Generating the local oscillator"locally"in continuous-variable quantum key distribution based on coherent detection

Continuous-variable quantum key distribution (CV-QKD) protocols based on coherent detection have been studied extensively in both theory and experiment. In all the existing implementations of CV-QKD, both the quantum signal and the local oscillator (LO) are generated from the same laser and propagate through the insecure quantum channel. This arrangement may open security loopholes and also limit the potential applications of CV-QKD. In this paper, we propose and demonstrate a pilot-aided feedforward data recovery scheme which enables reliable coherent detection using a"locally"generated LO. Using two independent commercial laser sources and a spool of 25 km optical fiber, we construct a coherent communication system. The variance of the phase noise introduced by the proposed scheme is measured to be 0.04 (rad^2), which is small enough to enable secure key distribution. This technology also opens the door for other quantum communication protocols, such as the recently proposed measurement-device-independent (MDI) CV-QKD where independent light sources are employed by different users.


I. INTRODUCTION
Quantum key distribution (QKD) allows two authenticated parties, normally referred to as Alice and Bob, to generate a secure key through an insecure quantum channel controlled by an eavesdropper, Eve [1][2][3][4][5]. Based on fundamental laws in quantum mechanics, idealized QKD protocols have been proved to be unconditionally secure against adversaries with unlimited computing power and technological capabilities [6][7][8].
Both discrete-variable (DV) QKD protocols based on single photon detection [1, 2] and continuous-variable (CV) QKD protocols based on coherent detection [9][10][11] have been demonstrated as viable solutions in practice. One well-known CV-QKD protocol is the Gaussianmodulated coherent state (GMCS) protocol [11], which has been demonstrated through a 80km optical fiber link recently [12]. One important advantage of the GMCS QKD is its robustness against incoherent background noise. The strong local oscillator (LO) employed in coherent detection also acts as a natural and extremely selective filter, which can suppress noise photons effectively. This intrinsic filtering function makes CV-QKD an appealing solution for secure key distribution over a noisy channel, such as a lit fiber in a conventional fiber optic network [13][14][15] or a free-space optical link.
However, all existing implementations of CV-QKD based on coherent detection contain a serious weakness: to reduce the phase noise, both the signal and the LO * qib1@ornl.gov are generated from the same laser and propagate through the insecure quantum channel [11,12,16]. This arrangement has several limitations. First of all, the above copropagating scheme allows Eve to access both the quantum signal and the LO. Eve may launch sophisticated attacks by manipulating the LO, as demonstrated in recent studies [17][18][19][20]. Second, sending a strong LO through a lossy channel can drastically reduce the efficiency of QKD in certain applications. For example, to achieve a shot-noise limited coherent detection, the required photon number in the LO is typically above 10 8 photons per pulse at the receiver's end [11,12,16]. With a 1 GHz pulse repetition rate and a channel loss of 20 dB, the required LO power at input of the channel is about 1.2 W (at 1550 nm). Noise photons generated by the strong LO inside the optical fiber may significantly reduce QKD efficiency and multiplexing capacity. Third, the LO is typically 7 or 8 orders of magnitude brighter than the quantum signal, complicated multiplexing and demultiplexing schemes are required to effectively separate the LO from the quantum signal at the receiver's end.
In brief, in CV-QKD, it is desirable to generate the LO "locally" using an independent laser source at the receiver's end. Unfortunately, such a scheme has never been implemented in practice. The main challenge is how to effectively establish a reliable phase reference between Alice and Bob. While various techniques, such as feedforward carrier recovery [21], optical phase-locked loops [22], and optical injection phase-lock loop [23], have been developed in classical coherent communication, these techniques are not suitable in QKD where the quantum signal is extremely weak and the tolerable phase noise is low. Furthermore, to prevent Eve from manipulating the LO, the LO laser should be isolated from outside both optically and electrically.
In this paper, we solve the above long outstanding problem by proposing and demonstrating a pilot-aided feedforward data recovery scheme, which enables reliable coherent detection using a "locally" generated LO. This scheme is built upon the observation that in GMCS QKD, Bob does not need to perform the measurement in the "correct basis". In fact, Bob can perform the measurement in an arbitrarily rotated basis as along as the basis information is available afterwards. With this post-measurement basis information, either Alice or Bob can rotate data at hand and generate correlated data with the other. We demonstrate the above scheme in a coherent communication system constructed by a spool of 25 km optical fiber and two independent commercial laser sources operated at free-running mode. The observed phase-noise variance is 0.04 (rad 2 ), which is small enough to enable secure key distribution. This technology also opens the door for other novel quantum communication protocols, such as the measurement-deviceindependent (MDI) CV-QKD protocol [24,25] where independent light sources are employed by different users.
