1. INTRODUCTION

A major challenge for today’s communication networks is to ensure safe exchange of sensitive data between distant parties. However, the rapid development of quantum information protocols towards the quantum computer [1–3] poses a substantial threat for current cyber-security systems. In fact, quantum routines such as Shor’s factorization algorithm [4–6] could potentially render today’s cryptographic schemes obsolete and completely insecure. Fortunately, quantum key distribution (QKD) [7–9] represents a solution to this catastrophic scenario. By leveraging on the principles of quantum mechanics and the characteristics of photons, QKD allows two distant parties, conventionally called Alice and Bob, to distill a perfectly secret key and bound the shared information with any adversarial eavesdropper [10]. Furthermore, QKD is an interesting solution for applications requiring long-term privacy, since algorithmic and technological advances for both classical and quantum computation do not threaten the security of keys generated with QKD.

Since its first proposal by Bennet and Brassard in 1984 [7], QKD has received much attention, and several experiments have shown its feasibility by exploiting different photonic degrees of freedom and platforms in free space [11–14], optical fibers [15–20], or even satellite links [21–25]. Recent developments have focused mainly on rendering QKD implementations simpler and more robust, aiming for compatibility with standard communication networks and widespread usage. This has led, for example, to the introduction of self-compensated modulators for different photonic degrees of freedom such as time-bin [26], mean photon number [27], and polarization [28,29], all based on Sagnac interferometric configurations. Also, simpler QKD protocols have been introduced such as a three-state [30,31] and one-decoy state version of the BB84 protocol, which simplifies the requirements of the quantum state encoder [32] and can provide higher rates in the finite-key scenario [33].

A critical aspect of QKD systems is the distribution of a temporal reference between the transmitter (Alice) and the receiver (Bob). This is crucial for at least two reasons. First, it allows to discriminate between the quantum signal and the noise introduced by either the quantum channel or detector defects. Second, it allows to correlate the qubit sequence transmitted by Alice with the detection events recorded by Bob. This correlation enables the distillation of the quantum-secure cryptographic key. The transmission of the temporal reference is usually achieved by sending a decimated version of Alice’s clock using an additional laser communication system that, in turn, requires the use of a secondary fiber channel [16,34], or time or wavelength multiplexing schemes to separate the quantum information from the classical light pulses [23,35]. Also, global navigation satellite systems (GNSSs) can be used to synchronize Alice and Bob, since these systems can give precise temporal references [14,36,37]. All these approaches, however, require additional hardware with respect to what is already needed for the quantum communication task.

 

Fig. 1. Experimental setup. For a detailed description, see Section 2. Single-mode fibers are indicated in yellow, while polarization-maintaining fibers are in blue.

Download Full Size | PDF

Polarization-encoded QKD in fiber-optic links has been studied to a great extent [32,34,35,38,39]. Unfortunately, this type of link has an important drawback given by the natural birefringence of optical fibers, which causes the polarization state of transmitted photons to change continuously and in an unpredictable fashion [40]. Several approaches have been conceived to counteract these random polarization drifts, most of them requiring auxiliary laser pulses and time or wavelength multiplexing schemes [35,38,39,41], which, similar to the synchronization task discussed above, require additional hardware. A different approach was introduced by Ding et al. that used the revealed portion of the sifted key [42], produced during the error correction and privacy amplification procedures, to detect and compensate for the polarization drifts of the fiber link. Unfortunately, this method requires post-processing of an entire block of raw key, imposing a limit to the polarization tracking speed.

Here we present a simple QKD system, in which quantum communication, temporal synchronization, and polarization compensation are all realized in the same optical setup. The temporal synchronization is performed using a novel method, whose technical details are presented elsewhere [43]. This method does not require any auxiliary time reference and works by sending a public qubit sequence at pre-established times. Hence, it is named Qubit4Sync, because it uses only qubits for synchronization. Predetermined qubit sequences are also exploited to monitor and compensate for the polarization drift introduced by the quantum channel, constituted by a 26 km long fiber spool. With respect to Ref. [42], our solution does not require post-processing of an entire block of raw key, allowing for an increased compensation speed. Furthermore, the QKD source here presented exhibits several hours of stability and an intrinsic quantum bit error rate (QBER) on the order of 0.05%, which is, to the best of our knowledge, the lowest reported so far. This source exploits the scheme for polarization encoding based on a Sagnac loop (hence the name POGNAC) we introduced in Ref. [28]. The relaxed hardware requirements, the high stability, and the record-low QBER of the presented implementation represent an important technological step towards mature and efficient QKD systems.

