all normalized to shot noise units. The Gaussian-modulated quantum states form a unidimensional chain structure in phase space with a length of $\sqrt{V_{M} + 1}$ and a thickness of 1. Alice sends these quantum states to Bob through an untrusted quantum channel, characterized by its transmission $T_{x}, T_{y}$ and excess noise $ε_{x}, ε_{y}$ . On the receiver Bob’s side, a balanced homodyne detector (BHD) with efficiency $η$ and electronic noise $υ_{e}$ is used to measure the amplitude or phase quadrature. In realistic conditions, it is supposed that the eavesdropper Eve cannot access Bob’s apparatus. The efficiency $η$ and electronic noise $υ_{e}$ are phase insensitive and should be calibrated before the communication.

Fig. 1 PM and EB schemes of the UD protocol under realistic conditions.

Download Full Size | PDF

The EB scheme, which is equivalent to the PM scheme of the UD protocol, is shown in Fig. 1(b). On Alice’s side, an Einstein-Podolsky-Rosen (EPR) state $ρ_{A B_{0}}$ with variance $V$ is utilized. Then, Alice squeezes one of its modes B0 with squeezing parameter $r = \ln \sqrt{V}$ . We denote the output mode S. Without loss of generality, we assume that the phase quadrature is squeezed. The resulting covariance matrix $γ_{A S}$ is

γ_{A S} = [\begin{matrix} V & 0 & \sqrt{V (V^{2} - 1)} & 0 \\ 0 & V & 0 & - \sqrt{(V^{2} - 1) / V} \\ \sqrt{V (V^{2} - 1)} & 0 & V^{2} & 0 \\ 0 & - \sqrt{(V^{2} - 1) / V} & 0 & 1 \end{matrix}] .

The mode $S$ , with variance $V^{2} = V_{M} + 1$ in the amplitude quadrature, is sent to the remote trusted party, Bob, through a phase-sensitive channel characterized by the transmission $T_{x}, T_{y}$ and excess noise $ε_{x}, ε_{y}$ ; the covariance matrix then becomes

γ_{A B_{1}} = [\begin{matrix} \sqrt{1 + V_{M}} & 0 & \sqrt{T_{x} V_{M}} {(1 + V_{M})}^{1 / 4} & 0 \\ 0 & \sqrt{1 + V_{M}} & 0 & C_{y}^{B_{1}} \\ \sqrt{T_{x} V_{M}} {(1 + V_{M})}^{1 / 4} & 0 & T_{x} (V_{M} + 1 + χ_{l i n e x}) & 0 \\ 0 & C_{y}^{B_{1}} & 0 & V_{y}^{B_{1}} \end{matrix}],

where

V_{y}^{B_{1}}

is the variance of mode

B_{1}

in the phase quadrature,

C_{y}^{B_{1}}

is the correlation between the two modes

A

and

B_{1}

in the phase quadrature, and

χ_{l i n e x}

is the channel noise in the amplitude quadrature and can be expressed as

χ_{l i n e x} = (1 - T_{x}) / T_{x} + ε_{x}

. Because there is no modulation in the phase quadrature, the correlation

C_{y}^{B_{1}}

cannot be estimated.

In the EB scheme, the realistic BHD can be modeled as a beam splitter with transmission $η$ and a perfect BHD. The electronic noise $V_{e}$ of the realistic BHD can be modeled as a thermal state $ρ_{R_{0}}$ , which could be considered to be the reduced state obtained from an EPR state $ρ_{R_{0} H}$ with variance $V_{N}$ entering the other input port of the beam splitter. The variance $V_{N}$ has a relationship with $υ_{e}$ given by $V_{N} = 1 + υ_{e} / (1 - η)$ . After the beam splitter, the covariance matrix $γ_{A B}$ has the form

γ_{A B} = [\begin{matrix} \sqrt{1 + V_{M}} & 0 & \sqrt{η T_{x} V_{M}} {(1 + V_{M})}^{1 / 4} & 0 \\ 0 & \sqrt{1 + V_{M}} & 0 & C_{y}^{B} \\ \sqrt{η T_{x} V_{M}} {(1 + V_{M})}^{1 / 4} & 0 & η T_{x} (V_{M} + 1 + χ_{t o t x}) & 0 \\ 0 & C_{y}^{B} & 0 & V_{y}^{B} \end{matrix}],

where

χ_{t o t x} = χ_{l i n e x} + χ_{hom} / T_{x}

is the total noise added between Alice and Bob relative to the channel input in the amplitude quadrature, and

χ_{hom} = (1 - η) / η + V_{e} / η

is the total noise introduced by the realistic BHD relative to Bob’s input in the amplitude quadrature.

V_{y}^{B}

is the variance of mode

B

in the phase quadrature. The noise

χ_{hom}

, which is phase insensitive, has the same value in both the amplitude and phase quadrature.

C_{y}^{B}

is the correlation between the two modes

A

and

B

in the phase quadrature.

V_{y}^{B}

and

C_{y}^{B}

are related to

V_{y}^{B_{1}}

and

C_{y}^{B_{1}}

as follows

V_{y}^{B} = η (V_{y}^{B_{1}} + χ_{hom}) a n d C_{y}^{B} = C_{y}^{B_{1}} \sqrt{η} .

