1. Introduction

The security of quantum key distribution (QKD) is based on the laws of quantum physics. In principle, QKD can guarantee secure communication between two remote parties, usually referred to as Alice and Bob, even under the existence of a malicious eavesdropper, Eve. However, a real-life implementation of a QKD system exhibits inevitable flaws, such as, non-ideal light sources, imperfect single-photon detectors, and lossy channels. Eve may use those imperfections and carry out corresponding attacks on practical QKD systems. Therefore, there have been discrepancies between their theoretical unconditional security [1–3] and their actual performance since the first BB84 protocol was proposed [4]. Till today, several different attack strategies have been proposed, e.g., time-shift attacks, photon-number-splitting attacks, and Trojan horse attacks [5–11]. Nevertheless, various protocols and methods have been suggested for countering these attacks [12–14]. Among them, the decoy-state method has become a preferred method for QKD implementations, which dramatically improves the practical performance of quantum cryptography.

To date, numerous studies have been carried out on decoy-state QKD, both theoretical and experimental [15–25]. Some QKD schemes [26, 27] show superiority both in security and transmission distance. In principle, quantum light––such as heralded single-photon sources (HSPS) from a parametric down-conversion (PDC) process, or single-photon sources (SPS) from quantum dots or NV centers–– possesses a higher single-photon probability than weak coherent sources (WCS), and thus, seems more suitable for quantum key transmission [18–20]. Nevertheless, in real-life implementations of quantum cryptography, WCS is applied most often, as there are some defects in the current protocols and systems involving quantum lights [21,22,28,29].

In most existing HSPS generation schemes, a commercial silicon-avalanche photodiode is employed as the single-photon detector for local detection [18–22]. Then, the saturation threshold of the local detector limits both the pump power and the intensity of the signal pulses. As a result, the optimal intensity of the signal-state can never be reached [21, 22]. Besides, with the current technology, the collected photon pairs from the PDC process have a relatively low correlation rate due to coupling loss and imperfect detection efficiency, resulting in a relatively low heralding rate of HSPS [21, 22]. This will substantially decrease the key generation rate in most existing protocols based on HSPS [18–20]. Moreover, in a phase-coding QKD system, the signal pulses have to pass through Mach–Zehnder (MZ) [25, 30] or Faraday–Michelson interferometers [21, 22, 31, 32] and usually suffer from a substantial systematic loss, which is especially severe for PDC sources [21,22]. Therefore, to date, there have been only a few QKD experiments carried out based on PDC sources. In addition, most of them showed relatively poor performance compared with WCS.

In this work, by employing our novel passive decoy scheme (see Appendix A for more details), we can eliminate several flaws present in existing QKD systems using HSPS [23]. For example, a higher intensity of the signal state can be achieved due to the doubling of the maximum counting rate of the local detectors. Besides, in the present scheme, the final key rate does not depend crucially on the correlation rate of the collected photon pairs, considering all the clicking and non-clicking events can be used to distill the secret keys. In other words, it depresses the influence of the coupling loss and imperfect detection efficiency of the local detectors. Furthermore, the systematic loss can be substantially reduced by utilizing low-loss asymmetric MZ interferometers.

2. Methods

The generation scheme for passive HSPS is shown in Fig. 1. At the beginning, a squeezed two-mode field is generated from a parametric down-conversion (PDC) process, which can be written as ${|\mathrm{\Psi }〉}_{\mathit{IS}}={\sum }_{n=0}^{\infty }\sqrt{P_n}{|n〉}_I{|n〉}_S$. Here, I(S) denotes the idler (signal) mode; |n〉 represents an n-photon state; P_n corresponds to the probability of an n-photon state obeying a Poissonian photon-number distribution in our experiments. Then, the idler mode is split into two parts by a beam-splitter (BS) and sent into two commercial silicon avalanche-photodiode single-photon detectors (D₁, D₂), respectively. Each recorded event of D₁ and D₂ can be separated into four classes, denoted as X_i (i = 1, 2, 3, 4).

 

Fig. 1 Schematic of the passive heralded single-photon source at Alice’s side.

Download Full Size | PDF

Whenever an X_i event occurs, the signal state is projected into the photon-number space ${\rho }_l={\sum }_n{a}_n^l|n〉〈n|$ (l = x, y, z, w), where x, y, z, w are the states corresponding to events X_i (i = 1, 2, 3, 4). The nomenclature of different events is listed in Table 3. By carrying out a Hanbury Brown–Twiss experiment, we identified the original photon-number distribution to be Poissonian. We denote the mean photon number of the original signal mode as μ₀, the overall efficiency of the branches of the idler mode (including both the coupling and detection efficiency) as η₁ and η₂, respectively, and the coupling efficiency of the signal mode as η_s. As shown in Appendix A, we can get the probability of all four heralding events in the signal mode,

In our experiment, for simplicity, we used only three events, i.e. x, y, z, to distill the secure keys. Moreover, we employed a new form of Chernoff method [33,34] to distill the final keys, accounting for finite data-size effects. As addressed in [34], the new analysis method poses no assumption on the eavesdropper and its security is comparable to the Chernoff or the Hoeffding bound [35,36], while its efficiency is higher than the other two. The description of the passive decoy-state method and the application of the newly proposed Chernoff method can be found in Appendix B.

