1. Introduction

Quantum networks can distribute keys among multiple users and guard information security when quantum computers are introduced and popularized in the future. The quantum conference key agreement (QCKA) [1–4], which distributes keys among multiple parties over long distances, plays a vital role in the construction and development of quantum networks. To distribute keys among multiple parties, one can, for instance, perform the quantum key distribution (QKD) [5–13] protocol between every two users and then use the secret keys established in this manner to encode the final common secret key. However, as shown by Ref. [14], we obtain a relatively higher key rate and longer transmission distance by performing the conference key agreement protocol to deliver the same secret key to all parties involved in the protocol than by performing the QKD process separately between multiple parties and then encrypting the final common key using the obtained key. The fundamental laws of quantum mechanics and one-time-paid encryption [15] guarantee secure multiparty quantum communication [2,16]. In the era of rapid development of quantum communication technology, some QCKA protocols have been demonstrated theoretically [17–25] and experimentally [26]. There are many QCKA protocols [12,27–30] inspired by QKD protocols. These protocols are equating to allocations of quantum resources, particularly multiple party Greenberger-Horne-Zeilinger (GHZ) states or the "twisted" version of the GHZ state [1,31,32].

To achieve a relatively mature application of QKD [33–45], the recently proposed and high-profile twin-field QKD (TFQKD) protocol [39,46–60] has been consistently proposed. Where an untrusted relay , which is always presented as Charlie, is employed as the transmission node. TFQKD enables researchers to break the Pirandola-Laurenza-Ottaviani-Banchi (PLOB) bound [61] by transforming the relationship between the key rate and channel loss based on the decoy state from a linear to square-root relationship. QCKA protocols inspired by TFQKD have been proposed and perform better in terms of the key rate and transmission distance. Subsequent QCKA protocols inspired by TFQKD were proposed and have progressed in terms of protocol practicality. For example, the asymmetric QCKA protocol [30], based on the sending-or-not-sending (SNS) two-field QKD protocol [48], obtains better transmission distances than previous methods [23] in the asymmetric case. In tripartite key distribution scenarios, asymmetric situations involving unequal distances between the three users are often involved. The existing asymmetric QCKA protocol can distribute keys at long distances among three asymmetric parties, but the protocol has a strict restrictive relationship on light intensity modulation and the corresponding probability, similar to SNS QKD protocols [53,54]. In a practical tripartite quantum key distribution scenario, users need to modulate the light intensity strictly according to the constraint mentioned above, which greatly increases the difficulty of implementing asymmetric QCKA protocols. In addition, these constraints cannot be strictly satisfied. This issue is problematic as even a small deviation from the constraints can significantly reduce the code formation rate of the protocol. Additionally, the three users involved are frequently online and offline, and it is more difficult to modulate the light intensity strictly according to the constraints each time.

We propose a post-matching QKCA protocol that can achieve a higher key rate while removing the constraints on optical intensity and probability based on two-photon two-field QKD [60]. The security proof of our protocol is provided by proving that the effective density matrix of the X basis is equal to the density matrix of the Z basis, and introducing a virtual protocol to obtain the entangled GHZ states between the three parties. We also analyzed the simulation results of our protocol, investigated the secret key formation and transmission distance of the asymmetric QCKA protocols under deviating constraints, and compared our protocol with asymmetric QCKA protocols in various scenarios. In our finite-key regime simulation of the symmetric case, the protocol can achieve a transmission distance $25\%$ greater than the previous asymmetric QCKA protocol when the decoy state optical pulse intensity (named $\nu _b$) is $1\%$ higher than the constraint and can obtain a transmission distance $100\%$ greater when $\nu _b$ is $10\%$ higher than the constraint. In the finite-key regime simulation of the asymmetric case (where the distance between sender Alice and receiver Charlie is 50 km longer than that between sender Bob and receiver Charlie), our protocol can achieve a transmission distance of $22\%$ more than the previous asymmetric QCKA protocol when the optical pulse intensity $\nu _b$ is $1\%$ higher than the constraint and can obtain a transmission distance $90\%$ higher when $\nu _b$ is $10\%$ higher than the constraint. In addition, this protocol also has better applicability in complex cases because of the intrinsic reduction of the base value of the phase error rate. In the construction of quantum networks, severe asymmetries due to channel distance and channel loss often occur, and some nodes also have increased misalignment error rates owing to complicating factors such as atmospheric disturbance or terrain complexity. Therefore, we believe that our protocol has promising prospects for practical application.

