## Modeling a measurement-device-independent quantum key distribution system |

Optics Express, Vol. 22, Issue 11, pp. 12716-12736 (2014)

http://dx.doi.org/10.1364/OE.22.012716

Acrobat PDF (4851 KB)

### Abstract

We present a detailed description of a widely applicable mathematical model for quantum key distribution (QKD) systems implementing the measurement-device-independent (MDI) protocol. The model is tested by comparing its predictions with data taken using a proof-of-principle, time-bin qubit-based QKD system in a secure laboratory environment (i.e. in a setting in which eavesdropping can be excluded). The good agreement between the predictions and the experimental data allows the model to be used to optimize mean photon numbers per attenuated laser pulse, which are used to encode quantum bits. This in turn allows optimization of secret key rates of existing MDI-QKD systems, identification of rate-limiting components, and projection of future performance. In addition, we also performed measurements over deployed fiber, showing that our system’s performance is not affected by environment-induced perturbations.

© 2014 Optical Society of America

## 1. Introduction

1. N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, “Quantum cryptography,” Rev. Mod. Phys. **74**, 145–195 (2002). [CrossRef]

2. V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf, M. Dušek, N. Lütkenhaus, and M. Peev, “The security of practical quantum key disitrbution,” Rev. Mod. Phys. **81**, 1301–1350 (2009). [CrossRef]

3. A. Dixon, Z. L. Yuan, J. Dynes, A. W. Sharpe, and A. Shields, “Continuous operation of high bit rate quantum key distribution,” Appl. Phys. Lett. **96**, 161102 (2010). [CrossRef]

4. D. Stucki, N. Walenta, F. Vannel, R. T. Thew, N. Gisin, H. Zbinden, S. Gray, C. R. Towery, and S. Ten, “High rate, long-distance quantum key distribution over 250 km of ultra low loss fibres,” New J. Phys. **11**, 075003 (2009). [CrossRef]

5. T. Schmitt-Manderbach, H. Weier, M. Fürst, R. Ursin, F. Tiefenbacher, T. Scheidl, J. Perdigues, Z. Sodnik, C. Kurtsiefer, J. G. Rarity, A. Zeilinger, and H. Weinfurter, “Experimental demonstration of free-space decoy-state quantum key distribution over 144 km,” Phys. Rev. Lett. , **98**, 010504 (2007). [CrossRef] [PubMed]

6. L. Masanes, S. Pironio, and A. Acín, “Secure device-independent quantum key distribution with causally independent measurement devices,” Nat. Commun. **2**, 238 (2011). [CrossRef] [PubMed]

7. H.-K. Lo, M. Curty, and B. Qi, “Measurement-device-independent quantum key distribution,” Phys. Rev. Lett. **108**, 130503 (2012). [CrossRef] [PubMed]

8. S. L. Braunstein and S. Pirandola, “Side-channel-free quantum key distribution,” Phys. Rev. Lett. **108**, 130502 (2012). [CrossRef] [PubMed]

9. A. Rubenok, J. A. Slater, P. Chan, I. Lucio-Martinez, and W. Tittel, “Real-world two-photon interference and proof-of-principle quantum key distribution immune to detector attacks,” Phys. Rev. Lett. **111**, 130501 (2013). [CrossRef] [PubMed]

9. A. Rubenok, J. A. Slater, P. Chan, I. Lucio-Martinez, and W. Tittel, “Real-world two-photon interference and proof-of-principle quantum key distribution immune to detector attacks,” Phys. Rev. Lett. **111**, 130501 (2013). [CrossRef] [PubMed]

10. Y. Liu, T.-Y. Chen, L.-J. Wang, H. Liang, G.-L. Shentu, J. Wang, K. Cui, H.-L. Yin, N.-L. Liu, L. Li, X. Ma, J. S. Pelc, M. M. Fejer, Q. Zhang, and J.-W. Pan, “Experimental measurement-device-independent quantum key distribution,” Phys. Rev. Lett. **111**, 130502 (2013). [CrossRef] [PubMed]

9. A. Rubenok, J. A. Slater, P. Chan, I. Lucio-Martinez, and W. Tittel, “Real-world two-photon interference and proof-of-principle quantum key distribution immune to detector attacks,” Phys. Rev. Lett. **111**, 130501 (2013). [CrossRef] [PubMed]

## 2. Side-channel attacks

13. G. Brassard, N. Lütkenhaus, T. Mor, and B. Sanders, “Limitation on practical quantum cryptography,” Phys. Rev. Lett. **85**, 1330 (2000). [CrossRef] [PubMed]

14. W. Hwang, “Quantum key distribution with high loss: towards global secure communication,” Phys. Rev. Lett. **91**, 057901 (2003). [CrossRef]

16. X. Wang, “Beating the photon-number-splitting attack in practical quantum cryptography,” Phys. Rev. Lett. **94**, 230503 (2005). [CrossRef] [PubMed]

17. N. Gisin, S. Fasel, B. Kraus, H. Zbinden, and G. Ribordy, “Trojan-horse attacks on quantum-key-distribution systems,” Phys. Rev. A **73**, 022320 (2006). [CrossRef]

17. N. Gisin, S. Fasel, B. Kraus, H. Zbinden, and G. Ribordy, “Trojan-horse attacks on quantum-key-distribution systems,” Phys. Rev. A **73**, 022320 (2006). [CrossRef]

18. C.-H. F. Fung, B. Qi, K. Tamaki, and H.-K. Lo, “Phase-remapping attack in practical quantum key distribution systems,” Phys. Rev. A **75**, 032314 (2007). [CrossRef]

18. C.-H. F. Fung, B. Qi, K. Tamaki, and H.-K. Lo, “Phase-remapping attack in practical quantum key distribution systems,” Phys. Rev. A **75**, 032314 (2007). [CrossRef]

19. A. Lamas-Linares and C. Kurtsiefer, “Breaking a quantum key distribution system through a timing side channel,” Opt. Express **15**, 9388–9393 (2007). [CrossRef] [PubMed]

