OSA's Digital Library

Optics Express

Optics Express

  • Editor: Andrew M. Weiner
  • Vol. 22, Iss. 11 — Jun. 2, 2014
  • pp: 12716–12736
« Show journal navigation

Modeling a measurement-device-independent quantum key distribution system

P. Chan, J. A. Slater, I. Lucio-Martinez, A. Rubenok, and W. Tittel  »View Author Affiliations


Optics Express, Vol. 22, Issue 11, pp. 12716-12736 (2014)
http://dx.doi.org/10.1364/OE.22.012716


View Full Text Article

Acrobat PDF (4851 KB)





Browse Journals / Lookup Meetings

Browse by Journal and Year


   


Lookup Conference Papers

Close Browse Journals / Lookup Meetings

Article Tools

Share
Citations

Abstract

We present a detailed description of a widely applicable mathematical model for quantum key distribution (QKD) systems implementing the measurement-device-independent (MDI) protocol. The model is tested by comparing its predictions with data taken using a proof-of-principle, time-bin qubit-based QKD system in a secure laboratory environment (i.e. in a setting in which eavesdropping can be excluded). The good agreement between the predictions and the experimental data allows the model to be used to optimize mean photon numbers per attenuated laser pulse, which are used to encode quantum bits. This in turn allows optimization of secret key rates of existing MDI-QKD systems, identification of rate-limiting components, and projection of future performance. In addition, we also performed measurements over deployed fiber, showing that our system’s performance is not affected by environment-induced perturbations.

© 2014 Optical Society of America

1. Introduction

From the first proposal in 1984 to now, the field of quantum key distribution (QKD) has evolved significantly [1

1. N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, “Quantum cryptography,” Rev. Mod. Phys. 74, 145–195 (2002). [CrossRef]

, 2

2. V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf, M. Dušek, N. Lütkenhaus, and M. Peev, “The security of practical quantum key disitrbution,” Rev. Mod. Phys. 81, 1301–1350 (2009). [CrossRef]

]. For instance, experimentally, systems delivering key at Mbps rates [3

3. A. Dixon, Z. L. Yuan, J. Dynes, A. W. Sharpe, and A. Shields, “Continuous operation of high bit rate quantum key distribution,” Appl. Phys. Lett. 96, 161102 (2010). [CrossRef]

] as well as key distribution over more than 100 km [4

4. D. Stucki, N. Walenta, F. Vannel, R. T. Thew, N. Gisin, H. Zbinden, S. Gray, C. R. Towery, and S. Ten, “High rate, long-distance quantum key distribution over 250 km of ultra low loss fibres,” New J. Phys. 11, 075003 (2009). [CrossRef]

, 5

5. T. Schmitt-Manderbach, H. Weier, M. Fürst, R. Ursin, F. Tiefenbacher, T. Scheidl, J. Perdigues, Z. Sodnik, C. Kurtsiefer, J. G. Rarity, A. Zeilinger, and H. Weinfurter, “Experimental demonstration of free-space decoy-state quantum key distribution over 144 km,” Phys. Rev. Lett. , 98, 010504 (2007). [CrossRef] [PubMed]

] have been reported. From a theoretical perspective, efforts aim at developing QKD protocols and security proofs with minimal assumptions about the devices used [6

6. L. Masanes, S. Pironio, and A. Acín, “Secure device-independent quantum key distribution with causally independent measurement devices,” Nat. Commun. 2, 238 (2011). [CrossRef] [PubMed]

]. Of particular practical importance are two recently developed protocols that do not require trusted single photon detectors (SPDs) [7

7. H.-K. Lo, M. Curty, and B. Qi, “Measurement-device-independent quantum key distribution,” Phys. Rev. Lett. 108, 130503 (2012). [CrossRef] [PubMed]

, 8

8. S. L. Braunstein and S. Pirandola, “Side-channel-free quantum key distribution,” Phys. Rev. Lett. 108, 130502 (2012). [CrossRef] [PubMed]

]. One of these, the so-called measurement-device-independent QKD (MDI-QKD) protocol, has already been implemented experimentally [9

9. A. Rubenok, J. A. Slater, P. Chan, I. Lucio-Martinez, and W. Tittel, “Real-world two-photon interference and proof-of-principle quantum key distribution immune to detector attacks,” Phys. Rev. Lett. 111, 130501 (2013). [CrossRef] [PubMed]

12

12. Z. Tang, Z. Liao, F. Xu, B. Qi, L. Qian, and H.-K. Lo, “Experimental demonstration of polarization encoding measurement-device-independent quantum key distribution,” arXiv:1306.6134 [quant-ph].