2. Post-matching QCKA protocol

A schematic representation of our post-matching QCKA protocol is shown in Fig. 1; the protocol is described as follows.

 

Fig. 1. A schematic of the setup for the proposed asymmetric QCKA protocol. Narrow-linewidth continuous-wave lasers, intensity modulators (IMs), phase modulators (PMs), and attenuators (ATTs) are utilized to prepare phase-randomized weak coherent sources with different intensities and phases in the sending parts for Alice and Bob. When the states are sent to Charlie, he passively chooses the measurement bases with the first and second beam splitters (BS1 and BS2). The logic bit is received in the Z basis through single-photon detectors (SPD1 and SPD2). For the X basis, interference measurements are performed using a third beam splitter (BS3) and single-photon detectors (SPD3 and SPD4). Charlie announces detection events where only detectors SPD3 or SPD4 click. Note that phase-locking and phase-tracking techniques are required in our protocol.

Download Full Size | PDF

1 Preparation. At each time bin $i\in \{1,2,\ldots,N\}$, Alice chooses a random phase $\theta _{a}^{i}\;\in [0,2\pi )$ and random classical bit $r_{a}^{i}\in \{0, 1\}$. Subsequently, she prepares a phase-randomized weak pulse $| {e^{\textbf {i}(\theta _{a}^{i}+r_{a}^{i}\pi )}\sqrt {k_{a}^{i}}} \rangle$ with probability $p_{k_a}$, where $k_a^{i}\in \{\mu _a,~\nu _a,~\mathbf {o}_{a},~\hat {\mathbf {o}}_{a}\}$ correspond to the signal, decoy, preserve-vacuum, and declare-vacuum intensities, respectively. Similarly, Bob prepares a phase-randomized weak coherent pulse $| {e^{\textbf {i}(\theta _{b}^{i}+r_{b}^{i}\pi )}\sqrt {k_{b}^{i}}} \rangle$ ($k_b^{i}\in \{\mu _b,~\nu _b,~\mathbf {o}_{b},~\hat {\mathbf {o}}_{b}\}$). The intensities of Alice and Bob satisfy the relation $\mu _a>\nu _a>\mathbf {o}_{a}$ $=\hat {\mathbf {o}}_{a} = 0$ and $\mu _b>\nu _b>\mathbf {o}_{b}$ $=\hat {\mathbf {o}}_{b} = 0$. Alice and Bob send the corresponding pulses, $| {e^{\textbf {i}(\theta _{a}^{i}+r_{a}^{i}\pi )}\sqrt {k_{a}^{i}}} \rangle$ and $| {e^{\textbf {i}(\theta _{b}^{i}+r_{b}^{i}\pi )}\sqrt {k_{b}^{i}}} \rangle$, to Charlie through insecure quantum channels. In experimental implementation, phase-locking and phase-tracking techniques are necessary. The phase-locking techniques include the method that injects the Charlie’s seed laser to Alice and Bob’s slave lasers for locking phases of both Alice and Bob’s lasers to that of Charlie’s. As for phase-tracking techniques which are required in our protocol, Alice and Bob each send a bright reference light to Charlie to measure the phase noise difference $\phi _{ab}^{i}$.

