1. Introduction

Light and matter are ultimately constituted of quantum entities, so that the limitations of technology cannot be prescribed by the principles of classical physics. Quantum-optical devices promise better-than-classical performance in sensing [1, 2], computation [3–5] and, in particular, communications [6, 7]. Quantum effects in optical systems are easily observed at room temperature because thermal background radiation at optical frequencies is negligible. Light has numerous degrees of freedom that can be co-opted for the transmission of quantum information, and optical signals can be generated and detected efficiently. Modern telecommunications leverage the very large capacity of optical fields via dense multiplexing techniques, and the efficiency of quantum information processing can be similarly enhanced with the use of large-alphabet encoding strategies. In this connection, time-frequency encoding offers numerous advantages over polarisation or spatial-mode encodings, since multiple spectral modes are supported in waveguides and optical fibres with minimal dispersion, and zero cross-talk. For this reason, large-alphabet spectral-temporal multiplexing in quantum optics has recently received growing attention [8, 9], with immediate applications in quantum key distribution (QKD) [10–12].

Public key cryptography underpins much of commerce today [13], but it is threatened by the advanced computational tools made possible by quantum information processing. Although a quantum computer remains many years away, the threat is sufficient to motivate the search for security that is immune to a quantum adversary. Quantum key distribution [14] provides this security, and in the three decades since the first proposals were made based on polarized photons [15], it has developed into both a burgeoning industry [16], and a diverse research field [17–20]. While polarisation states are vulnerable to corruption in waveguides and optical fibres, the arrival time of photons is a more robust encoding [21]. In general, transmission losses limit the range of QKD, but the use of entangled photons [22] allows the distance to be extended by means of quantum repeaters [23, 24], which employ entanglement swapping between short segments to distribute secure correlations over large distances.

These considerations motivate the study of QKD with photon pairs entangled in their chrono-cyclic degree of freedom [8, 25–30]. The security of such time-frequency QKD (TFQKD) protocols is based on the ability to detect non-classical correlations in at least two complementary measurement bases, and these bases should be mutually unbiased (i.e. Fourier conjugates of one another) to maximise the sensitivity of the measured correlations to intrusion by an eavesdropper. Time and frequency domain detection provides a particularly convenient conjugate pair both because time- and frequency-resolving measurements are mature technologies, and because photon sources based on parametric scattering, such as spontaneous downconversion or four-wave mixing naturally produce photon pairs with widely-tunable correlation properties ranging from uncorrelated emission [31, 32] to extremely broadband spectral entanglement [33–35]. However, accessing the large entropy of these photon pairs requires precise measurements in both time and frequency bases, which is a non-trivial problem because of technical constraints on the timing jitter of photon detectors and the resolution of spectrometers.

Recently it was proposed to use fast time-resolving photon detectors to record the correlated arrival times of entangled photons, and to insert a dispersive medium before the detectors to measure in the frequency basis [10]. The dispersion delays each spectral component of the incident photons differently, converting the arrival time at the detector into a frequency measurement [36]. This protocol has the advantage that a single detector can sample a large region in chronocyclic space [37]. However the timing jitter of the detector sets a lower limit to the correlation time of the photon pairs. Fast detectors are not yet efficient [38, 39], whereas efficient detectors are generally slower [40–42], so with current technology the spectral correlations should be very narrowband in order for the arrival-time correlations to extend over a long enough period to be resolved by the detectors. Besides the challenges of engineering a bright photon source to fit these criteria, the narrow bandwidth also means that extremely dispersive media are required to implement the frequency measurements, which are generally lossy.

Here we introduce an alternative large-alphabet entangled TFQKD protocol that is dual to [10]. We propose to use spectral measurements to detect frequency correlations, and to use phase modulators to convert these measurements to the time basis. We show that with this detection scheme it is feasible to demultiplex up to 4 bits per photon with readily available components, while technical advances — essentially improving the power dissipation of electro-optical phase modulators to allow larger modulation depth — could allow much larger alphabets. While chronocyclic entanglement produces correlations between the continuous variables of arrival time and frequency, measurements inevitably map these correlations to a set of discrete outcomes. We provide a security analysis that accounts for the effects of this detector-binning, and we model the constraints on the secure key arising from dark counts.

2. The protocol

Key distribution aims at generating a pair of correlated random bit strings shared exclusively by two parties — conventionally called Alice and Bob — that can be used to encrypt and decrypt communications by means of a one time pad[43]. In our TFQKD protocol, Alice and Bob construct correlated bit strings by recording the results of joint measurements on pairs of spectrally entangled photons. The entanglement produces correlations in both the frequencies and the arrival times of the photons which are destroyed if the system is measured by a third party. Uncorrelated measurement results therefore reveal the presence of an eavesdropper (Eve) when Alice and Bob compare a subset of their bits. We consider the set-up sketched in part (a) of Fig. 1, in which the measurement basis at each party is selected randomly by a 50:50 beam splitter. Transmitted photons are directed to a spectrometer, and reflected photons are directed to an apparatus that measures their arrival time by means of a time-to-frequency converter (see below) followed by another spectrometer. After publicly revealing their measurement bases, but not their measurement outcomes, Alice and Bob generate a sifted key by rejecting measurement outcomes that were recorded with incommensurate bases. Some fraction [44] of the sifted key is then shared so that Alice and Bob can estimate the error probability in the sifted key: provided the errors are low enough, this allows Alice and Bob to generate a reduced key with certified security.