2.2 Security analysis

In the asymptotic limit, the collective attack has been proven to be the optimal attack [14] and the corresponding secret key rate is given by

K^{\infty} = β \cdot I_{A B} - χ_{B E},

where

I_{A B}

is the Shannon mutual information between Alice and Bob,

χ_{B E}

represents the Holevo bound between Bob and Eve for reverse reconciliation, and

β

is the reverse reconciliation efficiency. The mutual information can be calculated by the following expression

I_{A B} = \frac{1}{2} \log_{2} (1 + \frac{V_{M}}{1 + χ_{t o t x}}) .

The Holevo bound is defined as

χ_{B E} = S (ρ_{E}) - S (ρ_{E}^{x_{B}}),

where

S (ρ_{E})

is the von Neumann entropy of the eavesdropper’s quantum state

ρ_{E}

, and

S (ρ_{E}^{x_{B}})

is the conditional von Neumann entropy. As

S (ρ_{A B_{1}}) = S (ρ_{E})

and

S (ρ_{E}^{x_{B}}) = S (ρ_{A R H}^{x_{B}})

[13], we can rewrite

χ_{B E}

as

χ_{B E} = S (ρ_{A B_{1}}) - S (ρ_{A R H}^{x_{B}}) .

After an elaborate derivation, the analytical expression for the symplectic eigenvalues of the covariance matrix $γ_{A B_{1}}$ is

λ_{1, 2}^{2} = \frac{1}{2} (A \pm \sqrt{A^{2} - 4 B}),

where

A = 1 + V_{y}^{B_{1}} + V_{M} + V_{y}^{B_{1}} (ε_{x} + V_{M}) T_{x} + 2 C_{y}^{B_{1}} {(1 + V_{M})}^{\frac{1}{4}} \sqrt{V_{M} T_{x}},

B = (V_{y}^{B_{1}} (1 + V_{M}) - {(C_{y}^{B_{1}})}^{2} \sqrt{1 + V_{M}}) (1 + ε_{x} T_{x}) .

The analytical expressions for the symplectic eigenvalues $λ_{3, 4, 5}$ of the covariance matrix $γ_{A R H}^{x_{B}}$ are

λ_{3, 4}^{2} = \frac{1}{2} [C \pm \sqrt{C^{2} - 4 D}], λ_{5} = 1

where

C = \frac{A (1 + υ_{e}) + ((ε_{x} T_{x} + 1) (V_{M} + 2) + V_{M} T_{x} - A) η}{1 + ε_{x} T_{x} η + V_{M} T_{x} η + υ_{e}},

D = \frac{B (1 + υ_{e} - η) + (1 + V_{M}) (1 + ε_{x} T_{x}) η}{1 + ε_{x} T_{x} η + V_{M} T_{x} η + υ_{e}} .

The Holevo bound can be obtained by

χ_{B E} = G (λ_{1}) + G (λ_{2}) - G (λ_{3}) - G (λ_{4}),

where

G (x) = (x + 1) \log_{2} (x + 1) - x \log_{2} x

. The variables

C_{y}^{B_{1}}

and

V_{y}^{B_{1}}

have uncertainty constrained by the Heisenberg uncertainty principle as

γ_{A B_{1}} + i \cdot Ω \geq 0,

where

Ω = \oplus_{k = 1}^{n =2} [\begin{matrix} 0 & 1 \\ - 1 & 0 \end{matrix}] .

We then obtain the parabolic equation

{(C_{y}^{B_{1}} - C_{0})}^{2} \leq \frac{V_{M}}{\sqrt{(1 + V_{M})}} \frac{χ_{linex}}{1 + χ_{linex}} (V_{y}^{B_{1}} - V_{0}),

where

V_{0} = \frac{1}{T_{x} (1 + χ_{l i n e x})}

and

C_{0} = - \frac{V_{0} \sqrt{T_{x} V_{M}}}{{(1 + V_{M})}^{1 / 4}} .

The parabolic curve between $C_{y}^{B_{1}}$ and $V_{y}^{B_{1}}$ is shown in black in Fig. 2. The whole plane is divided into two regions by the parabolic curve, i.e., physical region and unphysical region. The region contained by the parabolic curve is the physical region, which is divided into secure and unsecure regions by the solid cyan curve. In the secure region, the secret key rate is greater than zero. In the unsecure region, the secret key rate is less than zero. In the unphysical region, the values of $C_{y}^{B_{1}}$ and $V_{y}^{B_{1}}$ cannot be satisfied simultaneously. For more details about the regions, refer to Ref [32].

Fig. 2 Regions of the UD protocol under realistic and ideal conditions.