With the methods mentioned above, we can get the secure key rate as follows,

Table 1. Nomenclature and the corresponding probabilities of the signal states depending on the detection events in the idler mode, where “0” denotes the detector not clicking and “1” corresponds to a click.

View Table | View all tables in this article

3. Experimental setup

A schematic of our experimental setup is displayed in Fig. 2. At Alice’s side, a 76 MHz repetition rate, picosecond, mode-locked Ti:Sapphire laser at 898 nm is frequency doubled to 449 nm light through a β−BaB₂O₄ (BBO) crystal. It is then used to pump a periodically poled LiNbO₃ (PPLN) crystal, generating non-degenerated parametric down-conversion photon pairs, centered at 633 nm and 1545 nm, respectively. The generated photon pairs are separated by a dichroic mirror (DM). The photons at 633 nm are further split into two paths by a beam splitter (BS). Subsequently, each path is individually coupled into a fiber and sent into a silicon avalanche photodiode (SAPD). The photons at 1545 nm––after being coupled into a fiber––are initially filtered by a tunable bandpass filter with a full width half maximum of 3 nm, then sent into an asymmetric Mach–Zehnder interferometer (AMZI), and further transmitted to Bob through a quantum channel (single-mode fiber). At Bob’s side, the received signal pulses pass through another AMZI and are immediately sent into a commercial super-conducting nanowire single-photon detector (SNSPD: TCOPRS-CCR-SW-85, SCONTEL company) operating at 2.15 K with a 80% detection efficiency and a dark count rate of 7 Hz.

 

Fig. 2 Schematic setup of the passive decoy-state QKD with HSPS. BBO: β−BaB₂O₄ crystal; PPLN: periodically poled LiNbO₃ crystal; M: mirror; BPF: band-pass filter; LPF: long-pass filter; DM: dichroic mirror; BS: beam splitter; SAPD: silicon APD; PC: polarization controller; Filter: 3nm fiber filter with a variable central wavelength; FBS: fiber beam-splitter; FPBS: fiber polarization beam-splitter; PM: phase modulator; TDC: time to digital converter; CB: control board; SNSPD: superconducting nanowire single-photon detector.

Download Full Size | PDF

Here, we use a set of low-loss asymmetric MZ interferometers (AMZI) on both Alice’s and Bob’s side. Inside the AMZIs, polarization maintaining fibers are employed in every connection and a fiber polarization beam-splitter is used to replace the normal fiber beam-splitter in either the input or the output port. In this way, we can avoid most device loss exhibited by conventional Mach–Zehnder interferometers, and thus achieving a 3 dB lower loss in the entire set of the AMZIs. A phase modulator (PM)––driven by the control board (CB) using stored pseudorandom number sequences––in each AMZI randomly generates the four BB84 states, {0, π/2, π, 3π/2}. In order to stabilize the system, a polarization controller (PC) is inserted before each AMZI to adjust the polarization of the incident photons, and two more PCs are placed before the SNSPDs to maximize the counting rates. At both sides, we use a time-to-digital converter (TDC) to collect signals from each detector, with the time window set to 4 ns. Every TDC and CB is synchronized by the Ti:Sapphire laser clock.

4. Results and discussion

First, we should note that in general the PDC source is a multi-mode process. However, here, the multi-mode information would not leak to Eve, as only one mode (signal mode) can leave Alice’s lab. From Eve’s viewpoint, there is no side-channel information leakage from the multi-mode PDC process. In order to keep our passive QKD system stably running for a long time, we adopt a scan and transmission mode [31,32]. For example, during a typical operating time of 112 mins, the effective transmission time is 80 mins (the secure key rate per second presented below is only based on the actual transmission time), and the remaining 32 mins are used for scanning and compensation. In our experiment, the total inserted loss ––mainly caused by the filter, AMZIs, and PCs––was 5.6 dB. Besides, we have run the passive QKD system with three different transmission losses of 20 dB, 40 dB, and 50 dB, corresponding to standard single-mode optical fibers (0.2 dB/km) of 100 km, 200 km and 250 km, respectively. For simplicity, at each distance, the pump light of 449 nm is kept at 7 mW, such that the mean photon number in the original PDC source is μ₀ = 1.22. After being coupled into the fiber and passing through the first AMZI, the mean photon number of the signal pulses sent out from Alice to Bob is μ = μ₀η_s = 0.31. The remaining parameters used in our experiment are listed in Appendix D.

