Simple security analysis of phase-matching measurement-device-independent quantum key distribution
Jie Lin Norbert Lütkenhaus










Institute for Quantum Computing and Department of Physics and Astronomy, University of Waterloo, Waterloo, Ontario, Canada N2L 3G1 

Institute for Quantum Computing and Department of Physics and Astronomy, University of Waterloo, Waterloo, Ontario, Canada N2L 3G1 





Variations of phase-matching measurement-device-independent quantum key distribution (PM-MDI QKD) protocols have been investigated before, but it was recently discovered that this type of protocol (under the name of twin-field QKD) can beat the linear scaling of the repeaterless bound on secret key capacity. We propose a variation of PM-MDI QKD protocol, which reduces the sifting cost and uses non-phase-randomized coherent states as test states. We provide a security proof in the infinite key limit. Our proof is conceptually simple and gives tight key rates. We obtain an analytical key rate formula for the loss-only scenario, confirming the square root scaling and also showing the loss limit. We simulate the key rate for realistic imperfections and show that PM-MDI QKD can overcome the repeaterless bound with currently available technology.






Simple security analysis of phase-matching measurement-device-independent 
 quantum key distribution
    Norbert Lütkenhaus
    December 30, 2023
====================================================================================================







§ INTRODUCTION

Quantum key distribution (QKD) <cit.> protocols enable two distant parties (Alice and Bob) to establish information-theoretically secure private keys using a quantum channel and an authenticated classical channel. There is a wealth of QKD protocols around (see Ref. <cit.> for a review). A bottleneck for QKD applications, be it as individual link or as part of a network, is the scaling of the generated secret key rate with the loss in the channel represented by the single-photon transmissivity η. The best-known QKD protocols have a scaling of their key rate in the limit of infinite channel uses (infinite key limit) as R^∞ = O(η), and by now we have bounds on repeaterless optical channels which show that this is the optimal rate scaling that can be achieved <cit.>. The tight bound on the performance of QKD in terms of secret key rate per employed optical mode is given by R^∞≤log_2 1/1-η  <cit.>, which can be saturated <cit.>. In principle, inserting intermediate stations performing some operations can improve the performance, and quantum repeaters <cit.> aim at this. The field of quantum repeater research is very active and made conceptual and practical advances over the recent years, but as of today, no quantum repeater has been demonstrated yet that would outperform the direct use of optical channels, and thus breaking the repeaterless bounds.

While proposals have been made for simplest possible devices that allow a demonstration of quantum repeater action by beating repeaterless bounds using a simple single-node layout <cit.>, the corresponding quantum advantage has not been experimentally demonstrated yet. In a pleasant surprise to the field, the phase-matching measurement-device-independent protocols (PM-MDI) <cit.> were recently shown to beat the repeaterless bound when using suitable test states <cit.>. This important observation justifiably creates quite an interest in the community. In the original paper <cit.>, it has been argued that the secret key rate in the infinite key limit indeed scales as R^∞= O(√(η)), where we keep η as the single-photon transmissivity of the total distance, rather than that of a segment. It is interesting to see that an MDI protocol can achieve that performance without the use of any quantum memory or similar advanced components. Remarkably, the only difference to previous MDI QKD protocols that show a scaling of R^∞=O(η) is the change from single-photon signals (or mixture of photon number states) with two-photon interference events at the beam splitter, to coherent states as signal states and single-photon interference events at the beam splitter. 

So far, the security analyses <cit.> of the PM-MDI QKD protocols have been done in a framework based on the quantum error correction inspired approach by Shor-Preskill <cit.>, which is improved by Koashi <cit.>, and later extended to work with a wider class of privacy amplification protocols <cit.>. However, for security proofs in this framework, due to some pessimistic estimation of the phase error rate, the key rate bound can potentially be loose. Also, the variations of the protocol proposed in <cit.> require phase-randomization on the signal states and thus introduce a large sifting cost. 
The goal of the present paper is two-fold. We propose a variation of the PM-MDI QKD protocol that clearly distinguishes between test states, meant to probe potential eavesdropping activities, and signal states, which are meant to establish secret keys and are not phase randomized. For this modified protocol we then execute a security analysis which is expected to be tight as it uses the framework by Renner <cit.>. This framework is known to be flexible in terms of error correction and privacy amplification methods, and is general enough to be adaptable to any generic QKD protocol. It is interesting to point out that even though these two frameworks have been generally considered independent of each other in the community, recently there has been an effort to unify these two different security proof frameworks <cit.>.


We will first analyze the security of the protocol in a setting with infinitely many different test states, similar to the initial discussion of decoy states in weak coherent pulse BB84 protocols <cit.>. In this setting, we can derive an analytical key rate formula for the scenario where Alice and Bob observe correlations coming from a loss-only scenario. We derive the general framework that includes also the noisy case, for which we then resort to numerical evaluations to demonstrate the stability of the proposed protocol. 

Since the test states in our protocol are non-phase-randomized coherent states, we do not apply the decoy state analysis. Instead of using phase-randomized coherent states to simulate a classical mixture of photon number states, we directly use the properties of coherent states to perform a variation of tomography on the quantum channel and untrusted measurement devices. Our approach thus generalizes the decoy state idea to the use of general test states to test the channel and to deduce information about the adversary's attacks. To the best of our knowledge, this approach has not been used in the context of QKD security proof and might be interesting to apply a similar approach to other QKD protocols.  

This paper is organized as follows. We first describe our version of the PM-MDI protocol in Sec. <ref>, and we then compare different variations of the PM-MDI protocol in Sec. <ref> and highlight how our variation (and our proof idea) differs from other works. Next, we describe the framework for our security proof and procedures for key rate calculation in Sec. <ref>. We then simulate the key rates with the loss-only scenario and with realistic experimental imperfections in Sec. <ref>. Finally, in Sec. <ref>, we summarize our results and provide insights for future work. Some technical details relevant for the key rate calculation are presented in the appendixes.






 



§ PM-MDI QKD PROTOCOLS

In this section, we first present an idealized version of PM-MDI QKD in the sense that Alice and Bob use infinitely many coherent states as test states in the protocol, similar to the initial discussion of decoy states in weak coherent pulse BB84 protocols <cit.>. We will prove its security in this paper. Then, we will compare different variations of PM-MDI QKD protocols. In the next section, when we prove the security of the idealized version of our protocol, we will also provide insights for the security analysis of a practical version of this protocol with a small number of choices of test states.



 §.§ Description of our protocol




  (1) Test/key-generation mode selection. Alice (Bob) chooses a random bit m_A (m_B) according to a priori probability distribution {p_A, 1-p_A} ({p_B, 1-p_B}). If m_A = 0, Alice then labels this round as in the key-generation mode. If m_A =1, Alice labels this round as in the test mode and similarly for Bob. 

  (2) State preparation. If the test mode is chosen,  Alice (Bob) then randomly chooses a phase θ_A (θ_B) ∈ [0, 2π) and randomly chooses an intensity μ_A (μ_B). Then she (he) prepares a coherent state |√(μ_A) e^i  θ_A⟩ ( |√(μ_B) e^i θ_B⟩) and sends it to the untrusted third party Charlie through the quantum channel.

If the key-generation mode is chosen, Alice (Bob) randomly generates a bit value k_A  (k_B) ∈{0,1} with a uniform probability distribution. Alice (Bob) chooses the pre-agreed intensity μ and sends a coherent state |√(μ) e^i π k_A⟩ (|√(μ) e^i π k_B⟩) to Charlie.

  (3) Measurements. For each round, Charlie performs a joint measurement on the signals received from Alice and Bob, and then makes an announcement about the measurement outcome. If Charlie is honest, he is supposed to perform the measurement as shown in Fig. *fig:scheme_a and announces one of the following outcomes {“Only detector D_+ clicks", “Only detector  D_-  clicks", “No detectors click", “Both detectors click"}, which, for the later convenience of notation, we abbreviate as {+,-,?,d}, respectively. We denote Charlie's announcement as γ throughout this paper.

 
After steps 1-3 are repeated for many times, and after Charlie has made all the announcements, Alice and Bob then proceed with the following steps.


  (4) Sifting. Alice and Bob use an authenticated classical channel to communicate and sort all rounds into two disjoint sets, where one set is used for the key generation and the other is for the parameter estimation. To do so, they disclose the choices of m_A and m_B for each round and also use the announcement γ. If m_A = m_B =0, that is, they both selected the key-generation mode for a given round, and Charlie announced γ∈{+,-}, they save their data corresponding to this round for the key generation. All remaining rounds are used for parameter estimation.


  (5) Parameter estimation. To perform parameter estimation, Alice and Bob disclose the choices of μ_A, μ_B, θ_A, θ_B (also k_A, k_B if they have chosen one for that round) for the rounds in the set labeled for parameter estimation and also use the announcement result γ for each of these rounds to estimate how Eve has interacted with the signals during their exchange in the protocol. If, from their analysis, they find out that Eve has learned too much about the signals and no secret keys can be generated, then they abort the protocol. Otherwise, they continue. 


  (6) Key map. Alice forms a raw key using her bit value k_A from each of the rounds saved for the key generation. (In principle, Bob does not need to do anything in this step since he can correctly determine Alice's key by the error correction. In practice, depending on the choice of error correction code, it might be convenient for Bob to flip his bit value when the announcement is γ = “-".)