Download Full Size | PDF

In the UD protocol, the variance of phase quadrature $V_{y}^{B_{1}}$ can be measured by switching the detection bases randomly in the experiment. For a constant value of $V_{y}^{B_{1}}$ , the value of $C_{y}^{B_{1} m}$ corresponding to the minimum secret key rate $K_{m}^{\infty}$ can be achieved by scanning all values of $C_{y}^{B_{1}}$ in the physical region. During the scanning process, for each value of $C_{y}^{B_{1}}$ , a corresponding secret key rate should be calculated, which is time consuming. The analytical expressions for the symplectic eigenvalues are employed to shorten the computation time significantly, rather than using the positive eigenvalues of the covariance matrix $i Ω γ$ . The solid curve of $C_{y}^{B_{1} m}$ versus $V_{y}^{B_{1}}$ is plotted with three different colors (Fig. 2). The red solid part overlaps with the parabolic curve. As the value of $V_{y}^{B_{1}}$ increases, it separates from the parabolic curve (the green solid part). The red and green solid parts lie in the secure region, and the secret key rates $K_{m}^{\infty}$ are larger than zero; this implies that Alice and Bob can distribute the secret key safely with a rate $K_{m}^{\infty}$ without the estimation of $C_{y}^{B_{1}}$ .The blue part is in the unsecure region, and the secret key rate $K_{m}^{\infty}$ is smaller than zero. The dashed lines indicate the corresponding cases under ideal conditions. Under realistic conditions, the parameters are set to $V_{M} = 3$ , $T_{x} = 0.1$ , $ε_{x} = 0.01$ , $β = 0. 97$ , $η = 0.6$ , and $υ_{e} = 0.1$ , and the curves are drawn with solid lines. Under ideal conditions the parameters are set to $V_{M} = 3$ , $T_{x} = 0.1$ , $ε_{x} = 0.01$ , $β = 1$ , $η = 1$ , and $υ_{e} = 0$ , and the curves are drawn with dashed lines. From Fig. 2 it is clear that the secure region is smaller under realistic conditions. To provide a more intuitive description for the secret key rate in the secure region, four three-dimensional plots are shown in Fig. 3 from different visual angles. Figure 3(a) presents a top view of the secure region. The other subfigures present side views of the secret key rates in the secure region. It should be noted that the units of all secret key rates are bits/pulse.

Fig. 3 Three-dimensional plots for the secret key rates in the secure region from different visual angles.

Download Full Size | PDF

3. The dependence of the secret key rate on realistic parameters

From the analysis above, we can see that Alice and Bob can share the secret key $K_{m}^{\infty}$ in the UD protocol under realistic conditions. In this section, the dependence of the secret key rate on realistic parameters, including the reconciliation efficiency $β$ , detection efficiency $η$ , and electronic noise $υ_{e}$ , will be analyzed in detail.

The curves for the secret key rate $K_{m}^{\infty}$ versus the phase quadrature variance $V_{y}^{B_{1}}$ with different reconciliation efficiencies are shown in Fig. 4. The other parameters are set to $V_{M} = 3$ , $T_{x} = 0.1$ , $ε_{x} = 0.01$ , $η = 0.6$ , and $υ_{e} = 0.1$ . We can see that the secret key rate decreases with the variance of $V_{y}^{B_{1}}$ , and that there exists a maximum value $V_{y m}^{B_{1}}$ . When the reconciliation efficiency is higher, the tolerable maximum variance $V_{y m}^{B_{1}}$ in the phase quadrature is larger. Obviously, a higher secret key rate $K_{m}^{\infty}$ can be achieved with a higher reconciliation efficiency.

Fig. 4 Minimum secret key rate $K_{m}^{\infty}$ versus $V_{y}^{B_{1}}$ for different reconciliation efficiencies under realistic conditions.

Download Full Size | PDF

The secret key rate $K_{m}^{\infty}$ versus the phase quadrature variance $V_{y}^{B_{1}}$ at different detection efficiencies is shown in Fig. 5(a). The other parameters are set to $V_{M} = 3$ , $T_{x} = 0.1$ , $β = 0. 97$ , $υ_{e} = 0.1$ , and $ε_{x} = 0.01$ . We can see that the tolerable maximum values $V_{y m}^{B_{1}}$ are nearly the same even though the detection efficiencies are different. The secret key rate $K_{m}^{\infty}$ versus the detection efficiency $η$ is shown in detail in Fig. 5(b) ( $V_{y}^{B_{1}} =1 .004$ ). The secret key rate increases with the detection efficiency. For a detection efficiency higher than 0.5, the improvement of the key rate is not obvious. Due to various limitations, such as the transmission loss of the devices on Bob’s side and the quantum efficiency of photodiodes, the typical detection efficiency in current experiments is around 0.6 [20, 36].

Fig. 5 (a) Secret key rate $K_{m}^{\infty}$ versus the phase quadrature variance $V_{y}^{B_{1}}$ at different detection efficiencies. (b) The secret key rate $K_{m}^{\infty}$ versus the detection efficiency $η$ .

Download Full Size | PDF

The secret key rate $K_{m}^{\infty}$ versus the phase quadrature variance $V_{y}^{B_{1}}$ for different electronic noise values is shown in Fig. 6(a). The other parameters are $V_{M} = 3$ , $T = 0.1$ , $β = 0. 97$ , $η = 0. 6$ , and $ε_{x} = 0.01$ . Note that when the electrical noise is different, the tolerable maximum variance $V_{y m}^{B_{1}}$ in the phase quadrature remains nearly unchanged. The secret key rate $K_{m}^{\infty}$ versus the electronic noise is shown in detail in Fig. 6(b) ( $V_{y}^{B_{1}} =1 .004$ ). The lower the electronic noise, the higher the secret key rate that can be achieved. However, the secret key rate $K_{m}^{\infty}$ is almost constant when the electronic noise is in the range from [0.01, 0.1]. An electronic noise of 0.1 corresponds to a weaker LO pulse, which is beneficial for suppressing the leakage from the LO pulse to the signal pulse [36,37]. In practice, 0.1 is selected as a typical electronic noise value.