2. SETUP

Our experimental setup, which implements the simplified three-state and one-decoy protocol proposed in [32], is sketched in Fig. 1. A gain-switched distributed feedback (DFB) laser source outputs a 50 MHz stream of phase-randomized pulses with 270 ps of full-width-at-half-maximum temporal duration at 1550 nm wavelength. The light pulses first pass through a lithium niobate intensity modulator (IM) used to set the intensity levels required by the decoy-state method. The pulses then enter the POGNAC polarization modulator realized using only standard commercial off-the-shelf (COTS) fiber components, namely, a circulator (CIRC), a polarization controller (PC), a polarizing beam splitter (PBS), and a phase modulator ($ \phi $-mod). Compared to other polarization modulators, the POGNAC requires a lower $ {V_\pi } $ voltage, can be developed using $ \phi $-mods that carry only a single polarization mode, exhibits no polarization mode dispersion, and has a self-compensating design that guarantees robustness against temperature and electrical drifts (see Ref. [28] for a full description and additional details).

The photons emerge from the POGNAC with a polarization state given by

If no voltages are applied by the SoC, the polarization state remains unchanged, i.e., $ | + \rangle = ( {|H\rangle + |V\rangle } )/\sqrt 2 $. Instead, if $ {\phi _e} $ is set to $ \frac{\pi }{2} $ while $ {\phi _\ell } $ remains zero, the output state becomes $ |L\rangle = ( {|H\rangle + i|V\rangle } )/\sqrt 2 $. Alternatively, if $ {\phi _e} $ remains zero while $ {\phi _\ell } $ is set to $ \frac{\pi }{2} $, the output state becomes $ |R\rangle = ( {|H\rangle - i|V\rangle } )/\sqrt 2 $. In this way, we generate the three states required by the simplified three-polarization-state version of BB84 [32], with the key-generation basis $ {\cal Z} = \{ |0\rangle ,|1\rangle \} $, where $ |0\rangle : = |L\rangle $, $ |1\rangle : = |R\rangle $, and the control state $ | + \rangle $ of the $ {\cal X} = \{ | + \rangle ,| - \rangle = ( {|H\rangle - |V\rangle } )/\sqrt 2 \} $ basis.

The optical pulses then encounter an optical attenuator (ATT) that weakens the light to the single-photon level. A 99:1 beam splitter (BS) is used to estimate the intensity level of the pulses: the 1% output port is directed to a gated InGaAs/InP single-photon avalanche diode (SPAD, manufactured by Micro Photon Devices Srl [44]), while the other output port is directed to the quantum channel (QC). In our implementation, the QC is formed by a 26 km spool of G.655 dispersion-shifted fiber with 0.35 dB/km of loss followed by a variable optical attenuator (VOA). This VOA allows us to introduce further channel loss in order to test our system’s resilience.

Alice sends key-generation states with probability $ p_A^{\cal Z} = 0.9 $ ($ p_A^{\cal X} = 0.1 $), while the two intensity levels are $ {\mu _1} \approx 0.80 $ and $ {\mu _2} \approx 0.28 $, which are sent with probabilities $ {p_{{\mu _1}}} = 0.7 $ and $ {p_{{\mu _2}}} = 0.3 $, respectively. This intensity modulation is driven by the SoC, and presents no drifts during the QKD runs, as attested by the data presented in Supplement 1. The used parameters are close to optimal according to our simulations and Ref. [33]. The random bits used in the QKD runs are obtained from the source-device-independent quantum random generator based on optical heterodyne measurements described in Ref. [45].

The fiber receiving setup consists of a 90:10 fiber BS setting the detection probabilities of the two measurement bases to $ p_B^{\cal Z} = 0.9 $ and $ p_B^{\cal X} = 0.1 $. Each output arm of the BS is connected to an automatic polarization controller (APC) and a PBS. The four outputs are then sent to four superconductive nanowire single-photon detectors (SNSPDs, manufactured by ID Quantique SA) cooled to 0.8 K. The detection efficiencies are around 85% for the detectors in the $ {\cal Z} $ basis, whereas it is 90% and 30% for the $ | + \rangle $ and $ | - \rangle $ detectors, respectively. As discussed in Refs. [14,46], some events are randomly discarded in post-processing to balance the different efficiencies. All the detectors are affected by about 200 Hz of free-running intrinsic dark count rate. The SNSPD detections are recorded by the quTAG time-to-digital converter (TDC, manufactured by qutools GmbH) with 1 ps of temporal resolution and jitter of 10 ps. A computer (CMP) then reads the TDC data and uses it for temporal synchronization, polarization compensation, and QKD. The low dark count rate and negligible afterpulsing represent the main reasons that made us choose SNSPDs over, for example, InGaAs SPADs. Indeed, a low dark count rate allows the QBER to stay low even for strong levels of channel attenuation (i.e., long fiber links).