  (7) Error correction and privacy amplification. Alice and Bob then apply the procedures of error correction and privacy amplification as in a typical QKD protocol to generate a secret key.



 
We remark that since this protocol uses an MDI setup, it is inherently immune to all side channels in the measurement devices once its security is proven. However, Alice and Bob's sources have to be trusted and protected. In our security analysis, we assume that Alice and Bob's devices are fully characterized and Eve has no access. This assumption needs to be justified in the experimental implementations of the protocol. In particular, we want to remark that the choices of m_A and m_B (also k_A and k_B) should not be leaked to Eve by side channels before the announcement is made. In the implementation of the protocol, Alice and Bob need to make sure that Eve cannot distinguish the key-generation mode from test mode by any classical side information leaked from their devices before Charlie's announcement. Just like other MDI QKD protocols, this protocol can be vulnerable to side-channel attacks on the sources.   

We also comment on the the choices of parameters p_A, p_B. While values of p_A, p_B need to be optimized in the finite-key regime, in the infinite key limit, we can choose p_A and p_B arbitrarily close to 1 so that the sifting factor is asymptotically 1, like the efficient BB84 protocol <cit.>. 

Finally, we remark on the choices of μ_A and μ_B and their corresponding probability distributions. Since states in the test mode essentially are used to perform a tomography on Eve's attacks on the subspace of signal states used in the key-generation mode, for the purpose of this paper, we initially use coherent states whose complex amplitudes cover the entire complex space. In the infinite key limit, the probability distribution (with no zeros) does not matter. We will remark on how a finite number of choices of test states can approximately accomplish the same task and the choices of  μ_A and μ_B will then be closely related to the value of μ.



 §.§ Comparison of different variations of PM-MDI QKD protocols

Many variations of the PM-MDI QKD protocol have been proposed and investigated. Different names have been assigned to different variations, such as, phase-encoding scheme for MDI <cit.>, MDI-B92 <cit.>, twin-field QKD (TF-QKD) <cit.> and phase-matching QKD (PM-QKD) <cit.>. However, they all have the essential components needed to achieve the rate scaling of R^∞ = O(√(η)), namely, they all use coherent states as signal states and rely on single-photon interference events at the beam splitter of an untrusted intermediate node, even though not all variations can indeed achieve this scaling.    

We first describe the common features of all those protocols and then discuss how each variation differs in the following two aspects: choices of signal states used for establishing secret keys and choices of test states used to probe Eve's attacks. 

In an ideal PM-MDI QKD protocol, Alice and Bob will only establish keys from the  rounds where each of them has selected a state from the set {|+α⟩, |-α⟩}, where α can be an arbitrary complex number. In other words, Alice and Bob will only establish keys from the rounds that satisfies the phase-matching condition, that is, they have chosen the same global phase and same intensity for their states. We call two coherent states {|+α⟩, |-α⟩} with only a π phase difference as a phase-matching pair. In addition, Alice and Bob may decide to send some states as test states to probe eavesdropping activities for randomly selected rounds and those rounds will be used in the parameter estimation step only. Alice and Bob will send their states to an untrusted party Charlie at the intermediate node for measurements. An honest Charlie will use the single-photon interference events at the beam splitter for his announcement.  

Since this type of protocol is measurement-device independent and generates keys when Alice and Bob use the same phase-matching pair of coherent states, phase-matching measurement-device-independent QKD is in our view a more descriptive name that captures important features of this type of protocol. 

Now, we compare some variations of PM-MDI QKD. Different variations may use different number of phase-matching pairs as signal states and may use different types of states as test states, such as a mixture of photon number states (phase-randomized coherent states), partially phase-randomized coherent states, or coherent states without phase randomization. Some variations may use the same number of phase-matching pairs as signal states, but differ in how to handle them. We present those variations just for the comparison purpose and we do not neither claim this is an exhausted list nor verify the security analysis of each work.



  (1) The variation proposed in Ref. <cit.> is called phase encoding scheme I for MDI. This protocol essentially uses two phase-matching pairs of coherent states. In the original description of the protocol, these two pairs are labeled as two bases, similar to a BB84-type protocol, due to the proof technique adopted. In an abstract description, we can view this protocol as essentially using one phase-matching pair of coherent states as signal states and an additional pair as test states. Because of the proof technique and a limited number of test states, the scaling R^∞ = O(√(η)) was not found. 

  (2) The variation studied in Ref. <cit.> is called MDI-B92 protocol. Reference <cit.> analyzes different types of measurements for the intermediate node. Under the investigation of unambiguous state discrimination attacks, it basically proposes a variation of PM-MDI protocol with exactly one phase-matching pair of coherent states as the signal states and no test states. Because there are no test states, this protocol is not expected to have the scaling R^∞ = O(√(η)).

  (3)  The variation proposed in Ref. <cit.> has the name of TF-QKD protocol. This protocol uses infinitely many phase-matching pairs of coherent states (phase-randomized coherent states) as signal states. In addition, for the purpose of security analysis, each round is assigned to one of two bases to mimic a BB84-type protocol. Instead of achieving the perfect phase-matching conditions, this protocol allows some small errors in identifying whether Alice and Bob have chosen the same phase-matching pair. To distill keys, Alice and Bob disclose some partial information about the global phases. If their global phases only differ by a small amount, they assume they have used the same phase-matching pair. Due to the phase-matching condition, the sifting cost of this protocol can be large, which affects the prefactor of key rate. In this protocol, states used as test states are effectively the same as states used for signal states. These test states are partially phase-randomized coherent states as Eve knows some partial information about the global phase. Reference <cit.> argued that this type of protocol can have the O(√(η)) rate scaling.

  (4) The variation investigated in Ref. <cit.> uses the name PM-QKD protocol. Like TF-QKD <cit.>, it also uses infinitely many phase-matching pairs of coherent states as signal states and adopts a procedure similar to that in Ref. <cit.> in identifying whether Alice and Bob have chosen the same phase-matching pair for each round. It also uses partially phase-randomized coherent states as test states. The difference from TF-QKD is that there is no assignment of basis choice for each round. This work shows the O(√(η)) rate scaling and its security analysis does not use standard decoy state methods.

  (5) The variation studied in Ref. <cit.> is called TF-QKD^* protocol. This protocol, similar to the original TF-QKD protocol, uses infinitely many phase-matching pairs as signal states and later postselects on rounds where the global phases are different by less than a small amount. Effectively, by allowing some errors, Alice and Bob assume that they have chosen the same phase-matching pair when the difference in their global phases is small. This protocol also has an assignment of basis choice for each round in order to apply a BB84-type security argument. Unlike the original TF-QKD protocol, this protocol uses a mixture of photon number states as test states. The security analysis applies the standard decoy state methods and shows O(√(η)) rate scaling.

  (6) The variation proposed in Ref. <cit.> is also called PM-QKD protocol. It uses exactly one phase-matching pair as signal states and uses a mixture of photon number states as test states. 

  (7) The variation studied in Ref. <cit.> is referred as a TF-QKD type protocol. This variation essentially is the same as in Ref. <cit.>. It uses exactly one phase-matching pair as signal states and uses a mixture of photon number states as test states. These two works differ by the security proof methods. 

  (8) In this paper, we propose a modified PM-MDI QKD protocol. Our protocol uses exactly one phase-matching pair as signal states and infinitely many different coherent states (without phase randomization) as test states. Our security analysis does not use the standard decoy state method since our test states are not mixtures of photon number states. We rely on the tomographic reconstruction of POVM elements using the coherent states as test states to prove the security. 



In the end, we remark on the advantages of different types of test states. Phase-randomized weak coherent state sources are used to approximate single-photon sources and test states of this type are used to estimate the single-photon contribution. Using a mixture of photon number states as test states allows the standard decoy state analysis, which has been investigated and well understood. In addition, using a small number of decoy states <cit.> as test states has been investigated in many other protocols and might be readily adapted to some variations of PM-MDI QKD protocol. On the other hand, using non-phase-randomized coherent states as test states, we directly use properties of coherent states, that is, they are overcomplete and non-orthogonal to each other. Test states of this type have the potential to give tighter key rates, as we will demonstrate in this paper when using infinitely many coherent states. Also, no phase randomization is required in the experimental implementations. 



§ SECURITY PROOF

To prove the security of a QKD protocol, the ultimate goal is to provide a full security proof following the ϵ-security definition of QKD <cit.> in the framework of universal composability. Currently, there are well-developed techniques to simplify the problem, such as, the quantum de Finetti theorem <cit.>, so-called postselection technique <cit.>, and the entropy accumulation theorem <cit.>. These techniques allow us to prove the security in a two-step procedure. In the first step, we prove the security against collective attacks in the infinite key scenario, and in the second step we apply one of the mentioned techniques to extend the analysis to a full security proof against general attacks, including finite-size effects. The scope of this paper is to prove the first step, namely the analysis of the collective attack in the infinite key limit. We leave technical details of the extension to the full security for the future work. 


To prove the security of this protocol against collective attacks, we first apply the source-replacement scheme <cit.> to both Alice and Bob's sources and convert this protocol to its equivalent entanglement-based protocol. Then we proceed to prove the security of the entanglement-based version by evaluating the secret key generation rate. 