22. L. Lydersen, C. Wiechers, C. Wittmann, D. Elser, J. Skaar, and V. Makarov, “Hacking commercial quantum cryptography systems by tailored bright illumination,” Nat. Photonics **4**, 686–689 (2010). [CrossRef]

20. Y. Zhao, C.-H. F. Fung, B. Qi, C. Chen, and H.-K. Lo, “Quantum hacking: experimental demonstration of time-shift attack against practical quantum key distribution systems,” Phys. Rev. A , **78**, 042333 (2008). [CrossRef]

20. Y. Zhao, C.-H. F. Fung, B. Qi, C. Chen, and H.-K. Lo, “Quantum hacking: experimental demonstration of time-shift attack against practical quantum key distribution systems,” Phys. Rev. A , **78**, 042333 (2008). [CrossRef]

22. L. Lydersen, C. Wiechers, C. Wittmann, D. Elser, J. Skaar, and V. Makarov, “Hacking commercial quantum cryptography systems by tailored bright illumination,” Nat. Photonics **4**, 686–689 (2010). [CrossRef]

22. L. Lydersen, C. Wiechers, C. Wittmann, D. Elser, J. Skaar, and V. Makarov, “Hacking commercial quantum cryptography systems by tailored bright illumination,” Nat. Photonics **4**, 686–689 (2010). [CrossRef]

24. L. Lydersen, C. Wiechers, C. Wittmann, D. Elser, J. Skaar, and V. Makarov, “Avoiding the blinding attack in QKD,” Nat. Photonics **4**, 801 (2010). [CrossRef]

## 3. The measurement-device-independent quantum key distribution protocol

7. H.-K. Lo, M. Curty, and B. Qi, “Measurement-device-independent quantum key distribution,” Phys. Rev. Lett. **108**, 130503 (2012). [CrossRef] [PubMed]

26. X.-B. Wang, “Three-intensity decoy-state method for device-independent quantum key distribution with basis-dependent errors,” Phys. Rev. A **87**, 012320 (2013). Note that we have corrected a mistake present in Eq. (17). [CrossRef]

7. H.-K. Lo, M. Curty, and B. Qi, “Measurement-device-independent quantum key distribution,” Phys. Rev. Lett. **108**, 130503 (2012). [CrossRef] [PubMed]

*h*

_{2}is the binary entropy function,

*f*indicates the error correction efficiency,

*Q*indicates the gain (the probability of a projection onto |

*ψ*

^{−}〉 per emitted pair of pulses [27]) and

*e*indicates error rates (the ratio of erroneous to total projections onto |

*ψ*

^{−}〉). Furthermore, the superscripts,

*x*or

*z*, denote if gains or error rates are calculated for qubits prepared in the x-or the z-basis, respectively. Similarly, the subscripts,

*μ*and

*σ*, show that the quantity under concern is calculated or measured for pulses with mean photon number

*μ*(sent by Alice) and

*σ*(sent by Bob), respectively. Finally, the subscript 11 indicates quantities stemming from detection events for which the pulses emitted by Alice and Bob contain only one photon each. Note that

*Q*

_{11}and

*e*

_{11}cannot be measured; their values must be bounded using either a decoy state method, or employing qubit tagging [13

13. G. Brassard, N. Lütkenhaus, T. Mor, and B. Sanders, “Limitation on practical quantum cryptography,” Phys. Rev. Lett. **85**, 1330 (2000). [CrossRef] [PubMed]

**108**, 130503 (2012). [CrossRef] [PubMed]

26. X.-B. Wang, “Three-intensity decoy-state method for device-independent quantum key distribution with basis-dependent errors,” Phys. Rev. A **87**, 012320 (2013). Note that we have corrected a mistake present in Eq. (17). [CrossRef]

## 4. The model

28. F. Xu, M. Curty, B. Qi, and H.-K. Lo, “Practical aspects of measurement-device-independent quantum key distribution,” New J. Phys. **15**, 113007 (2013). [CrossRef]

11. T. F. da Silva, D. Vitoreti, G. B. Xavier, G. P. Temporão, and J. P. von der Weid, “Proof-of-principle demonstration of measurement device independent QKD using polarization qubits,” Phys. Rev. A. **88**, 052303 (2013). [CrossRef]

### 4.1. State preparation

*ψ*

^{−}〉 Bell state. We model the probability of a |

*ψ*

^{−}〉 projection for various quantum states of photons emitted by Alice and Bob as a function of the mean photon number per pulse (

*μ*and

*σ*, respectively) and transmission coefficients of the fiber links (

*t*and

_{A}*t*, respectively). We consider photons in qubit states described by: where |0〉 and |1〉 denote orthogonal modes (i.e. early and late temporal modes assuming time-bin qubits), respectively. Note that |

_{B}*ψ*〉 describes any pure state [29] and the presence of the

*m*and

^{x,z}*b*terms in Eq. (2), as opposed to using only one parameter, is motivated by the fact that they model different experimentally characterizable imperfections. In the ideal case,

^{x,z}*m*∈ [0, 1] for photon preparation in the z-basis (in this case, the value of

^{z}*ϕ*is irrelevant),

^{z}*ϕ*∈ [0,

^{x}*π*] for the x-basis, and

*b*= 0 for both bases. Imperfect preparation of photon states is modelled by using non-ideal

^{x,z}*m*,

^{x,z}*ϕ*and

^{x,z}*b*for Alice and Bob. The parameter

^{x,z}*b*is included to represent the background light emitted and modulated by an imperfect source. Furthermore, in principle, the various states generated by Alice and Bob could have differences in other degrees of freedom (i.e. polarization, spectral, spatial, temporal modes). This is not included in Eq. (2), but would be reflected in a reduced quality of the BSM, which will be discussed below.

