PaperlayerView exact revision on arXiv

Source-linked AI summary

Experimental quantum conference key agreement

Massimiliano Proietti, Joseph Ho, Federico Grasselli, Peter Barrow, Mehul Malik, Alessandro Fedrizzi

arXiv:2002.01491v2quant-ph

TL;DR

Pair-wise quantum communication can be inefficient for conference keys, motivating direct key generation from multipartite entanglement. The paper experimentally demonstrates N-BB84 using distributed GHZ states and reports long-distance telecom-fibre transmission with key rates not significantly degraded by fibre transmission.

  • Problem

    Pair-wise quantum key distribution requires multiple keys and classical distillation for multi-user conference keys, while direct multipartite approaches offer an alternative.

    Source: INTRODUCTION · p. 1

  • Method

    The experiment implements N-BB84 by distributing GHZ states to four users, who use Z-basis rounds for raw keys and X-basis rounds for security checks.

    Source: INTRODUCTION · pp. 1–2

  • Results

    Similar noise parameters and asymptotic key rates across fibre arrangements indicate that transmission did not significantly degrade entanglement quality.

    Source: RESULTS · p. 3

  • Takeaways & Limitations

    Direct GHZ-based CKA has a significant (N−1) rate advantage in fully featured quantum networks, although direct transmission scales unfavourably with user number under losses.

    Source: DISCUSSION · p. 4

    Direct GHZ transmission scales unfavourably with the number of users because transmission losses exponentially reduce multi-photon detections.

    Source: DISCUSSION · p. 4

Abstract

from arXiv · show

Quantum networks will provide multi-node entanglement over long distances to enable secure communication on a global scale. Traditional quantum communication protocols consume pair-wise entanglement, which is sub-optimal for distributed tasks involving more than two users. Here we demonstrate quantum conference key agreement, a quantum communication protocol that exploits multi-partite entanglement to efficiently create identical keys between N users with up to N-1 rate advantage in constrained networks. We distribute four-photon Greenberger-Horne-Zeilinger (GHZ) states generated by high-brightness, telecom photon-pair sources across up to 50 km of fibre, implementing multi-user error correction and privacy amplification on resulting raw keys. Under finite-key analysis, we establish $1.15\times10^6$ bits of secure key, which are used to encrypt and securely share an image between the four users in a conference transmission. We have demonstrated a new protocol tailored for multi-node networks leveraging low-noise, long-distance transmission of GHZ states that will pave the way forward for future multiparty quantum information processing applications.

INTRODUCTION

Conference key agreement shares one information-theoretically secure key among multiple users, while quantum CKA derives it directly from multipartite entanglement. This section introduces the N-BB84 protocol, in which Z-basis rounds form the raw key and X-basis rounds test security.

INTRODUCTION

  • Quantum CKA derives conference keys directly from multipartite entangled states, while pair-wise QKD requires N−1 keys and classical distillation.In true quantum networks, GHZ states can be distilled from a graph state in one network use, whereas pair-wise QKD may require up to N−1 copies.Source: INTRODUCTION · p. 1
  • The experiment demonstrates the N-BB84 protocol with a photonic platform, distributing maximally entangled GHZ states to four participants.The four users are Alice and Bob 1, Bob 2, and Bob 3.Source: INTRODUCTION · p. 1
  • Z-basis type-1 rounds form the raw key, while randomly selected X-basis type-2 rounds detect eavesdropping.Users coordinate measurement choices with L·h(p) pre-shared bits; p is typically about 0.02.Source: INTRODUCTION · p. 1
  • Users reveal a random subset of type-1 outcomes and all type-2 outcomes for parameter estimation and security checks.The protocol defines QBER from the observed error rates.Source: INTRODUCTION · p. 2
  • After retaining n = L − 2m raw-key bits, users apply error correction and privacy amplification, then remove bits for the pre-shared measurement-type key.This key-growing routine reserves L·h(p) bits for subsequent protocols.Source: INTRODUCTION · p. 2

RESULTS

The experiment evaluates asymptotic conference-key rates across fibre arrangements and implements finite-key post-processing in an asymmetric network. It establishes a secure conference key and uses part of it to encrypt an image for the four users.