 §.§ Source-replacement scheme

For the purpose of clarifying notations, let us start with a more abstract view of the protocol. In each round, Alice chooses a state from the set of possible signal states {|φ_x⟩} according to a priori probability distribution {p_x} and similarly, Bob chooses a state from the same set {|φ_y⟩} with a priori probability distribution {q_y}. Then in the source-replacement scheme, Alice and Bob's sources effectively prepare the following state 

    |Ψ⟩_ABA'B'
    
    =   (∑_x√(p_x)|x⟩_A|φ_x⟩_A') ⊗(∑_y√(q_y)|y⟩_B|φ_y⟩_B') 
     
    =   ∑_x,y√(p_x q_y)|x,y⟩_AB|φ_x, φ_y⟩_A'B',

where the register A records the choices of states prepared in the register A' and similarly the register B records the choices of states in the register B'. We introduce an orthonormal basis {|x⟩_A} for the register system A corresponding to states {|φ_x⟩}, and an orthonormal basis {|y⟩_B} for the register system B corresponding to states {|φ_y⟩}. It is crucial that Eve has no access to the registers A and B. Then, Alice keeps the register A and sends the system A' to Charlie, and similarly, Bob keeps B and sends B'. To learn their choices of states sent to Charlie for each round, Alice performs a local measurement described by a positive-operator valued measure (POVM) M_A={xx} on her register A and likewise, Bob applies his POVM M_B={yy} to his register B. 


Importantly, we only apply the source-replacement scheme for the signal states in the key-generation mode since the test states in the test mode are only used to put constraints on how Eve acts in the subspace spanned by signal states. We denote the set of signal states in the key-generation mode as 𝒮, that is, 

    𝒮 =   {|+√(μ),+√(μ)⟩,   |-√(μ),-√(μ)⟩, 
        |+√(μ),-√(μ)⟩,   |-√(μ),+√(μ)⟩},

where each state is a two-mode coherent state coming from both Alice and Bob, and we dropped the subscript A'B' for the ease of writing. Since finitely many coherent states are linearly independent, we want to point out that 𝒮 is indeed a basis of (𝒮). 







 §.§ Description of Eve's attack

As an MDI QKD protocol, Eve has a full control of both the quantum channels connecting Alice, Bob and the intermediate node Charlie, and the measurement devices at the intermediate node. Since measurement devices are neither characterized nor trusted, Eve is assumed to play the role of Charlie to perform the measurement. Therefore, in the PM-MDI QKD protocol, we can view the protocol in an alternative and equivalent picture, as shown in Fig. *fig:scheme_b. In order to make an announcement strategy, Eve performs some measurement, which can be described by a POVM F, directly on the states from Alice and Bob in the registers A' and B'. Moreover, without loss of generality, we can assume that F only has four elements since only {+,-,?,d} outcomes are meaningful for Alice and Bob, and all other outcomes are simply discarded in the protocol. (Even though Alice and Bob may only keep {+,-} outcomes to distill keys, we are allowed to include {?, d} outcomes for parameter estimation.)  We write this POVM F as F={F^+, F^-,F^?, F^d}, or abbreviate it as {F^γ} for γ∈{+,-,?,d}. The probability of announcing the outcome γ is (F^γσ_A'B') for an input state σ_A'B'. 


From Alice and Bob's point of view, they can only know the probability of each announcement, not the post-measurement states in Eve's hand. They can infer what POVM F that Eve applied from their observed correlations. However, Eve can perform a nondestructive measurement and keep her post-measurement states for further analysis. That is, Eve applies a completely positive trace-preserving (CPTP) map ℰ_A'B' → EC on the input quantum states in the registers A' and B'. Her announcement about the measurement outcome is stored in the classical register C and she keeps the postmeasurement state in the register E. Here, we introduce an orthonormal basis {|γ⟩} for the register C, each of which corresponds to every possible announcement outcome. In general, we can write ℰ_A'B' → EC as follows:

    ℰ_A'B' → EC (X) =∑_γℰ_γ (X) ⊗γγ_C,

where each ℰ_γ is a completely positive trace non-increasing map and X is an arbitrary linear operator on the systems A'B'. 

In the Choi-Kraus representation, each ℰ_γ can be written as

    ℰ_γ(X) = ∑_j ∈ℐ(γ) K_j^γ X (K_j^γ)^†,

with ∑_j  (K_j^γ)^†K_j^γ = F^γ and the summation going over some index set ℐ(γ) that depends on γ.  Without loss of generality we can use maps ℰ_γ(X) with a single Kraus operator K^γ = √(F^γ). The reason for this is that the general case of Eqs. (<ref>) and (<ref>) can be represented as a concatenation of two maps, the first one using the case of K^γ = √(F^γ), followed by a second channel operation that is conditioned on the classical register C and uses Kraus operators K̃_j^γ = K_j^γ (F^γ)^-1/2. To see this, we need only to verify two things: (a) the concatenation of both operations gives the general form and (b) the Kraus operators K̃_j^γ for each value of γ define a valid CPTP map. The proof of (a) is trivial, and for (b) we need only to verify that ∑_j ∈ℐ_γ(K̃_j^γ)^†K̃_j^γ = 1_γ, where 1_γ is the projector onto the support of F^γ and (F^γ)^-1/2 is the corresponding pseudoinverse of √(F^γ). We insert the definition to find

    ∑_j ∈ℐ(γ)   (K̃_j^γ)^†K̃_j^γ
     
    =   ∑_j ∈ℐ(γ)(F^γ)^-1/2(K_j^γ)^† K_j^γ (F^γ)^-1/2
    
    =    (F^γ)^-1/2(  ∑_j ∈ℐ(γ)(K_j^γ)^† K_j^γ) (F^γ)^-1/2
    
    =     (F^γ)^-1/2 F^γ (F^γ)^-1/2
    
    =   1_γ.

Clearly, since the general case can thus be considered as a two-step procedure, where the first step gives rise to the announcement γ and the second step acts only on Eve's conditional states, it can only strengthen Eve's position by not forcing her to do this second step. Without loss of generality, we can thus assume that Eve's optimal strategy performs only the first step.

 
Since we assume the sources are protected, Eve cannot have the access to the registers A and B and cannot modify the states in those registers. Therefore, when Eve directly acts on the state |Ψ⟩_ABA'B' shown in Eq. (<ref>) from the source-replacement scheme, the joint state ρ_ABEC shared by Alice, Bob and Eve along with the classical register C for announcements is as follows:  

    ρ_ABEC   = (1_AB⊗ℰ_A'B' → EC) (ΨΨ_ABA'B') 
       = ∑_x,y,x',y'√(p_x p_x' q_y q_y')x,yx',y'_AB
       ⊗∑_γ  (√(F^γ)φ_x, φ_yφ_x', φ_y'√(F^γ))_E⊗γγ_C.












 §.§ Key rate evaluation with Devetak-Winter formula

To distill keys from ρ_ABEC, Alice and Bob perform measurements using POVMs M_A on the register A and M_B on the register B, respectively. Upon measurements, Alice stores her measurement outcomes in a classical register X and Bob stores his in a classical register Y. Alice then applies a key map that maps her measurement result in the register X to a raw key bit in the register K. We want to point out that the key map step is necessary, but the key map can be trivial, as it is in this PM-MDI QKD protocol. The key map here is an identity map from the register X to the register K. Let 𝒢 denote the effective CPTP map that transforms ρ_ABEC to ρ_KYEC. In the end, we generate keys from the state ρ_KYEC, which has the form

    ρ_KYEC =   𝒢(ρ_ABEC) 
    
    =   ∑_k,y, γ  p(γ) p(k,y|γ) kk_K⊗yy_Y
       ⊗ρ_E^k,y,γ⊗γγ_C,

where ρ_E^k, y, γ is Eve's conditional state conditioned on Alice holding k in the register K, Bob having y in the register Y and the central node announcing γ. Here, p(γ) is a marginal probability of the joint probability distribution p(k, y, γ) and p(k, y |γ) = p(k,y, γ)/p(γ) is a conditional probability. 

Under collective attacks, we can evaluate the secret key generation rate using Devetak-Winter formula <cit.>, which is expressed in terms of a single-copy state ρ_KYEC shared by Alice, Bob and Eve.

As is typical in the MDI protocols, we can choose to generate keys from each announcement outcome γ independently as the announcement is available to all parties. We rewrite ρ_ABEC by defining conditional states of Alice, Bob and Eve conditioned on the announcement outcome γ as 

    ρ_KYE^γ = ∑_k,y  p(k,y|γ) kk_K⊗yy_Y⊗ρ_E^k,y,γ,

and  ρ_KYEC = ∑_γ p(γ) ρ_KYE^γ⊗γγ_C.



We adapt the Devetak-Winter formula to a general case where the error correction is not necessarily performed at the Shannon limit. In that case, the number of secret bits that we can distill from the state ρ_KYE^γ is r(ρ_KYE^γ), which is defined as

    r(ρ_KYE^γ) = max [1-δ_EC^γ - χ (K:E)_ρ_KYE^γ,0],
 
where δ_EC^γ is the amount of information leakage per signal during the error correction step for the rounds corresponding to the announcement outcome γ, and 
    χ (K:E)_ρ_KYE^γ =S(ρ_E^γ) - ∑_k p(k|γ)S(ρ_E^k,γ)

 is the Holevo information, where S(ρ) = -(ρlog_2 ρ) is the von Neumann entropy. The states ρ_E^γ and ρ_E^k,γ are defined as:

    ρ_E^k,γ   :=∑_yp(k, y|γ)/p(k|γ)ρ_E^k, y, γ
        = ∑_y p(y|k,γ) ρ_E^k, y, γ, 
    ρ_E^γ   := ∑_kp(k|γ)ρ_E^k,γ.