 

Fig. 1 Time-frequency quantum key distribution with spectrally entangled photon pairs. (a) photon pairs from the source are distributed to Alice and Bob, who have identical measurement setups: spectral correlations are revealed with photon-counting spectrometers (spect); security is certified by measurements in the conjugate arrival-time basis using time-to-frequency conversion (TFC). (b) We assume a source with a Gaussian anti-correlated joint spectral amplitude f (ω,ω′) (top) and a corresponding positively correlated Gaussian arrival time distribution f̃(t,t′) (bottom). Black ruled lines indicate spectral/temporal measurements made by Alice and Bob centred at the values {ωj}/{t_j} (see text). (c) Time-to-frequency conversion is implemented with a dispersive element followed by a phase modulator. The phase modulation (black wavy line) is timed so that the pulses from the source (red) arrive during the quadratic portion of the phase modulation.

Download Full Size | PDF

2.1. Source

As shown in Fig. 1, a parametric source (which may or may not be under the control of Eve) produces photon pairs in the entangled state (ignoring for the moment the emission of vacuum or double pairs)

2.2. Frequency measurements

In our protocol, Alice and Bob each have a photon-counting spectrometer, which they use to measure the frequencies of their photons. A photon entering one of the spectrometers is spatially dispersed and then directed towards one of M photon counting detectors, such that a ‘click’ at the j^th detector (j = 1, 2,...,M) is described by a projective positive operator-valued measure (POVM) element

2.3. Arrival time measurements

To certify the security of their key, they need to also check that the arrival times of the photons are correlated. As mentioned previously, the large timing jitter (≳ 200 ps for APDs) of efficient photon-counting detectors makes it challenging to resolve the temporal correlations directly. Instead, we propose to implement measurements in the time basis by sending each photon through a time-to-frequency converter[50–52]. As shown in Fig. 1, this comprises a dispersive element followed by a phase modulator, the combined effect of which is to implement a Fourier transform on the incident waveform, thus converting time to frequency. The effect is rigorously analogous to a spatial Fourier transform implemented on the transverse profile of a light field using a lens followed by free-propagation over a distance equal to its focal length. To see how this works, consider first the effect of the phase modulator on an incoming field (analogous to free propagation alone). The modulator imprints a sinusoidally time-varying [53] phase ϕ(t) = Acos(Ωt) with amplitude A and angular frequency Ω. Near the peak of the modulation at t ≈ 0 the phase has a quadratic time dependence ϕ(t) ≈ −AΩ²t²/2 = − ϕ̈t²/2, where we have defined ϕ̈ = AΩ² and we dropped an unimportant global phase. The time-dependent amplitude E(t) of the incident field is transformed to E(t)exp{iϕ̈t²/2}, which in frequency space induces a transformation analogous to the Fresnel-Kirchhoff diffraction formula,

Having described how to implement temporal measurements, we consider the parameters required for an effective TFQKD protocol using our approach. As an idealised example, we assume a Gaussian correlated joint spectrum of the form [56, 57]

The correlations in the time domain are determined by the joint temporal amplitude f̃(t,t′), which is the two-dimensional Fourier transform of the joint spectral amplitude, f (ω,ω′). The form assumed in Eq. (9) is convenient because f̃(t,t′) is again a correlated Gaussian as shown in Fig. 1, with major and minor temporal widths given by T_± = 1/Δ_∓. If we require the same ability to resolve temporal correlations as spectral correlations, we should have a temporal resolution δt = T₋/β₋, which fixes the modulator phase curvature to be

3. Security

The output of TFQKD is a digital bit string, as for all QKD protocols, but this is extracted from measurements on continuous degrees of freedom. Therefore it is not immediately obvious whether a security analysis developed for discrete-variable QKD protocols can be applied. To examine the security of TFQKD with entangled photons, we adapt arguments developed for spatially-encoded QKD [59] to the case of finite detector resolution [60–65]. To proceed, we consider the correlations revealed by the sifted joint probability distribution { $p_{ba}^{\text{BA}}$} describing the probability of Bob’s b^th detector firing along with Alice’s a^th detector, when both measure in the frequency basis. These correlations are quantified by the mutual information I_BA,

4. Practical considerations

So far we have considered the security of finite-resolution measurements on photon-pair states, but the real photonic states emitted by a parametric source contain dominant contributions from vacuum (no photons emitted), and smaller contributions from multi-pair emission (most significantly, four photons emitted instead of two). Multi-pair emission does not necessarily represent a security threat, since in general the spectral correlations of the source are strictly pair-wise, meaning that Eve cannot glean extra information by ‘splitting off’ extraneous photons. However our security proof is based on a representation of the POVMs in the Hilbert space spanned by a single photon impinging on each detector. The proof is therefore only approximate, but squashing protocols have been proposed for qubit-based QKD to deal with the effects of multi-pair emission [69], and a similar idea could be used here by randomly assigning measurement outcomes whenever more than one detector in an array fires.