2 Measurement. We denote the events that Charlie detects signal with SPD1 and SPD2 (SPD3 and SPD4) as Z basis events (X basis events). For each time bin $i$, Charlie passively selects bases and performs measurements using beam splitters and single-photon detectors. During the basis selection, Charlie receives the signal from Alice (Bob), which is measured in the Z basis with probability $t_a$ ($t_b$) and in the X basis with probability $1-t_a$ ($1-t_b$). A successful event is obtained when only one detector clicks. Charlie publicly announces the basis information for each successful event. If he broadcasts the event in which at least one of Alice and Bob chooses the decoy or declare-vacuum intensity, the three parts communicate their intensities and phase information with each other via an authenticated channel. The unannounced detection events in the basis of $Z$, that is, $\{\mu _a,\mathbf {o}_{b}\}$, $\{\mu _a,\mu _b\}$, $\{\mathbf {o}_{a},\mu _b\}$, and $\{\mathbf {o}_{a},\mathbf {o}_{b}\}$, are used to generate key bits. We suppose that event serial number $i$ and $j$ satisfy the relationship $i<j$. For these events, Alice randomly matches time bin $i$ of intensity $\mu _a$ ($\mathbf {o}_{a}$) with another time bin $j$ of intensity $\mathbf {o}_{a}$ ($\mu _a$). Then, she sets her bit value to 0 (1) and sends serial numbers $i$ and $j$ to the remaining parts. In the corresponding time bins, if Bob chooses intensities $k_b^{i}=\mu _b$ $(\mathbf {o}_{b})$ and $k_b^{j}=\mathbf {o}_{b}$ $(\mu _b)$, then he sets a bit value of 0 (1). Bob announces an event in which $k_b^{i} = k_b^{j}=\mathbf {o}_{b}$ or $\mu _b$. Thus, the valid events on the $Z$ basis are $\{\mu _a \mathbf {o}_{a},~ \mathbf {o}_{b}\mu _b\}$, $\{\mu _a\mathbf {o}_{a},~\mu _b\mathbf {o}_{b}\}$, $\{\mathbf {o}_{a}\mu _a,~ \mathbf {o}_{b}\mu _b\}$, and $\{\mathbf {o}_{a}\mu _a,~\mu _b\mathbf {o}_{b}\}$. For the Z basis, Charlie obtains bit 0 (1) when SPD1 (SPD2) clicks only in the $i$ time beam and SPD2 (SPD1) in the $j$ time beam. For the X basis, after the interference measurement, he publicly announces whether he obtained a successful detection event and which detector clicked.

We denote $\{k_a,~k_b\}$ as a successful detection event where Alice sends intensity $k_a$ and Bob sends intensity $k_b$. The compressed notation $\{k_a^{i}k_a^{j},~ k_b^{i}k_b^{j}\}$ indicates that $\{k_a^{i},~k_b^{i}\}$ and $\{k_a^{j},~ k_b^{j}\}$ are matched; the first label refers to time bin $i$, and the second to time bin $j$. Alice and Bob repeat the first two steps for $N$ rounds to obtain sufficient data.

3 Reconciliation. For the announced detection events in the X basis, we define the global phase difference in time bin $i$ as $\theta ^{i}:= \theta _a^{i}- \theta _b^{i} +\phi _{ab}^{i}$. Alice, Bob, and Charlie maintain detection events $\{\nu _a^{i},~\nu _b^{i}\}$ only if $\theta ^{i}~\in \{-\delta,\delta \}\cup \{\pi -\delta,\pi +\delta \}$. They randomly select two retained detection events that satisfy $\left |\theta ^{i} -\theta ^{j}\right |= 0$, or satisfy $\left |\theta ^{i} -\theta ^{j}\right |=\pi$ and match these events. These are denoted as $\{\nu _a^{i}\nu _a^{j},\nu _b^{i}\nu _b^{j}\}$. By calculating classical bits $r_a^{i} \oplus r_a^{j}$ and $r_b^{i} \oplus r_b^{j}$, Alice, Bob, and Charlie extract the $X$ basis bit value, respectively.

The detection events $\{o_a,\nu _b\}$, $\{\nu _a,o_b\}$, $\{\hat {\mathbf {o}}_a,\mu _b\}$, $\{\mu _a,\hat {\mathbf {o}}_b\}$, $\{\hat {\mathbf {o}}_a,o_b\}$, and $\{\mathbf {o}_a, \hat {\mathbf {o}}_b\}$ on the X basis are used for decoy analysis, where $o_{a(b)}\in \{\mathbf {o}_{a(b)}, \hat {\mathbf {o}}_{a(b)}\}$. Afterwards, in the $Z$ basis, Bob always flips his bit. In the $X$ basis, Bob flips a part of his bits to correlate them with those of Alice (see Table 1).