In the Shannon limit, we have 1-δ_EC^γ = I(K:Y)_ρ_KYE^γ, where I(K:Y)_ρ_KYE^γ is the classical mutual information, and thus we recover the original Devetak-Winter formula in Eq. (<ref>). Another important observation is that δ_EC^γ is directly determined from the experimentally observed correlations. 

The total number of secret bits that we can distill from the state ρ_KYEC, denoted by r̃(ρ_KYEC), is defined as

    r̃(ρ_KYEC) = ∑_γ p(γ) r(ρ_KYE^γ).


From Eq. (<ref>), we can calculate Eve's conditional states ρ_E^k, y, γ as

    ρ_E^k, y, γ =Θ^γ_k,yΘ^γ_k,y,

where we define 

    |Θ^γ_k,y⟩ =√(F^γ)|φ_k, φ_y⟩/√(⟨φ_k, φ_y|F^γ|φ_k, φ_y⟩).

Then, by substituting Eq. (<ref>) into Eq. (<ref>), we can calculate the conditional states ρ_E^γ and ρ_E^k,γ, and evaluate χ (K:E)_ρ_KYE^γ in Eq. (<ref>) to obtain r(ρ_KYE^γ) in Eq. (<ref>).

From the relation between ρ_ABEC and {F^γ} shown in Eq. (<ref>), we notice that a full knowledge of {F^γ} gives us a full knowledge of ρ_ABEC and thus we can determine the key rate using Eq. (<ref>). However, if we cannot uniquely determine F^γ, then we cannot uniquely determine ρ_ABEC. In that case, we have a set of compatible density operators ρ_ABEC, that is, 𝒞={ρ_ABEC: ρ_ABEC is compatible with experimental observations}. Thus, we need to consider the worst-case scenario by taking the minimum of r̃ over the set 𝒞, or equivalently, over the set 𝒞 =  {ρ_KYEC: ρ_KYEC = 𝒢(ρ_ABEC),  where ρ_ABEC∈𝒞}. 
 
In this situation, the asymptotic key rate R^∞ should be expressed as 

    R^∞   = min_ρ_KYEC∈𝒞r̃(ρ_KYEC)
       =min_ρ_ABEC∈𝒞r̃(𝒢(ρ_ABEC)).



The essential part of the optimization is to optimize the Holevo information χ(K:E) by finding the all possible Eve's conditional states, which are needed to evaluate Eq. (<ref>).  


We remark that most of the discussion so far is general to a generic MDI QKD protocol. In the next section, we will adapt this procedure to our specific PM-MDI QKD protocol. 





 §.§ Determination of Eve's POVM for PM-MDI QKD


As discussed in the previous sections, knowing Eve's POVM elements allows us to calculate the key rate, since the minimization in Eq. (<ref>) is now over a set containing only one element. We will now explain how our choice of test states (coherent states with a continuum of complex amplitudes) allows in principle to determine Eve's POVM elements. 

For simplicity, let us concentrate on the case of testing a measurement device acting on a single mode (rather than the two-mode case of our protocol). Knowing some POVM element F̃ is equivalent to being able to predict the probability p(F̃) of the associated outcome for any input state ρ as p(F̃) = [ ρ F̃]. We can now use the phase-space formalism of quantum mechanics (see, for example, Refs. <cit.>)  where we use the P-function  representation of ρ = ∫ d^2 α   P(α) αα so that we have

    p(F̃) = ∫ d^2 α  P(α)  ⟨α|F̃|α⟩  .

As we see from this equation, knowledge of the function p( F̃ |α) :=⟨α|F̃|α⟩ allows the prediction of p( F̃ ) for all input states for which the P function of the density matrix ρ exists. So testing the measurement device with all possible coherent states |α⟩ and observing the corresponding probabilities p( F̃ |α) is equivalent to knowing F̃. 

Actually, using results from <cit.>, one can reconstruct the operator F̃ explicitly also in cases where the P function of ρ may not exist. Let us go through the arguments directly for the POVM elements F^γ for the outcome γ in the two-mode case. We adapt the Eqs (3.4)-(3.6) from Ref. <cit.> to our scenario. 

By substituting Eqs. (3.4) and (3.6) into Eq. (3.5) from Ref. <cit.>, we obtain a power series for each F^γ as:


    F^γ =∑_n_1,n_2, 
     m_1,m_2=0^∞   (∂_α_1^m_1∂_α_2^m_2∂_α̅_1^n_1∂_α̅_2^n_2⟨α_1,α_2|F^γ|α_1,α_2⟩)|_α_1=0,α_2=0/m_1! m_2! n_1! n_2!
       ×  (a_1^†)^n_1 (a_2^†)^n_2a_1^m_1a_2^m_2,

where  α_1, α_2 and their complex conjugated counterparts α̅_1,α̅_2 are treated as independent variables, and a_1, a_1^†, a_2, a_2^† are the annihilation and creation operators of the two modes. Since F^γ is a POVM element and thus has bounded eigenvalues, such series exist and converge <cit.>. Using the two-mode test states |α_1,α_2⟩ and the associated observed probabilities p(γ|α_1,α_2) =⟨α_1,α_2|F^γ|α_1,α_2⟩ thus uniquely determines F^γ.  



Note that a full description of F^γ as shown above is more than what we actually need since we are only interested in how F^γ acts on the subspace (𝒮), which is only a four-dimensional space.


For this, we need to be able to calculate off-diagonal elements of the form ⟨α_1,α_2|F^γ|β_1,β_2⟩. It is an interesting question of whether we can estimate these elements well enough with just a few number of coherent states. (The diagonal elements are directly accessible.) We present now the handle to attack this question.

We first notice that characterizing F^γ on (𝒮) is equivalent to the question whether the operator β_1, β_2α_1,α_2 can be approximated to arbitrary precision in the Hilbert-Schmidt norm by the discrete diagonal coherent state representation <cit.>:

    β_1, β_2α_1,α_2  = ∑_i=1^∞λ_iω_1^(i),ω_2^(i)ω_1^(i), ω_2^(i),
 
where we use sets of tensor products of coherent states |ω_1^(i),ω_2^(i)⟩  and complex numbers λ_i ∈ℂ. 

Then, we can write ⟨α_1,α_2|F^γ|β_1,β_2⟩ as a sum of observed values ⟨ω_1^(i),ω_2^(i)|F^γ|ω_1^(i),ω_2^(i)⟩ as

    ⟨α_1,α_2|F^γ|β_1,β_2⟩   = (F^γβ_1, β_2α_1,α_2)
       =∑_i=1^∞λ_i ⟨ω_1^(i),ω_2^(i)|F^γ|ω_1^(i),ω_2^(i)⟩.


By appropriate choices of {|ω_1^(i),ω_2^(i)⟩}_i=1^N, we will be able to get a good approximation by terminating the summation at N. From the approximation, we will then determine a set of POVMs compatible with experimental correlations, which is a neighborhood of the POVM that Eve actually performed. When we calculate the key rate in this case, we need to perform the minimization in Eq. (<ref>). In that case, we may apply numerical methods <cit.> to perform the desired optimization. If such an approximation makes this set of compatible POVMs small enough, then the key rate with several choices of test states would be close to the key rate with infinite choices of test states. We leave the detailed analysis of finite choices of test states scenario to the future work.

In Appendix <ref>, we will discuss how to represent F^γ in the four-dimensional subspace (𝒮) after knowing ⟨α_1,α_2|F^γ|β_1,β_2⟩ for |α_1,α_2⟩, |β_1,β_2⟩∈𝒮.



§ SIMULATION

We perform simulations to study the loss scaling of this PM-MDI QKD protocol and also the stability of the protocol. 





 §.§ Loss-only scenario

To show that the key rate of this protocol has a scaling of √(η) with the single-photon transmissivity η between Alice and Bob, we first study the loss-only scenario. We simulate the quantum channel as a lossy channel and we consider the normal situation where Charlie (Eve) performs the measurements so that the observed statistics during the parameter estimation step is compatible with Charlie performing the measurement shown in Fig. *fig:scheme_a. That is, we calculate the POVM F corresponding to the real setup. Our protocol can verify via test states in the test mode that this is the actual POVM performed by Eve in the loss-only scenario. For the purpose of our presentation, we consider a symmetric setup, that is, Charlie is at an equal distance from Alice and Bob, and the loss in each path is the same. For a total transmissivity η between Alice and Bob, each segment has the transmissivity √(η).

In this situation, when Alice sends a coherent state |α_A⟩ and Bob sends a coherent state |α_B⟩ in the same optical mode, the state becomes |√(√(η))α_A, √(√(η))α_B⟩ after the lossy channel. When Charlie performs the measurement on this state, the probability for each announcement outcome γ can be calculated as follows:


    ⟨α_A, α_B| F^+ |α_A, α_B⟩   = (1-e^-√(η)α_A + α_B^2/2)e^-√(η)α_A - α_B^2/2, 
    ⟨α_A, α_B| F^- |α_A, α_B⟩   =  e^-√(η)α_A + α_B^2/2(1-e^-√(η)α_A - α_B^2/2),
    ⟨α_A, α_B| F^? |α_A, α_B⟩   = e^-√(η)α_A + α_B^2/2e^-√(η)α_A - α_B^2/2, 
    ⟨α_A, α_B| F^d |α_A, α_B⟩   = (1-e^-√(η)α_A + α_B^2/2)(1-e^-√(η)α_A - α_B^2/2).