Fig. 6 (a) Secret key rate $K_{m}^{\infty}$ as a function of the phase quadrature variance $V_{y}^{B_{1}}$ with different electronic noise values. (b) The secret key rate $K_{m}^{\infty}$ versus the electronic noise $υ_{e}$ .

Download Full Size | PDF

From the above numerical analysis, it is evident that in order to achieve a higher secret key rate, a higher reconciliation efficiency, higher detection efficiency, and lower electronic noise are required. Currently, the highest reconciliation efficiency that can be achieved is 97% [24], and the detection efficiency in a fiber-based system is ~0.6. The typical value of the electronic noise of 0.1 is selected.

With the parameters $β = 0. 97$ , $η = 0. 6$ , $υ_{e} = 0.1$ , and $V_{y}^{B_{1}} = 1 + T_{x} ε_{x}$ , assuming that $T_{y} = T_{x}$ and $ε_{y} = ε_{x}$ , the secret key rate $K_{m}^{\infty}$ as a function of the distance is presented with different excess noise values in Fig. 7. It should be noted that the modulation variance is optimized at each distance. Compared to its SY counterpart, the UD protocol is more sensitive to the excess noise. When the excess noise is low, a comparable secret key rate and transmission distance can be achieved.

Fig. 7 Secret key rate versus distance in the SY and UD coherent state protocols for different excess noise values.

Download Full Size | PDF

4. Secret key rate in the finite size scenario

In a practical UD CV QKD protocol, the unknown parameters are estimated using finite-sized data samples. In this section, we consider the Gaussian collective attack and analyze the secret key rate in the finite-size scenario.

The secret key rate considering the finite-size effect can be written as [35, 38, 39]

K_{m}^{f} = \frac{n}{N} (β I_{A B} - χ_{B E}^{δ_{P E}} - Δ (n)),

where

N

is the total number of signals exchanged between Alice and Bob, in which

n

scales the number of signals used to extract the secret keys, and

N - n

scales the number of the remainder of the signals for parameter estimation.

χ_{B E}^{δ_{P E}}

represents the maximum of the Holevo information compatible with the statistics, except with the probability

δ_{P E}

.

Δ (n)

is a correction term for the achievable mutual information in the finite case

Δ (n) \approx 7 \sqrt{\frac{\log_{2} (2 / \bar{ϵ})}{n}}, n \geq 10^{4},

where

\bar{ϵ}

is the probability of error during privacy amplification; a conservative value of

\bar{ϵ} {=10}^{-10}

is utilized here.

4.1 Parameter estimation

In the UD protocol, Alice modulates the coherent states in the amplitude quadrature, and Bob measures the transmitted coherent states in the same quadrature. At the same time, Bob also needs to randomly switch the detection bases to measure the phase quadrature. Alice then rejects the portion of her data corresponding to the switched bases when Bob makes public his detection bases. After this process, Alice and Bob can share two groups of correlated data samples ${(x_{A i}, x_{B i})}_{i = 1 \dots N - l}$ , where $x_{A}$ ( $x_{B}$ ) represents Alice’s data (Bob’s data) in amplitude quadrature, and $l$ represents the number of Bob’s data samples in phase quadrature. The $l$ phase quadrature data will be used to evaluate the variance of the phase quadrature $V_{y}^{B}$ . From the $N - l$ amplitude quadrature data, Alice and Bob will select $m$ data samples to evaluate the transmission efficiency $T_{x}$ and excess noise $ε_{x}$ .

The data obtained in the amplitude quadrature is linked through the following linear equation:

x_{B} = t_{x} x_{A} + z_{x},

where

t_{x} = \sqrt{η T_{x}}

and

z_{x}

follows a Gaussian distribution with a mean of zero and unknown variance

σ_{x}^{2} = 1 + η T_{x} ε_{x} + υ_{e}

. Here,

η

and

υ_{e}

can be well-calibrated on Bob’s side. The modulation variance of the random Gaussian variable

x_{A}

is

V_{M}

. In the symmetrical CV QKD protocol, it has been proven that the information gained by Eve,

χ_{B E}^{δ_{P E}}

, is the largest in the case of minimum channel transmittance

t_{\min}

and maximum

σ_{\max}^{2}

. However, in the UD protocol the information

χ_{B E}^{δ_{P E}}

obtained by Eve not only depends on the variables

t_{x}

and

σ_{x}^{2}

, but also has a dependence on the variable

V_{y}^{B_{1}}

. From numerical analysis, it is not difficult to prove the following inequality:

\frac{\partial χ_{B E}}{\partial V_{y}^{B_{1}}} |_{t, σ^{2}} > 0 .

This means that the maximum information

χ_{B E}^{δ_{P E}}

eavesdropped by Eve can be calculated by substituting

t_{x},

σ_{x}^{2}

, and

V_{y}^{B_{1}}

with

t_{x \min},

σ_{x \max}^{2}

, and

V_{y \max}^{B_{1}}

.