Table 1. Processing of raw key in the reconciliation step. The numbers $34$ ($43$) denote that detectors $SPD3$ ($SPD4$) and $SPD4$ ($SPD3$) click in time bins $i$ and $j$, respectively. The number $33$ ($44$) denotes that detector $SPD3$ ($SPD4$) clicks in time bins $i$ and $j$.

View Table | View all tables in this article

4 Parameter estimation. Alice, Bob, and Charlie randomly select parts of the unannounced bits that are measured in the $Z$ basis and exploit them to form the raw key bit $n^{z}$. The remaining unannounced bits measured in the $Z$ basis are used to compute the bit error rate $E^{z}$. The decoy state method [33,34] is also used to estimate the number of vacuum events $s_{0\mu _b}^{z}$ and the number of single-photon pairs $s_{11}^{z}$ on the $Z$ basis. The bits that have been detected and announced on the $X$ basis are used to calculate the total error count of single-photon pairs $t_{11}^{x}$ on the $X$ basis, with which we can obtain the phase error rate of single-photon pairs $\phi _{11}^{z}$ on the $Z$ basis (see Appendix B.2 for details).

5 Post-processing. The final keys are distilled using error correction, error verification, and a privacy amplification algorithm. Similar to Ref. [62], the length of the final secret key $\ell$ with the total security $\varepsilon _{\textrm {TP}}=\varepsilon _{\textrm {sec}} + \varepsilon _{\textrm {cor}}$ can be written as follows:

3. Security analysis

In the first step of the security proof, we introduce a virtual protocol.

1. Alice and Bob prepare entangled states, and both perform quantum non-demolition measurements jointly. The states are set as $| {10} \rangle _{a(b)}^{ij}= | {1} \rangle _{a(b)}$, $| {01} \rangle _{a(b)}^{ij}= | {0} \rangle _{a(b)}$ on the Z basis and ${\frac { | {1} \rangle _{a(b)}\pm | {1} \rangle _{a(b)}}{\sqrt {2}}} = | {\pm } \rangle _{a(b)}$ on the X basis. The entangled states are $| {\Phi } \rangle _{Aa}=1/\sqrt {2}( | {0} \rangle _{A} | {0} \rangle _{a}+ | {1} \rangle _{A} | {1} \rangle _{a})$, where $A$ ($B$) represents the quantum bit system held by Alice (Bob), and $a$ ($b$) is the quantum state sent to Charlie. For both reserved and sent states, $\left \{ | {0} \rangle, | {1} \rangle \right \}$ are two eigenvectors of the Z basis, and the eigenvectors of the X basis are $\left \{ | {+} \rangle, | {-} \rangle \right \}$. After entangled state preparation, Alice and Bob jointly perform an operation called quantum nondemolition measurement. This measurement operation is carried out before states $a$ and $b$ are sent to part Charlie, and only the cases for which different eigenvectors are shared by $a$ and $b$ are reserved. Therefore, we obtain the entangled state among the systems $A$, $B$, $a$, and $b$:

2. Alice, Bob, and Charlie randomly choose bases Z or X to measure the reserved systems A and B, respectively, and the equivalent sent state C. As mentioned before for the state preparation, the eigenvectors of basis Z or X are $\left \{ | {0} \rangle, | {1} \rangle \right \}$ or $\left \{ | {+} \rangle, | {-} \rangle \right \}$.

3. Alice, Bob, and Charlie announce the preparation and measurement bases for all rounds.

4. Alice, Bob, and Charlie obtain raw key bits by exploiting random bits in the Z basis, and they use the disclosed bits in the X basis for information leakage estimation. A secure key is acquired through error correction and privacy amplification. In this process, the decoy-state method is exploited to calculate the Z-basis bit error rate of single-photon pairs and the Z-basis phase error rate of single-photon pairs. At the end of this procedure, we obtain the asymptotic key rate as