Specifically, the conditional probability of each announcement outcome for each state in the set 𝒮 is summarized in Table <ref>. From this table, we can directly evaluate the classical mutual information I(K:Y) as

    I(K:Y)_ρ_KYE^+    = I(K:Y)_ρ_KYE^-   =1,
    
    I(K:Y)_ρ_KYE^?    = I(K:Y)_ρ_KYE^d   =0.






Clearly, we cannot distill keys from γ = “?" and γ = “d" announcements. Also, we find δ_EC^+ = δ_EC^-=0 since no error correction is needed in this loss-only scenario. Now, we only need to evaluate χ(K:E) for γ = “+" and γ = “-". We first find conditional states ρ_E^k,y,+ and ρ_E^k,y,- defined in Eq. (<ref>). 



As we can notice from Table <ref>, in the loss-only scenario, whenever Alice and Bob prepare coherent states with a π phase difference, Charlie will never announce γ=“+" and whenever they prepare coherent states with the same phase, Charlie will never announce γ=“-". Because p(0,1,+)=p(1,0,+) =0 and p(0,0,-)=p(1,1,-) =0, each of the states ρ_E^k, + and ρ_E^k, - ∀ k ∈{0,1} is a pure state so that S(ρ_E^k, +) = S(ρ_E^k, -) =0. Therefore, we only need to evaluate S(ρ_E^+) and S(ρ_E^-). 



In this loss-only case, 

    ρ_E^+    = 1/2(Θ_0,0^+ + Θ_1,1^+), 
    ρ_E^-    = 1/2(Θ_0,1^- + Θ_1,0^-).


The eigenvalues of ρ_E^+ are 1/2(1±⟨Θ_0,0^+||Θ_1,1^+⟩) and thus S(ρ_E^+) = h(1 - ⟨Θ_0,0^+||Θ_1,1^+⟩/2), where h(x) = -x log_2(x) - (1-x) log_2(1-x) is the binary entropy function. 
Similarly, the eigenvalues of ρ_E^- are 1/2(1±⟨Θ_0,1^-||Θ_1,0^-⟩) and thus S(ρ_E^-) = h(1 - ⟨Θ_0,1^-||Θ_1,0^-⟩/2). 
Using the definition of |Θ_k,y^γ⟩ in Eq. (<ref>), we obtain 


 
    ⟨Θ_0,0^+|Θ_1,1^+⟩   = ⟨+√(μ),+√(μ)|F^+|-√(μ),-√(μ)⟩/√(⟨+√(μ),+√(μ)|F^+|+√(μ),+√(μ)⟩⟨-√(μ),-√(μ)|F^+|-√(μ),-√(μ)⟩), 
    ⟨Θ_0,1^-|Θ_1,0^-⟩   = ⟨+√(μ),-√(μ)|F^-|-√(μ),+√(μ)⟩/√(⟨+√(μ),-√(μ)|F^-|+√(μ),-√(μ)⟩⟨-√(μ),+√(μ)|F^-|-√(μ),+√(μ)⟩).


Thus, we have S(ρ_E^+) = S(ρ_E^-) = h(1-e^-4 μ (1-√(η))e^-2 μ√(η)/2). We provide explicit expressions of F^γ for this loss-only scenario in Sec. <ref> of Appendix <ref>, using which the reader can check the result directly.

Finally, we obtain the expression of secret key generation rate as a function of η and the intensity μ in this loss-only scenario as
 
    R^∞ = (1-e^-2 μ√(η)) [1- h(1-e^-4 μ (1-√(η))e^-2 μ√(η)/2)].


For small values of η, R^∞≈ 2μ (1-h(1-e^-4μ/2)) √(η). When we take the optimal value of μ, which is μ_opt≈ 0.1146, then we find R^∞≈ 0.0714 √(η), thus confirming the rate scaling of R^∞ = O(√(η)).

In Fig. <ref>, the short-dashed line is the asymptotic key rate of this loss-only scenario as a function of the transmission distance L, where we take η = 10^-0.2L/10 and μ is optimized for each distance L. The solid line is the fundamental repeaterless bound -log_2(1-10^-0.2 L/10) <cit.>. This calculation gives an intuitive understanding on how the PM-MDI QKD  can beat the repeaterless key rate bound. We see that this PM-MDI QKD protocol beats the repeaterless bound at around 150 km. Our key rate expression in Eq. (<ref>) is tight for the loss-only scenario. Therefore, we expect this is the loss limit for PM-MDI QKD.






 §.§ Realistic Imperfections

It is of practical interest to study how stable this protocol is in noisy scenarios. In particular, we simulate the scenario with realistic imperfections in experimental devices, including the dark counts of detectors, mode mismatch and phase mismatch, detector inefficiency, and error correction inefficiency. In this section, we briefly introduce sources of imperfections and corresponding simulation parameters, then explain the correlations that Alice and Bob would observe in our simulation model, and finally present the results of our key rate calculation. In Appendix <ref>, we provide more detailed explanations for the physical model of each imperfection. 

For the purpose of presentation, we assume that both detectors have the same detector efficiency η_d and the same dark count probability p_d. We remark that the simulation method described in Appendix <ref> is also applicable to more general situations. 


In the ideal implementation of this protocol, Alice and Bob should prepare coherent states in the same optical mode, that is, with the same spectral, temporal profiles and the same polarization, in order to have single-photon interference at the beam splitter. In reality, since their states may come from different lasers and pass through different optical components before reaching the central node, the modes of their states are not necessarily perfectly matched. Thus, we consider the relative mode mismatch between their states with a simulation parameter V. In our simulation, if without any mode mismatch, the state arriving at the central node from Alice and Bob is supposed to be |α_A,α_B⟩, then with the mode mismatch, the state becomes |α_A,√(V)α_B⟩ in the original mode and |0,√(1-V)α_B⟩ in a second mode. Both modes enter Charlie's devices independently.

Another source of imperfection considered in our simulation model is the phase mismatch. 
In the key-generation mode, Alice and Bob are supposed to prepare states in the set 𝒮, which are coherent states with the same global phase and with the encoding information in the relative phases. In reality, the global phase is not guaranteed to be the same when states reach the detectors. Therefore, we consider the situation where there is a relative phase mismatch between Alice's signal state and Bob's signal state. If without any phase mismatch, the state is supposed to be |α_A,α_B⟩, then due to the phase mismatch, the state is changed to |α_A,α_B e^i δ⟩ with a simulation parameter δ.



Table <ref> lists the choice of parameters in our simulation. In particular, we choose the same values for the efficiency of a detector η_d and the dark count probability of a detector p_d as those used in Ref. <cit.> for the comparison purpose. We also select pessimistic values for the mode mismatch and phase mismatch to demonstrate the feasibility of beating the repeaterless bound with currently available devices.  





We now give the expressions for the probability of each announcement outcome γ given each choice of the input state in terms of the simulation parameters V, δ, η_d, and p_d. We define the total transmissivity as η = η_tη_d^2, where η_t is the channel transmission probability between Alice and Bob.


    ⟨α_A, α_B| F^+ |α_A, α_B⟩   =(1-p_d) (1-ξ_1ξ_2)ξ_2ξ_3 
       +(1-p_d)p_d ξ_1ξ_2^2 ξ_3,
    ⟨α_A, α_B| F^- |α_A, α_B⟩   =  (1-p_d)ξ_1ξ_2 (1-ξ_2ξ_3) 
       + (1-p_d)p_d ξ_1ξ_2^2 ξ_3, 
    ⟨α_A, α_B| F^? |α_A, α_B⟩   = (1-p_d)^2ξ_1ξ_2^2ξ_3,
    ⟨α_A, α_B| F^d |α_A, α_B⟩   = p_d (1-ξ_1ξ_2)ξ_2ξ_3+p_d ξ_1ξ_2 (1-ξ_2ξ_3)
       +p_d^2ξ_1ξ_2^2ξ_3+(1-ξ_1ξ_2)(1-ξ_2ξ_3),

where for the simplicity of writing, we have made the following definitions

    ξ_1   =e^-1/2√(η)α_A + √(V)α_B e^iδ^2,
    ξ_2   =e^-1/2√(η)(1-V)α_B^2, 
    ξ_3   =e^-1/2√(η)α_A - √(V)α_B e^iδ^2.





From Eq. (<ref>), it is straightforward to derive the conditional probability of each announcement outcome given the state in 𝒮. Similar to the loss-only scenario, we also discover that the mutual information I(K:Y) is zero for γ =“ ?  " and γ = “ d  " since the probability of making those announcements is independent from the signal states sent by Alice and Bob in our simulation. Thus, we only generate keys from γ = “+" and γ = “-" outcomes. 

We define error rates e_+ and e_- given the announcement outcome γ = “+" and γ = “-", respectively. 

    e_+   := p(0,1|+)+p(1,0|+) 
       =ζ_2 - (1-p_d)ζ_1ζ_2/ζ_1 + ζ_2 - 2(1-p_d)ζ_1ζ_2, 
    
    e_-   := p(0,0|-)+p(1,1|-)   = e_+,

where we define ζ_1 = e^-√(η)μ (1-√(V)cos(δ)) and ζ_2 =  e^-√(η)μ (1+√(V)cos(δ)).