Unbiased estimators ${\hat{t}}_{x}$ and ${\hat{σ}}_{x}^{2}$ are known for the normal linear model:

{\hat{t}}_{x} = \frac{\sum_{i = 1}^{m} x_{A}_{i} x_{B}_{i}}{\sum_{i = 1}^{m} x_{A}_{i}^{2}} a n d {\hat{σ}}_{x}^{2} = \frac{1}{m - 2} \sum_{i = 1}^{m} {(x_{B}_{i} - {\hat{t}}_{x} x_{A}_{i})}^{2}

where

m

represents the number of data samples. Moreover,

{\hat{t}}_{x}

and

{\hat{σ}}_{x}^{2}

are independent estimators with the following distribution:

{\hat{t}}_{x} \sim (t_{x}, \frac{σ_{x}^{2}}{\sum_{i = 1}^{m} x_{A i}^{2}}) a n d \frac{(m - 2) {\hat{σ}}_{x}^{2}}{σ_{x}^{2}} \sim χ^{2} (m - 2)

Unbiased estimator ${\hat{V}}_{y}^{B}$ is known for the Gaussian distribution:

{\hat{V}}_{y}^{B} = \frac{1}{l - 1} \sum_{i = 1}^{l} {(y_{B i} - {\bar{y}}_{B})}^{2},

where

{\hat{V}}_{y}^{B}

has the following distribution:

\frac{(l - 1) {\hat{V}}_{y}^{B}}{V_{y}^{B}} ~ χ^{2} (l - 1) .

The chi-square distribution will be approximately equal to a normal distribution when the data set is large enough. Thus, we obtain the confidence intervals (CI) with confidence level $1 - δ_{P E}$ .

\begin{matrix} CI (t_{x}) = [{\hat{t}}_{x} - Δ {\hat{t}}_{x}, {\hat{t}}_{x} + Δ {\hat{t}}_{x}], \\ CI (σ_{x}^{2}) = [{\hat{σ}}_{x}^{2} - Δ {\hat{σ}}_{x}^{2}, {\hat{σ}}_{x}^{2} + Δ {\hat{σ}}_{x}^{2}], \\ CI ({\hat{V}}_{y}^{B}) = [{\hat{V}}_{y}^{B} - Δ {\hat{V}}_{y}^{B}, {\hat{V}}_{y}^{B} + Δ {\hat{V}}_{y}^{B}], \end{matrix}

where

Δ {\hat{t}}_{x} = z_{δ_{P E} / 2} \sqrt{\frac{{\hat{σ}}_{x}^{2}}{m V_{M}}}

,

Δ {\hat{σ}}_{x}^{2} = z_{δ_{P E} / 2} \frac{{\hat{σ}}_{x}^{2} \sqrt{2}}{\sqrt{m}}

, and

Δ {\hat{V}}_{y}^{B} = z_{δ_{P E} / 2} \frac{{\hat{V}}_{y}^{B} \sqrt{2}}{\sqrt{l}}

with

z_{δ_{P E} / 2} = \sqrt{2} e r f^{- 1} (1 - δ_{P E})

. Here,

e r f^{- 1} (x)

is the inverse function of the error function. In addition, we have

{\hat{T}}_{x} = \frac{{\hat{t}}_{x}^{2}}{η}

,

{\hat{ε}}_{x} = \frac{{\hat{σ}}_{x}^{2} - 1 - υ_{e}}{{\hat{t}}_{x}^{2}}

, and

{\hat{V}}_{y}^{B_{1}} = 1 + \frac{{\hat{V}}_{y}^{B} - 1 - υ_{e}}{η}

. Finally, we can obtain the worst-case values for

T_{x}

,

ε_{x}

, and

V_{y}^{B_{1}}

.

\begin{array}{l} T_{x}_{\min} \approx \frac{1}{η} {(\sqrt{η {\hat{T}}_{x}} - z_{δ_{P E} / 2} \sqrt{\frac{1 + η {\hat{T}}_{x} {\hat{ε}}_{x} + υ_{e}}{m V_{M}}})}^{2}, \\ ε_{x}_{\max} \approx {\hat{ε}}_{x} + z_{δ_{P E} / 2} \frac{(1 + η {\hat{T}}_{x} {\hat{ε}}_{x} + υ_{e}) \sqrt{2}}{η {\hat{T}}_{x} \sqrt{m}}, \\ V_{y \max}^{B_{1}} \approx {\hat{V}}_{y}^{B_{1}} + z_{δ_{P E} / 2} \frac{(η ({\hat{V}}_{y}^{B_{1}} - 1) + 1 + υ_{e}) \sqrt{2}}{η \sqrt{l}} . \end{array}

To calculate the final secret key rate using Eq. (19), the estimated values of ${\hat{T}}_{x}$ , ${\hat{ε}}_{x}$ , and ${\hat{V}}_{y}^{B_{1}}$ are substituted by their expected values $E ({\hat{T}}_{x}) = T_{x}$ , $E ({\hat{ε}}_{x}) = ε_{x}$ ,and $E ({\hat{V}}_{y}^{B_{1}}) = V_{y}^{B_{1}}$ . Here we assume that $V_{y}^{B_{1}} = 1 + T_{x} ε_{x}$ , $T_{y} = T_{x}$ , and $ε_{y} = ε_{x}$ .