A. Synchronization

In this work, we use the Qubit4Sync algorithm to synchronize Alice’s and Bob’s clocks using the same qubits exchanged during the QKD protocol. This means that the setup does not need any synchronization subsystem, which is usually implemented with a pulsed laser or GNSS clock to share an external time reference. The synchronization method is described in detail in Ref. [43].

Here we report the main features of the algorithm. The synchronization is done in post-processing, adjusting the times in which Bob expects to receive the qubits from Alice. For this, Bob needs to determine at which frequency (in his time reference) the qubits are arriving at the detectors and the absolute time in which the first qubit should arrive. Our approach is to compute the frequency from the time-of-arrival measurements. To recover the absolute time, we send an initial public string encoded in the first $ L $ states. By correlating this string with the one received by Bob, it is possible to distinguish which state received by Bob is the first one sent by Alice, hence the absolute time of the first qubit. This is the typical technique used, for instance, by the Global Positioning System (GPS) receiver to synchronize with the satellite signal [47].

The novelty of Qubit4Sync is the implementation of a fast correlation algorithm requiring lower computational cost than the algorithms based on a sparse fast Fourier transform, as we show in Ref. [43]. This allows us to calculate, in real time, the position of the maximum correlation peak of long synchronization strings, which is required to cope with the high losses of a quantum channel. To the best of our knowledge, no similar algorithms have been previously proposed or used for QKD.

B. Polarization Compensation Scheme

Mechanical and temperature fluctuations lead to variations in the natural birefringence of fiber optics, transforming the polarization state of the photons that travel through the fiber. This transformation is troublesome for QKD since it causes Alice and Bob to effectively have different polarization reference frames. As a consequence of this mismatch, the QBER increases, lowering the secure key rate (SKR) up to the point where no quantum secure key can be established. To prevent this, a polarization compensation system must be utilized.

Here we propose a polarization compensation scheme that exploits a shared public string, not necessarily related to the synchronization string. Every second, the shared string of $ {10^6} $ states is transmitted by Alice encoded using weak coherent pulses in the $ {\cal Z} $ basis with $ {\mu _1} $ intensity. Bob detects the sequence, and after performing the temporal synchronization routine, he estimates the QBER of his recorded sequence. Bob still has to estimate the $ {\cal X} $ basis QBER. For this purpose, at the end of each interval, Alice reveals the basis used to encode the QKD qubits that follow the public string. This process is actually the standard basis reconciliation procedure of QKD. Since in this protocol only one state is transmitted in the $ {\cal X} $ basis, Bob can immediately estimate the QBER [32].

The estimated QBER values are then fed into an optimization algorithm, based on coordinate descent [48] and running in Bob’s CMP, which controls the APCs of Bob’s setup. The APCs have four different piezoelectric 1D actuators, alternately at 0° and 45° to the horizontal plane, that stress and strain the optical fibers, changing the polarization of the light that traverses them [49]. Our optimization algorithm loops through the four actuators sequentially. At each round, the position of an actuator is changed with a step size proportional to the measured QBER. If such a change causes a reduction in the measured QBER, our algorithm keeps changing the position of the same actuator in the same direction, always with a step size proportional to the measured QBER. Instead, if an increased QBER is measured, the algorithm reverses the direction of motion for the actuator. Only one reversal is permitted per round, after which the next actuator is selected and a new round begins.

Compared to Ref. [42], our approach has the advantage that only the basis reconciliation step is required to obtain sufficient information to run the polarization compensation algorithm. This renders our approach less communication intensive, and we were able to achieve a 1 s feedback cycle, which is 12 times faster than the one reported in Ref. [42]. Also, the length of the shared string and its transmission frequency can be changed to best match the requirements of the fiber optical link. Furthermore, the public string can be transmitted in an interleaved fashion together with the QKD qubits at predetermined times.

3. RESULTS

A. POGNAC Low Intrinsic QBER and High Stability

The $ {{\rm QBER}_{{\rm opt}}} $, i.e., intrinsic (or “optical”) QBER of the source, gives a quantitative and qualitative measure of its suitability for use in QKD [8]. Its characterization is relevant to predict the SKR under different conditions, such as different channels or detector technologies. It is also meaningful to measure its stability to find how long the source can function without realignment.