Alice and Bob can remove the influence of the vacuum components by post-selecting on joint detection events, and this also allows the protocol to run when the channel transmission and detector efficiencies are less than unity. For Alice and Bob to use postselection, they must employ spectral filters and temporal gates that prevent signals entering their detectors with spectral or temporal components outside the range of their measurements. To see why, suppose that Eve is capable of performing a very precise projective (non-destructive) frequency measurement on Bob’s photon. If he goes on to measure in the frequency basis, he will get the same result as Eve, and if Alice also used the frequency basis, this measurement result will form part of the sifted key. However, if Bob makes a temporal measurement without any time gate, the narrow-band photon produced by Eve’s measurement will fall mostly outside of Bob’s detection range in the time domain, and so will not be detected. Alice and Bob therefore discount this event, since they are post-selecting events where both parties receive a photon. Mutatis mutandis Eve can make the same kind of intercept-resend attack in the temporal basis. In this way, Eve can gain perfect knowledge of the sifted key, while forcing Alice and Bob to ignore those events where she failed to choose the correct measurement basis. Alice and Bob can prevent this attack by always rejecting photons occupying regions of chronocyclic space outside the sensitivity regions of their detectors, by means of spectral filters and temporal gates [25]. In our proposed protocol this could be accomplished with a combination of a dielectric stack and a Pockels cell preceding each of Alice’s and Bob’s detection systems. See [64] for a more general discussion of the effects of finite detection range on entanglement verification.

With postselection as described above, non-unit efficiencies and losses do not directly affect the security, but they reduce the key exchange rate which increases the fraction of uncorrelated dark counts. As is the case with all other QKD protocols, the increasingly important role of dark counts as channel losses grow ultimately limits the distance over which TFQKD can be run securely [10, 59, 70]. To analyse this limitation we consider a simple error model in which the source joint spectrum produces perfect correlations at Alice’s and Bob’s detectors, while random errors occur with probability p in either the time or frequency measurements, so that

 

Fig. 2 TFQKD in the presence of losses and noise. (a) The source emits mostly the vacuum state |0〉, with ε the small probability to emit a correlated photon pair. For simplicity we consider the source located equidistant from Alice and Bob, connected by lossy channels of length L with attenuation length L_att. The photon detectors comprising the spectrometers have efficiency η_d and suffer dark counts (red stars) with probability d. (b) We compute the secure key size I as a function of the alphabet size I_M at a distance L = L_att for a typical protocol with ε = 0.1, η_d = 25% (including coupling losses) and d = 10⁻⁶, which are achievable with guided-wave parametric sources [74, 75] and standard APD detectors at near-infrared (NIR) wavelengths [41]. (c) We plot the secure key size as a function of the channel length L, assuming L_att = 2.2 km (corresponding to silica fibre at NIR wavelengths [76]), for a range of alphabet sizes.

Download Full Size | PDF

A realistic joint spectrum, as approximated in Eq. (9), will not exactly produce the simplified delta-correlated outcome distribution in Eq. (22); in general there will be some finite cross-talk between adjacent detection channels and a Gaussian-like variation in the marginal detection probabilities. However we have verified numerically, using Eq. (9), that the choices β₊ = 3/4, β₋ = 1/5, which we introduced previously, generate H_B ≈ I_M, and agree with Eq. (24), to within 0.05 bits, so that Eq. (25) is approximately correct even for a source with a realistic joint spectral amplitude.

Part (b) of Fig. 2 shows the variation of the secure key size I on the size I_M of the alphabet for a typical implementation with APD-type detectors and a channel length with L = L_att, assuming the values of β_± used previously. The secure key initially grows in proportion to the alphabet, albeit with a magnitude reduced by the binning deficit c ≈ 0.086 bits. Here the deficit is small enough that exchanging up to 4 secure key bits per detected photon pair remains feasible with the components described previously. However for I_M > 11 (i.e. M > 2048) the secure key decreases and rapidly falls to zero, since the dark count rate from the growing number of detectors causes significant errors that are attributed to Eve.

Part (c) of Fig. 2 shows how the secure key falls off with distance. Here the secret key decays more rapidly with distance for the large alphabet protocols because of increased dark counts. This calculation exemplifies a natural technical trade-off in TFQKD, where information can be extracted rapidly from photon pairs using detector arrays as we propose here, whereas single-detector protocols extract less information per registered photon pair, but are affected much less by dark counts [10].