4.2 Determining the largest secret key rate among N total samples

It is well known that the larger the number of data samples used for parameter estimation, the less the finite-size effects. Considering the real-time stability of the CV QKD system, it is not necessarily beneficial to increase the total number of samples. Given a number of total samples $N$ , there is a trade-off to consider in assigning them. The proportion of the total samples used for parameter evaluation should be optimized to maximize the secret key rate. In the SY coherent state protocol, when $r$ samples are selected to evaluate the parameters, only the proportion $r / N$ needs to be determined. However, in the UD protocol there are two parameters, $m$ and $l$ . Thus, not only the proportion $m / N$ , but also the proportion $l / N$ needs to be determined. In order to determine the largest secret key rate with $N$ total samples, a method was designed to scan the proportions of $m / N$ and $l / N$ at the same time to achieve an optimal proportion $(m : l : n)$ . The scanning result can be seen in Fig. 8.

Fig. 8 Secret key rate versus the proportions of $m / N$ and $l / N$ .

Download Full Size | PDF

In Fig. 8, we can see that there exists a best proportional (BP) point (red diamond) corresponding to the largest secret key rate. The coordinate of the BP point is ( $l / N$ , $m / N$ , $K_{m}^{B P}$ ) = (0.19, 0.155, 2.2 × 10-3), where $K_{m}^{B P}$ is the secret key rate of the BP point, i.e., the maximum secret key rate that can be achieved when the total sample is limited. In Fig. 8, the total data sample is $N = 10^{9}$ and the optimal ratio is (0.19: 0.155: 0.655). Thus, the number of samples used to evaluate the parameters $T_{x}$ and $ε_{x}$ is $m = 1.9 \times 10^{8}$ , the number of samples used to evaluate the parameter ${\hat{V}}_{y}^{B_{1}}$ is $l = 1.55 \times 10^{8}$ , and the number of samples used to distill the secret key is $n = 6.55 \times 10^{8}$ . The other parameters are set to $β = 0. 97$ , $T_{x} = 0.1,$ $ε_{x} = 0.01,$ $η = 0. 6$ , $υ_{e} = 0.1$ , $V_{y}^{B_{1}} = 1 + T_{x} ε_{x}$ , and $V_{M} = 3.1$ (optimized).

Figure 9 presents the secret key rates versus the proportions $m / N$ and $l / N$ for different total numbers of samples. From bottom to top the total number of samples is 10⁷, 10⁸, 10⁹, and 10¹⁰, respectively. The other parameters are the same as in Fig. 8, except that the transmission efficiency is $T_{x} = 0.4$ (corresponding to a distance of 20 km) and the optimal modulation variance is $V_{M} = 6.35$ . With the increase in the total number of samples, the secret key rate of the BP, $K_{m}^{B P}$ , also increases, and gradually approaches the secret key rate $K_{m}^{\infty}$ (red circle).

Fig. 9 Secret key rates versus the proportions $m / N$ and $l / N$ for different total samples.

Download Full Size | PDF

Table 1 mainly shows the proportions and the secret key rate versus the total samples. The optimal proportions $m / N$ and $l / N$ decrease with the increase in the total number of samples. The optimal proportions of the SY protocol are also listed, and obey a similar rule to that of the UD protocol. $K^{f}$ is the secret key rate of the SY coherent state protocol with optimal modulation variance $V_{M} = 18.62$ , transmission efficiency $T = 0.4$ , and excess noise $ε = 0.01$ . The other parameters are the same as those in the UD protocol. When the total number of samples approaches infinity, the proportions approach zero, and the secret key rate $K_{m}^{f}$ ( $K^{f}$ ) approaches $K_{m}^{\infty}$ ( $K^{\infty}$ ); here $K^{\infty}$ is the asymptotic secret key rate in the SY protocol. Comparing the secret key rates for different total samples, we can see that the secret key rate $K_{m}^{f}$ decreases more rapidly than $K^{f}$ as the total samples decrease. Therefore, the UD protocol is more sensitive to the total number of samples than the SY protocol.

Table 1. Optimal proportions and secret key rates versus total number of samples.

View Table

In the SY protocol, the number of random numbers used for detection base switching is a constant, $N$ . In the UD protocol, the proportion $l / N$ decreases with the increasing total number of samples. This means that a smaller amount of random numbers was required to switch the detection bases to measure the non-modulated phase quadrature. Furthermore, the asymmetrical base switching in the UD protocol decreases the amount of information required for the public declaration of Bob’s measurement bases and facilitates Alice’s data sifting. Therefore, the superiority of the UD protocol emerges for QKD systems with large data samples [40].

5. Conclusion

In this paper, the finite size effect of the UD continuous-variable quantum key distribution protocol is analyzed under realistic conditions. We believe that the characteristics discovered and methods proposed in this paper will aid in the exploration of the latent capacity of the unidimensional protocol, as well as the discovery of more applications sensitive to the cost of the quantum key distribution system. The composable security [41, 42] of the UD protocol will be considered in a further theoretical analysis.

Funding

The Key Project of the Ministry of Science and Technology of China (2016YFA0301403); the National Natural Science Foundation of China (NSFC) (Grants No. 11504219, No. 61378010); Shanxi 1331KSC; the Program for the Outstanding Innovative Teams of Higher Learning Institutions of Shanxi.

References and links

1. V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf, M. Dušek, N. Lütkenhaus, and M. Peev, “The security of practical quantum key distribution,” Rev. Mod. Phys. 81(3), 1301–1350 (2009).

2. C. Weedbrook, S. Pirandola, R. García-Patrón, N. J. Cerf, T. C. Ralph, J. H. Shapiro, and S. Lloyd, “Gaussian quantum information,” Rev. Mod. Phys. 84(2), 621–669 (2012).