5. Alice, Bob, and Charlie utilize the classical error-correction algorithm to distill the final key.

Then, we demonstrate that the density matrices in the Z and X bases are equal. In our post-matching QCKA protocol, the three parts obtain their original keys from the Z basis. The preshared state of Alice (Bob) is $| {\phi ^{+}} \rangle _{Aa}=1/\sqrt {2}( | {1,0} \rangle ^{i,j}_A | {1,0} \rangle ^{i,j}_a+ | {0,1} \rangle ^{i,j}_A | {0,1} \rangle ^{i,j}_a)$ ($| {\phi ^{+}} \rangle _{Bb}=1/\sqrt {2}( | {1,0} \rangle ^{i,j}_B | {1,0} \rangle ^{i,j}_b+ | {0,1} \rangle ^{i,j}_B | {0,1} \rangle ^{i,j}_b)$), when time bins $i$ and $j$ are matched. $| {1,0} \rangle ^{i,j}$ and $| {0,1} \rangle ^{i,j}$ are the two eigenvectors of the Z basis, and the eigenvectors of the X basis are $1/\sqrt {2}( | {1,0} \rangle ^{i,j}+ | {0,1} \rangle ^{i,j})$ and $1/\sqrt {2}( | {1,0} \rangle ^{i,j}- | {0,1} \rangle ^{i,j})$. We replace $| {1,0} \rangle ^{i,j}$, $| {0,1} \rangle ^{i,j}$ with $| {+z} \rangle$, $| {-z} \rangle$, and $1/\sqrt {2}( | {1,0} \rangle ^{i,j}+ | {0,1} \rangle ^{i,j})$, $1/\sqrt {2}( | {1,0} \rangle ^{i,j}- | {0,1} \rangle ^{i,j})$ with $| {+x} \rangle$, $| {-x} \rangle$. The joint state density matrix of Alice, Bob, and Charlie in the Z basis is

As for the joint state in the X basis, it is shown as the form of coherent state direct product $| {\Psi } \rangle = | {\psi _1} \rangle | {\psi _2} \rangle$, $| {\psi _1} \rangle = | {e^{i(\theta +r_{a}^{i}\pi )}\alpha _{a}} \rangle _{A}^{i}\otimes | {e^{i(\varphi +r_{a}^{j}\pi )}\alpha _{a}} \rangle _{A}^{j}\otimes | {e^{i(\theta +r_{b}^{i}\pi )}\alpha _{b}} \rangle _{B}^{i}\otimes | {e^{i(\varphi +r_{b}^{j}\pi )}\alpha _{B}} \rangle _{b}^{j}$, $| {\psi _2} \rangle = | {e^{i(\theta +r_{a}^{i}\pi )}\alpha _{a}} \rangle _{a}^{i}\otimes | {e^{i(\varphi +r_{a}^{j}\pi )}\alpha _{a}} \rangle _{a}^{j}\otimes | {e^{i(\theta +r_{b}^{i}\pi )}\alpha _{b}} \rangle _{b}^{i}\otimes | {e^{i(\varphi +r_{b}^{j}\pi )}\alpha _{b}} \rangle _{b}^{j}$, where the angle $\theta$ and $\varphi$ are both randomized. The density matrix of this four-coherent state is

4. Performance and discussion

4.1 Asymmetric QCKA simulation with deviation of restriction in finite-key condition

For comparison, we first introduce the simulation formula with the deviation of restriction in the asymmetric QCKA protocol of Ref. [30]. In a realistic situation, the mathematical constraints required by the perfect modulated asymmetric QCKA protocol ( Eq. (15) in Appendix A) may not be satisfied, leading to completely insecure key rates. In this situation, the quantitative bounds that connect the deviation from the mathematical constraint to the security of the SNS protocol need to be introduced, thus providing the secure key rate when the constraint is violated; see Appendix A in detail. Without a loss of generality, the modulation intensity $\nu _b$ is considered to be inaccurate. When the light intensity does not satisfy the constraint [30], the density matrix $\rho ^{11}_z$ in the $Z$ basis is not equal to the density matrix $\rho ^{11}_x$ in the $X$ basis. Therefore, we can no longer assume that the phase error rate $e_{11}^{z}$ in the $Z$ basis is equal to the bit error rate $e_{11}^{x}$ in the $X$ basis. The relationship between the two error rates requires the introduction of fidelity, which is shown in the specific form in Appendix A.