^{x,z}### 4.2. Conditional probability for projections onto |*ψ*^{−}〉

*ψ*

^{−}〉 occurs if one of the SPDs after Charlie’s 50/50 beam splitter signals a detection in an early time-bin (a narrow time interval centered on the arrival time of photons occupying an early temporal mode) and the other detector signals a detection in a late time-bin (a narrow time-interval centered on the arrival time of photons occupying a late temporal mode). Note that, in the following paragraphs, this is the desired detection pattern we search for when modeling possible interference cases or noise effects. Also, note that we assume that Charlie’s two single-photon detectors have identical properties. A deviation from this approximation does not open a potential security loophole (in contrast to prepare-and-measure and entangled photon based QKD), as all detector side-channel attacks are removed in MDI-QKD.

*ψ*

^{−}〉. The outputs are characterized by the number of photons per output port as well as their joint quantum state. The probabilities for each of the possible outputs to occur can then be calculated based on the inputs to the beam splitter (characterized by the number of photons per input port and their quantum states, as defined in Eq. (2)). Note that for the simple cases of inputs containing zero or one photon (summed over both input modes), we calculate the probabilities leading to the desired detection pattern directly, i.e. without going through the intermediate step of calculating outputs from the beam splitter. Finally, the probability for each input to occur is calculated based on the probability for Alice and Bob to send attenuated light pulses containing exactly

*i*photons, all in a state given by Eq. (2). The probability for a particular input to occur also depends on the transmissions of the quantum channels,

*t*and

_{A}*t*. We note that this model considers up to three photons incident on the beam splitter. This is sufficient as, in the case of heavily attenuated light pulses and lossy transmission, higher order terms do not contribute significantly to projections onto |

_{B}*ψ*

^{−}〉. However, we limit the following description to two photons at most: the extension to three is lengthy but straightforward and follows the methodology presented for two photons.

#### Detector noise

*P*. Detector noise stems from two effects: dark counts and afterpulsing [32

_{n}32. D. Stucki, G. Ribordy, A. Stefanov, H. Zbinden, J. Rarity, and T. Wall, “Photon counting for quantum key distribution with Peltier cooled InGaAs/InP APDs,” J. Mod. Opt. **48**, 1967–1981 (2001). [CrossRef]

*P*. Afterpulsing is an additional noise source produced by the detector as a result of prior detection events. The probability of afterpulsing depends on the total count rate, hence we denote the afterpulsing probability per time-bin as

_{d}*P*, which is a function of the mean photon number per pulse from Alice and Bob (

_{a}*μ*and

*σ*), the transmission of the channels (

*t*and

_{A}*t*) and the efficiency of the detectors (

_{B}*η*) located at Charlie (see below for afterpulse characterization). The total probability of a noise count in a particular time-bin is thus

*P*=

_{n}*P*+

_{d}*P*. All together, we find the probability for generating the detection pattern associated with a projection onto the |

_{a}*ψ*

^{−}〉-state, conditioned on having no photons at the input, specified by “in”, of the beam splitter, to be : Here and henceforward, we have ignored the multiplication factor (1−

*P*) ∼ 1 [30], which indicates the probability that a noise event did not occur in the early time-bin (this is required in order to see a detection during the late time-bin assuming detectors with recovery time larger than the separation between the |0〉 and |1〉 temporal modes). Note that the probability conditioned on having no photons at the inputs of the beam splitter equals the one conditioned on having no photons at the outputs (specified in Eq. (3) by the conditional “out”).

_{n}#### One-photon case

*ψ*

^{−}〉, either the photon must be detected and a noise event must occur in the other detector in the opposite time-bin, or, if the photon is not detected, two noise counts must occur as in Eq. (3). We find where

*η*denotes the probability to detect a photon that occupies an early (late) temporal mode during an early (late) time-bin (we assume

*η*to be the same for both detectors).

#### Two-photon case

*ψ*

^{−}〉 is then

*ψ*

^{−}〉 can now also originate from the detection of both photons. This leads to

*p*(

^{x,z}*i*,

*j*) is proportional to finding photon one before the beam-splitter in temporal mode

*i*and photon two in temporal mode

*j*, where

*i*,

*j*∈ [0, 1]. Finally,

*â*

^{†}(0) and

*â*

^{†}(1) are the creation operators for a photon in the |0〉 or |1〉 state, respectively. Evolving this state through the standard unitary transformation for a lossless, 50/50 beam splitter, described by

*ĉ*

^{†}and

*d̂*

^{†}are the two output modes of the beam splitter), one finds that with probability 1/2 the two photons exit the beam splitter in the same output port (or spatial mode) and with probability 1/2 in different ports. Furthermore, with probability

*b̂*

^{†}is the creation operator for a photon in the second input mode of the beam splitter. One can then evolve the state with the beam splitter unitary described by

*ĉ*

^{†}and

*ê*

^{†}correspond to the same spatial output mode but with distinguishability in another degree of freedom, and similarly for the other spatial output mode described by

*d̂*

^{†}and

*f̂*

^{†}. One finds the same result as for the previous case, described by Eq. (10): The definition reflects that there is no two-photon interference in both cases.

### 4.3. Aggregate probability for projections onto |*ψ*^{−}〉

## 5. Characterizing experimental imperfections

**111**, 130501 (2013). [CrossRef] [PubMed]

*μ*,

*σ*,

*b*and

^{x,z}*m*for Alice and Bob, as well as dark count and afterpulsing probabilities), measurements of phase (required to establish

^{x,z}*ϕ*for Alice and Bob), and visibility measurements. In the following paragraphs we describe the procedures we followed to obtain these parameters from our system.

^{x,z}### 5.1. Our MDI-QKD implementation

**111**, 130501 (2013). [CrossRef] [PubMed]

31. The separation of photons into genuine qubit photons and background photons is somewhat artificial – as a matter of fact, there is no way to distinguish background photons from real photons. As already stated in section 4.1, the distinction is motivated by the need to write down a general expression for all emitted single-photon qubit states using parameters that can be characterized directly through experiments (these measurements are further described below).