5. Conclusion

We have described an implementation of highly multiplexed time-frequency quantum key distribution using photon-counting spectrometers and phase modulators to implement frequency and arrival-time measurements on pairs of spectrally correlated photons by means of time-to-frequency conversion. We analysed the technical demands required for such a protocol and found that a large-alphabet detection system is feasible with commercially-available components. We developed a general security analysis for continuous-variable QKD protocols with binned measurement results, and applied it to our protocol to model the effects of dark counts on the size of the secure key. The protocol we presented is one of a family of time-frequency protocols well suited to transmission using waveguides and optical fibres, where spatial or polarisation mode encoding is vulnerable to cross-talk and differential scattering losses. Highly multimode quantum light sources are now a well-developed technology, and the use of entangled beams allows the communication distance to be extended via entanglement swapping with quantum repeaters. Our measurement scheme based on phase modulation represents a compact and technically straightforward way to demultiplex a large-alphabet key from a multimode entangled light source, which is a convenient source of correlations that removes the need for an active encoding step. The security analysis we presented shows how the protocol can be treated as a finite-dimensional QKD scheme, despite the continuous nature of the chronocyclic degree of freedom. We anticipate that these results will influence the next generation of quantum cryptographic systems.

A. Entropic uncertainty relation for finite-resolution measurements

As described in the main text, the complementarity of non-commuting measurements {Π_j}, {Π̃_k} is manifested by the entropic uncertainty relation in Eq. (16), with the bound $B=-2{\text{log}}_2{\text{max}}_{jk}{\Vert {\mathrm{\Pi }}_j^{1/2}{\tilde{\mathrm{\Pi }}}_k^{1/2}\Vert }_{\infty }$. To compute the singular values of the product ${\mathrm{\Pi }}_j^{1/2}{\tilde{\mathrm{\Pi }}}_k^{1/2}$ we first note that the square-roots can be dropped because for the top-hat-shaped frequency bins defined in Eq. (3) we have F(ω)^1/2 = F(ω). We therefore consider the singular values of the operator

(26)$$\begin{array}{lll}{\mathrm{\Pi }}_j{\tilde{\mathrm{\Pi }}}_k\hfill & =\hfill & {\left(2\pi \ddot{\varphi }\right)}^{-1/2}\iint F_j\left({\omega }^{\prime }\right){\tilde{F}}_k\left({\omega }^{\prime }-{\omega }^{″}\right)|{\omega }^{\prime }〉〈{\omega }^{″}|\text{d}{\omega }^{\prime }\text{d}{\omega }^{″}\hfill \\ \hfill & =\hfill & \frac{\delta \omega }{2\pi \ddot{\varphi }}\iint F_j\left({\omega }^{\prime }\right)e^{-\text{i}{\omega }_k\left({\omega }^{\prime }-{\omega }^{″}\right)/\ddot{\varphi }}\text{sinc}\left[\frac{\delta \omega }{2}\frac{\left({\omega }^{\prime }-{\omega }^{″}\right)}{\ddot{\varphi }}\right]|{\omega }^{\prime }〉〈{\omega }^{″}|\text{d}{\omega }^{\prime }\text{d}{\omega }^{″}.\hfill \end{array}$$

The phase factor e^{−iω_k(ω′−ω″)/ϕ̈} can be dropped since this represents a unitary transformation that does not affect the singular values. Similarly the index j on F_j is arbitrary since this parameterises a shift in the position of the top-hat function that again does not affect the singular values. The singular values are thus obtained by considering the Schmidt decomposition of the two-dimensional function

(27)$$ℱ\left({\omega }^{\prime },{\omega }^{″}\right)=\{\begin{array}{cc}\frac{\delta \omega }{2\pi \ddot{\varphi }}\text{sinc}\left[\frac{\delta \omega }{2}\frac{\left({\omega }^{\prime }-{\omega }^{″}\right)}{\ddot{\varphi }}\right]& \left|{\omega }^{\prime }-{\omega }_j\right|\le \delta \omega /2;\\ 0& \text{otherwise}.\end{array}$$

As shown in Fig. (3), this has the form of a narrow vertical strip cut from a broad diagonal band, and is well approximated by the factorable function ℱ(ω′,ω″) ≈ λf (ω′)g(ω″), where f (ω′) is a mode function with width δω, g(ω″) is a mode function with width 2πϕ̈/δω, and

(28)$$\lambda =\frac{\delta \omega }{2\pi \ddot{\varphi }}\times \sqrt{\delta \omega \frac{2\pi \ddot{\varphi }}{\delta \omega }}.$$

Numerical calculations confirm that this remains an excellent approximation to the largest singular value of the function in Eq. (27) provided δω/(2πϕ̈/δω) < 0.1, which is guaranteed by Eq. (10) for a large-alphabet protocol with M ≫ 1/β₊β₋. Here we note that even though this approximation breaks down for smaller alphabets, we have checked numerically that the formula in Eq. (21) in the main text can still be used, since the condition I ≤ H_B becomes saturated. Substituting Eq. (28) into Eq. (20) and using δt = δω/ϕ̈, we obtain the bound on the secret key given in Eq. (21). We note that the resulting bound applies quite generally to any TFQKD protocol employing binned frequency and time measurements with resolutions δω, δt.