For these reasons, we report in Fig. 2 the stability of the intrinsic QBER of our QKD polarization source. This measurement was performed by sending a pseudo-random qubit sequence of $ \{ |0\rangle ,|1\rangle ,| + \rangle \} $ states (used only for this test) and measuring the QBER of the sifted string recovered by Bob. To remove all fluctuations not attributable to the source, the fiber spool of the QC was bypassed while the VOA was set to $ \approx 11\,{\rm dB} $ of attenuation. Furthermore, the 90:10 BS was replaced with a 50:50 BS in order to have comparable statistics for both measurement bases. Every second, the QBER was estimated for both the $ {\cal Z} $ key-generation basis and the $ {\cal X} $ control basis. In 45 min, an average QBER of $ {Q_{\cal Z}} = 0.07 \pm 0.02\% $ was measured for the $ {\cal Z} $ basis, while the average QBER for the $ {\cal X} $ was $ {Q_{\cal X}} = 0.02 \pm 0.01\% $, giving a mean $ {{\rm QBER}_{{\rm opt}}} $ in the two relevant bases for QKD of 0.05%. This corresponds to an extinction ratio of 33 dB for the used states. We note that the reported data include the contribution from dark counts, and therefore slightly overestimate the value of the $ {{\rm QBER}_{{\rm opt}}} $. To verify that the $ {\cal X} $ and $ {\cal Z} $ bases are mutually unbiased, we also measured the QBER of the $ {\cal Z} $ states when observed in the $ {\cal X} $ basis and vice versa, obtaining $ 48.8 \pm 0.4\% $ in both cases.

 

Fig. 2. Intrinsic QBER and temporal stability of the POGNAC polarization encoder. The average QBER measured for the key-generation basis was $ {Q_{\cal Z}} = 0.07 \pm 0.02\% $ (dashed red line), while an average $ {Q_{\cal X}} = 0.02 \pm 0.01\% $ (dashed green line) was measured for the control basis. A close-up between minutes 15–30 can be seen in the inset plot.

Download Full Size | PDF

These measurements corroborate the results of Ref. [28] and demonstrate the low intrinsic QBER, and high stability of the POGNAC polarization modulator. It is worth noticing that an extinction ratio above 30 dB is typically not achievable by using COTS polarization modulators, which also suffer from temporal drifts due to temperature and electronics fluctuations. These drifts can be suppressed by exploiting self-compensating schemes, as the POGNAC or the one in Ref. [50]. However, Ref. [50] reported a limited extinction ratio of less than 20 dB due to implementation imperfections.

Table 1 reports a comparison of the intrinsic QBER with the existing literature, in particular Refs. [14,20,29,51–55]. The $ {{\rm QBER}_{{\rm opt}}} $ we registered here is the lowest ever reported, even considering encodings other than polarization (as used in Refs. [14,20,29,52]), such as time-bin (in Refs. [53–55]) and differential phase shift (in Ref. [51]), as well as different platforms to realize the source, as fibers-based schemes (in Refs. [29,51,52,54,55]) or integrated photonics chips (in Refs. [14,20]).

Table 1. Comparison among Intrinsic QBERs Reported in Literature^a

View Table

B. Polarization Drift Compensation with 26 km of Optical Fiber

To test our polarization drift compensation algorithm, we performed a 6 h long run with the QC including both the 26 km optical fiber spool and the VOA for $ \approx 19\,{\rm dB} $ of total losses.

On average, the detected bits of the shared polarization compensation string in the $ {\cal Z} $ basis were $ \approx 8 \times {10^3} $, while the sifted bits from the control basis were $ \approx 3 \times {10^3} $. This allowed to correct the polarization drift with an average QBER measured for the key-generation basis of $ {Q_{\cal Z}} = 0.3 \pm 0.1\% $ while an average $ {Q_{\cal X}} = 0.2 \pm 0.1\% $ for the control basis, for 6 h of continuous operation (see Fig. 3). These values are about an order of magnitude lower than those observed in Ref. [42].

 

Fig. 3. QBER measurement for a 6 h long acquisition along a 26 km optical fiber channel. The average QBER measured for the key-generation basis was $ {Q_{\cal Z}} = 0.3 \pm 0.1\% $ (dashed blue line), while an average $ {Q_{\cal X}} = 0.2 \pm 0.1\% $ (dashed yellow line) was measured for the control basis.