This paper is organized as follows: in Section II, we conduct a theoretical analysis of the proposed scheme. In Section III, we present the details of the experimental setup and experiment results. We conclude this paper with a discussion in Section IV.

II. THEORETICAL ANALYSIS
In GMCS QKD, Alice draws two random numbers X A and P A from a set of Gaussian random numbers (with a mean of zero and a variance of V A N 0 ) and sends a coherent state |X A + iP A to Bob. Here N 0 = 1/4 denotes the shot-noise variance. In GMCS QKD based on homodyne detection [11], Bob randomly chooses to measure either the amplitude quadrature (X) or phase quadrature (P) using a homodyne detector. In GMCS QKD based on heterodyne detection [26], Bob splits the incoming signal with a 50:50 beam splitter and conducts conjugate homodyne detections to measure both X and P. In this study, we adopt the heterodyne protocol. After the quantum transmission stage, Alice shares a set of correlated Gaussian random variables (called the"raw key") with Bob. Alice and Bob compare a random sample of the raw key through an authenticated classical channel to estimate the transmittance and excess noise of the quantum channel. If the observed excess noise is small enough, they can further work out a secure key. One widely adopted assumption in QKD is that the users cannot distinguish the noise due to Eve's attack from the intrinsic noise of the QKD system. If the intrinsic noise of the QKD system is too high, then it is impossible to generate quantum keys with proven security.
One important source of excess noise in CV-QKD is the phase noise in coherent detection. High-precision coherent detection relies on the fixed phase relation between the signal laser and the LO laser. In practice, it is very difficult to lock the phase of these two lasers, especially when they are isolated from each other both optically and electrically. Fortunately, in GMCS QKD, Bob does not need to measure Alice's signal in the "correct basis". As long as they can know which basis is used by Bob, one of them can rotate the data at hand in the post-processing stage and establish correlation with the other party. In our scheme, both the signal laser and the LO laser are operated at free-running mode. For convenience, we choose Alice's signal laser as the phase reference. When Bob performs conjugate homodyne detections, the phase φ of the LO laser is a random number uniformly distributed between [0, 2π). Obviously, Bob's measurement results (X φ , P φ ) have no correlation with the random numbers (X A , P A ) encoded by Alice. However, if Alice and Bob have a method to determine φ, then one of them (for example, Alice) can remap the data at hand during the post-processing process Under normal conditions (no Eve), (X φ , P φ ) and (X A , P A ) are correlated. Alice and Bob can further apply error correction and privacy amplification to work out a secure key, as in the conventional GMCS QKD. We remark that a similar "quadrature-remapping" scheme was first applied in [16] to remove the noise due to the slow phase drift of a fiber interferometer.
We developed a pilot-aided feedforward data recovery scheme [27] which allows Bob to determine the phase φ reliably. The basic idea is as follows. For each quantum transmission, Alice sends out a Gaussian modulated weak coherent state (signal pulse) and a relatively strong phase reference pulse generated from the same laser (the signal laser). These two pulses propagate through the same quantum channel to the measurement device, where Bob performs conjugate homodyne detections on both of them using LOs generated from the LO laser. The measurement results from the phase reference pulse (X R , P R ) can be used to determine φ.
In practice, φ cannot be determined perfectly due to laser phase noise and measurement errors. From eq. (1), the uncertainty of φ will be translated into an excess noise in (X A , P A ) as where V A is Alice's modulation variance, σ φ is the noise variance in determining φ. To achieve a high secure key rate, it is crucial to reduce σ φ . Define the laser phase at time t = 0 as θ 0 . The phase noise ∆θ(t) quantifies the deviation of the laser phase at time t from θ 0 + 2πf t (the phase expected from an ideal sine wave), where f is the central frequency of the laser. ∆θ(t) can be treated as Gaussian noise with a mean of zero and a variance of [28] (∆θ(t)) 2 = 2t τ c .