**111**, 130501 (2013). [CrossRef] [PubMed]

33. C. K. Hong, Z. Y. Ou, and L. Mandel, “Measurement of subpicosecond time intervals between two photons by interference,” Phys. Rev. Lett. **59**, 2044 (1987). [CrossRef] [PubMed]

*V*= 50% (and not 100% as it would be with single photons) [34

_{max}34. L. Mandel, “Photon interference and correlation effects produced by independent quantum sources,” Phys. Rev. A , **28**, 929 (1983). [CrossRef]

*V*= (47 ± 1), irrespective of whether they were taken with spooled fiber inside the lab, or over deployed fiber.

### 5.2. Time-resolved energy measurements

*P*, of the SPDs (InGaAs-avalanche photodiodes operated in gated Geiger mode [32

_{d}32. D. Stucki, G. Ribordy, A. Stefanov, H. Zbinden, J. Rarity, and T. Wall, “Photon counting for quantum key distribution with Peltier cooled InGaAs/InP APDs,” J. Mod. Opt. **48**, 1967–1981 (2001). [CrossRef]

*b*(per time-bin) for Alice and Bob. Next, we characterize the afterpulsing probability per time-bin,

^{x,z}*P*, by placing the pulses within the gate, and observing the change in count rate in the region of the gate prior to the arrival of the pulse. The afterpulsing model we use to assess

_{a}*P*from these measurements is described below.

_{a}*m*can be calculated by generating all required states and observing the count rates in the two time-bins corresponding to detecting photons generated in early and late temporal modes. Observe that

^{x,z}*m*

^{z=1}for photons generated in state |1〉 (the late temporal mode) is zero, since all counts in the early time-bin are attributed to one of the three sources of background described above. Furthermore, we observed that

*m*

^{z=0}for photons generated in the |0〉 state (the early temporal mode) is smaller than one due to electrical ringing in the signals driving the intensity modulators. Note that, in our implementation, the duration of a temporal mode exceeds the width of a time-bin, i.e. it is possible to detect photons outside a time-bin (see Fig. 3 for a schematical representation). Hence, it will be useful to also define the probability for detecting a photon arriving at any time during a detector gate; we will refer to this quantity as

*η*.The count rate per gate, after having subtracted the rates due to background and detector noise, together with the detection efficiency,

_{gate}*η*(

_{gate}*η*, as well as

_{gate}*η*, have been characterized previously based on the usual procedure [32

32. D. Stucki, G. Ribordy, A. Stefanov, H. Zbinden, J. Rarity, and T. Wall, “Photon counting for quantum key distribution with Peltier cooled InGaAs/InP APDs,” J. Mod. Opt. **48**, 1967–1981 (2001). [CrossRef]

*μ*or

*σ*, respectively). The efficiency coefficient relevant for our model,

*η*, is smaller than

*η*. Finally, we point out that the entire characterization described above was repeated for all experimental configurations investigated (the configurations are detailed in Table 2). We found all parameters to be constant in

_{gate}*μσt*, with the obvious exception of the afterpulsing probability.

_{A}t_{B}### 5.3. Phase measurements

*ϕ*determining the superposition of photons in early and late temporal modes, let us assume for the moment that the lasers at Alice’s and Bob’s emit light at the same frequency. First, we defined the phase of Bob’s |+〉 state to be zero (this can always be done by appropriately defining the time difference between the two temporal modes |0〉 and |1〉). Next, to measure the phase describing any other state (generated by either Alice or Bob) with respect to Bob’s |+〉 state, we sequentially send unattenuated laser pulses encoding the two states through a common reference interferometer. This reference interferometer featured a path-length difference equal to the time-difference between the two temporal modes defining Alices and Bob’s qubits. For the phase measurement of qubit states |+〉 and |−〉 (generate by Alice), and |−〉 generated by Bob), first, the phase of the interferometer was set such that Bob’s |+〉 state generated equal intensities in each output of the interferometer (i.e. the interferometers phase was set to

^{x,z}*π*/4). Thus, sending any of the other three states through the interferometer and comparing the output intensities, we can calculate the phase difference. We note that any frequency difference between Alice’s and Bob’s lasers results in an additional phase difference. Its upper bound for our maximum frequency difference of 10 MHz is denoted by

*ϕ*.

_{freq}### 5.4. Measurements of afterpulsing

*k*= −1, the probability of an afterpulse occuring in gate

*k*is given by

*P*=

_{k}*αp*(1 −

*p*)

*. Thus, if there are no other sources of detection events, the probability of an afterpulse occuring due to a detection event is given by*

^{k}*k*≥

*k*(note that time and the number of gates applied to the detector are proportional). The deadtime can simply be accounted for by starting the above summation at

_{dead}*k*=

*k*rather than

_{dead}*k*= 0. However, for an afterpulse to occur during the

*k*gate following a particular detection event, no other detection events must have occured in prior gates. This leads to the following equation for the probability of an afterpulse per detection event: where: and

^{th}*P*denotes the detector dark count probability per gate (as opposed to per time-bin), and

_{d,gate}*μ*

_{avg}(

*μ*,

*σ*,

*t*,

_{A}*t*) expresses the average number of photons present on the detector during each gate as follows: where

_{B}*b*and

_{A}*b*characterize the amount of background light per gate from Alice and Bob, respectively, and the factor of

_{B}*γ*), either caused by a modulated pulse or background light, nor a detector dark count (

*υ*) in any gate before and including gate

*k*, and not having an afterpulse in any gate before gate

*k*(

*ρ*), followed by an afterpulse in gate

*k*(

*P*). Equation (15) takes into account that afterpulsing within each time-bin is influenced by all detections within each detector gate, and not only those happening within the time-bins that we post-select when acquiring experimental data.