RESULTS

  • Across four fibre arrangements with measured losses of 0, 4.84, 7.57, and 11.77 dB, four-photon generation rates were 40.89, 12.68, 6.31, and 2.03 Hz, respectively.The conference key rate is the fractional asymptotic key rate multiplied by the recorded generation rate.Source: RESULTS · p. 2, Figure 2 · p. 3
  • Similar noise parameters and asymptotic key rates across fibre arrangements indicate that transmission did not significantly degrade entanglement quality.The experimental asymptotic key rate was mainly limited by multiple-pair generation and photon spectral impurities.Source: RESULTS · p. 3
  • The complete protocol, including error correction and privacy amplification, was implemented over the asymmetric {5, 10, 20} km fibre network with 9.53 dB total loss.Finite-key analysis was needed because of the low rates; the chosen type-2 measurement fraction was p = 0.012.Source: RESULTS · p. 3
  • 1.15 × 10^6 bits of ϵtot-secure conference key were generated, and 1.06 × 10^6 bits encrypted an image for the three Bobs to decode.The image was sent over a public channel using a one-time-pad-like scheme.Source: Figure 3 · p. 3
  • Post-processing used multi-party LDPC error correction and Toeplitz-matrix privacy amplification to produce a common, shortened key.Finite-data error correction used the fraction of parity bits disclosed by Alice instead of the Shannon-limit term.Source: RESULTS · p. 4

DISCUSSION

The discussion considers protocol choices, security assumptions, network-rate questions, and future applications. It notes both the loss-related scaling challenge of direct GHZ transmission and the potential rate advantage in fully featured quantum networks.

DISCUSSION

  • N-BB84 was chosen for experimental friendliness and higher rates for short keys; alternatives based on twin-field and phase-matching protocols require a shared phase reference.The authors note that establishing a common reference across all users will be challenging in a network.Source: DISCUSSION · p. 4
  • The security approach allows an untrusted GHZ source and untrusted Bob devices, but trusts Alice’s measurement device and assumes memoryless devices with basis-independent detector efficiencies.Full measurement-device independence for QCKA remains in progress.Source: DISCUSSION · p. 4
  • Direct GHZ transmission scales unfavourably with user number because transmission losses exponentially reduce multi-photon detections.The authors expect loss not to be a problem in fully featured quantum networks, where CKA has a significant (N−1) rate advantage.Source: DISCUSSION · p. 4
  • General rate bounds for conference networks with nontrivial connectivity and noise have only recently been established, leaving achievable rates an open question.The point-to-point repeaterless bound does not apply to this four-user common-server scenario.Source: DISCUSSION · p. 4
  • Pair-wise QKD’s conversion of N−1 keys into a conference key incurs a composable security penalty that lowers the final key rate.To obtain an ϵ-secure conference key, each pair-wise key must be processed to a security threshold of ϵ/(N−1).Source: DISCUSSION · p. 4
  • Future experimental work is directed toward increasing GHZ rates, adding conference parties, and field tests in established fibre networks.Other cited multiparty applications include remote clock synchronization, quantum secret sharing, and GHZ-based repeater protocols.Source: DISCUSSION · p. 4

Entangled photon source

The experiment combines two telecom photon-pair sources to create four-photon GHZ states by interference and post-selection. The sources and resulting state are characterized by their brightness, entanglement, visibility, purity, and fidelity.

Entangled photon source

  • Each source has typical two-photon Bell-state fidelity F = 95.58 ± 0.15%, purity P = 92.07 ± 0.27%, and concurrence C = 92.38 ± 0.21%.Average source brightness is ∼4100 pairs/mW/s with loose 3 nm bandpass filters.Source: Entangled photon source · p. 5
  • The four-photon GHZ state is created by interfering one photon from each source on a polarising beamsplitter and post-selecting one photon in each output, with probability 1/2.The sources produce polarisation-entangled photons at 1549.8 nm.Source: Entangled photon source · p. 5
  • Four-qubit tomography measured GHZ-state purity P = 81.39 ± 0.83% and fidelity F = 87.58 ± 0.48%.The measured two-photon interference visibility was 92.96 ± 0.95%.Source: Entangled photon source · p. 5

Active switching

The protocol uses active basis switching because all users share a measurement sequence, and motorised stages reduce the achievable raw generation rate. Active polarisation control compensates fibre-induced rotations, but its feedback loop is not monitored for eavesdropper tampering.

Active switching

  • Motorised rotation stages switch in seconds, marginally slower than required on average, reducing the maximum possible raw generation rate gR.Passive switching is unavailable because all users implement the same measurement sequence; type-2 measurements occur relatively infrequently.Source: Active switching · p. 5
  • The active switching adjustment gives g′R/gR = 0.91 for the {5, 10, 20} topology, with p = 0.02 over 1000 protocol rounds.The lower bound assumes type-2 rounds are never sequential, so each occurrence incurs switching time.Source: Active switching · p. 5

Active polarisation control

  • Fibre-induced polarisation rotations are corrected by tomography-based feedback that estimates each link’s unitary transformation and adjusts motorised waveplates.All four links are measured simultaneously; the procedure takes under 30 seconds and runs about once every 20 minutes.Source: Active polarisation control · pp. 5–6
  • The polarisation-control feedback is unmonitored for tampering, and a clever adversary may exploit it with a time-shift attack variant to control detectors.The text notes local random swapping of which detectors register outcomes as a possible mitigation without additional inter-user communication.Source: Active polarisation control · p. 6

Error correction using LDPC codes

The experiment adapts DVB-S2 LDPC codes to correct all Bobs’ keys using parity information sent by Alice. The finite-key rate accounts for statistical uncertainty and security parameters, while the optimal multi-user error-correction disclosure strategy remains open.