In each run, the number of pulses sent from Alice is N = 3.648 × 10¹¹. The experimental results are listed in Table 5 of Appendix D. With the method introduced above and taking statistical fluctuations into account, we can obtain the experimental key generation rate, which are shown together with the corresponding theoretical predictions in Fig. 3. The solid line (Rt_passive) denotes the theoretical predictions with the actual experimental parameters, while the two pentagram points (Re_passive) represent our experimental key rate at the losses of 25.6 dB and 45.6 dB, respectively. The experimental key rates were 8.24 × 10⁻⁵ and 5.24 × 10⁻⁷ bits per pulse, which correspond to secret key extraction at the rates of 6.26 kbps and 39.82 bps, respectively. We can see from Fig. 3 that our experimental data shows a behavior comparable with the theoretical predictions. Note that in this passive scenario, no secure keys can be experimentally distilled at the 55.6 dB loss due to the rough estimation of Y₀ in the passive scheme. However, by implementing the 2-intensity decoy-state method with the same setup, i.e., by adding another decoy-state––the vacuum state––the yield of the vacuum component Y₀ can be measured directly. This way, a key rate of 0.13 bps can be obtained at the loss of 55.6 dB, as shown in Fig. 3. The dashed line (Rt_2-intensity) and the circular points (Re_2-intensity) show the theoretical predictions and the experimental data for this case. Interestingly, the 2-intensity decoy-state method exhibits these merits only with the passive scheme at a larger loss, e.g., > 52 dB.

 

Fig. 3 Rt_passive and Re_passive represent the theoretical and experimental key generation rate by using our proposed passive scheme; Rt_2-intensity and Re_2-intensity correspond to the case of implementing two-intensity decoy states (μ and 0). The horizontal axis represents the total channel loss (or equivalent to using commercial standard single-mode fiber at a certain length, as marked in the figure by 100 km, 200 km, 250 km, respectively), and the vertical axis indicates the key generation rate per pulse with logarithmic coordinates.

Download Full Size | PDF

We also compared our present work with several other previous reports using the one-way BB84 (or BBM92) protocol using PDC sources (HSPS and EPR pair), as listed in Table 2. Specifically, Wang et al.’s work in 2008 [21] and Sun et al.’s work in 2014 [22] presented the first implementation of the active and passive decoy-state QKD with HSPS. Scheidl et al.’s work in 2009 [28] tested the performance of EPR-based QKD with the BBM92 protocol over a loss of 35 dB, while not taking the finite data-size effect into account and considering only the asymptotic case for the calculation of the secure key rate. When compared with these reports, the present work obtained a better performance in key generation rate per second at similar transmission distances.

Table 2. Performance comparison between different works on QKD.

View Table | View all tables in this article

In addition, we compared our passive QKD system to other works based on WCS, as listed in Table 2. For example, when comparing with Liu et al.’s work from 2010 using WCS [24], our work shows an improvement of more than a factor of 2 in the key generation rate per second at the loss of 40 dB. Besides, Liu et al. used a polarization-coding scheme [24], which is very sensitive to the environment and requires a tremendous time for scanning and system re-calibration, making it less efficient for real implementations. Moreover, the conventional three-intensity decoy-state method was employed in [24], which inevitably causes intensity-modulating errors during the random switching between signal and decoy pulses at a high frequency (this was in fact, not considered in [24]). In contrast, we employed the phase-coding scheme combined with a novel passive decoy-state method, thus, we were able to avoid almost every flaw of existing QKD systems. Recently, Frohlich et al. have realized a phase-coding active decoy-state QKD with a loss over 44.4 dB with a 1 GHz system repetition rate [25], representing a state-of-art QKD system using WCS. However, by adopting the 2-intensity decoy-state method, our present QKD setup could achieve an even higher transmission loss of up to 50 dB.

The presented improvements can be attributed to a few aspects as follows. First, it is due to the use of a novel passive decoy-state protocol described in Appendix A. In the current passive scheme, by using splitting-local-mode detection and employing every clicking and non-clicking event to carry out parameter estimation and secret key distillation, we could not only reduce the influence of the coupling loss and imperfect detection efficiency of the local detectors, but also obtained a more accurate estimation of the single-photon-pulse contribution. Furthermore, it can be attributed to the implementation of the novel asymmetric MZ interferometers with a low systematic loss and high-efficiency SNSPD.

5. Conclusion

In summary, we have realized a proof-of-principle demonstration of the parametric down-conversion source-based quantum key distribution with a channel loss above 40 dB. This demonstrates that parametric down-conversion sources can show a superior performance in real-life implementations of QKD. For example, a secure key rate of 6.26 kbps was achieved at 20 dB (equivalent to 100 km), which is suitable for secure communication within a city [37]. By implementing our novel passive scheme and asymmetric MZ interferometers, we could not only avoid some disadvantages of existing QKD systems using HSPS, but also obtain a more precise parameter estimation of single-photon-pulse contribution. In addition, we employed the newly proposed analysis method [34] to account for statistical fluctuations, which poses no assumptions on the eavesdropper and can be secure against common attacks, such as, coherent attacks. As a result, we were able to obtain an improved performance in both key generation rate and secure transmission distance compared with former reports using parametric down-conversion sources and even several active decoy-state BB84 QKD systems using WCS.