3. T. C. Ralph, “Continuous variable quantum cryptography,” Phys. Rev. A 61(1), 010303 (1999).

4. N. J. Cerf, M. Levy, and G. Van Assche, “Quantum distribution of Gaussian keys using squeezed states,” Phys. Rev. A 63(5), 052311 (2001).

5. Ch. Silberhorn, T. C. Ralph, N. Lütkenhaus, and G. Leuchs, “Continuous variable quantum cryptography: beating the 3 dB loss limit,” Phys. Rev. Lett. 89(16), 167901 (2002). [PubMed]

6. F. Grosshans and P. Grangier, “Continuous variable quantum cryptography using coherent states,” Phys. Rev. Lett. 88(5), 057902 (2002). [PubMed]

7. F. Grosshans, G. Van Assche, J. Wenger, R. Brouri, N. J. Cerf, and P. Grangier, “Quantum key distribution using Gaussian-modulated coherent states,” Nature 421(6920), 238–241 (2003). [PubMed]

8. C. Weedbrook, A. M. Lance, W. P. Bowen, T. Symul, T. C. Ralph, and P. K. Lam, “Quantum cryptography without switching,” Phys. Rev. Lett. 93(17), 170504 (2004). [PubMed]

9. A. M. Lance, T. Symul, V. Sharma, C. Weedbrook, T. C. Ralph, and P. K. Lam, “No-switching quantum key distribution using broadband modulated coherent light,” Phys. Rev. Lett. 95(18), 180503 (2005). [PubMed]

10. C. Weedbrook, A. M. Lance, W. P. Bowen, T. Symul, T. C. Ralph, and P. K. Lam, “Coherent-state quantum key distribution without random basis switching,” Phys. Rev. A 73(2), 022316 (2006).

11. R. García-Patrón and N. J. Cerf, “Unconditional optimality of Gaussian attacks against continuous-variable quantum key distribution,” Phys. Rev. Lett. 97(19), 190503 (2006). [PubMed]

12. M. Navascués, F. Grosshans, and A. Acín, “Optimality of Gaussian attacks in continuous-variable quantum cryptography,” Phys. Rev. Lett. 97(19), 190502 (2006). [PubMed]

13. J. Lodewyck, M. Bloch, R. García-Patrón, S. Fossier, E. Karpov, E. Diamanti, T. Debuisschert, N. J. Cerf, R. Tualle-Brouri, S. W. McLaughlin, and P. Grangier, “Quantum key distribution over 25 km with an all-fiber continuous-variable system,” Phys. Rev. A 76(4), 042305 (2007).

14. R. Renner and J. I. Cirac, “de Finetti representation theorem for infinite-dimensional quantum systems and applications to quantum cryptography,” Phys. Rev. Lett. 102(11), 110504 (2009). [PubMed]

15. R. García-Patrón and N. J. Cerf, “Continuous-variable quantum key distribution protocols over noisy channels,” Phys. Rev. Lett. 102(13), 130501 (2009). [PubMed]

16. A. Leverrier and P. Grangier, “Unconditional security proof of long-distance continuous-variable quantum key distribution with discrete modulation,” Phys. Rev. Lett. 102(18), 180504 (2009). [PubMed]

17. Q. Dinh Xuan, Z. Zhang, and P. L. Voss, “A 24 km fiber-based discretely signaled continuous variable quantum key distribution system,” Opt. Express 17(26), 24244–24249 (2009). [PubMed]

18. L. S. Madsen, V. C. Usenko, M. Lassen, R. Filip, and U. L. Andersen, “Continuous variable quantum key distribution with modulated entangled states,” Nat. Commun. 3, 1083 (2012). [PubMed]

19. F. Furrer, T. Franz, M. Berta, A. Leverrier, V. B. Scholz, M. Tomamichel, and R. F. Werner, “Continuous variable quantum key distribution: finite-key analysis of composable security against coherent attacks,” Phys. Rev. Lett. 109(10), 100502 (2012). [PubMed]

20. P. Jouguet, S. Kunz-Jacques, A. Leverrier, P. Grangier, and E. Diamanti, “Experimental demonstration of long-distance continuous-variable quantum key distribution,” Nat. Photonics 7, 378–381 (2013).

21. X. Y. Wang, Z. L. Bai, S. F. Wang, Y. M. Li, and K. C. Peng, “Four-state modulation continuous variable quantum key distribution over a 30-km fiber and analysis of excess noise,” Chin. Phys. Lett. 30(1), 010305 (2013).

22. T. Gehring, V. Händchen, J. Duhme, F. Furrer, T. Franz, C. Pacher, R. F. Werner, and R. Schnabel, “Implementation of continuous-variable quantum key distribution with composable and one-sided-device-independent security against coherent attacks,” Nat. Commun. 6, 8795 (2015). [PubMed]

23. B. Qi, P. Lougovski, R. Pooser, W. Grice, and M. Bobrek, “Generating the local oscillator “Locally” in continuous-variable quantum key distribution based on coherent detection,” Phys. Rev. X 5(4), 041009 (2015).

