PaperlayerView exact revision on arXiv

Source-linked AI summary

Simple security analysis of phase-matching measurement-device-independent quantum key distribution

Jie Lin, Norbert Lütkenhaus

arXiv:1807.10202v2quant-ph

TL;DR

Prior PM-MDI security analyses could yield loose bounds and required phase-randomized states, while the protocol family was shown to achieve square-root scaling beyond the repeaterless linear bound. This paper proposes coherent-state tomography and proves security in the infinite-key collective-attack setting; its loss-only analysis confirms square-root scaling and identifies a loss limit.

  • Problem

    Prior PM-MDI security analyses could yield loose key-rate bounds, while the protocol family’s square-root scaling contrasts with the repeaterless bound’s linear scaling.

    Source: §I · p. 1

  • Method

    The protocol uses non-phase-randomized coherent test states to reconstruct Eve’s measurement and derives key rates from her conditional states in an infinite-test-state security analysis.

    Source: §I · p. 2, §V · p. 11

  • Results

    0.0714√η: the optimized loss-only asymptotic key rate, confirming O(√η) scaling and beating the repeaterless bound at around 150 km.

    Source: A. Loss-only scenario · p. 9, §V · p. 11

  • Takeaways & Limitations

    The loss-only key-rate expression is tight, and the paper concludes that it gives the loss limit for PM-MDI QKD.

    Source: A. Loss-only scenario · p. 9, §V · p. 11

    The proof covers collective attacks in the infinite-key limit; extending it to general attacks and finite-size effects is outside the paper’s scope.

    Source: §III · p. 5

Abstract

from arXiv · show

Variations of phase-matching measurement-device-independent quantum key distribution (PM-MDI QKD) protocols have been investigated before, but it was recently discovered that this type of protocol (under the name of twin-field QKD) can beat the linear scaling of the repeaterless bound on secret key rate capacity. We propose a variation of PM-MDI QKD protocol, which reduces the sifting cost and uses non-phase-randomized coherent states as test states. We provide a security proof in the infinite key limit. Our proof is conceptually simple and gives tight key rates. We obtain an analytical key rate formula for the loss-only scenario, confirming the square root scaling and also showing the loss limit. We simulate the key rate for realistic imperfections and show that PM-MDI QKD can overcome the repeaterless bound with currently available technology.

I. INTRODUCTION

The introduction frames PM-MDI QKD as a route to square-root key-rate scaling, beyond the repeaterless bound’s linear scaling, and identifies costly sifting and potentially loose security estimates in prior analyses. The proposed variation uses non-phase-randomized coherent test states and a Renner-framework security analysis, then compares its protocol choices with earlier variants.

I. INTRODUCTION

  • Earlier PM-MDI analyses could give loose key-rate bounds and required phase-randomized signal states, motivating a protocol and proof designed to reduce sifting and tighten the analysis.The proposed proof uses the Renner framework; test states probe attacks while signal states establish keys.Source: §I · p. 1

B. Comparison of different variations of PM-MDI QKD protocols

  • The protocol uses coherent states without phase randomization as test states, exploiting their properties for channel and measurement tomography instead of applying decoy-state analysis.The paper notes that these test states have potential to give tighter key rates and do not require phase randomization in implementation.Source: §I · p. 2, B. Comparison of different variations… · p. 4

A. Description of our protocol

B. Comparison of different variations of PM-MDI QKD protocols

  • Earlier variants differ in their signal and test states: TF-QKD uses infinitely many phase-matching pairs, while other proposals use one pair with photon-number-mixture test states.The comparison describes protocol variations rather than verifying the security analysis of each work.Source: B. Comparison of different variations… · pp. 3–4
  • Unlike TF-QKD, which allows small phase-matching errors and can incur a large sifting cost, this variation uses one phase-matching signal pair and non-phase-randomized coherent test states.Its test states support tomographic reconstruction of Eve’s POVM rather than standard decoy-state analysis.Source: B. Comparison of different variations… · p. 4

III. SECURITY PROOF

The security analysis proves security against collective attacks in the infinite-key limit, using source replacement and a model in which Eve controls the channels and Charlie’s measurement. Test states constrain Eve’s action on the signal-state subspace.

III. SECURITY PROOF

  • The proof covers collective attacks in the infinite-key limit; extending it to general attacks and finite-size effects is left for future work.Source: §III · p. 5

A. Source-replacement scheme

B. Description of Eve’s attack

  • Eve is modeled as controlling the channels and intermediate measurement, represented by a four-outcome POVM whose announcements include outcomes used for parameter estimation.Source: B. Description of Eve’s attack · p. 5
  • Eve’s attack can retain a postmeasurement state while recording its outcome, and each outcome-conditioned operation is a completely positive trace-nonincreasing map.Source: B. Description of Eve’s attack · p. 5
  • Eve’s strategy can be reduced to producing the announcement alone, since an additional outcome-conditioned operation can only strengthen her position.Source: B. Description of Eve’s attack · p. 6

C. Key rate evaluation with Devetak-Winter formula

The key-rate evaluation applies the Devetak–Winter formula to the state shared after key extraction and announcement. When observations do not uniquely determine Eve’s measurement, the rate is minimized over compatible states.