Download Full Size | PDF

After the experimental run, we noted a lower detection efficiency of 45% for the detectors of the $ {\cal Z} $ basis. This was due to a non-optimal polarization rotation of the photons entering the SNSPD detectors, which are polarization sensitive. This reduced detection efficiency did not hamper the polarization drift compensation algorithm, demonstrating its robustness even in non-optimal conditions.

C. QKD Secure Key Rate for Different Channel Losses

To test the performances of our system with qubit-based synchronization and a self-compensating polarization encoder, as well as its resistance to channel losses, several QKD runs were executed, each with increased losses, as reported in Fig. 4. The losses were added increasing the attenuation of the VOA after the 26 km of fiber. A random qubit sequence of $ \{ |0\rangle ,|1\rangle ,| + \rangle \} $ states was transmitted at a repetition rate of 50 MHz, where the first $ L $ qubits of the sequence formed the publicly known synchronization string.

 

Fig. 4. Sifted and secure key rate as a function of channel losses. For the four runs with lower losses, we also include finite-key analysis ($ {{\rm SKR}_{fk}} $), for 90 s of acquisition each. The equivalent fiber distance (upper $ x $-axis) is based on SMF28 losses (0.2 dB/km). The crosses represent the experimental runs, while the lines show the results of our simulation based on the physical parameters of our experiment. Error bars are standard deviations, obtained by simulating 1000 repetitions of the experiment.

Download Full Size | PDF

For each run, the SKR was calculated in the asymptotic limit according to

For the four runs with lower losses, we also performed the finite-key analysis using the bits produced in $ t = 90 {\rm s} $ of acquisition by using [33]

As discussed in Ref. [43], if the background and dark counts are not considered, the synchronization can be established with $ L{ = 10^6} $ for up to 40 dB of total losses, i.e., considering channel and receiver losses as well as detector inefficiency. A longer string, with $ L{ = 10^7} $, could be used to synchronize up to 50 dB of losses. In our experiment, the presence of dark counts lowers the bounds by about 6 dB. Indeed, using a synchronization string of length $ L{ = 10^6} $, we performed several QKD runs with losses up to 34 dB. With $ L{ = 10^7} $, we successfully ran QKD up to the channel loss at which the key rate drops to zero. In the QKD run with highest losses, we achieved a SKR of 80 bits per second at 40 dB channel losses, corresponding to about 200 km of SMF28 fiber (0.2 dB/km) or 235 of ultralow-loss fiber (0.17 dB/km). It is important to note that our QKD implementation withstands up to 41 dB of channel loss, as reported in the $ {{\rm SKR}_\infty } $ simulation in Fig. 4. Our results prove that the Qubit4Sync method properly works even at the highest losses tolerated by our QKD implementation.

4. CONCLUSION

Here we have presented a simple polarization encoded QKD implementation with qubit-based synchronization and a self-compensating polarization modulator. Its simple and hardware-efficient design reduces the complexity for both the QKD transmitter and receiver. In fact, the same optical setup is used for three different tasks, i.e., synchronization, polarization compensation, and quantum communication, without requiring any changes to the working parameters of the setup or any additional hardware. The QKD transmitter shows high stability and an intrinsic QBER below 0.1%. This, in addition to the effective polarization compensation technique and the use of high-performance SNSPD detectors, allows us to obtain high SKRs and resilience up to about 40 dB of channel losses, even with a repetition-rate of 50 MHz. Indeed, although the repetition rate of our source is an order of magnitude smaller than those of recent polarization-encoded fiber-based QKD experiments [18,20], we achieved a SKR that is comparable with that of Ref. [20] and an order of magnitude higher than that reported in Ref. [18] for distances greater than 50 km. If the SNSPDs were replaced with InGaAs SPADs, with a free-running dark count rate of 500 Hz, 15% quantum efficiency, and 20 µs hold-off time [44], we expect that the system would be able to produce a positive $ {{\rm SKR}_\infty } $ for up to 35 dB (31 dB) of channel losses using a temporal gating window of 0.3 ns (1 ns).

Currently, the POGNAC requires to be manually aligned once every day. However, to make our system more autonomous, its PC could be replaced with an APC controlled by a power monitor inside the fiber Sagnac loop. This would render our implementation compatible with different operative scenarios, ranging from urban QKD fiber links [20] to free-space satellite QKD links via CubeSats [56], or even to implement other quantum communication schemes such as quantum digital signatures [57] or remote blind qubit preparation [58]. Last, our implementation is particularly promising for free-space QKD [13,14,23] since polarization is not significantly affected by atmospheric propagation [59] and long-term stability is required, especially for links with satellites in medium Earth orbit [60] or part of a GNSS constellation [61].