For the finite-size regime, we set the failure parameters $\varepsilon _{\textrm {cor}}$, $\varepsilon '$, $\hat {\varepsilon }$, $\varepsilon _e$, $\varepsilon _\beta$, and $\varepsilon _{\rm PA}$ as the same $\epsilon$. We have $\varepsilon _0+\varepsilon _1=15\epsilon$ because we use the Chernoff bound [63,64] 15 times to estimate $s_{0\nu _b}^{z}$, $s_{11}^{z}$, and the bit error rate in the $X$ basis. We define the distance between Alice and Charlie as $L_{a}$, and the distance between Bob and Charlie as $L_{b}$. Thus, the total distance between Alice and Bob is $L= L_{a}+ L_{b}$. In the asymmetric QCKA protocol simulation described in Refs. [30], we set the two asymmetric cases to $L_{b}- L_{a}=50~km$ and $L_{b}- L_{a}=100~km$. A genetic algorithm is applied to search for the best parameters. Figure 3 and Fig. 4 plot the secure key rates of the scenario when the data size is $N=10^{12}$ in the two different asymmetric channels. Some experimental parameters were set as listed in Table 2. The misalignment angle in the $X$ basis of asymmetric QCKA is $\sigma =5^{\circ }$, and the security bound is $\varepsilon _{\textrm {asy-QCKA}}=26 \varepsilon$ in the finite-size cases. It was observed that the key rate of the asymmetric QCKA protocol declined rapidly as this deviation level increased. When the parameters, including the light intensity, are perfectly modulated, the secret key rate of the asymmetric QCKA protocol is slightly lower than that of the post-matching QCKA protocol. However, it is challenging to control every parameter according to the constraints and without deviation. As the parameters fail to meet the ideal criterion, we only consider the situation in which the light intensity $\nu _b$ cannot be perfectly prepared for simplification. As the constraint in Eq. (15) shows, any one of the six parameters can be represented by the rest five. That only the modulation intensity $\nu _b$ is considered to be inaccurate is without a loss of generality. The key rate and transmission length of the asymmetric QCKA are clearly inferior to those of the PMQCKA when there is a deviation of more than 1% in the preparation of light intensity $\nu _b$. In the practical realization of a protocol, a 1% deviation in the preparation of light intensity is common. For example, when the light intensity $\nu$ prepared by user Bob changes from 0.010 to 0.0101, the preparation deviation reaches 1%. This preparation deviation further reduces the key rate with its increase, even resulting in a secure key rate of zero.

Table 2. Simulation parameters. $\eta _{d}$ and $p_{d}$ are the detector efficiency and the dark count rate, respectively. $\alpha$ and $f$ are the attenuation coefficient of the fiber and error-correction efficiency, respectively. $\epsilon$ is the failure probability considered in the error verification and finite-data analysis processes.

View Table | View all tables in this article

4.2 Post-matching QCKA simulation results of the finite-key asymptotic case

When simulating the post-matching QCKA protocol in finite-key asymptotic conditions, we have $\varepsilon _0+\varepsilon _1=12\epsilon$ because we use the Chernoff bound [63,64] 12 times to estimate $s_{0\nu _b}^{z}$, $s_{11}^{z}$, and the bit error rate on the $X$ basis. The corresponding security bound is $\varepsilon _{\textrm {TP}}=23\varepsilon$. Appendix B.1 shows the detailed formulas for simulating the post-matching QCKA protocol. As described in the four-intensity decoy-state post-matching QCKA protocol, Alice chooses a random phase $\theta _{a}^{i}\;\in [0,2\pi )$ and a random classical bit $r_{a}^{i}\in \{0, 1\}$ at each time bin $i\in \{1,2,\ldots,N\}$. Subsequently, she prepares a weak coherent pulse $| {e^{\textbf {i}(\theta _{a}^{i}+r_{a}^{i}\pi )}\sqrt {k_{a}^{i}}} \rangle$ with probability $p_{k_a}$, where $k_a^{i}\in \{\mu _a, \nu _a, \mathbf {o}_{a}, \hat {\mathbf {o}}_{a}\}$. The intensities satisfy the relationship $\mu _a>\omega _a>\nu _a>\mathbf {o}_{a} =\hat {\mathbf {o}}_{a} = 0$, Similarly, Bob prepares a phase-randomized weak coherent pulse. Valid events on the $Z$ basis consist of $\{\mu _a \mathbf {o}_{a}, \mathbf {o}_{b}\mu _b\}$, $\{\mu _a\mathbf {o}_{a}, \mu _b\mathbf {o}_{b}\}$, $\{\mathbf {o}_{a}\mu _a, \mathbf {o}_{b}\mu _b\}$, and $\{\mathbf {o}_{a}\mu _a, \mu _b\mathbf {o}_{b}\}$. The valid events on $X$ basis are $\{\nu _a^{i}\nu _a^{j},\nu _b^{i}\nu _b^{j}\}$ that satisfy $\theta ^{i(j)} \in \{-\delta,\delta \}\cup \{\pi -\delta,\pi +\delta \}$ at time $\left |\theta ^{i} -\theta ^{j}\right |= 0$ or $\pi$. The detection events $\{o_a, \nu _b\}$, $\{\nu _a, o_b\}$, $\{o_a, \omega _b\}$, $\{\omega _a, o_b\}$, $\{\hat {\mathbf {o}}_a, \mu _b\}$, $\{\mu _a, \hat {\mathbf {o}}_b\}$, $\{\hat {\mathbf {o}}_a,o_b\}$, and $\{\mathbf {o}_a, \hat {\mathbf {o}}_b\}$ are used later for decoy analysis. We compared the performance of the post-matching QCKA protocol using the decoy-state method with the performance of the asymmetric QCKA protocol of [30] using the decoy-state method.