C. Key rate evaluation with Devetak-Winter formula

D. Determination of Eve’s POVM for PM-MDI QKD

Coherent-state test probes can determine Eve’s POVM, while only its action on the four-dimensional signal-state subspace is needed. With finitely many test states, approximation quality remains a condition for rates to approach the infinite-test-state case.

D. Determination of Eve’s POVM for PM-MDI QKD

IV. SIMULATION

The simulations examine the protocol’s loss scaling and stability; in the symmetric loss-only case, the analytical rate confirms square-root scaling and beats the repeaterless bound at about 150 km.

IV. SIMULATION

  • The simulations study both loss scaling and protocol stability.For the loss-only distance curves, µ is optimized at each distance and the rate is compared with the repeaterless bound.Source: §IV · p. 8, A. Loss-only scenario · p. 9

A. Loss-only scenario

  • The loss-only simulation uses a symmetric setup, with each Alice–Charlie and Bob–Charlie segment having transmissivity √η.Test states can verify that Charlie’s measurement is compatible with the simulated POVM in this scenario.Source: A. Loss-only scenario · p. 8
  • R∞≈0.0714√η at µopt≈0.1146 confirms O(√η) scaling; the loss-only protocol beats the repeaterless bound at around 150 km.The authors describe the loss-only key-rate expression as tight and expect it to give the protocol’s loss limit.Source: A. Loss-only scenario · p. 9

B. Realistic Imperfections

With experimentally feasible parameters, the simulated protocol beats the repeaterless bound, with a crossover around 250 km; the section models realistic device imperfections and compares rates with prior PM-QKD results.

B. Realistic Imperfections

  • The noisy-device simulation includes detector dark counts and inefficiency, mode mismatch, phase mismatch, and error-correction inefficiency.The model computes announcement probabilities and numerically evaluates Eve’s Holevo information for the key-generating outcomes.Source: B. Realistic Imperfections · pp. 9–11
  • For presentation, both detectors are assumed to share the same efficiency and dark-count probability; the simulation method also applies to more general cases.Detector parameters match Ref., while pessimistic mode- and phase-mismatch values are chosen to demonstrate feasibility.Source: B. Realistic Imperfections · pp. 9–10
  • The simulation represents mode mismatch by separating the arriving states into a second mode and represents relative phase mismatch with parameter δ.The ideal states share optical modes and global phase; the simulation accounts for departures from those conditions.Source: B. Realistic Imperfections · pp. 9–10
  • With experimentally feasible parameters, the protocol beats the repeaterless bound at a crossover around 250 km; its rate gap over Ref. is attributed to tomographically complete test states and a tight proof.The comparison uses the same set of experimental parameters for both approaches.Source: Figure 2 · p. 10, B. Realistic Imperfections · pp. 10–11

V. SUMMARY AND OUTLOOK

The paper presents a PM-MDI QKD variation with non-phase-randomized coherent test states and a security analysis based on determining Eve’s measurement. It establishes square-root scaling and identifies reducing the number of test states as a future question.

V. SUMMARY AND OUTLOOK

  • The protocol uses non-phase-randomized coherent states as test states and one phase-matching pair as key-generation signals.Tomographically complete tests determine Eve’s POVM and conditional states for direct Devetak–Winter evaluation, without minimization.Source: §V · p. 11
  • The infinite-test-state analysis against collective attacks gives O(√η) scaling in the loss-only case and shows the protocol’s loss limit.The paper reports that experimentally feasible, possibly pessimistic, parameters allow beating the repeaterless bound between roughly 250 km and 400 km.Source: §V · p. 11
  • Whether a few test-state choices can approach the rate bound remains open; the analysis would need to study optimal choices and nonunique Eve POVMs.The authors also suggest that their generalization of the decoy-state idea may be useful for other QKD protocols.Source: §V · p. 11
  • Two similar works, Refs. [21] [22], appeared after the authors had presented their protocol and completed their analysis independently.The paper says it includes those references to distinguish the approaches and for readers’ convenience.Source: §V · p. 11

Appendix A: A REPRESENTATION OF EVE’S POVM IN THE SUBSPACE S

Appendix A represents Eve’s POVM in a four-dimensional orthonormal basis for the signal-state subspace. It uses a change-of-basis matrix to convert matrix elements determined from test states into that representation.