In addition, the present scheme can be extended to the measurement-device-independent quantum key distribution [38], or high-dimensional protocols, such as round-robin differential phase-shift (RRDPS) QKD [39], which are expected to achieve interesting phenomena. Further work will be carried out in our future research.

Appendix A: model for calculating the passive heralded single-photon source probabilities

In the following, we describe in detail how to calculate the photon-number distribution of the passive heralded single-photon source from parametric down-conversion (PDC) processes. As shown in Fig. 1, the non-degenerate photon pairs are generated from the PDC process through a periodically poled LiNbO₃ (PPLN) crystal, and separated by a dichroic mirror (DM). The two modes are denoted as idler or signal, respectively. In contrast with a conventional scheme producing heralded single photons, we split the idler mode into two branches by a beam-splitter (BS) and send each branch into one local single-photon detector (D₁ and D₂), respectively. After recording every clicking event of the two local single-photon detectors, we can divide them into four different species, and denote each as X_i (i = 1, 2, 3, 4). (1) Non-clicking; (2) Single clicking at D₁; (3) Single clicking at D₂; (4) Clicking at both D₁ and D₂.

We denote as l (l = x, y, z, w) the signal state conditioned on a recording event X_i in the idler mode, which can be expressed in the photon-number space as: ${\rho }_l={\sum }_n{a}_n^l|n〉〈n|$ (l = x, y, z, w), where $a_n^l$ corresponds to the photon-number distribution of a l state. Below, we formulate the configuration of $a_n^l$ step by step. For simplicity, we include the imperfect detection efficiency of each local single-photon detector into the coupling loss, assuming it has a detection efficiency of 100% at Alice’s side.

We start from the idler mode. Denote as P_{Xi |s1s2} the probability of an X_i event given by a projection state |s₁s₂〉. For a vacuum projection state, the local detector will click with a probability of d_i (the probability of the dark counts) and non-click with a probability of (1 − d_i). Meanwhile, for a non-vacuum projection state, the local detector will click with certainty. We can then list all the probabilities of the four X_i events as shown in Table 3.

Table 3. Probability for a X_i event to occur.

View Table | View all tables in this article

For any m-photon state, after passing through the BS and being projected into the state |s₁s₂〉, the corresponding projecting probability of P_s1s2|m can be formulated as:

(3)$$\begin{array}{l}{P}_{s_1{s}_2|m}\\ =\sum _{k=0}^m\sum _{s_2=0}^{m-k}\sum _{s_1=0}^k{(C}_m^k{t}^k{\left(1-t\right)}^{m-k}{C}_k^{s_1}{\eta }_{10}^{s_1}{\left(1-{\eta }_{10}\right)}^{k-s_1}\\ \times C_{m-k}^{s_2}{\eta }_{20}^{s_2}{\left(1-{\eta }_{20}\right)}^{m-k-s_2})\\ =\sum _{k=0}^m\sum _{s_2=0}^{m-k}\sum _{s_1=0}^k\frac{m!t^k{\left(1-t\right)}^{m-k}{\eta }_{10}^{s_1}{\eta }_{10}^{s_2}{\left(1-{\eta }_{10}\right)}^{k-s_1}{\left(1-{\eta }_{20}\right)}^{m-k-s_2}}{s_1!s_2!(k-s_1)!\left(m-k-s_2\right)!},\end{array}$$

where t represents the transmission efficiency of the BS; η₁₀ and η₂₀ denote the overall efficiency of each branch in the idler mode, respectively, which includes the detection efficiency but excludes the transmission efficiency of the BS (t); η_s corresponds to the coupling efficiency of the signal mode.

Defining P_{Xi |m} as the probability of an X_i event given by any m-photon state, we have

(4)$$P_{X_i|m}=\sum _{s_1{s}_2}{P}_{X_i|s_1{s}_2}{P}_{s_1{s}_2|m}.$$

After a conditional detection in the idler mode, the corresponding probability of finding n photons in the signal state l (l = x, y, z, w) is given by

(5)$$a_n^l=\sum _{m=n}^{\infty }\frac{{{\mu }_0}^m{e}^{-{\mu }_0}}{m!}{C}_m^n{\eta }_s^n{\left(1-{\eta }_s\right)}^{m-n}{P}_{X_i|m},$$

where μ₀ is the original mean photon number from the PDC process.

Since we use three states x, y, z, we calculate the corresponding simplified photon-number distributions of the x, y, and z states as

(6)$$\begin{array}{l}{a}_n^x=(1-d_1)(1-d_2)e^{-{\mu }_0({\eta }_1+{\eta }_2)}{P}_n\left[{\mu }_0{\eta }_s(1-{\eta }_1-{\eta }_2)\right],\\ a_n^y=(1-d_2)e^{-{\mu }_0{\eta }_2}{P}_n\left[{\mu }_0{\eta }_s(1-{\eta }_2)\right]-a_n^x,\\ a_n^z=(1-d_1)e^{-{\mu }_0{\eta }_1}{P}_n\left[{\mu }_0{\eta }_s(1-{\eta }_1)\right]-a_n^x,\end{array}$$

where P_n(Ξ) = e^−ΞΞⁿ/n!; η₁ = tη₁₀ and η₂ = (1 − t)η₂₀ can be regarded as the overall efficiency of the path from the crystal to the detectors.