 

To take the inefficiency of error correction into consideration, we take the following values for δ_EC^+ and δ_EC^-:

    δ_EC^+   =f_EC h(e_+),
    δ_EC^-   = f_EC h(e_-)   =  δ_EC^+,

where f_EC is the efficiency of error correction.


The rest of the task is to find each of ρ_E^k,y,+ and ρ_E^k,y,-. In Appendix <ref>, we give explicit expressions for F in this scenario. Using Eqs. (<ref>) and (<ref>), we can find the four-dimensional representation of each of ρ_E^k,y,+ and ρ_E^k,y,-. We numerically evaluate the Holevo information χ(K:E) for γ = “+" and γ = “-" (even though it is still possible but non-trivial to evaluate χ(K:E) analytically). 

In Fig. <ref>, the long-dashed line shows the result of our simulation. With those experimentally feasible parameters, we see this PM-MDI QKD protocol can still beat the repeaterless bound and this crossover happens at around 250 km. We also compare our results with the key rates from Ref. <cit.> for the same set of experimental parameters. We notice a distinct gap that we attribute to the tomographically complete set of test states and to the fact that our proof technique is tight. Both approaches can provide stronger advantages over the repeaterless bound for less pessimistic experimental parameters.









§ SUMMARY AND OUTLOOK

We have presented a variation of PM-MDI QKD protocol, which uses coherent states (without phase randomization) as test states to probe Eve's attacks and uses exactly one phase-matching pair of coherent states as signal states for key generation. From the tomographical completeness of test states, we can uniquely determine Eve's measurement POVM and then derive Eve's conditional states needed for the direct evaluation of the Devetak-Winter formula (no minimization). We calculate the asymptotic key rate of this PM-MDI QKD protocol against collective attacks in the scenario of infinite choices of test states.  Our analytical key rate formula for the loss-only scenario confirms that the PM-MDI QKD protocol has O(√(η)) scaling, better than O(η) scaling of the fundamental repeaterless bound <cit.>. It also shows the loss limit of PM-MDI QKD. In addition, we simulate the key rate with experimentally feasible parameters (if not even pessimistic), and show that PM-MDI QKD can beat the repeaterless bound between roughly 250 km and 400 km. An interesting question for the future work is whether we can approach this key rate bound by using a few choices of test states. We also presented a possible path to proceed with such an analysis. Such an analysis needs to include the study of optimal choices of test states and the effects on the key rate due to nonunique determination of Eve's POVM. We also believe the generalization of decoy state idea presented in this paper can be useful for other QKD protocols. 


Note added. During the preparation of this paper, we have presented our protocol, proof idea and main results in a conference <cit.>. After our presentation, two other works considering similar protocols were posted on a preprint server <cit.>. In this article, we compared differences among those similar protocols and showed the clear distinction. Our initial idea was conceived independently from these two works and our analysis has already finished before the appearance of these two works. We nevertheless include references to these publications in our paper for the convenience of the readers.



We thank Ashutosh Marwah, Barry Sanders and Kei Nemoto for helpful discussions regarding the tomographic reconstruction of the POVM elements, and Pei Zeng for discussion about the security proof in Ref. <cit.> and for providing data for the key rate curve of PM-QKD in Fig. <ref>. The work has been performed at the Institute for Quantum Computing, University of Waterloo, which is supported by Industry Canada. The research has been supported by NSERC under the Discovery Program, Grant No. 341495. Financial support for this work has been partially provided by Huawei Technologies Canada Co., Ltd.


















































































§ A REPRESENTATION OF EVE'S POVM IN THE SUBSPACE 𝒮

In this Appendix, we will describe how to find a representation of Eve's POVM {F^γ} in an orthonormal basis of the subspace spanned by the signal states, which we previously denoted as (𝒮). When we discuss about the two-mode coherent states |α_A,α_B⟩ prepared by Alice and Bob, for the ease of notation, we write α⃗ = (α_A,α_B) and |α⃗⟩=|α_A,α_B⟩. 

If we are given ⟨α⃗|F^γ|β⃗⟩ for every α⃗ ,β⃗∈𝒮, then the procedure described here allows us to find a four-dimensional representation of F^γ in the subspace (𝒮) and helps us evaluate the von Neumann entropy of Eve's conditional states more straightforwardly. We remark here that the values of ⟨α⃗|F^γ|β⃗⟩ can be determined by test states in the test mode of our protocol, as discussed in Sec. <ref>. For our simulations in Appendix <ref>, we also provide a simulation method to obtain ⟨α⃗|F^γ|β⃗⟩.



Before we proceed, we want to emphasize that the set 𝒮 defined in Eq. (<ref>) is a basis for the subspace (𝒮) and we will use this particular ordering of basis elements in the later discussion.









 §.§ Orthonormal basis decomposition

Since two coherent states {|+√(μ)⟩ , |-√(μ)⟩} span a two-dimensional space, we start with a canonical two-dimensional description of {|+√(μ)⟩ , |-√(μ)⟩}.

    |+√(μ)⟩   = c_0 |e_0⟩ + c_1 |e_1⟩, 
    |-√(μ)⟩   = c_0 |e_0⟩ - c_1 |e_1⟩,

where {|e_0⟩,|e_1⟩} is an orthonormal basis,  c_0^2 +c_1^2 =1 and c_0^2 -c_1^2 = ⟨+√(μ)|-√(μ)⟩. Without loss of generality, we choose c_0 and c_1 to be real numbers by absorbing the complex phases into the definitions of |e_0⟩, |e_1⟩. We remark here that the explicit expressions for |e_0⟩ and |e_1⟩ are irrelevant for our discussion, but a canonical choice of this basis written in the Fock state basis is 

    |e_0⟩   = 1/√(cosh(μ))∑_n=0^∞√(μ)^2n/√((2n)!)|2n⟩,
    |e_1⟩   = 1/√(sinh(μ))∑_n=0^∞√(μ)^2n+1/√((2n+1)!)|2n+1⟩,
 
and with this choice of basis, c_0 = e^-μ/2√(cosh(μ)) and c_1 = e^-μ/2√(sinh(μ)). 

We then obtain a basis for span(𝒮) as ℬ={|e_0,e_0⟩,|e_1,e_1⟩,|e_0, e_1⟩,|e_1,e_0⟩}. We remark that this particular ordering of basis elements is useful for the presentation and later allows us to see the block diagonal structures of some particular POVM elements more straightforwardly. 

We now write out signal states in the set 𝒮 as column vectors in this basis ℬ:

    |+√(μ),+√(μ)⟩   =[  c_0^2;  c_1^2; c_0c_1; c_0c_1 ],    |-√(μ),-√(μ)⟩   =[   c_0^2;   c_1^2; -c_0c_1; -c_0c_1 ], 
    |+√(μ),-√(μ)⟩   =[   c_0^2;  -c_1^2; -c_0c_1;  c_0c_1 ],    |-√(μ),+√(μ)⟩   =[   c_0^2;  -c_1^2;  c_0c_1; -c_0c_1 ].


Once we write out F^γ in the basis ℬ, we can then find Eve's conditional states in the basis ℬ by appropriate multiplications. Then the evaluation of von Neumann entropy of conditional states is straightforward since finding eigenvalues of 4 × 4 matrices is computationally simple.



 §.§ Change of basis matrix
 
Suppose we have determined ⟨α⃗|F^γ|β⃗⟩, where α⃗, β⃗∈𝒮. Now we want to write out F^γ in the basis ℬ. This can be done by a change of basis matrix.

We can write |e⃗_m⟩∈ℬ in the basis 𝒮:

    |e⃗_m⟩ =∑_n A_nm|α⃗_n⟩,

where A_nm is the (n,m) entry of the desired change of basis matrix A and |α⃗_n⟩∈𝒮. 

Similarly, 

    ⟨e⃗_m| =∑_nA̅_nm⟨α⃗_n| = ∑_n(A^†)_mn⟨α⃗_n|,

where A̅_nm is the complex conjugate of A_nm and A^† is the Hermitian conjugate of A.

Combining previous two equations, we have 

    ⟨e⃗_m|F^γ|e⃗_n⟩ = ∑_i,j (A^†)_mj⟨α⃗_j| F^γ|α⃗_i⟩ A_in.


In the ordering of 𝒮 and ℬ, this change of basis matrix A can be expressed as

    A=[    1/4c_0^2    1/4c_1^2  1/4c_0 c_1  1/4c_0 c_1;    1/4c_0^2    1/4c_1^2 -1/4c_0 c_1 -1/4c_0 c_1;    1/4c_0^2   -1/4c_1^2 -1/4c_0 c_1  1/4c_0 c_1;    1/4c_0^2   -1/4c_1^2  1/4c_0 c_1 -1/4c_0 c_1 ],

where c_0 and c_1 are defined from Eq. (<ref>).






§ SIMULATION

 
 
In this section, we explain how to obtain values of ⟨α⃗| F^γ|β⃗⟩ for |α⃗⟩, |β⃗⟩∈𝒮 through simulations. After knowing  ⟨α⃗| F^γ|β⃗⟩, we can then use the results from Appendix <ref>, in particular, Eq. (<ref>), to express F^γ in the basis ℬ and then proceed with the evaluation of key rate. 