24. D. Huang, P. Huang, D. Lin, and G. Zeng, “Long-distance continuous-variable quantum key distribution by controlling excess noise,” Sci. Rep. 6, 19201 (2016). [PubMed]

25. Y. M. Li, X. Y. Wang, Z. L. Bai, W. Y. Liu, S. S. Yang, and K. C. Peng, “Continuous variable quantum key distribution,” Chin. Phys. B 26, 040303 (2017).

26. S. Pirandola, C. Ottaviani, G. Spedalieri, C. Weedbrook, S. L. Braunstein, S. Lloyd, T. Gehring, C. S. Jacobsen, and U. L. Andersen, “High-rate measurement-device-independent quantum cryptography,” Nat. Photonics 9, 397–402 (2015).

27. P. Papanastasiou, C. Ottaviani, and S. Pirandola, “Finite size analysis of measurement device independent quantum cryptography with continuous variables,” https://arxiv.org/abs/1707.04599.

28. C. Lupo, C. Ottaviani, P. Papanastasiou, and S. Pirandola, “CV MDI QKD: Composable Security against Coherent Attacks,” https://arxiv.org/abs/1704.07924.

29. S. Fossier, E. Diamanti, T. Debuisschert, A. Villing, R. Tualle-Brouri, and P. Grangier, “Field test of a continuous-variable quantum key distribution prototype,” New J. Phys. 11(4), 045023 (2009).

30. P. Jouguet, S. Kunz-Jacques, T. Debuisschert, S. Fossier, E. Diamanti, R. Alléaume, R. Tualle-Brouri, P. Grangier, A. Leverrier, P. Pache, and P. Painchault, “Field test of classical symmetric encryption with continuous variables quantum key distribution,” Opt. Express 20(13), 14030–14041 (2012). [PubMed]

31. D. Huang, P. Huang, H. Li, T. Wang, Y. Zhou, and G. Zeng, “Field demonstration of a continuous-variable quantum key distribution network,” Opt. Lett. 41(15), 3511–3514 (2016). [PubMed]

32. V. C. Usenko and F. Grosshans, “Unidimensional continuous-variable quantum key distribution,” Phys. Rev. A 92(6), 062337 (2015).

33. T. Gehring, C. S. Jacobsen, and U. L. Andersen, “Single-quadrature continuous-variable quantum key distribution,” Quantum Inf. Comput. 16(13), 1081–1095 (2016).

34. X. Y. Wang, W. Y. Liu, P. Wang, and Y. M. Li, “Experimental study on all-fiber-based unidimensional continuous-variable quantum key distribution,” Phys. Rev. A 95(6), 062330 (2017).

35. A. Leverrier, F. Grosshans, and P. Grangier, “Finite-size analysis of a continuous-variable quantum key distribution,” Phys. Rev. A 81(6), 062343 (2010).

36. X. Y. Wang, Z. L. Bai, P. Y. Du, Y. M. Li, and K. C. Peng, “Ultrastable fiber-based time-domain balanced homodyne detector for quantum communication,” Chin. Phys. Lett. 29(12), 124202 (2012).

37. B. Qi, L. L. Huang, L. Qian, and H. K. Lo, “Experimental study on the Gaussian-modulated coherent-state quantum key distribution over standard telecommunication fibers,” Phys. Rev. A 76(5), 052323 (2007).

38. L. Ruppert, V. C. Usenko, and R. Filip, “Long-distance continuous-variable quantum key distribution with efficient channel estimation,” Phys. Rev. A 90(6), 062310 (2014).

39. O. Thearle, S. M. Assad, and T. Symul, “Estimation of output-channel noise for continuous-variable quantum key distribution,” Phys. Rev. A 93(4), 042343 (2016).

40. Z. Qu and I. B. Djordjevic, “High-speed free-space optical continuous-variable quantum key distribution enabled by three-dimensional multiplexing,” Opt. Express 25(7), 7919–7928 (2017). [PubMed]

41. A. Leverrier, “Composable security proof for continuous-variable quantum key distribution with coherent States,” Phys. Rev. Lett. 114(7), 070501 (2015). [PubMed]

42. A. Leverrier, “Security of Continuous-Variable Quantum Key Distribution via a Gaussian de Finetti Reduction,” Phys. Rev. Lett. 118(20), 200501 (2017). [PubMed]

N	10⁷	10⁸	10⁹	10¹⁰	10¹¹	10¹²	10¹³	$\infty$
m/N	0.202	0.072	0.034	0.021	0.008	0.004	0.002	0
l/N	0.362	0.132	0.066	0.031	0.013	0.006	0.003	0
(m + l)/N	0.564	0.204	0.100	0.052	0.021	0.010	0.005	0
r/N	0.146	0.068	0.033	0.016	0.007	0.003	0.002	0
$K_{m}^{f}$	0.001	0.025	0.041	0.049	0.053	0.055	0.056	0.057
$K^{f}$	0.081	0.117	0.134	0.143	0.147	0.148	0.149	0.150

Finite-size analysis of unidimensional continuous-variable quantum key distribution under realistic conditions

Abstract

1. Introduction

2. Unidimensional protocol under realistic conditions

2.1 An introduction to unidimensional protocol schemes

2.2 Security analysis

3. The dependence of the secret key rate on realistic parameters

4. Secret key rate in the finite size scenario

4.1 Parameter estimation

4.2 Determining the largest secret key rate among N total samples

5. Conclusion

Funding

References and links

Cited By

Figures (9)

Tables (1)

Equations (27)

Optics Express