_{k}*P*, for given

_{a,gate}*μ*,

*σ*,

*t*and

_{A}*t*can then be found by multiplying Eq. (15) by the total count rate This equation expresses that afterpulsing can arise from prior afterpulsing, which explains the appearance of

_{B}*P*on both sides of the equation. Equation (18) simplifies to Finally, to extract the afterpulsing probability per time-bin,

_{a,gate}*P*(

_{a}*μ*,

*σ*,

*t*,

_{A}*t*), we note that we found that the distribution of afterpulsing across the gate to be the same as the distribution of dark counts across the gate. Hence, Fitting our afterpulse model to the measured afterpulse probabilities, we find

_{B}*α*= 1.79 × 10

^{−1},

*p*= 2.90 × 10

^{−2}, and

*k*= 20. The fit, along with the measured values, is shown in Fig. 4 as a function of the average number of photons arriving at the detector per gate

_{dead}*μ*

_{avg}(

*μ*,

*σ*,

*t*,

_{A}*t*).

_{B}## 6. Testing the model, and real-world tests

### 6.1. Comparing modelled with actual performance

*e*) and gains (

^{z,x}*Q*) predicted by the model as a function of

^{z,x}*μσt*. The plot includes uncertainties from the measured parameters, leading to a range of values (bands) as opposed to single values. The figure also shows the experimental values of

_{A}t_{B}*e*and

^{z,x}*Q*from our MDI-QKD system in both the laboratory environment and over deployed fiber.

^{z,x}**111**, 130501 (2013). [CrossRef] [PubMed]

**111**, 130501 (2013). [CrossRef] [PubMed]

**111**, 130501 (2013). [CrossRef] [PubMed]

## 7. Optimization of system performance

### 7.1. Decoy-state analysis

26. X.-B. Wang, “Three-intensity decoy-state method for device-independent quantum key distribution with basis-dependent errors,” Phys. Rev. A **87**, 012320 (2013). Note that we have corrected a mistake present in Eq. (17). [CrossRef]

**87**, 012320 (2013). Note that we have corrected a mistake present in Eq. (17). [CrossRef]

*μ*,

_{s}*μ*, and

_{d}*μ*, respectively, for Alice, and, similarly, as

_{v}*σ*,

_{s}*σ*, and

_{d}*σ*for Bob. Note that

_{v}*μ*=

_{v}*σ*= 0 by definition. This decoy analysis assumes that perfect vacuum intensities are achievable, which may not be correct in an experimental implementation. However, note that, first, intensity modulators with more than 50 dB extinction ratio exist, which allows obtaining almost zero vacuum intensity, and second, that a similar decoy state analysis with non-zero vacuum intensity values is possible as well [28

_{v}28. F. Xu, M. Curty, B. Qi, and H.-K. Lo, “Practical aspects of measurement-device-independent quantum key distribution,” New J. Phys. **15**, 113007 (2013). [CrossRef]

*t*=

_{A}*t*≡

_{B}*t*), according to our experimental configuration, and Alice and Bob hence both select the same mean photon numbers for each of the three intensities (that is

*μ*=

_{s}*σ*≡

_{s}*τ*,

_{s}*μ*=

_{d}*σ*≡

_{d}*τ*, and

_{d}*μ*=

_{v}*σ*≡

_{v}*τ*). Additionally, for compactness of notation, we omit the

_{v}*μ*and

*σ*when describing the gains and error rates (e.g. we write

*(*

_{i}*τ*) denote the probability that a pulse with photon number distribution 𝔻 and mean

*τ*contains exactly

*i*photons, and

### 7.2. Optimization of signal and decoy intensities

*τ*and

_{s}*τ*, respectively). Here we consider its optimization as a function of the total transmission (or distance) between Alice and Bob. We make the assumptions that both the channel between Alice and Charlie and the channel between Bob and Charlie have the same transmission coefficient,

_{d}*t*, and that Alice and Bob use the same signal and decoy intensities. We considered values of

*τ*in the range 0.01 ≤

_{d}*τ*< 0.99 and values of

_{d}*τ*in the range

_{s}*τ*<

_{d}*τ*≤ 1. An exhaustive search computing the secret key rate for an error correction efficiency

_{s}*f*= 1.14 [36

36. M. Sasaki, “Field test of quantum key distribution in the Tokyo QKD network,” Opt. Express , **19**, 10387–10409 (2011). [CrossRef] [PubMed]

*τ*and

_{s}*τ*. For each point, the model described in section 4 is used to compute all the experimentally accessible quantities required to compute secret key rates using the three-intensity decoy state method summarized in Eqs. (21–24).

_{d}*τ*= 0.01 is the optimal decoy intensity. We attribute this to the fact that

_{d}*τ*has a large impact on the tightness of the upper bound on

_{d}*τ*, are attributed to the case in which both parties sent exactly one photon). Fig. 6 shows, as a function of total loss (or distance), the optimum values of the signal state intensity,

_{d}*τ*, and the corresponding secret key rate,

_{s}*S*, for decoy intensities of

*τ*∈ [0.01, 0.05, 0.1], as well as for a perfect decoy state protocol (i.e. using values of

_{d}### 7.3. Rate-limiting components

37. F. Marsili, V. B. Verma, J. A. Stern, S. Harrington, A. E. Lita, T. Gerrits, I. Vayshenker, B. Baek, M. D. Shaw, R. P. Mirin, and S. W. Nam, “Detecting single infrared photons with 93% system efficiency,” Nat. Photonics **7**, 210–214 (2013). [CrossRef]

*μ*= 0.05 are shown in Fig. 7. First, using state-of-the-art SSPDs in [37

_{d}37. F. Marsili, V. B. Verma, J. A. Stern, S. Harrington, A. E. Lita, T. Gerrits, I. Vayshenker, B. Baek, M. D. Shaw, R. P. Mirin, and S. W. Nam, “Detecting single infrared photons with 93% system efficiency,” Nat. Photonics **7**, 210–214 (2013). [CrossRef]

*η*) is improved from 14.5% to 93%, and the dark count probability (

*P*) is reduced by nearly two orders of magnitude. Furthermore, the mechanisms leading to afterpulsing in InGaAs SPDs are not present in SSPDs (that is

_{d}*P*= 0). This improvement results in a drastic increase in the secret key rate and maximum distance as both the probability of projection onto |

