Phase-Matching Quantum Key Distribution

Quantum key distribution allows remote parties to generate information-theoretic secure keys. The bottleneck throttling its real-life applications lies in the limited communication distance and key generation speed, due to the fact that the information carrier can be easily lost in the channel. For all the current implementations, the key rate is bounded by the channel transmission probability $\eta$. Rather surprisingly, by matching the phases of two coherent states and encoding the key information into the common phase, this linear key-rate constraint can be overcome—the secure key rate scales with the square root of the transmission probability $O(\sqrt{\eta })$, as proposed in twin-field quantum key distribution [M. Lucamarini et al. Overcoming the Rate–Distance Limit of Quantum Key Distribution without Quantum Repeaters, Nature (London) 557, 400 (2018)]. To achieve this, we develop an optical-mode-based security proof that is different from the conventional qubit-based security proofs. Furthermore, the proposed scheme is measurement device independent; i.e., it is immune to all possible detection attacks. The simulation result shows that the key rate can even exceed the transmission probability $\eta$ between two communication parties. In addition, we apply phase postcompensation to devise a practical version of the scheme without phase locking, which makes the proposed scheme feasible with the current technology. This means that quantum key distribution can enjoy both sides of the world—practicality and security.

Popular Summary

Quantum key distribution (QKD) uses principles of quantum mechanics to encrypt information and alert communicating parties to any attempts at eavesdropping. In practice, short transmission distances and low rates of key generation restrict large-scale implementation of QKD. Here, we propose a practical scheme for distributing quantum keys that surpasses this limit on key generation.

For all current realizations, the key rate is bounded by the channel transmission probability, which is widely believed to limit QKD without repeaters. Our scheme, known as phase-matching QKD, beats the linear key-rate constraint: The secure key rate scales with the square root of the transmission probability. In addition, we employ phase postcompensation to devise a practical version of the scheme without phase locking, which makes the proposed scheme feasible with the current technology. Furthermore, the scheme is immune to all detection attacks.

With its advantages in performance and practical security, the phase-matching QKD scheme could become a new standard for future QKD implementations.

Figure 1

(a) Schematic diagram of PM-QKD. Alice generates a coherent state, $|\sqrt{{\mu }_a}{e}^{2\pi i{\kappa }_a/d}⟩$, where ${\kappa }_a\in \{0,1,\dots ,d-1\}$. Similarly, Bob generates $|\sqrt{{\mu }_b}{e}^{2\pi i{\kappa }_b/d}⟩$. The two coherent states are sent and interfered at an untrusted measurement site. (b) Schematic diagram of PM-QKD with $d=2$ plus phase randomization. Alice prepares $|\sqrt{{\mu }_a}{e}^{i({\varphi }_a+\pi {\kappa }_a)}⟩$ and Bob prepares $|\sqrt{{\mu }_b}{e}^{i({\varphi }_b+\pi {\kappa }_b)}⟩$. The two coherent states interfere at an untrusted measurement site. If the phase difference $|({\varphi }_a+\pi {\kappa }_a)-({\varphi }_b+\pi {\kappa }_b)|$ is 0, detector $L$ clicks; if the phase difference is $\pi$, detector $R$ clicks. After Eve announces her measurement result, Alice and Bob publicly announce ${\varphi }_a$ and ${\varphi }_b$. (c) Equivalent scenario for the postselected signals with ${\varphi }_a={\varphi }_b$. A trusted party (Charlie) prepares $|\mathrm{\Psi }{⟩}_C$, splits it, and sends it to both Alice and Bob. Without loss of generality, we consider the case where Alice and Bob both modulate this by the same phase 0 or $\pi$ to create the systems $A$ and $B$. If $|\mathrm{\Psi }{⟩}_C$ only contains odd- or even-photon number components, we can see that $|{\mathrm{\Psi }}_0⟩=|{\mathrm{\Psi }}_{\pi }⟩$.

Figure 2

Phase postcompensation. Without loss of generality, here we consider the case ${\kappa }_a={\kappa }_b$. Denote the phase references of Alice and Bob as ${\varphi }_{a0}$ and ${\varphi }_{b0}$, and, hence, the reference deviation is ${\varphi }_0={\varphi }_{b0}-{\varphi }_{a0}$ mod $2\pi$. Bob can figure out the proper phase compensation offset $j_d$ by minimizing the QBER from random sampling as follows. Bob sets up a $j_d$, sifts the bits by $|j_b+j_d-j_a|=0$, and evaluates the sample QBER. He tries all possible $j_d\in \{0,1,\dots ,M-1\}$ and figures out the proper $j_d$ to minimize the sample QBER. Then, he announces the sifted locations of unsampled bits to Alice. As shown in the figure, we set $M=12$, and the reference deviation ${\varphi }_0=70°$; hence, Bob can set $j_d=2$ to compensate the effect of ${\varphi }_0$.

Figure 3

Simulation of our PM-QKD protocol. For the considered simulation parameters, the key rate of PM-QKD surpasses that of the conventional BB84 protocol when $l>120\mathrm{km}$, and it exceeds the linear key-rate bound by Pirandola et al. (PLOB bound) [11] when $l>250\mathrm{km}$. In addition, our protocol is also able to achieve a long transmission distance of $l=450\mathrm{km}$.

Figure 4

(a) Schematic diagram of Protocol I. (b) Equivalent view of Protocol I, where the $X$-basis measurement on $A^{\prime }$ or $B^{\prime }$ is realized by a Hadamard gate followed by the $Z$-basis measurement.

Figure 5

(a) A specific realization of Protocol I, where Charlie prepares $|\sqrt{\mu }⟩$ and $|\sqrt{-\mu }⟩$ with equal probabilities. (b) Schematic diagram of Protocol II, where Alice and Bob prepare $|\sqrt{\mu /2}⟩$ and add the same random phase $\varphi \in \{0,\pi \}$.

Figure 6

The schematic diagram of protocols II, IIa, and III. In Protocol II, Alice and Bob add the same phase $\varphi \in \{0,\pi \}$ on their coherent state $\sqrt{\mu /2}$. In Protocol IIa, Alice and Bob announce the phase $\varphi$ after Eve’s announcement. In Protocol III, Alice and Bob add phases ${\varphi }_a$ and ${\varphi }_b$, independently. They announce ${\varphi }_a$ and ${\varphi }_b$ after Eve’s announcement.

Figure 7

(a) Schematic diagram of Protocol IV, where the decoy-state method is applied. The random phase ${\varphi }_a$, ${\varphi }_b\in [0,2\pi )$. (b) Schematic diagram of PM-QKD protocol.

Figure 8

Key-rate comparison with fixed light intensity $\mu =0.5$. Here, we can see that the GLLP tagging formula for the single-photon component cannot hold under the beam-splitting attack when the transmittance $\eta <0.6$.

Figure 9

Key-rate comparison with fixed transmittance $\eta =0.2$. The GLLP tagging formula for the single-photon component cannot hold under the beam-splitting attack.

Figure 10

(a) Schematic diagram of phase-encoding MDI-QKD (Scheme I in Ref. [17]). (b) Schematic diagram of TF-QKD, which is the decoy-state version of the scheme in (a). (c) Schematic diagram of $d$-phase PM-QKD.