The distance between Alice and Charlie is $L_{a}$ and the distance between Bob and Charlie is $L_{b}$. The total distance between Alice and Bob is denoted by $L= L_{a}+ L_{b}$. In our protocol simulation, we set the two asymmetric cases to $L_{b}- L_{a}=50$ and $L_{b}- L_{a}=100$. We used a genetic algorithm to search for the source parameters $\mu _a$, $\nu _a$, $p_{\mu _a}$, $p_{\nu _a}$, $p_{\mathbf {o_a}}$, $\mu _b$, $\nu _b$, $p_{\mu _b}$, $p_{\nu _b}$, and $p_{\mathbf {o_b}}$, and the probability parameters: probability of choosing the Z basis between Alice and Charlie $t_a$, probability of choosing the Z basis between Bob and Charlie $t_b$, and probability of postselected phase matching $p_{pm}(=\frac {2\delta }{\pi })$.

In Fig. 2, Fig. 3, and Fig. 4, it is observed that our post-matching QCKA protocol has a slight advantage in terms of key rate when the constraints of the symmetric or asymmetric QCKA protocol in Ref. [30] are perfectly satisfied for the 0km, 50km, and 100 km distance gaps between $L_{BC}$ and $L_{AC}$. However, when the optical intensity modulation of the asymmetric QCKA protocol deviates slightly from the constraint, the key rate and transmission distance significantly decrease. As for post-matching QCKA protocol, the dashed black line (which represents the key rate of the post-matching QCKA in the case of $10\%$ preparation deviations of the light intensity $\nu _b$) shows that even $10\%$ preparation deviations of the light intensity $\nu _b$ affects the key rate slightly. In the case of a 50 km distance gap, when the optical intensity $\nu _b$ deviates from the constraint by $1\%$, the transmission distance of the asymmetric QCKA protocol decreases by $17.1\%$. When the deviation from the constraint is $3\%$, the transmission distance of the asymmetric QCKA protocol decreases by $30.0\%$. When this deviation is $10\%$, the transmission distance of the asymmetric QCKA protocol decreases by $46.4\%$. In the real environment of protocol implementation and the construction of quantum networks, the percentage of cases in which light-intensity modulation deviates from the target value is not low. Therefore, the post-matching QCKA protocol without any restrictions has a significant advantage over the asymmetric QCKA protocol during real protocol implementation. As shown in Fig. 5, we simulated the key rates of post-matching QCKA protocol with different data volume to indicate the practicability of the proposed protocol.