_{a}*ψ*

^{−}〉 and the signal-to-noise-ratio are improved significantly. Second, imperfections in the intensity modulation system used to create pulses in our implementation contribute significantly to the observed error rates, particularly in the z-basis. Using commercially-available, state-of-the-art intensity modulators [38] allow suppressing the background light (represented by

*b*in general quantum state given in Eq. (2)) by an additional 10–20 dB, corresponding to an extinction ration of 40 dB. Furthermore, we considered improvements to the driving electronics that reduces ringing in our pulse generation by a factor of 5, bringing the values of

^{x,z}*m*in Eq. (2) closer to the ideal values. As seen in Fig. 7, this provides a modest improvement to the secret key rate, both when applied to our existing implementation, and when applied in conjunction with the SSPDs. Note that in the case of improved detectors and intensity modulation system the optimized

^{x,z}*τ*for small loss (under 10 dB) is likely overestimated due to neglected higher-order terms.

_{s}## 8. Discussion and conclusion

## Acknowledgments

## References and links

1. | N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, “Quantum cryptography,” Rev. Mod. Phys. |

2. | V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf, M. Dušek, N. Lütkenhaus, and M. Peev, “The security of practical quantum key disitrbution,” Rev. Mod. Phys. |

3. | A. Dixon, Z. L. Yuan, J. Dynes, A. W. Sharpe, and A. Shields, “Continuous operation of high bit rate quantum key distribution,” Appl. Phys. Lett. |

4. | D. Stucki, N. Walenta, F. Vannel, R. T. Thew, N. Gisin, H. Zbinden, S. Gray, C. R. Towery, and S. Ten, “High rate, long-distance quantum key distribution over 250 km of ultra low loss fibres,” New J. Phys. |

5. | T. Schmitt-Manderbach, H. Weier, M. Fürst, R. Ursin, F. Tiefenbacher, T. Scheidl, J. Perdigues, Z. Sodnik, C. Kurtsiefer, J. G. Rarity, A. Zeilinger, and H. Weinfurter, “Experimental demonstration of free-space decoy-state quantum key distribution over 144 km,” Phys. Rev. Lett. , |

6. | L. Masanes, S. Pironio, and A. Acín, “Secure device-independent quantum key distribution with causally independent measurement devices,” Nat. Commun. |

7. | H.-K. Lo, M. Curty, and B. Qi, “Measurement-device-independent quantum key distribution,” Phys. Rev. Lett. |

8. | S. L. Braunstein and S. Pirandola, “Side-channel-free quantum key distribution,” Phys. Rev. Lett. |

9. | A. Rubenok, J. A. Slater, P. Chan, I. Lucio-Martinez, and W. Tittel, “Real-world two-photon interference and proof-of-principle quantum key distribution immune to detector attacks,” Phys. Rev. Lett. |

10. | Y. Liu, T.-Y. Chen, L.-J. Wang, H. Liang, G.-L. Shentu, J. Wang, K. Cui, H.-L. Yin, N.-L. Liu, L. Li, X. Ma, J. S. Pelc, M. M. Fejer, Q. Zhang, and J.-W. Pan, “Experimental measurement-device-independent quantum key distribution,” Phys. Rev. Lett. |

11. | T. F. da Silva, D. Vitoreti, G. B. Xavier, G. P. Temporão, and J. P. von der Weid, “Proof-of-principle demonstration of measurement device independent QKD using polarization qubits,” Phys. Rev. A. |

12. | Z. Tang, Z. Liao, F. Xu, B. Qi, L. Qian, and H.-K. Lo, “Experimental demonstration of polarization encoding measurement-device-independent quantum key distribution,” arXiv:1306.6134 [quant-ph]. |

13. | G. Brassard, N. Lütkenhaus, T. Mor, and B. Sanders, “Limitation on practical quantum cryptography,” Phys. Rev. Lett. |

14. | W. Hwang, “Quantum key distribution with high loss: towards global secure communication,” Phys. Rev. Lett. |

15. | H.-K. Lo, X. Ma, and K. Chen, “Decoy state quantum key distribution,” Phys. Rev. Lett. |

16. | X. Wang, “Beating the photon-number-splitting attack in practical quantum cryptography,” Phys. Rev. Lett. |

17. | N. Gisin, S. Fasel, B. Kraus, H. Zbinden, and G. Ribordy, “Trojan-horse attacks on quantum-key-distribution systems,” Phys. Rev. A |

18. | C.-H. F. Fung, B. Qi, K. Tamaki, and H.-K. Lo, “Phase-remapping attack in practical quantum key distribution systems,” Phys. Rev. A |

19. | A. Lamas-Linares and C. Kurtsiefer, “Breaking a quantum key distribution system through a timing side channel,” Opt. Express |

20. | Y. Zhao, C.-H. F. Fung, B. Qi, C. Chen, and H.-K. Lo, “Quantum hacking: experimental demonstration of time-shift attack against practical quantum key distribution systems,” Phys. Rev. A , |

21. | L. Lydersen, C. Wiechers, C. Wittmann, D. Elser, J. Skaar, and V. Makarov, “Thermal blinding of gated detectors in quantum cryptography,” Opt. Express |

22. | L. Lydersen, C. Wiechers, C. Wittmann, D. Elser, J. Skaar, and V. Makarov, “Hacking commercial quantum cryptography systems by tailored bright illumination,” Nat. Photonics |

23. | Z. L. Yuan, J. F. Dynes, and A. J. Shields, “Avoiding the blinding attack in QKD,” Nat. Photonics |

24. | L. Lydersen, C. Wiechers, C. Wittmann, D. Elser, J. Skaar, and V. Makarov, “Avoiding the blinding attack in QKD,” Nat. Photonics |

25. | C. Bennett and G. Brassard, “Quantum cryptography: public key distribution and coin tossing,” Proceedings of IEEE International Conference on Computers Systems and Signal Processing, 175 (1984). |

26. | X.-B. Wang, “Three-intensity decoy-state method for device-independent quantum key distribution with basis-dependent errors,” Phys. Rev. A |