Appendix B: key rate

The parameters used in our experiment satisfy 0 < η₁₀ < 1, 0 < η₂₀ < 1, 0 < t ⩽ 0.5. Considering η₁ = tη₁₀, η₂ = (1 − t)η₂₀, we can easily obtain η₁ > 0, 1 − η₂ > 0, 1 − η₁ − η₂ > 0.

As d₁ ≪ 1, for any n ⩾ 2, we get

(7)$$\begin{array}{l}\frac{a_n^z}{a_n^x}-\frac{a_{n-1}^z}{a_{n-1}^x}=\frac{e^{{\mu }_0{\eta }_2(1-{\eta }_s)}}{1-d_2}\left[{\left(\frac{1-{\eta }_1}{1-{\eta }_1-{\eta }_2}\right)}^n-{\left(\frac{1-{\eta }_1}{1-{\eta }_1-{\eta }_2}\right)}^{n-1}\right]\hfill \\ \begin{array}{ll}\hfill & =\frac{e^{{\mu }_0{\eta }_2(1-{\eta }_s)}}{1-d_2}{\left(\frac{1-{\eta }_1}{1-{\eta }_1-{\eta }_2}\right)}^{n-1}\frac{{\eta }_2}{1-{\eta }_1-{\eta }_2}\hfill \end{array}\hfill \\ \begin{array}{ll}\hfill & ⩾0,\hfill \end{array}\hfill \end{array}$$

therefore, the following inequality holds true for any n ⩾ 2

(8)$$\frac{a_n^z}{a_n^x}⩾\frac{a_2^z}{a_2^x}⩾\frac{a_1^z}{a_1^x}.$$

With the above formulae and the model presented in [14], we can derive the lower bound of the yield ($Y_1^L$) and the upper bound of the quantum-bit error-rate ($e_1^U$) for single-photon pulses as in [18], hence we obtain

(9)$$\begin{array}{l}{Y}_1^L=\frac{a_2^z{\mathrm{\Delta }}^L\left[Q^{x}N\right]-a_2^x{\mathrm{\Delta }}^U\left[Q^{z}N\right]-\left(a_2^z{a}_0^x-a_2^x{a}_0^z\right)Y_0^U}{N\left(a_1^x{a}_2^z-a_1^z{a}_2^x\right)},\\ e_1^U=\frac{{\mathrm{\Delta }}^U\left[E^y{Q}^{y}N\right]-e_0{a}_0^y{Y}_0^L}{N\left(a_1^y{Y}_1^L\right)},\end{array}$$

where e₀ (= 0.5) denotes the quantum-bit error-rate of vacuum pulses at Bob’s side; Q^ξ and E^ξ (ξ = x, y, z) represent the overall counting rate and the quantum-bit error-rate for the ξ event, respectively; N is the total number of pulses sent from Alice to Bob; $Y_0^L$ and $Y_0^U$ are the lower and upper bounds of the yield of vacuum state at Bob’s side, respectively, estimated by [40]

(10)$$\begin{array}{l}{Y}_0^L=\text{max}\left\{\frac{a_1^y{\mathrm{\Delta }}^L\left[Q^{x}N\right]-a_1^x{\mathrm{\Delta }}^U\left[Q^{y}N\right]}{N\left(a_0^x{a}_1^y-a_0^y{a}_1^x\right)},\hspace{0.17em}\hspace{0.17em}\frac{a_1^z{\mathrm{\Delta }}^L\left[Q^{x}N\right]-a_1^x{\mathrm{\Delta }}^U\left[Q^{z}N\right]}{N\left(a_0^x{a}_1^z-a_0^z{a}_1^x\right)},0\right\},\\ Y_0^U=\text{min}\left\{\frac{{\mathrm{\Delta }}^U\left[E^x{Q}^{x}N\right]}{N{a}_0^x{e}_0},\hspace{0.17em}\hspace{0.17em}\frac{{\mathrm{\Delta }}^U\left[E^y{Q}^{y}N\right]}{N{a}_0^y{e}_0},\hspace{0.17em}\hspace{0.17em}\frac{{\mathrm{\Delta }}^U\left[E^z{Q}^{z}N\right]}{N{a}_0^z{e}_0}\right\}.\end{array}$$

To be noted, here we employ a new form of the Chernoff bound method when considering statistical fluctuations. As demonstrated in [34], it poses no assumptions on the eavesdropper and can thus achieve a high level of security. The upper and lower bounds of the measured values are given by:

(11)$${\mathrm{\Delta }}^L[\chi ]=\frac{\chi }{1+{\delta }^L},\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}{\mathrm{\Delta }}^U[\chi ]=\frac{\chi }{1-{\delta }^U}.$$

Here, δ^L and δ^U can be obtained by solving the following equation set:

(12)$${\left[\frac{e^{{\delta }^L}}{{\left(1+{\delta }^L\right)}^{1+{\delta }^L}}\right]}^{\frac{\chi }{1+{\delta }^L}}=\frac{1}{2}\epsilon ,\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}{\left[\frac{e^{-{\delta }^U}}{{\left(1-{\delta }^U\right)}^{1-{\delta }^U}}\right]}^{\frac{\chi }{1-{\delta }^U}}=\frac{1}{2}\epsilon ,$$

where ε is the failure probability, fixed at 10⁻⁷.