Here τ c is the coherence time of the laser, which is related to its linewidth ∆f by [28] τ c 1 π∆f .
Suppose the linewidths of the signal laser and the LO laser are ∆f 1 and ∆f 2 , respectively; the time delay between the signal pulse and the phase reference pulse is T d . Using eqs. (3) and (4), the phase noise contributed by the two lasers is given by From eq. (5), the phase measurement precision can be improved by reducing either the laser linewidths or the time delay between the signal pulse and the phase reference pulse.

III. EXPERIMENTAL SETUP AND RESULTS
We demonstrate the pilot-aided feedforward data recovery scheme using commercial off-the-shelf devices. The experimental setup is shown in Fig.1. Two commercial frequency-stabilized continuous wave (cw) lasers at Telecom wavelength (Clarity-NLL-1542-HP from Wavelength Reference) are employed as the signal and the LO laser. Both lasers are operated at free-running mode and the central frequency difference between the two lasers can stay within 10 MHz without feedback controls. A LiNbO3 waveguide intensity modulator (EOSpace) is used to generate 8 ns laser pulses at a repetition rate of 50 MHz. Since half of the laser pulses will be used as phase references, the equivalent data transmission rate in our experiment is 25 MHz. A LiNbO3 waveguide phase modulator (EOSpace) is used to encode binary phase information on the signal pulses.
Both the signal pulses and reference pulses propagate through a spool of 25km single mode fiber before arriving at the measurement device. At the receiver's end, the average photon number is about 10 5 per pulse, which is significantly lower than that of the LO used in GMCS QKD. A commercial 90-degree optical hybrid (Optoplex) and two 350 MHz balanced amplified photodetectors (Thorlabs) are employed to measure both X-quadrature and Pquadrature of the incoming pulses. The 90-degree optical hybrid is a passive device featuring a compact design. No temperature control is required to stabilize its internal interferometers. The output of the balanced photodetectors are sampled by a broadband oscilloscope at 1 GHz sampling rate. For simplicity, the LO laser is operated in the cw mode. A waveform generator with a bandwidth of 120 MHz provides the modulation signals to both the intensity and the phase modulator, and a synchronization signal to the oscilloscope.
Note, a signal pulse S i and the corresponding reference pulse R i (see Fig.1) are measured at different times with a time delay of T d . If the central frequency difference of the two lasers (f 1 − f 2 ) is a constant over a long time period, we can simply correct the phase measurement result of R i by adding a constant phase shift of 2π(f 1 − f 2 )T d . In practice, however, both lasers present frequency drift over time. In our experiment, we use a simple scheme to estimate the phase difference φ S,i at the time when the signal pulse is measured. Since the signal pulse S i is in the middle of two reference pulses R i and R i+1 , we can estimate φ S,i from the phase measurement results on R i and R i+1 as where is the estimated frequency difference of the two lasers. One assumption made in the above equations is the frequency difference of the two lasers is stable within the time interval between two adjacent reference pulses (40 ns in our experiment), so the phase difference grows linearly with time.
To evaluate the effectiveness of the above LO phase recovery scheme, we conduct a phase encoding coherent communication experiment using a binary pattern of "01010101...", where bit 0 is represented by no phase shift and bit 1 by phase shift of 1.65. In total, 25000 signal pulses are transmitted. The experimental results are summarized in Fig.2. As shown in Fig.2(a) and (b), before phase correction, the measured phases are randomly distributed within [0, 2π), regardless the encoded information. After phase correction, the measurement results for bit 0 and bit 1 are clearly separated. The residual phase noise variances (after phase correction) have been determined to be 0.040 (for bit 0) and 0.039 (for bit 1) respectively. As shown in the Appendix, phase noise at this level is tolerable in the GMCS QKD protocol.
One major cause of the observed phase noise is the laser phase noise associated with its linewidth. First of all, due to the laser phase noise, the difference of the central frequencies of the two lasers cannot be determined precisely. Using eqs. (5) and (7), the uncertainty of f d is given by ∆f 1 + ∆f 2 4πT d , which is translated into a phase noise of πT d (∆f 1 + ∆f 2 ) in φ S,i (eqs. (6)). Second, as discussed in the previous section, even with a precisely determined f d , there is still a noise variance of 2πT d (∆f 1 + ∆f 2 ) due to the finite linewidths of the two lasers. In total, the two lasers contribute a noise variance of 3πT d (∆f 1 + ∆f 2 ) in the above scheme. Using ∆f 1 = 62 KHz, ∆f 2 = 70 KHz (provided by the vendor), and T d = 20 ns, the noise variance contributed by the two lasers is estimated to be 0.024. The difference between the experimentally observed and the theoretically estimated noise variances could come from the measurement system.