27. | Note that a pulse does not necessarily contain one single photon. In particular, when considering attenuated light pulses, the number of photons in a pulse will, for example, follow the Poissonian distribution. |

28. | F. Xu, M. Curty, B. Qi, and H.-K. Lo, “Practical aspects of measurement-device-independent quantum key distribution,” New J. Phys. |

29. | To the best of our knowledge, this assumption correctly describes all existing experimental implementations. See section 5 for more information. |

30. | Note that this approximation is, in general, not correct. However, in order to obtain the best performance from a QKD implementation, the noise level should be as low as possible, i.e. P |

31. | The separation of photons into genuine qubit photons and background photons is somewhat artificial – as a matter of fact, there is no way to distinguish background photons from real photons. As already stated in section 4.1, the distinction is motivated by the need to write down a general expression for all emitted single-photon qubit states using parameters that can be characterized directly through experiments (these measurements are further described below). |

32. | D. Stucki, G. Ribordy, A. Stefanov, H. Zbinden, J. Rarity, and T. Wall, “Photon counting for quantum key distribution with Peltier cooled InGaAs/InP APDs,” J. Mod. Opt. |

33. | C. K. Hong, Z. Y. Ou, and L. Mandel, “Measurement of subpicosecond time intervals between two photons by interference,” Phys. Rev. Lett. |

34. | L. Mandel, “Photon interference and correlation effects produced by independent quantum sources,” Phys. Rev. A , |

35. | K. Tamaki, H.-K. Lo, C.-H. F. Fung, and B. Qi, “Phase encoding schemes for measurement device independent quantum key distribution and basis-dependent flaw,” arxiv:1111.3413v4 (2013). |

36. | M. Sasaki, “Field test of quantum key distribution in the Tokyo QKD network,” Opt. Express , |

37. | F. Marsili, V. B. Verma, J. A. Stern, S. Harrington, A. E. Lita, T. Gerrits, I. Vayshenker, B. Baek, M. D. Shaw, R. P. Mirin, and S. W. Nam, “Detecting single infrared photons with 93% system efficiency,” Nat. Photonics |

38. | For instance, EOSpace sells intensity modulators with 50 dB extinction ratio. |

**OCIS Codes**

(040.5570) Detectors : Quantum detectors

(060.2330) Fiber optics and optical communications : Fiber optics communications

(270.5565) Quantum optics : Quantum communications

(270.5568) Quantum optics : Quantum cryptography

**ToC Category:**

Quantum Optics

**History**

Original Manuscript: January 13, 2014

Revised Manuscript: March 24, 2014

Manuscript Accepted: March 25, 2014

Published: May 19, 2014

**Citation**

P. Chan, J. A. Slater, I. Lucio-Martinez, A. Rubenok, and W. Tittel, "Modeling a measurement-device-independent quantum key distribution system," Opt. Express **22**, 12716-12736 (2014)