 

Fig. 3 Schematic of the operator ${\mathrm{\Pi }}_j^{1/2}{\tilde{\mathrm{\Pi }}}_k^{1/2}$, showing the approximate computation of its largest singular value.

Download Full Size | PDF

B. Dark count error probability

The error probability p is given by [71]

$$p=\frac{p_{\text{incorrect}}}{p_{\text{correct}}+p_{\text{incorrect}}},$$

where P_correct, P_incorrect are the probabilities for recording correlated and uncorrelated detector clicks, respectively. Alice and Bob postselect on single clicks at each side, so only events where one detector fires each are counted. We make the simplifying assumption that if both photons from a photon pair are successfully emitted and detected, without a dark count occurring in any other channel, then the two registered outcomes are perfectly correlated. If these photons are not registered, but dark counts occur, it is possible that the outcomes are incorrectly correlated. Taking into account all possibilities yields

(29)$$P_{\text{incorrect}}={\overline{d}}^{2\left(M-1\right)}\left[2\epsilon \eta \overline{\eta }\left(M-1\right)d+\epsilon {\overline{\eta }}^2{d}^{2}M\left(M-1\right)+\overline{\epsilon }{d}^{2}M\left(M-1\right)\right],$$

and

(30)$$P_{\text{correct}}={\overline{d}}^{2\left(M-1\right)}\left[\epsilon {\eta }^2+2\epsilon \eta \overline{\eta }d+\epsilon {\overline{\eta }}^2{d}^{2}M+\overline{\epsilon }{d}^{2}M\right],$$

where the overbar notation x̄ = 1−x denotes the probabilistic complement. The common factor of d̄^2(M−1) represents the probability that there is no dark count in the M − 1 remaining bins on each side, and this factor cancels out in the expression for p. After some algebra, one obtains the expressions in Eq. (23).

Acknowledgments

The authors gratefully acknowledge helpful discussions with M. G. Raymer, S. J. van Enk and N. K. Langford in the initial stages of this work. BJS was supported by the University of Oxford John Fell Fund and EPSRC grant No. EP/E036066/1. JN and IAW were supported by EPSRC grant No. EP/J000051/1.

References and links

1. J. Rarity, P. Tapster, J. Walker, and S. Seward, “Experimental demonstration of single photon rangefinding using parametric downconversion,” Appl. Opt. 29, 2939–2943 (1990) [CrossRef]   [PubMed]  .

2. A. Datta, L. Zhang, N. Thomas-Peter, U. Dorner, B. J. Smith, and I. A. Walmsley, “Quantum metrology with imperfect states and detectors,” Phys. Rev. A 83, 063836 (2011) [CrossRef]  .

3. P. Shor, “Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer,” Appl. Math. J. Comp 26, 1484–1509 (1997).

4. B. P. Lanyon, T. J. Weinhold, N. K. Langford, M. Barbieri, D. F. V. James, A. Gilchrist, and A. G. White, “Experimental demonstration of a compiled version of Shor’s algorithm with quantum entanglement,” Phys. Rev. Lett. 99, 250505 (2007) [CrossRef]  .

5. E. Martin-Lopez, A. Laing, T. Lawson, R. Alvarez, X.-Q. Zhou, and J. L. O’Brien, “Experimental realization of Shor’s quantum factoring algorithm using qubit recycling,” Nat. Photonics 6, 773–776 (2012) [CrossRef]  .

6. A. Muller, T. Herzog, B. Huttner, W. Tittel, H. Zbinden, and N. Gisin, ““Plug and play” systems for quantum cryptography,” Appl. Phys. Lett. 70, 793–795 (1997) [CrossRef]  .

7. J. H. Shapiro, “Defeating passive eavesdropping with quantum illumination,” Phys. Rev. A 80, 022320 (2009) [CrossRef]  .

8. A. Hayat, X. Xing, A. Feizpour, and A. M. Steinberg, “Multidimensional quantum information based on single-photon temporal wavepackets,” arXiv:1212.1483 (2012).

9. P. Rohde, J. Fitzsimons, and A. Gilchrist, “The information capacity of a single photon,” arXiv:1211.1427 (2012).

10. J. Mower, Z. Zhang, P. Desjardins, C. Lee, J. H. Shapiro, and D. Englund, “High-dimensional quantum key distribution using dispersive optics,” arXiv:1210.4501 (2012).

11. Z. Chang-Hua, P. Chang-Xing, Q. Dong-Xiao, G. Jing-Liang, C. Nan, and Y. Yun-Hui, “A new quantum key distribution scheme based on frequency and time coding,” Chin. Phys. Lett. 27, 090301 (2010) [CrossRef]  .