IV. DISCUSSION
A long outstanding problem in CV QKD based on coherent detection is how to generate the LO "locally". In all the existing implementations of CV-QKD, both the quantum signal and the LO are generated from the same laser and propagate through the insecure quantum channel. This arrangement may open security loopholes and also limit the potential applications of CV-QKD.
In this paper, we solve the above problem by proposing and demonstrating a pilot-aided feedforward data recovery scheme which allows reliable coherent detection using a "locally" generated LO. This scheme also greatly simplifies the CV-QKD design by getting rid of the cumbersome unbalanced fiber interferometers and the associated phase stabilization system. A proof of principle experiment based on commercial off-the-shelf components shows that the noise due to the proposed scheme is tolerable in CV-QKD. To further reduce the noise, laser sources with smaller linewidth can be applied.
Since a phase reference pulse is still required in our scheme, one may ask whether our scheme is really different from the conventional approach. The answer is twofold. First, the phase reference pulse is only used to provide the (classical) phase information, it is not directly used in the detection of the quantum signal. In fact, in our scheme Eve can never access the LO itself. Eve can certainly interfere with the phase estimation process by manipulating the phase reference pulse when it propagates through the quantum channel. This could result in increased phase noise and the secure key rate will be reduced. This is one type of denial-of-service attack, which can be applied to any QKD protocol. From Eve's point of view, whatever can be achieved by manipulating the reference pulse can also be achieved by manipulating the quantum signal directly. So, sending the reference pulses through the quantum channel will not give Eve any additional advantages, thus the standard security proof of CV-QKD (built upon the assumption that Eve can only access the quantum signal) can be applied in our scheme. Second, the reference pulse used in our experiment (10 5 photons per pulse) is much weaker than the LO itself (typically 10 8 photons per pulse). As a result, other problems associated with sending the strong LO through the channel, such as the reduction of QKD efficiency and the multiplexing capacity, are not present in our scheme.
To conduct a complete CV-QKD experiment with the current setup, broadband shot-noise limited homodyne detectors are required. Detectors with the desired performances have been implemented by several groups [29][30][31]. We expect our scheme will significantly improve the performance of CV-QKD. This technology also open the door for other quantum communication protocols, such as the measurement-device-independent (MDI) CV-QKD protocol.
This work was performed at Oak Ridge National Laboratory, operated by UT-Battelle for the U.S. Department of Energy under Contract No. DE-AC05-00OR22725. The authors acknowledge support from the laboratory directed research and development program.
Appendix: Simulation of secure key rate The security of one-way GMCS QKD has been well established. Here, our simulations are based on secure key rate formulas given in [32].
The secure key rate under the optimal collective attack, in the case of reverse reconciliation, is given by where I AB is the Shannon mutual information shared between Alice and Bob; f is the efficiency of the reconciliation algorithm; χ BE is the Holevo bound of the information between Eve and Bob. The mutual information between Alice and Bob is given by The Holevo bound of the information between Eve and Bob is given by System parameters in the above equations are defined as follows.
(a) V = V A + 1, where V A is Alice's modulation variance.
(b) The total noise referred to the channel input χ tot = χ line + χ het T , where T is the channel transmittance. If we assume the quantum channel between Alice and Bob is optical fiber with an attenuation coefficient of α, then the channel transmittance is given by T = 10 −αL 10 , where L is the fiber length. (c) The total channel-added noise referred to the channel input χ line = 1 T − 1 + ε, where ε is the excess noise outside of Bob's system. We assume that ε is mainly due to imperfection of the LO phase recovery scheme where σ φ is the noise variance associated with the LO phase recovery scheme.
We conduct numerical simulation using realistic parameters as summarized below: α = 0.2 dB/km, ν el = 0.1, σ φ = 0.04, η = 0.5, f = 0.95, and V A = 1. Fig.3 shows the simulation result in the asymptotic case (ignoring the finite data size effect). The simulation result shows that the proposed LO phase recovery scheme can be applied to achieve efficient QKD.