http://www.opticsinfobase.org/oe/abstract.cfm?URI=oe-22-11-12716

Sort: Year | Journal | Reset

### References

- N. Gisin, G. Ribordy, W. Tittel, H. Zbinden, “Quantum cryptography,” Rev. Mod. Phys. 74, 145–195 (2002). [CrossRef]
- V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf, M. Dušek, N. Lütkenhaus, M. Peev, “The security of practical quantum key disitrbution,” Rev. Mod. Phys. 81, 1301–1350 (2009). [CrossRef]
- A. Dixon, Z. L. Yuan, J. Dynes, A. W. Sharpe, A. Shields, “Continuous operation of high bit rate quantum key distribution,” Appl. Phys. Lett. 96, 161102 (2010). [CrossRef]
- D. Stucki, N. Walenta, F. Vannel, R. T. Thew, N. Gisin, H. Zbinden, S. Gray, C. R. Towery, S. Ten, “High rate, long-distance quantum key distribution over 250 km of ultra low loss fibres,” New J. Phys. 11, 075003 (2009). [CrossRef]
- T. Schmitt-Manderbach, H. Weier, M. Fürst, R. Ursin, F. Tiefenbacher, T. Scheidl, J. Perdigues, Z. Sodnik, C. Kurtsiefer, J. G. Rarity, A. Zeilinger, H. Weinfurter, “Experimental demonstration of free-space decoy-state quantum key distribution over 144 km,” Phys. Rev. Lett., 98, 010504 (2007). [CrossRef] [PubMed]
- L. Masanes, S. Pironio, A. Acín, “Secure device-independent quantum key distribution with causally independent measurement devices,” Nat. Commun. 2, 238 (2011). [CrossRef] [PubMed]
- H.-K. Lo, M. Curty, B. Qi, “Measurement-device-independent quantum key distribution,” Phys. Rev. Lett. 108, 130503 (2012). [CrossRef] [PubMed]
- S. L. Braunstein, S. Pirandola, “Side-channel-free quantum key distribution,” Phys. Rev. Lett. 108, 130502 (2012). [CrossRef] [PubMed]
- A. Rubenok, J. A. Slater, P. Chan, I. Lucio-Martinez, W. Tittel, “Real-world two-photon interference and proof-of-principle quantum key distribution immune to detector attacks,” Phys. Rev. Lett. 111, 130501 (2013). [CrossRef] [PubMed]
- Y. Liu, T.-Y. Chen, L.-J. Wang, H. Liang, G.-L. Shentu, J. Wang, K. Cui, H.-L. Yin, N.-L. Liu, L. Li, X. Ma, J. S. Pelc, M. M. Fejer, Q. Zhang, J.-W. Pan, “Experimental measurement-device-independent quantum key distribution,” Phys. Rev. Lett. 111, 130502 (2013). [CrossRef] [PubMed]
- T. F. da Silva, D. Vitoreti, G. B. Xavier, G. P. Temporão, J. P. von der Weid, “Proof-of-principle demonstration of measurement device independent QKD using polarization qubits,” Phys. Rev. A. 88, 052303 (2013). [CrossRef]
- Z. Tang, Z. Liao, F. Xu, B. Qi, L. Qian, H.-K. Lo, “Experimental demonstration of polarization encoding measurement-device-independent quantum key distribution,” arXiv:1306.6134 [quant-ph].
- G. Brassard, N. Lütkenhaus, T. Mor, B. Sanders, “Limitation on practical quantum cryptography,” Phys. Rev. Lett. 85, 1330 (2000). [CrossRef] [PubMed]
- W. Hwang, “Quantum key distribution with high loss: towards global secure communication,” Phys. Rev. Lett. 91, 057901 (2003). [CrossRef]
- H.-K. Lo, X. Ma, K. Chen, “Decoy state quantum key distribution,” Phys. Rev. Lett. 94, 230504 (2005). [CrossRef] [PubMed]
- X. Wang, “Beating the photon-number-splitting attack in practical quantum cryptography,” Phys. Rev. Lett. 94, 230503 (2005). [CrossRef] [PubMed]
- N. Gisin, S. Fasel, B. Kraus, H. Zbinden, G. Ribordy, “Trojan-horse attacks on quantum-key-distribution systems,” Phys. Rev. A 73, 022320 (2006). [CrossRef]
- C.-H. F. Fung, B. Qi, K. Tamaki, H.-K. Lo, “Phase-remapping attack in practical quantum key distribution systems,” Phys. Rev. A 75, 032314 (2007). [CrossRef]
- A. Lamas-Linares, C. Kurtsiefer, “Breaking a quantum key distribution system through a timing side channel,” Opt. Express 15, 9388–9393 (2007). [CrossRef] [PubMed]
- Y. Zhao, C.-H. F. Fung, B. Qi, C. Chen, H.-K. Lo, “Quantum hacking: experimental demonstration of time-shift attack against practical quantum key distribution systems,” Phys. Rev. A, 78, 042333 (2008). [CrossRef]
- L. Lydersen, C. Wiechers, C. Wittmann, D. Elser, J. Skaar, V. Makarov, “Thermal blinding of gated detectors in quantum cryptography,” Opt. Express 18, 27938–27954 (2010). [CrossRef]
- L. Lydersen, C. Wiechers, C. Wittmann, D. Elser, J. Skaar, V. Makarov, “Hacking commercial quantum cryptography systems by tailored bright illumination,” Nat. Photonics 4, 686–689 (2010). [CrossRef]
- Z. L. Yuan, J. F. Dynes, A. J. Shields, “Avoiding the blinding attack in QKD,” Nat. Photonics 4, 800–801 (2010). [CrossRef]
- L. Lydersen, C. Wiechers, C. Wittmann, D. Elser, J. Skaar, V. Makarov, “Avoiding the blinding attack in QKD,” Nat. Photonics 4, 801 (2010). [CrossRef]
- C. Bennett, G. Brassard, “Quantum cryptography: public key distribution and coin tossing,” Proceedings of IEEE International Conference on Computers Systems and Signal Processing, 175 (1984).
- X.-B. Wang, “Three-intensity decoy-state method for device-independent quantum key distribution with basis-dependent errors,” Phys. Rev. A 87, 012320 (2013). Note that we have corrected a mistake present in Eq. (17). [CrossRef]
- Note that a pulse does not necessarily contain one single photon. In particular, when considering attenuated light pulses, the number of photons in a pulse will, for example, follow the Poissonian distribution.
- F. Xu, M. Curty, B. Qi, H.-K. Lo, “Practical aspects of measurement-device-independent quantum key distribution,” New J. Phys. 15, 113007 (2013). [CrossRef]
- To the best of our knowledge, this assumption correctly describes all existing experimental implementations. See section 5 for more information.
- Note that this approximation is, in general, not correct. However, in order to obtain the best performance from a QKD implementation, the noise level should be as low as possible, i.e. Pn∼ 0.
- The separation of photons into genuine qubit photons and background photons is somewhat artificial – as a matter of fact, there is no way to distinguish background photons from real photons. As already stated in section 4.1, the distinction is motivated by the need to write down a general expression for all emitted single-photon qubit states using parameters that can be characterized directly through experiments (these measurements are further described below).
- D. Stucki, G. Ribordy, A. Stefanov, H. Zbinden, J. Rarity, T. Wall, “Photon counting for quantum key distribution with Peltier cooled InGaAs/InP APDs,” J. Mod. Opt. 48, 1967–1981 (2001). [CrossRef]
- C. K. Hong, Z. Y. Ou, L. Mandel, “Measurement of subpicosecond time intervals between two photons by interference,” Phys. Rev. Lett. 59, 2044 (1987). [CrossRef] [PubMed]
- L. Mandel, “Photon interference and correlation effects produced by independent quantum sources,” Phys. Rev. A, 28, 929 (1983). [CrossRef]
- K. Tamaki, H.-K. Lo, C.-H. F. Fung, B. Qi, “Phase encoding schemes for measurement device independent quantum key distribution and basis-dependent flaw,” arxiv:1111.3413v4 (2013).
- M. Sasaki et al., “Field test of quantum key distribution in the Tokyo QKD network,” Opt. Express, 19, 10387–10409 (2011). [CrossRef] [PubMed]
- F. Marsili, V. B. Verma, J. A. Stern, S. Harrington, A. E. Lita, T. Gerrits, I. Vayshenker, B. Baek, M. D. Shaw, R. P. Mirin, S. W. Nam, “Detecting single infrared photons with 93% system efficiency,” Nat. Photonics 7, 210–214 (2013). [CrossRef]
- For instance, EOSpace sells intensity modulators with 50 dB extinction ratio.

## Cited By |
Alert me when this paper is cited |

OSA is able to provide readers links to articles that cite this paper by participating in CrossRef's Cited-By Linking service. CrossRef includes content from more than 3000 publishers and societies. In addition to listing OSA journal articles that cite this paper, citing articles from other participating publishers will also be listed.

OSA is a member of CrossRef.