To avoid the confusion between our simulation method and experimental execution of the protocol, we remark on how to obtain ⟨α⃗| F^γ|β⃗⟩ in the actual implementation of the protocol. In the parameter estimation step, the values of ⟨α⃗|F^γ|α⃗⟩ for α⃗∈𝒮 are directly obtained from observed correlation. The values of ⟨α⃗|F^γ|β⃗⟩ for α⃗≠β⃗ can be calculated by observed correlation of test states, as explained in Sec. <ref>. 
 


For our simulation, we propagate the input states through our simulated model of imperfections and then apply the POVM of detectors to the final states arriving at the detectors to calculate  ⟨α⃗| F^γ|β⃗⟩.



 §.§ Eve's POVM associated with loss-only scenario

We now consider the loss-only scenario. Here, we simulate the quantum channel as a lossy channel and we consider the normal situation where Charlie (Eve) is honest and performs the measurements shown in Fig. *fig:scheme_a. Namely, we calculate the POVM F corresponding to the real setup with ideal devices at the central node. Our protocol can verify via test states in the test mode that this is the actual Eve's POVM in the loss-only scenario. As mentioned in the main text, for the purpose of presentation, we consider the symmetric setup. For a total single-photon transmissivity η between Alice and Bob, each path has a transmissivity √(η).

In this section, we will label Eve's POVM F^γ associated with the loss-only scenario by adding the subscript “loss". As shown in Fig. (<ref>), we will label the input modes of the beam splitter at the central node as I_A and I_B and the output modes as O_A and O_B, where O_A reaches the detector D_+ and O_B reaches the detector D_-. 


We describe how to obtain ⟨α⃗| F_loss^γ|β⃗⟩. First, Alice and Bob prepare coherent states |α_A⟩_A' and |α_B⟩_B' in the registers A' and B', respectively, and send them to Charlie. After the lossy channel, the state becomes |√(√(η))α_A, √(√(η))α_B⟩_I_AI_B, and Eve has the state |√(1-√(η))α_A, √(1-√(η))α_B⟩_E_AE_B at her disposal.  Then after the beam splitter, the state becomes |√(√(η))α_A+ √(√(η))α_B/√(2),√(√(η))α_A- √(√(η))α_B/√(2)⟩_O_AO_B. We now apply the POVM of the detectors to this state.




The ideal detectors are described by the following POVM:

    Π_ideal^+   = (1_O_A -00_O_A) ⊗00_O_B,
    Π_ideal^-    = 00_O_A⊗ (1_O_B -00_O_B),
    Π_ideal^?   = 00_O_A⊗00_O_B,
    Π_ideal^d    = (1_O_A-00_O_A) ⊗ (1_O_B-00_O_B),

where 1 is the identity operator and |0⟩ is the vacuum state.


Then, for |α⃗⟩ = |α_A,α_B⟩ and |β⃗⟩=|β_A,β_B⟩, we evaluate ⟨α⃗|F_loss^γ|β⃗⟩ as


    ⟨α⃗|F_loss^γ|β⃗⟩ =   ⟨η^1/4(α_A+ α_B)/√(2),η^1/4(α_A- α_B)/√(2)|Π_ideal^γ|η^1/4(β_A+ β_B)/√(2),η^1/4(β_A- β_B)/√(2)⟩⟨√(1-√(η))α_A|√(1-√(η))β_A⟩_E_A
       ×⟨√(1-√(η))α_B|√(1-√(η))β_B⟩_E_B.



Now we have obtained values for ⟨α⃗|F_loss^γ|β⃗⟩ from simulations, and we can then proceed to write F_loss^γ in the basis ℬ by using Eq. (<ref>).

    F_loss^+   = (1-ξ^2) [       1- ξ^2 Ω^2/8c_0^4 1- ξ^2 Ω^2/8c_0^2 c_1^2                       0                       0; 1- ξ^2 Ω^2/8c_0^2 c_1^2       1- ξ^2 Ω^2/8c_1^4                       0                       0;                       0                       0  1+ξ^2 Ω^2/8c_0^2 c_1^2 1+ ξ^2 Ω^2/8c_0^2 c_1^2;                       0                       0 1+ ξ^2 Ω^2/8c_0^2 c_1^2  1+ξ^2 Ω^2/8c_0^2 c_1^2 ],
    
    F_loss^-   = (1-ξ^2) [        1- ξ^2 Ω^2/8c_0^4  -1+ξ^2 Ω^2/8c_0^2 c_1^2                        0                        0;  -1+ξ^2 Ω^2/8c_0^2 c_1^2        1- ξ^2 Ω^2/8c_1^4                        0                        0;                        0                        0   1+ξ^2 Ω^2/8c_0^2 c_1^2  -1-ξ^2 Ω^2/8c_0^2 c_1^2;                        0                        0 -1- ξ^2 Ω^2/8c_0^2 c_1^2   1+ξ^2 Ω^2/8c_0^2 c_1^2 ], 
    
    F_loss^?   = ξ^2 [     (1+Ω)^2/4c_0^4                  0                  0                  0;                  0     (1-Ω)^2/4c_1^4                  0                  0;                  0                  0 1-Ω^2/4c_0^2 c_1^2                  0;                  0                  0                  0 1-Ω^2/4c_0^2 c_1^2 ],
    
    F_loss^d    = 0,

where for the ease of representation, we define Ω = e^-2(1-√(η))μ, and ξ = e^- √(η)μ.  Also, c_0 and c_1 are defined from the decomposition in Eq. (<ref>). By noting that 2c_0^2 = 1 + ξ^2 Ω and 2c_1^2 =  1 - ξ^2 Ω, we can easily check that F_loss^+ +F_loss^- + F_loss^? + F_loss^d = 1. 



 §.§ Models for imperfections

In this section, we consider realistic imperfections in the experimental setup. Specifically, we consider the mode mismatch, phase mismatch, dark counts of detectors and the inefficiency of detectors. In the following, we describe the physical models for those imperfections. 



  §.§.§ Mode mismatch



We consider the mode mismatch with a simulation parameter V. The model of the mode mismatch is that for a coherent state |α⟩_1 in a mode 1, due to the mode mismatch, the state |√(V)α⟩_1 remains in the mode 1 and |√(1-V)α⟩_2 is in the mode 2, which is distinct from the mode 1. To derive values for ⟨α⃗|F^γ|β⃗⟩, we will propagate the input states, similar to the loss-only case. In the place of I_A, I_B, O_A, O_B used in the discussion of loss-only scenario, we will replace them by I_A1, I_B1, O_A1, O_B1 for the initial mode and I_A2, I_B2, O_A2, O_B2 for the additional mode.

Suppose Alice sends |α_A⟩_A' and Bob sends |α_B⟩_B'. Since only the relative mode mismatch between Alice's mode and Bob's mode matters, without loss of generality, we leave the state in the register A' untouched when it reaches I_A1, that is, we have |α_A⟩_I_A1. Due to the mode mismatch, the state |α_B⟩_B' becomes |√(V)α_B⟩_I_B1|√(1-V)α_B⟩_I_B2. Correspondingly, we have the vacuum state in the mode I_A2. To summarize, the state arriving at the beam splitter of Charlie's station due to mode mismatch is |α_A,0⟩_I_A1I_A2|√(V)α_B,√(1-V)α_B⟩_I_B1I_B2. The mode I_A1 interferes with the mode I_B1 and the mode I_A2 interferes with the mode I_B2 independently. We remark here that this parameter V can be made close to 1 with experimentally available compensation systems, for example, see Ref. <cit.> in the setting of MDI protocols. In particular, V≥ 95% is readily achievable. 



  §.§.§ Phase mismatch



Ideally, Alice and Bob should prepare coherent states with the same global phase. We consider the situation where there is a phase mismatch between Alice's signal state and Bob's signal state. For the ideal input state |α_A,α_B⟩_A'B', due to the phase mismatch, the state becomes |α_A,α_B e^i δ⟩_I_AI_B for some δ.  We expect that with an experimentally feasible phase compensation system, the value of δ is typically small. For instance, the continuous-variable QKD experiment in Ref. <cit.> reports a value less than π/60.



  §.§.§ Detector dark count

We now consider dark counts of detectors. For simplicity of our presentation, we model two detectors to have the same dark count probability p_d. It is also straightforward to model the case where two detectors have different dark count probabilities. 

The effect of dark counts can be taken into consideration by modifying the POVM for detectors. Eq. (<ref>) gives the POVM associated with ideal detectors. When the detectors have dark counts, the associated POVM is modified as below

    Π_dark^+ =    (1_O_A -00_O_A)  ⊗ (1-p_d) 00_O_B
       + p_d 00_O_A⊗ (1-p_d) 00_O_B
     =    (1-p_d) Π_ideal^+ + (1-p_d)p_d Π_ideal^?, 
    Π_dark^-  =    (1-p_d) 00_O_A⊗ (1_O_B  -00_O_B )
       +  (1-p_d) 00_O_A⊗ p_d 00_O_B
    
    =     (1-p_d) Π_ideal^- + (1-p_d)p_d Π_ideal^?,  
    Π_dark^? =    (1-p_d)00_O_A⊗ (1-p_d)00_O_B
    
     =    (1-p_d)^2 Π_ideal^?, 
    Π_dark^d  =      (1_O_A -00_O_A) ⊗ p_d00_O_B
        +  p_d 00_O_A⊗ (1_O_B -00_O_B ) 
        + p_d 00_O_A⊗ p_d00_O_B
        + (1_O_A -00_O_A) ⊗ (1_O_B -00_O_B )  
    
     =     p_d Π_ideal^+ + p_d Π_ideal^- + p_d^2 Π_ideal^?+ Π_ideal^d.