Finally, the secure key rate is given by

(13)$$\begin{array}{l}{R}^l\ge \frac{1}{2}\left\{a_1^l{Y}_1^L\left[1-H\left(e_1^U\right)\right]-Q^{l}f\left(E^l\right)H\left(E^l\right)\right\},\\ R=R^x+R^y+R^z,\end{array}$$

Appendix C: low-loss asymmetric MZ interferometer

The asymmetric Mach–Zehnder interferometer (AMZI) employed in our system possesses a significantly lower internal loss compared with conventional ones. Its detailed structure is illustrated in Fig. 4. Unlike conventional AMZIs consisting of two beam-splitters (BS), our low-loss AMZI includes one polarizing BS and one conventional one. When Alice sends out photons through her AMZI to Bob’s AMZI, photons from Alice’s short arm are directed into Bob’s long arm (As − Bl), and those from Alice’s long arm are directed into Bob’s short arm (Al − Bs). As a result, other possibilities (As − Bs, Al − Bl) existing in conventional AMZI could be avoided.

 

Fig. 4 The structure of QKD system based the low-loss AMZIs.

Download Full Size | PDF

The path difference between As − Bl and Al − Bs could be precisely matched by carefully adjusting the arm difference between the two AMZIs. Consequently, in each run, there is only a single pulse output from the BS at Bob’s side. Therefore, we can eliminate the side-peak pulses originating from As − Bs and Al − Bl existing in conventional AMZIs, which can indeed reduce the internal loss.

Appendix D: experimental results

We started by characterizing the photon-number distribution of the PDC source by carrying out a Hanbury Brown–Twiss (HBT) measurement on the signal mode before and after it was heralded by the idler mode. We obtained g²(0) = 1.002 ± 0.004 before heralding, verifying the Poisson distribution of the original signal mode; We measured g²(0) = 0.244 ± 0.002 after heralding and observed a sub-Poissonian distribution.

Subsequently, we estimated the parameters of our HSPS, i.e., the mean photon number generated from the PPLN per pulse μ₀, and the overall transmission efficiencies of the idler and signal modes η_i (i = 1, 2, 3). We measured the dark count rate of each detector (d₁ and d₂ represent the dark count rates of the silicon detectors, and d_B denotes the dark count rate of the SNSPD), and calibrated the efficiency of the SNSPD, η_Bob. Then, the coupling efficiency of the signal mode η_s is given by η_s = η₃/η_Bob. The misalignment of our MZ interferometers e_d was calibrated before carrying out the experiment. Every parameter is listed in Table 4. In addition, we employed a simulation model to obtain the theoretical curve of our experiment described by the parameters in Table 4.

Table 4. Parameters used in our experiments.

View Table | View all tables in this article

We have run our passive QKD system for 112 minutes. Table 5 shows the details of the experimental results, in which the gains and overall error rates of the state x, y, z at different distances are displayed.

Table 5. Final experimental results. η is the total loss. N_i corresponds to the number of pulses sent out for X_i (i = 1, 2, 3) event.

View Table | View all tables in this article

Funding

National Key R&D Program of China (Grant Nos. 2018YFA0306400 and 2017YFA0304100), the National Basic Research Program of China (Grants Nos. 2011CBA00200 and 2011CB921200), the National Natural Science Foundation of China (Grants Nos. 11774180, 61590932, 61475197, 61101137 and 61201239), the Natural Science Foundation of the Jiangsu Higher Education Institutions (Grant No. 15KJA120002), the Outstanding Youth Project of Jiangsu Province (Grant No. BK20150039) and the Postgraduate Research and Practice Innovation Program of Jiangsu Province.

Acknowledgments

We thank Drs. Zhi-Yuan Zhou and Jian-Rong Zhu for technical supports, and thank Drs. Chun-Mei Zhang, Xue-Bi An and Chao Wang for enlightened discussion.

References and links

1. H.-K. Lo and H. F. Chau, “Unconditional security of quantum key distribution over arbitrarily long distances,” Science 283, 2050–2056 (1999). [CrossRef]   [PubMed]  

2. P. W. Shor and J. Preskill, “Simple proof of security of the BB84 quantum key distribution protocol,” Phys. Rev. Lett. 85, 441–444 (2000). [CrossRef]   [PubMed]  

3. D. Mayers, “Unconditional security in quantum cryptography,” J. ACM 48, 351–406 (2001). [CrossRef]  

4. C. H. Bennett and G. Brassard, “Quantum cryptography: Public key distribution and coin tossing,” in Proceedings of the IEEE International Conference on Computers, Systems and Signal Processing, Bangalore, India (IEEE, New York, 1984), pp. 175–179.