12. B. Qi, “Single-photon continuous-variable quantum key distribution based on the energy-time uncertainty relation,” Opt. Lett. 31, 2795–2797 (2006) [CrossRef]   [PubMed]  .

13. S. Galbraith, Mathematics of public key cryptography (Cambridge University, 2012) [CrossRef]  .

14. N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, “Quantum cryptography,” Rev. Mod. Phys. 74, 145–195 (2002) [CrossRef]  .

15. C. Bennett and G. Brassard, “Quantum cryptography: Public key distribution and coin tossing,” Proceedings of IEEE International Conference on Computers, Systems and Signal Processing 175–179 (1984).

16. “MagiQ (http://magiqtech.com), ID Quantique (www.idquantique.com), QuintessenceLabs (qlabsusa.com), Toshiba (http://www.toshiba-europe.com/research/crl/qig/quantumkeyserver.html),”.

17. D. Simon, N. Lawrence, J. Trevino, L. Negro, and A. Sergienko, “Quantum key distribution with Fibonacci orbital angular momentum states,” arXiv:1206.3548 (2012).

18. D. Gauthier, H. Guilbert, Y. Zhu, M. Shi, K. McCusker, B. Christensen, P. Kwiat, T. Brougham, S. Barnett, and V. Chandar, “Quantum key distribution using hyperentanglement,” in “Quantum Information and Measurement,” (Optical Society of America, 2012).

19. S. Braunstein and S. Pirandola, “Side-channel-free quantum key distribution,” Phys. Rev. Lett. 108, 130502 (2012) [CrossRef]   [PubMed]  .

20. H. Lo, M. Curty, and B. Qi, “Measurement-device-independent quantum key distribution,” Phys. Rev. Lett. 108, 130503 (2012) [CrossRef]   [PubMed]  .

21. N. Gisin, G. Ribordy, H. Zbinden, D. Stucki, N. Brunner, and V. Scarani, “Towards practical and fast quantum cryptography,” arXiv:0411022 (2004).

22. A. K. Ekert, “Quantum cryptography based on Bell’s theorem,” Phys. Rev. Lett. 67, 661–663 (1991) [CrossRef]   [PubMed]  .

23. L. Duan, M. Lukin, J. Cirac, and P. Zoller, “Long-distance quantum communication with atomic ensembles and linear optics,” Nature 414, 413–418 (2001) [CrossRef]   [PubMed]  .

24. E. Saglamyurek, N. Sinclair, J. Jin, J. Slater, D. Oblak, F. Bussières, M. George, R. Ricken, W. Sohler, and W. Tittel, “Quantum memory for quantum repeaters,” in “International Quantum Electronics Conference,” (Optical Society of America, 2011).

25. B. Qi, “Quantum key distribution based on frequency-time coding: security and feasibility,” arXiv:1101.5995 (2011).

26. J. Mower, F. Wong, J. H. Shapiro, and D. Englund, “Dense wavelength division multiplexed quantum key distribution using entangled photons,” arXiv:1110.4867v1 (2011).

27. I. Ali-Khan and J. C. Howell, “Experimental demonstration of high two-photon time-energy entanglement,” Phys. Rev. A 73, 031801 (2006) [CrossRef]  .

28. H. Takesue, K. Harada, K. Tamaki, H. Fukuda, T. Tsuchizawa, T. Watanabe, K. Yamada, and S. Itabashi, “Long-distance entanglement-based quantum key distribution experiment using practical detectors,” Opt. Express 18, 16777–16787 (2010) [CrossRef]   [PubMed]  .

29. I. Ali-Khan, C. J. Broadbent, and J. C. Howell, “Large-alphabet quantum key distribution using energy-time entangled bipartite states,” Phys. Rev. Lett. 98, 060503 (2007) [CrossRef]   [PubMed]  .

30. L. Olislager, J. Cussey, A. T. Nguyen, P. Emplit, S. Massar, J.-M. Merolla, and K. P. Huy, “Frequency-bin entangled photons,” Phys. Rev. A 82, 013804 (2010) [CrossRef]  .

31. P. J. Mosley, J. S. Lundeen, B. J. Smith, P. Wasylczyk, A. B. U’Ren, C. Silberhorn, and I. A. Walmsley, “Heralded generation of ultrafast single photons in pure quantum states,” Phys. Rev. Lett. 100, 133601 (2008) [CrossRef]   [PubMed]  .

32. O. Cohen, J. S. Lundeen, B. J. Smith, G. Puentes, P. J. Mosley, and I. A. Walmsley, “Tailored photon-pair generation in optical fibers,” Phys. Rev. Lett. 102, 123603 (2009) [CrossRef]   [PubMed]  .

33. G. Brida, V. Caricato, M. Fedorov, M. Genovese, M. Gramegna, and S. Kulik, “Characterization of spectral entanglement of spontaneous parametric-down conversion biphotons in femtosecond pulsed regime,” Europhys. Lett. 87, 64003 (2009) [CrossRef]  .