 

Fig. 2. The secret key rate comparison of this work and the asymmetric QCKA protocol of Ref. [30] in the finite-size regime under symmetric channels. In each plot, the solid red (blue) line represents the key rate of the post-matching QCKA (asymmetric QCKA) in the case of precisely prepared light intensity. The dashed black line represents the key rate of the post-matching QCKA in the case of $10\%$ preparation deviations of the light intensity $\nu _b$. The rest dashed lines correspond to the asymmetric QCKA protocol in Refs. [30] for different preparation deviations of the light intensity $\nu _b$. The parameters used in the simulations are listed in Table 2, and $N=10^{12}$. The angle of misalignment in the $X$ basis of the post-matching QCKA and asymmetric QCKA are both set to $\sigma =5^{\circ }$. The security bounds are $\varepsilon _{\textrm {PM}}=\varepsilon _{\textrm {Sym}}=\varepsilon _{\textrm {Ori}}=2.6\times 10^{-9}$.

Download Full Size | PDF

 

Fig. 3. The secret key rate comparison of this work and the asymmetric QCKA protocol of Ref. [30] in a finite-size regime under asymmetric channels. In each plot, the solid red (blue) line represents the key rate of the post-matching QCKA (asymmetric QCKA of Ref. [30]) for precisely prepared light intensity. The dashed black line represents the key rate of the post-matching QCKA in the case of $10\%$ preparation deviations of the light intensity $\nu _b$. The rest dashed lines correspond to the asymmetric QCKA protocol in Refs. [30] for different preparation deviations of the light intensity $\nu _b$. The difference in the length between the two channels was set to 50 km. The parameters used in the simulations are listed in Table 2, and $N=10^{12}$. The angle of misalignment in the $X$ basis of the post-matching QCKA and asymmetric QCKA are both set to $\sigma =5^{\circ }$. The security bounds are $\varepsilon _{\textrm {PM}}=\varepsilon _{\textrm {Asy}}=\varepsilon _{\textrm {Ori}}=2.6\times 10^{-9}$.

Download Full Size | PDF

 

Fig. 4. Comparison of the secret key rate of this work and asymmetric QCKA [30] in the finite-size regime under asymmetric channels. In each plot, the solid red (blue) line represents the key rate of the post-matching QCKA (asymmetric QCKA of Ref. [30]) for precisely prepared light intensity. The dashed black line represents the key rate of the post-matching QCKA in the case of $10\%$ preparation deviations of the light intensity $\nu _b$. The rest dashed lines correspond to the asymmetric QCKA protocol in Refs. [30] for different preparation deviations of the light intensity $\nu _b$. The difference in the length between the two channels was set to 100 km. The parameters used in the simulation were the same as those in the 50 km situation.

Download Full Size | PDF

 

Fig. 5. Comparison of the work secret key rate when N was set as $10^{11},~10^{12}$, and $10^{13}$ in the finite-size regime under asymmetric channels. The difference in the length between the two channels was set to 50 km. The parameters used in the simulation were the same as those shown in Fig. 4.

Download Full Size | PDF

5. Conclusion

In this work, we propose a post-matching QCKA protocol that shows higher key rate generation and stronger robustness than any other present protocol. The agreement process and the security proof of our study are presented in detail. To further analyze the advantages of our protocol, we turn the imperfect modulation in the present asymmetric QCKA protocol into an information leakage problem and quantify the security of the asymmetric QCKA protocol with the deviation of the constraints. The performance of the post-matching QCKA and asymmetric QCKA protocols in [30] using the decoy-state method with different intensities shows that the three-intensity protocol of our post-matching QCKA can achieve a better key rate and longer transmission distance than the asymmetric QCKA whenever it is in line with or nonconforms to the constraints. Our protocol has important practical advantages: high misalignment error tolerance, long transmission distances, and independent setting of probability and intensity for each user. Thus, it is highly versatile and suitable for most metropolitan networks.

The third part of our protocol (Charlie) randomly selects the measurement basis, resulting in our protocol no longer being a measurement device-independent scheme. However, it must be emphasized that our protocol can be directly implemented using currently available twin-field QKD devices. The post-matching QCKA protocol is able to reduce the intrinsic phase error rate floor, contributing to a greater communication distance. Because the noninterference mode is employed to extract the final key, our protocol can achieve a better key rate through combination with advanced single-photon source technology. There are practical applications for the asymmetric tripartite quantum communication case in this study. In addition, extending our efficient protocol design to include more than three parties is worthwhile. Our work serves the infrastructure of quantum cryptographic network large-scale deployment.