]. Hence, it is foreseeable that it will play an important role in the future of QKD, and it is thus important to understand the interplay between experimental imperfections (which will always remain in real systems) and system performance to maximize the latter.

In this work, we derive a widely applicable mathematical model describing systems that implement the MDI-QKD protocol. The model is based on facts about our [9

9. A. Rubenok, J. A. Slater, P. Chan, I. Lucio-Martinez, and W. Tittel, “Real-world two-photon interference and proof-of-principle quantum key distribution immune to detector attacks,” Phys. Rev. Lett. 111, 130501 (2013). [CrossRef] [PubMed]

], and other existing experimental setups [10

10. Y. Liu, T.-Y. Chen, L.-J. Wang, H. Liang, G.-L. Shentu, J. Wang, K. Cui, H.-L. Yin, N.-L. Liu, L. Li, X. Ma, J. S. Pelc, M. M. Fejer, Q. Zhang, and J.-W. Pan, “Experimental measurement-device-independent quantum key distribution,” Phys. Rev. Lett. 111, 130502 (2013). [CrossRef] [PubMed]

12

12. Z. Tang, Z. Liao, F. Xu, B. Qi, L. Qian, and H.-K. Lo, “Experimental demonstration of polarization encoding measurement-device-independent quantum key distribution,” arXiv:1306.6134 [quant-ph].

], and takes into account carefully characterized imperfect state preparation, loss in the quantum channel, as well as limited detector efficiency and noise. It is tested by comparing its predictions with data taken with a proof-of-principle QKD system [9

9. A. Rubenok, J. A. Slater, P. Chan, I. Lucio-Martinez, and W. Tittel, “Real-world two-photon interference and proof-of-principle quantum key distribution immune to detector attacks,” Phys. Rev. Lett. 111, 130501 (2013). [CrossRef] [PubMed]

] employing time-bin qubits and implemented in a laboratory environment. Our model, which contains no free parameter, reproduces the experimental data within statistical uncertainties over three orders of magnitude of a relevant parameter. The excellent agreement allows optimizing central parameters that determine secret key rates, such as mean photon numbers used to encode qubits, and to identify rate-limiting components for future system improvement. In addition, we also find that the model accurately reproduces experimental data obtained over deployed fibers, showing that our system minimizes environment-induced perturbation to quantum key distribution in real-world settings.

This paper is organized in the following way: In section 2 we detail some of the side-channel attacks (i.e. attacks exploiting incorrect assumptions about the working of QKD devices) proposed so far and review technological countermeasures. In section 3 we briefly describe the MDI-QKD protocol, which instead exploits fundamental quantum physical laws to render the most important of these attacks useless. Our model of MDI-QKD systems is presented in section 4. This section is followed by an in-depth account of experimental imperfections that affect MDI-QKD performance and a description of how we characterized them in our system (section 5). Section 6 shows the results of the comparison between modelled and measured quantities, and section 7 details how to optimize the performance of our MDI-QKD system using the model. Finally, we conclude the article in section 8.

2. Side-channel attacks

A healthy development of QKD requires investigating the vulnerabilities of QKD implementations in terms of potential side-channel attacks. Side-channels in QKD are channels over which information about the key may leak out unintentionally. One of the first QKD side-channel attacks proposed was the photon number splitting (PNS) attack [13

13. G. Brassard, N. Lütkenhaus, T. Mor, and B. Sanders, “Limitation on practical quantum cryptography,” Phys. Rev. Lett. 85, 1330 (2000). [CrossRef] [PubMed]

] in which the eavesdropper, Eve, exploits the fact that attenuated laser pulses sometimes include more than one photon to obtain information about the key. This attack can be detected if the decoy state protocol [14

14. W. Hwang, “Quantum key distribution with high loss: towards global secure communication,” Phys. Rev. Lett. 91, 057901 (2003). [CrossRef]

16

16. X. Wang, “Beating the photon-number-splitting attack in practical quantum cryptography,” Phys. Rev. Lett. 94, 230503 (2005). [CrossRef] [PubMed]

] is implemented. In the decoy state protocol, Alice varies the mean photon number per pulse in order to allow her and Bob to distill the secret key only from information stemming from single photon emissions. More proposals of side-channel attacks followed, including the Trojan-horse attack [17

17. N. Gisin, S. Fasel, B. Kraus, H. Zbinden, and G. Ribordy, “Trojan-horse attacks on quantum-key-distribution systems,” Phys. Rev. A 73, 022320 (2006). [CrossRef]

], for which the countermeasure is an optical isolator [17

17. N. Gisin, S. Fasel, B. Kraus, H. Zbinden, and G. Ribordy, “Trojan-horse attacks on quantum-key-distribution systems,” Phys. Rev. A 73, 022320 (2006). [CrossRef]