5. V. Makarov, A. Anisimov, and J. Skaar, “Effects of detector efficiency mismatch on security of quantum cryptosystems,” Phys. Rev. A 74, 022313 (2006). [CrossRef]  

6. B. Qi, C.-H. F. Fung, H.-K. Lo, and X. Ma, “Time-shift attack in practical quantum cryptosystems,” Quantum Inf. Comput. 7, 073 (2007).

7. Y. Zhao, C.-H. F. Fung, B. Qi, C. Chen, and H.-K. Lo, “Quantum hacking: Experimental demonstration of time-shift attack against practical quantum-key-distribution systems,” Phys. Rev. A 78, 042333 (2008). [CrossRef]  

8. G. Brassard, N. Lütkenhaus, T. Mor, and B. Sanders, “Limitations on practical quantum cryptography,” Phys. Rev. Lett. 85, 1330–1333 (2000). [CrossRef]   [PubMed]  

9. N. Lütkenhaus, “Security against individual attacks for realistic quantum key distribution,” Phys. Rev. A 61, 052304 (2000). [CrossRef]  

10. N. Lütkenhaus and M. Jahma, “Quantum key distribution with realistic states: photon-number statistics in the photon-number splitting attack,” New J. Phys. 4, 44 (2002). [CrossRef]  

11. J. C. Boileau, D. Gottesman, R. Laflamme, D. Poulin, and R. W. Spekkens, “Robust polarization-based quantum key distribution over a collective-noise channel,” Phys. Rev. Lett. 92, 017901 (2004). [CrossRef]   [PubMed]  

12. W. Y. Hwang, “Quantum key distribution with high loss: Toward global secure communication,” Phys. Rev. Lett. 91, 057901 (2003). [CrossRef]   [PubMed]  

13. X. B. Wang, “Beating the photon-number-splitting attack in practical quantum cryptography,” Phys. Rev. Lett. 94, 230503 (2005). [CrossRef]   [PubMed]  

14. H.-K. Lo, X. F. Ma, and K. Chen, “Decoy state quantum key distribution,” Phys. Rev. Lett. 94, 230504 (2005). [CrossRef]   [PubMed]  

15. Y. Zhao, B. Qi, X. F. Ma, H.-K. Lo, and L. Qian, “Experimental quantum key distribution with decoy states,” Phys. Rev. Lett. 96, 070502 (2006). [CrossRef]   [PubMed]  

16. C.-Z. Peng, J. Zhang, D. Yang, W.-B. Gao, H.-X. Ma, H. Yin, H.-P. Zeng, T. Yang, X.B. Wang, and J. W. Pan, “Experimental long-distance decoy-state quantum key distribution based on polarization encoding,” Phys. Rev. Lett. 98, 010505 (2007). [CrossRef]   [PubMed]  

17. D. Rosenberg, J. W. Harrington, P. R. Rice, P. A. Hiskett, C. G. Peterson, R. J. Hughes, A. E. Lita, S. W. Nam, and J. E. Nordholt, “Long-distance decoy-state quantum key distribution in optical fibe, r,” Phys. Rev. Lett. 98, 010503 (2007). [CrossRef]  

18. Q. Wang, X. B. Wang, and G. C. Guo, “Practical decoy-state method in quantum key distribution with a heralded single-photon source,” Phys. Rev. A 75, 012312 (2007). [CrossRef]  

19. Q. Wang and A. karlsson, “Performance enhancement of a decoy-state quantum key distribution using a conditionally prepared downconversion source in the Poisson distribution,” Phys. Rev. A 76, 014309 (2007). [CrossRef]  

20. Y. Adachi, T. Yamamoto, M. Koashi, and N. Imoto, “Simple and efficient quantum key distribution with parametric down-conversion,” Phys. Rev. Lett. 99, 180503 (2007). [CrossRef]   [PubMed]  

21. Q. Wang, W. Chen, G. Xavier, M. Swillo, T. Zhang, S. Sauge, M. Tengner, Z. F. Han, G. C. Guo, and A. Karlsson, “Experimental decoy-state quantum key distribution with a sub-poissionian heralded single-photon source,” Phys. Rev. Lett. 100, 090501 (2008). [CrossRef]   [PubMed]  

22. Q.-C. Sun, W.-L. Wang, Y. Liu, F. Zhou, J. S. Pelc, M. M. Fejer, C.-Z. Peng, X.-F. Chen, X.-F. Ma, Q. Zhang, and J.-W. Pan, “Experimental passive decoy-state quantum key distribution,” Laser Phys. Lett. , 11, 085202 (2014). [CrossRef]  

23. Q. Wang, C.-H. Zhang, and X.-B. Wang, “Scheme for realizing passive quantum key distribution with heralded single-photon sources,” Phys. Rev. A 93, 032312 (2016). [CrossRef]  