Since in our simulation, we propagate the input states through the physical models of imperfections to derive the final states before the detectors and then use the POVM of detectors to derive the values of ⟨α⃗|F^γ|β⃗⟩, the expression of ⟨α⃗|F^γ|β⃗⟩ will have a similar structure as the loss-only case shown in Eq. (<ref>). From this observation, we know that once we obtained the expression of Eve's POVM element F^γ, when we have considered all other imperfections except dark counts, we can then derive the POVM elements including dark counts of detectors by probabilistic mixtures of F^γ, following the same relation as between Π_dark^γ and Π_ideal^γ. 

To illustrate the idea, we give a simple example where we consider the physical channel to be a lossy channel and we want to include dark counts of detectors in our simulation. Since we have derived F^γ_loss in Eq. (<ref>), we can derive the expressions of F^γ_dark corresponding to this simulation as follows:

    F_dark^+    = (1-p_d) F_loss^+ + (1-p_d)p_d F_loss^?, 
    
    F_dark^-    = (1-p_d) F_loss^- + (1-p_d)p_d F_loss^?,  
    
    F_dark^?    = (1-p_d)^2 F_loss^?, 
    
    F_dark^d    =   p_d F_loss^+ + p_d F_loss^- + p_d^2 F_loss^? +F_loss^d.

 



  §.§.§ Detector's efficiency

We take into account that any practical single-photon detector has a limited efficiency. In our simulation method, we can easily modify the POVM of detectors as in Eq. (<ref>), to include the efficiency of each detector separately. However, for simplicity of our presentation, we assume that both detectors have the same efficiency η_d so that we can combine the detector's efficiency and the channel transmittance by redefining the total transmissivity η. Let η_t refer to the single-photon transmission probability of the quantum channel between Alice and Bob. Since both detectors have the same efficiency, we can redefine the total transmissivity η = η_t η_d^2 and use this value of η in the simulation. Then we can still use the POVM of detectors with the perfect efficiency in our simulation.



 §.§ Eve's POVM with those imperfections

As discussed in the previous section, we now take into consideration the mode mismatch with a simulation parameter V, and the phase mismatch with a simulation parameter δ. We consider both detectors have the same detector efficiency η_d and the same dark count probability p_d. 


We will first derive Eve's POVM F^γ_mismatch when we consider both the mode mismatch and the phase mismatch. Then we derive Eve's POVM F^γ_model when we include dark counts of detectors as well. Finally, the effects of detector efficiency is taken into consideration by a redefinition of η.

For an input coherent state |α_A, α_B⟩_A'B', the state after the lossy channels and models for the mode mismatch and phase mismatch becomes |√(√(η))α_A, √(√(η))√(V)α_B e^iδ⟩_I_A1I_B1⊗|0, √(√(η))√(1-V)α_B e^iδ⟩_I_A2 I_B2 and Eve has  |√(1-√(η))α_A, √(1-√(η))α_B⟩_E_AE_B at her disposal. Then, the state arriving at the detectors is |√(√(η))α_A+ √(√(η))√(V)α_Be^iδ/√(2),√(√(η))α_A- √(√(η))√(V)α_Be^iδ/√(2)⟩_O_A1O_B1⊗|√(√(η))√(1-V)α_Be^iδ/√(2),-√(√(η))√(1-V)α_Be^iδ/√(2)⟩_O_A2O_B2.

We now introduce the POVM of the ideal detectors when there are two independent modes entering the detectors due to mode mismatch. 

 
    Π_mismatch^+ =    (1_O_A1O_A2 -0000_O_A1O_A2) ⊗0000_O_B1O_B2,
    Π_mismatch^- =    0000_O_A1O_A2⊗ (1_O_B1O_B2 -0000_O_B1O_B2),
    Π_mismatch^? =    0000_O_A1O_A2⊗0000_O_B1O_B2,
    Π_mismatch^d =    (1_O_A1O_A2-0000_O_A1O_A2)
       ⊗ (1_O_B1O_B2-0000_O_B1O_B2).


Then, for |α⃗⟩ = |α_A,α_B⟩ and |β⃗⟩=|β_A,β_B⟩, we first define


    |α̃_final⟩   =   |η^1/4(α_A+√(V)α_Be^iδ)/√(2), η^1/4√(1-V)α_Be^iδ/√(2),η^1/4(α_A- √(V)α_Be^iδ)/√(2),-η^1/4√(1-V)α_Be^iδ/√(2)⟩_O_A1O_A2O_B1O_B2, 
    |β̃_final⟩   =   |η^1/4(β_A+√(V)β_Be^iδ)/√(2), η^1/4√(1-V)β_Be^iδ/√(2),η^1/4(β_A- √(V)β_Be^iδ)/√(2),-η^1/4√(1-V)β_Be^iδ/√(2)⟩_O_A1O_A2O_B1O_B2.


We evaluate ⟨α⃗|F_mismatch^γ|β⃗⟩ as


    ⟨α⃗|F_mismatch^γ|β⃗⟩   =
    ⟨α̃_final|Π^γ_mismatch|β̃_final⟩⟨√(1-√(η))α_A|√(1-√(η))β_A⟩_E_A⟨√(1-√(η))α_B|√(1-√(η))β_B⟩_E_B,

where η = η_t η_d^2 and η_t = 10^-0.2L/10 for a distance L in km.

Now, we write down F^γ_mismatch in the basis ℬ. For the ease of representation, we define ξ = e^-√(η)μ and Ω = e^-2(1-√(η))μ as before. We then define

    a   =(1-ξ^(1+√(V)cosδ))ξ^(1-√(V)cosδ), 
     b   =(ξ^2(1+√(V)cosδ)-ξ^(1+√(V)cosδ))ξ^(1-√(V)cosδ)Ω^2, 
     
     c   =(ξ^1+i√(V)sinδ -ξ)ξΩ,
     
      d   =(ξ^1-i√(V)sinδ -ξ)ξΩ, 
      
      o   =(1-ξ^(1-√(V)cosδ))ξ^(1+√(V)cosδ),
    
       p   =(ξ^2(1-√(V)cosδ)-ξ^(1-√(V)cosδ))ξ^(1+√(V)cosδ)Ω^2, 
      
       q   = (ξ^1+i√(V)sinδ -ξ) (ξ^1-i√(V)sinδ-ξ)Ω,
    
    m   =(1-ξ^(1+√(V)cosδ))(1-ξ^(1-√(V)cosδ)),
      
    n   =(ξ^2(1+√(V)cosδ)-ξ^(1+√(V)cosδ))(ξ^2(1-√(V)cosδ)-ξ^(1-√(V)cosδ))Ω^2.
 
 
 And, c_0 and c_1 are again defined from the decomposition in Eq. (<ref>). Then we have

    F_mismatch^+   =  [       a+b+2c+2d+o+p/8c_0^4       a+b-o-p/8c_0^2 c_1^2                          0                          0;       a+b-o-p/8c_0^2 c_1^2       a+b-2c-2d+o+p/8c_1^4                          0                          0;                          0                          0       a-b+o-p/8c_0^2 c_1^2 a-b+2c-2d-o+p/8c_0^2 c_1^2;                          0                          0 a-b-2c+2d-o+p/8c_0^2 c_1^2       a-b+o-p/8c_0^2 c_1^2 ],
    
    F_mismatch^-   =  [        a+b+2c+2d+o+p/8c_0^4       -a+b-o-p/8c_0^2 c_1^2                           0                           0;       -a+b-o-p/8c_0^2 c_1^2        a+b-2c-2d+o+p/8c_1^4                           0                           0;                           0                           0        a-b+o-p/8c_0^2 c_1^2 -a-b+2c-2d-o+p/8c_0^2 c_1^2;                           0                           0 -a-b-2c+2d-o+p/8c_0^2 c_1^2        a-b+o-p/8c_0^2 c_1^2 ], 
    
    F_mismatch^?   =ξ^2 [     (1+Ω)^2/4c_0^4                  0                  0                  0;                  0     (1-Ω)^2/4c_1^4                  0                  0;                  0                  0 1-Ω^2/4c_0^2 c_1^2                  0;                  0                  0                  0 1-Ω^2/4c_0^2 c_1^2 ],
    
    F_mismatch^d    = [    m+n+2q/4c_0^4                0                0                0;                0    m+n-2q/4c_1^4                0                0;                0                0 m-n/4c_0^2 c_1^2                0;                0                0                0 m-n/4c_0^2 c_1^2 ].



Finally, Eve's effective POVM corresponding to the mode mismatch, phase mismatch and dark counts of detectors is given as below

    F_model^+    = (1-p_d) F_mismatch^+ + (1-p_d)p_d F_mismatch^?,    F_model^-  = (1-p_d) F_mismatch^- + (1-p_d)p_d F_mismatch^?, 
    
    F_model^?    = (1-p_d)^2 F_mismatch^?,    F_model^d =  p_d F_mismatch^+ + p_d F_mismatch^-+p_d^2 F_mismatch^?  + F_mismatch^d.







apsrev4-1.bst