34. W. P. Grice and I. A. Walmsley, “Spectral information and distinguishability in type-II down-conversion with a broadband pump,” Phys. Rev. A 56, 1627–1634 (1997) [CrossRef]  .

35. L. Zhang, A. B. U’ren, R. Erdmann, K. O’Donnell, C. Silberhorn, K. Banaszek, and I. A. Walmsley, “Generation of highly entangled photon pairs for continuous variable Bell inequality violation,” J. Mod. Opt. 54, 707–719 (2007) [CrossRef]  .

36. M. Avenhaus, A. Eckstein, P. J. Mosley, and C. Silberhorn, “Fiber-assisted single-photon spectrograph,” Opt. Lett. 34, 2873–2875 (2009) [CrossRef]   [PubMed]  .

37. I. A. Walmsley and C. Dorrer, “Characterization of ultrashort electromagnetic pulses,” Adv. Opt. Photon. 1, 308–437 (2009) [CrossRef]  .

38. H. Takesue, S. Nam, Q. Zhang, R. Hadfield, T. Honjo, K. Tamaki, and Y. Yamamoto, “Quantum key distribution over a 40-db channel loss using superconducting single-photon detectors,” Nat. Photonics 1, 343–348 (2007) [CrossRef]  .

39. S. Cova, A. Lacaita, M. Ghioni, G. Ripamonti, and T. Louis, “20-ps Timing resolution with single-photon avalanche diodes,” Rev. Sci. Instrum. 60, 1104 (1989) [CrossRef]  .

40. A. Lita, A. Miller, and S. W. Nam, “Counting near-infrared single-photons with 95% efficiency,” Opt. Express 16, 3032–3040 (2008) [CrossRef]   [PubMed]  .

41. R. H. Hadfield, “Single-photon detectors for optical quantum information applications,” Nat. Photonics 3, 696–705 (2009) [CrossRef]  .

42. F. Marsili, V. Verma, J. Stern, S. Harrington, A. Lita, T. Gerrits, I. Vayshenker, B. Baek, M. Shaw, R. Mirin, and S. W. Nam, “Detecting single infrared photons with 93% system efficiency,” Nat. Photonics 7, 210–214 (2013) [CrossRef]  .

43. G. Vernam, “Cipher printing telegraph systems for secret wire and radio telegraphic communications,” Transactions of the American Institute of Electrical Engineers 45, 295–301 (1926) [CrossRef]  .

44. Since we do not treat finite size effects, the fraction is arbitrary, although realistically it should be large enough to suppress Poissonian errors on the estimation of error rates.

45. W. P. Grice, R. Erdmann, I. A. Walmsley, and D. Branning, “Spectral distinguishability in ultrafast parametric down-conversion,” Phys. Rev. A 57, R2289–R2292 (1998) [CrossRef]  .

46. C. K. Law, I. A. Walmsley, and J. H. Eberly, “Continuous frequency entanglement: effective finite hilbert space and entropy control,” Phys. Rev. Lett. 84, 5304–5307 (2000) [CrossRef]   [PubMed]  .

47. J. Eberly, K. Chan, and C. Law, “Schmidt-mode analysis of entanglement for quantum information studies,” in “Quantum Communication and Information Technologies,” (Springer, 2003), pp. 1–12 [CrossRef]  .

48. The assumption of a top-hat profile can be relaxed without changing our analysis, but the calculation in Appendix A would require numerics.

49. L. Zhang, L. Neves, J. S. Lundeen, and I. A. Walmsley, “A characterization of the single-photon sensitivity of an electron multiplying charge-coupled device,” J. Phys. B 42, 114011 (2009) [CrossRef]  .

50. B. H. Kolner, “Space-time duality and the theory of temporal imaging,” IEEE J. Quantum Electron. 30, 1951–1963 (1994) [CrossRef]  .

51. C. V. Bennett and B. H. Kolner, “Upconversion time microscope demonstrating 103 x magnification of femtosecond waveforms,” Opt. Lett. 24, 783–785 (1999) [CrossRef]  .

52. J. Lavoie, J. M. Donohue, L. G. Wright, A. Fedrizzi, and K. J. Resch, “Spectral compression of single photons,” Nat. Photonics 7363–366 (2013) [CrossRef]  .

53. Other phase modulation schemes such as four-wave mixing in waveguides [54] or sum-frequency generation in nonlinear crystals [51] could of course be used. Here we consider electro-optic phase modulation, which can be implemented with off-the-shelf telecoms components efficiently and with low loss.

54. R. Salem, M. Foster, A. Turner, D. Geraghty, M. Lipson, and A. Gaeta, “Optical time lens based on four-wave mixing on a silicon chip,” Opt. Lett. 33, 1047–1049 (2008) [CrossRef]   [PubMed]  .