24. Y. Liu, T.-Y. Chen, J. Wang, W.-Q. Cai, X. Wan, L.-K. Chen, J.-H. Wang, S.-B. Liu, H. Liang, L. Yang, C.-Z. Peng, K. Chen, Z.-B. Chen, and J.-W. Pan, “Decoy-state quantum key distribution with polarized photons over 200 km,” Opt. Expr. 8, 8587–8594 (2010). [CrossRef]  

25. B. Frohlich, M. Lucamarini, J. F. Dynes, L. C. Comandar, W. W.-S. Tam, A. Plews, A. W. Sharpe, Z.-L. Yuan, and A. J. Shields, “Long-distance quantum key distribution secure against coherent attacks,” Optica , 4, 163–167 (2017). [CrossRef]  

26. B. Korzh, C. C. W. Lim, R. Houlmann, N. Gisin, M. J. Li, D. Nolan, B. Sanguinetti, R. Thew, and H. Zbinden, “Provably secure and practical quantum key distribution over 307 km of optical fibre,” Nature Photon. 9, 163–168 (2015). [CrossRef]  

27. H.-L. Yin, T.-Y. Chen, Z.-W. Yu, H. Liu, L.-X. You, Y.-H. Zhou, S.-J. Chen, Y.-Q. Mao, M.-Q. Huang, W.-J. Zhang, H. Chen, M.-J. Li, D. Nolan, F. Zhou, X. Jiang, Z. Wang, Q. Zhang, X.-B. Wang, and J.-W. Pan, “Measurement-Device-Independent Quantum Key Distribution Over a 404 km Optical Fiber,” Phys. Rev. Lett. 117190501 (2016). [CrossRef]  

28. T. Scheidl, R. Ursin, A. Fedrizzi, S. Ramelow, X.-S. Ma, T. Herbst, R. Prevedel, L. Ratschbacher, J. Kofler, T. Jennewein, and A. Zeilinger, “Feasibility of 300 km quantum key distribution with entangled states,” New J. Phys. 11, 085002 (2009). [CrossRef]  

29. Y. Adachi, T. Yamamoto, M. Koashi, and N. Imoto, “Boosting up quantum key distribution by learning statistics of practical single-photon sources,” New J. Phys. 11, 113033 (2009). [CrossRef]  

30. C. Gobby, Z. L. Yuan, and A. J. Shields, “Quantum key distribution over 122 km of standard telecom fiber,” Appl. Phys. Lett. 84, 3762–3764 (2004). [CrossRef]  

31. X.-F. Mo, B. Zhu, Z.-F. Han, Y.-Z. Gui, and G.-C. Guo, “Faraday-Michelson system for quantum cryptography,” Opt. Lett. 30, 2632–2634 (2005). [CrossRef]   [PubMed]  

32. Z.-F. Han, X.-F. Mo, Y.-Z. Gui, and G.-C. Guo, “Stability of phase-modulated quantum key distribution systems,” Appl. Phys. Lett. 86, 221103 (2005). [CrossRef]  

33. C.-H. F. Fung, X. Ma, and H. F. Chau, “Practical issues in quantum-key-distribution postprocessing,” Phys. Rev. A 81, 012318 (2010). [CrossRef]  

34. Z. Zhang, Q. Zhao, M. Razavi, and X. Ma, “Improved key-rate bounds for practical decoy-state quantum-key-distribution systems,” Phys. Rev. A 95, 012333 (2017). [CrossRef]  

35. C. C. W. Lim, M. Curty, N. Walenta, F. Xu, and H. Zbinden, “Concise security bounds for practical decoy-state quantum key distribution,” Phys. Rev. A 89, 022307 (2014). [CrossRef]  

36. M. Curty, F. Xu, W. Cui, C. C. W. Lim, K. Tamaki, and H.-K. Lo, “Finite-key analysis for measurement-device-independent quantum key distribution,” Nat. Commun. 5, 3732 (2014). [CrossRef]   [PubMed]  

37. Digital cellular telecommunications system; Full rate speech; Transcoding (GSM 06.10 RPE-LTP), ETS 300 961, V8.1.1 (2000).

38. Q. Wang, X.-Y. Zhou, and G.-C. Guo, “Realizing the measure-device-independent quantum-key-distribution with passive heralded-single photon sources,” Sci. Rep. 6, 35394 (2016). [CrossRef]   [PubMed]  

39. S. Wang, Z.-Q. Yin, W. Chen, D.-Y. He, X.-T. Song, H.-W. Li, L.-J. Zhang, Z. Zhou, G.-C. Guo, and Z.-F. Han,”Experimental demonstration of a quantum key distribution without signal disturbance monitoring,” Nat. Photonics 9, 832 (2015). [CrossRef]  

40. X. Ma, B. Qi, Y. Zhao, and H.-K. Lo, “Practical decoy state for quantum key distribution,” Phys. Rev. A , 72, 012326 (2005). [CrossRef]