Appendix A: A REPRESENTATION OF EVE’S POVM IN THE SUBSPACE S

  • Given ⟨α|Fγ|β⟩ for α, β in S, the procedure constructs a four-dimensional representation of Eve’s POVM in span(S), supporting evaluation of Eve’s conditional-state entropies.The test mode can determine these matrix elements; the simulations also provide a way to obtain them.Source: Appendix A · p. 11

1. Orthonormal basis decomposition

  • A basis for span(S) is B = {|e0, e0⟩, |e1, e1⟩, |e0, e1⟩, |e1, e0⟩}; this ordering aids presentation and makes some POVM elements’ block-diagonal structures more straightforward to see.Writing F γ in B yields Eve’s conditional states by appropriate multiplications; evaluating their von Neumann entropies is straightforward because eigenvalues of 4 × 4 matrices are computationally simple.Source: §1 · p. 12

2. Change of basis matrix

  • A change-of-basis matrix converts Eve’s POVM from its matrix elements on S to its representation in basis B.The figure labels the beam-splitter input and output modes used in the loss-only discussion.Source: §2 · p. 12, Figure 3 · p. 12

Appendix B: SIMULATION

Appendix B derives Eve’s POVM matrix elements for simulation and explains how observed correlations provide the corresponding values in protocol implementation. For the loss-only case, it models a symmetric lossy channel and an ideal central-node measurement.

Appendix B: SIMULATION

  • The simulation propagates input states through modeled imperfections, applies the detector POVM, and uses the resulting matrix elements to express Eve’s POVM in basis B.In protocol implementation, diagonal elements come from observed correlations, while off-diagonal elements are calculated from test-state correlations.Source: Appendix B · p. 12

1. Eve’s POVM associated with loss-only scenario

  • For loss-only analysis, the model assumes an honest Charlie using the ideal central-node setup and a symmetric channel with each path transmissivity √η.The protocol can verify the actual POVM through test states in test mode.Source: §1 · p. 13
  • The loss-only simulation propagates the input states through the channel and central beam splitter, then applies the detector POVM to obtain Eve’s POVM matrix elements.The beam-splitter input and output modes are labeled IA, IB and OA, OB; the latter reach D+ and D−, respectively.Source: §1 · p. 13

2. Models for imperfections

The simulations model mode mismatch, phase mismatch, and detector dark counts as experimental imperfections. The treatment specifies how these affect the input modes or detector POVM.

2. Models for imperfections

  • The section’s imperfection models cover mode mismatch, phase mismatch, and detector dark counts.The simulations propagate states through the modeled imperfections before applying the detector POVM.Source: §2 · p. 13

a. Mode mismatch

  • Mode mismatch is modeled with parameter V by splitting the mismatched state across modes; the two mode pairs interfere independently, and V ≥95% is readily achievable.The passage notes experimentally available compensation systems as a way to bring V close to 1.Source: a. Mode mismatch · pp. 13–14

b. Phase mismatch

  • Phase mismatch is represented by δ between Alice’s and Bob’s signal states; an experimentally feasible compensation system is expected to keep δ small.The ideal input states are described as having the same global phase.Source: b. Phase mismatch · p. 14

c. Detector dark count

  • The dark-count model assigns both detectors the same probability pd for simplicity, while allowing different probabilities as a straightforward extension.Dark counts are incorporated by modifying the detector POVM, and the resulting Eve POVM can be formed by probabilistic mixtures of the no-dark-count elements.Source: c. Detector dark count · p. 14

d. Detector’s efficiency

The simulation accounts for detector inefficiency by modifying detector POVMs, with equal detector efficiencies absorbed into the total transmissivity.

d. Detector’s efficiency

  • Detector efficiencies can be included separately by modifying the detector POVM.For simplicity, the presentation assumes both detectors have efficiency ηd.Source: d. Detector’s efficiency · p. 14
  • The equal-efficiency assumption combines detector efficiency with channel transmissivity rather than modeling the two factors separately.The passage specifies this simplification for the presentation.Source: d. Detector’s efficiency · pp. 14–15
  • With equal detector efficiencies, the simulation redefines total transmissivity as η = ηtη2_d and then uses perfect-efficiency detector POVMs.Here ηt is the channel’s single-photon transmission probability between Alice and Bob.Source: d. Detector’s efficiency · pp. 14–15

3. Eve’s POVM with those imperfections

The combined model derives Eve’s effective POVM for mode mismatch, phase mismatch, and dark counts, while accounting for detector efficiency through a redefinition of η.

3. Eve’s POVM with those imperfections

  • The combined simulation assumes matching detector efficiencies ηd and dark-count probabilities pd, alongside mode-mismatch parameter V and phase-mismatch parameter δ.It derives the effective POVM after modeling the input state through the lossy channels and mismatch effects.Source: §3 · p. 15
  • The model combines mode and phase mismatch to derive Eve’s POVM, then includes detector dark counts in that model.Detector efficiency is incorporated by redefining η.Source: §3 · pp. 15–16
  • For mode mismatch, the detector model treats the two independent modes entering the detectors with an ideal-detector POVM.The passage introduces that POVM before defining the associated matrix elements.Source: §3 · p. 15

Related papers

Loading 1807.10202v2…