55. J. Azaña, “Time-to-frequency conversion using a single time lens,” Opt. Commun. 217, 205–209 (2003) [CrossRef]  .

56. W. Wasilewski, A. I. Lvovsky, K. Banaszek, and C. Radzewicz, “Pulsed squeezed light: simultaneous squeezing of multiple modes,” Phys. Rev. A 73, 063819 (2006) [CrossRef]  .

57. W. P. Grice, A. B. U’Ren, and I. A. Walmsley, “Eliminating frequency and space-time correlations in multiphoton states,” Phys. Rev. A 64, 063815 (2001) [CrossRef]  .

58. M. T. Kauffman, W. C. Banyai, A. A. Godil, and D. M. Bloom, “Time-to-frequency converter for measuring picosecond optical pulses,” Appl. Phys. Lett. 64, 270–272 (1994) [CrossRef]  .

59. L. Zhang, C. Silberhorn, and I. A. Walmsley, “Secure quantum key distribution using continuous variables of single photons,” Phys. Rev. Lett. 100, 110504 (2008) [CrossRef]   [PubMed]  .

60. J. Schneeloch, C. J. Broadbent, S. P. Walborn, E. G. Cavalcanti, and J. C. Howell, “EPR steering inequalities from entropic uncertainty relations,” arXiv:1303.7432 (2013).

61. Ł. Rudnicki, S. Walborn, and F. Toscano, “Optimal uncertainty relations for extremely coarse-grained measurements,” Phys. Rev. A 85, 042115 (2012) [CrossRef]  .

62. J. Schneeloch, P. B. Dixon, G. A. Howland, C. J. Broadbent, and J. C. Howell, “Violation of continuous-variable Einstein-Podolsky-Rosen steering with discrete measurements,” Phys. Rev. Lett. 110, 130407 (2013) [CrossRef]   [PubMed]  .

63. D. Tasca, L. Rudnicki, R. Gomes, F. Toscano, and S. Walborn, “Reliable entanglement detection under coarse-grained measurements,” arXiv:1210.5945 (2012).

64. M. R. Ray and S. van Enk, “Missing data outside the detector range: application to continuous variable entanglement verification and quantum cryptography,” arXiv:1302.5087 (2013).

65. J. M. Renes and J.-C. Boileau, “Conjectured strong complementary information tradeoff,” Phys. Rev. Lett. 103, 020402 (2009) [CrossRef]   [PubMed]  .

66. In general the key distillation will have non-unit efficiency βsuch that I= βI_BA− I_BE. However high efficiencies can be achieved, with β> 90%. Although the formulas are simplified by assuming β= 1, our security analysis can be trivially extended to cover the general case.

67. M. Krishna and K. Parthasarathy, “An entropic uncertainty principle for quantum measurements,” Sankhyâ A 842–851 (2002).

68. F. Grosshans and N. J. Cerf, “Continuous-variable quantum cryptography is secure against non-gaussian attacks,” Phys. Rev. Lett. 92, 047905 (2004) [CrossRef]   [PubMed]  .

69. N. Beaudry, T. Moroder, and N. Lütkenhaus, “Squashing models for optical measurements in quantum communication,” Phys. Rev. Lett. 101, 93601 (2008) [CrossRef]  .

70. R. Ursin, F. Tiefenbacher, T. Schmitt-Manderbach, H. Weier, T. Scheidl, M. Lindenthal, B. Blauensteiner, T. Jennewein, J. Perdigues, P. Trojek, B. Oemer, M. Fuerst, M. Meyenburg, J. Rarity, Z. Sodnik, C. Barbieri, H. Weinfurter, and A. Zeilinger, “Free-space distribution of entanglement and single photons over 144 km,” Nature Phys. 3, 481 (2007) [CrossRef]  .

71. M. Bourennane, A. Karlsson, G. Björk, N. Gisin, and N. Cerf, “Quantum key distribution using multilevel encoding: security analysis,” J. Phys. A 35, 10065 (2002) [CrossRef]  .

72. N. J. Cerf, M. Bourennane, A. Karlsson, and N. Gisin, “Security of quantum key distribution using d-level systems,” Phys. Rev. Lett. 88, 127902 (2002) [CrossRef]   [PubMed]  .

73. Eq. (27) in [71] corresponds to setting I= 0 with c→ 0, M→ Nand $p\to e_B^N$.

74. J. B. Spring, P. S. Salter, B. J. Metcalf, P. C. Humphreys, M. Moore, N. Thomas-Peter, M. Barbieri, X.-M. Jin, N. K. Langford, W. S. Kolthammer, M. J. Booth, and I. A. Walmsley, “On-chip low loss heralded source of pure single photons,” arXiv:1304.7781 (2013).

75. G. Harder, V. Ansari, B. Brecht, T. Dirmeier, C. Marquardt, and C. Silberhorn, “An optimized photon pair source for quantum circuits,” arXiv:1304.6635 (2013).

76. D. Payne and W. Gambling, “New silica-based low-loss optical fibre,” Electron. Lett. 10, 289–290 (1974) [CrossRef]  .