Error correction using LDPC codes

  • Alice sends parity-check bits computed from blocks of k raw bits, and each Bob decodes their key; the disclosed parity bits are discarded from the final conference key.The experiment selects among code rates 2/3, 3/4, and 4/5 according to estimated QBER and block size.Source: Error correction using LDPC codes · p. 6
  • No proof establishes the optimal strategy for minimizing bit disclosure during multi-user QKD error correction, which remains an open question.LDPC disclosure depends on the largest QBER between Alice and any Bob; CASCADE’s bidirectional communication can add overhead and disclosures.Source: Error correction using LDPC codes · p. 6

Finite-key conference rate

  • Finite-round estimates of QX and QBER require statistical corrections in the final key rate, which also accounts for security parameters and removes key used to mark type-2 rounds.The final term is the portion removed after privacy amplification to account for the preshared key used in marking those rounds.Source: Finite-key conference rate · p. 6

Experimental Noise

Experimental noise remains nonzero even at low pump power, with QBER linked mainly to multipair events and QX constrained by GHZ-state coherence and imperfect interference. The measurements show a nonzero QX floor that the simple visibility model treats as an approximate lower bound.

Experimental Noise

  • High-order PDC generations and imperfect PBS mode-matching are the dominant noise sources, although a comprehensive noise model is beyond this work's scope.The ideal protocol state would give QX = 0 and QBER = 0, but experimental values are nonzero.Source: Experimental Noise · p. 7
  • Multipair events introduce measurement noise and lower the overall secret key rate, even though the entanglement-based scheme prevents an eavesdropper from learning the key from those terms without adding noise.The multipair events arise from the probabilistic PDC process.Source: Experimental Noise · p. 7
  • QX remains lower-bounded by 0.05 at zero power, while QBER and QX vary linearly with power and QBER has the steeper slope.The zero-power limit and linear trends apply within the power range considered.Source: Figure S1 · p. 7
  • Reducing pump power raises the signal-to-noise ratio and drives QBER toward zero, but QX retains a floor because spectral mixture limits GHZ coherence and PBS interference.The lower bound is linked to measured visibility; the simple model yields QX ≳ (1 − Vexp)/2, but may not fully characterize coherent PBS interference.Source: Experimental Noise · p. 7

Security parameters in NBB84

The finite-key NBB84 analysis sets the privacy-amplification output length to secure the key with a chosen total security parameter, accounting for estimation uncertainty between sampled and key-generating rounds. In the experiment, the EC and PA failure probabilities could not be quantitatively verified against their assigned values, although neither procedure failed in the observed instances.

Security parameters in NBB84

  • Finite-round security requires accounting for sampling deviations between parameter-estimation rounds and the rounds used to extract the key.The key length is chosen to preserve security at the stated total security parameter, with worst-case deviations included in the secret-key rate.Source: Security parameters in NBB84 · p. 8
  • The experiment optimized the type-2 fraction and failure probabilities at ϵtot = 1.8×10^-8, obtaining p = 0.012, ϵEC ∼ 10^-13, and ϵPA ∼ 10^-10.The optimized p was used to set the fraction of type-2 measurements during data collection.Source: Security parameters in NBB84 · p. 8
  • The experiment could not verify that EC and PA failure probabilities were below their assigned values, although neither procedure failed in the observed instances.The assigned values were 10^-13 for EC and 10^-10 for PA.Source: Security parameters in NBB84 · p. 8

Topology dependence in a conference key scenario

In a four-user network with depolarising link noise, conference-key error depends on the noise across all links, unlike the local QABi quantities. With total noise fixed, the conference-key rate is highest when noise is symmetrically distributed across the network.

Topology dependence in a conference key scenario

  • The analysis considers four users connected to a common server, with link noise modeled as depolarising channels.Alice’s channel is taken to be noiseless, pA = 0; the text says results are qualitatively the same under this simplification.Source: Topology dependence in a conference… · p. 8
  • QX depends on noise across all channels, whereas each QABi depends only on the noise in Alice’s link to Bi.Both functions reach their global minimum when all channels are noiseless.Source: Topology dependence in a conference… · p. 8
  • For fixed total noise c, the minimum of maxi QABi occurs when pB1 = pB2 = pB3 = c/3.This constrained comparison treats c as the sum of the three Bob-link noise parameters.Source: Topology dependence in a conference… · p. 8
  • At fixed total noise, QX is minimized when pB1 = pB2 = pB3 = c/3, maximizing the conference key rate.For c = 1.5, the plotted function is quite flat near this minimum, so small deviations may have negligible key-rate effects; other noise models remain open for study.Source: Topology dependence in a conference… · pp. 8–9, Figure S2 · p. 9
Loading 2002.01491v2…