], and the phase remapping attack [18

18. C.-H. F. Fung, B. Qi, K. Tamaki, and H.-K. Lo, “Phase-remapping attack in practical quantum key distribution systems,” Phys. Rev. A 75, 032314 (2007). [CrossRef]

], for which the countermeasure is phase randomization [18

18. C.-H. F. Fung, B. Qi, K. Tamaki, and H.-K. Lo, “Phase-remapping attack in practical quantum key distribution systems,” Phys. Rev. A 75, 032314 (2007). [CrossRef]

]. Later on, attacks that took advantage of SPD vulnerabilities were also proposed and demonstrated [19

19. A. Lamas-Linares and C. Kurtsiefer, “Breaking a quantum key distribution system through a timing side channel,” Opt. Express 15, 9388–9393 (2007). [CrossRef] [PubMed]

22

22. L. Lydersen, C. Wiechers, C. Wittmann, D. Elser, J. Skaar, and V. Makarov, “Hacking commercial quantum cryptography systems by tailored bright illumination,” Nat. Photonics 4, 686–689 (2010). [CrossRef]

]. For example, the time-shift attack [20

20. Y. Zhao, C.-H. F. Fung, B. Qi, C. Chen, and H.-K. Lo, “Quantum hacking: experimental demonstration of time-shift attack against practical quantum key distribution systems,” Phys. Rev. A , 78, 042333 (2008). [CrossRef]

] exploits a difference in the quantum efficiencies of the SPDs used in a QKD system. This attack can be prevented by actively selecting one of the two bases for the projection measurement, as well as by monitoring the temporal distribution of photon detections [20

20. Y. Zhao, C.-H. F. Fung, B. Qi, C. Chen, and H.-K. Lo, “Quantum hacking: experimental demonstration of time-shift attack against practical quantum key distribution systems,” Phys. Rev. A , 78, 042333 (2008). [CrossRef]

]. Another example is the detector blinding attack [22

22. L. Lydersen, C. Wiechers, C. Wittmann, D. Elser, J. Skaar, and V. Makarov, “Hacking commercial quantum cryptography systems by tailored bright illumination,” Nat. Photonics 4, 686–689 (2010). [CrossRef]

] in which the eavesdropper uses high intensity pulses to modify the performance (i.e. blind) the SPDs. It can be detected by monitoring the intensity of light at the entrance of Bob’s devices with a photodiode [22

22. L. Lydersen, C. Wiechers, C. Wittmann, D. Elser, J. Skaar, and V. Makarov, “Hacking commercial quantum cryptography systems by tailored bright illumination,” Nat. Photonics 4, 686–689 (2010). [CrossRef]

24

24. L. Lydersen, C. Wiechers, C. Wittmann, D. Elser, J. Skaar, and V. Makarov, “Avoiding the blinding attack in QKD,” Nat. Photonics 4, 801 (2010). [CrossRef]

]. Nevertheless, due to its power, the blinding attack is currently of particular concern.

3. The measurement-device-independent quantum key distribution protocol

The MDI-QKD protocol is a time-reversed version of entanglement-based QKD. In this protocol, the users, Alice and Bob, are each connected to Charlie, a third party, through a quantum channel, e.g. optical fiber (see Fig. 1). In the ideal version, the users have a source of single photons that they prepare randomly in one of the BB84 qubit states [25

25. C. Bennett and G. Brassard, “Quantum cryptography: public key distribution and coin tossing,” Proceedings of IEEE International Conference on Computers Systems and Signal Processing, 175 (1984).

] |0〉, |1〉, |+〉 and |−〉, where |±〉 = 2−1/2(|0〉 ± |1〉). The qubits are sent to Charlie where the SPDs are located. Charlie performs a partial Bell state measurement (BSM) through a 50/50 beam splitter and then announces the events for which the measurement resulted in a projection onto the |ψ〉 = 2−1/2(|0〉A|1〉B − |1〉A|0〉B) state. Alice and Bob then publicly exchange information about the used bases (z, spanned by |0〉 and |1〉, or x, spanned by |+〉 and |−〉). Associating quantum states with classical bits (e.g. |0〉, |−〉 ≡ 0, and |1〉, |+〉 ≡ 1) and keeping only events in which Charlie found |ψ〉 and they picked the same basis, Alice and Bob now establish anti-correlated key strings. (Note that a projection of two photons onto |ψ〉 indicates that the two photons, if prepared in the same basis, must have been in orthogonal states.) Bob then flips all his bits, thereby converting the anti-correlated strings into correlated ones. Next, the so-called x-key is formed out of all key bits for which Alice and Bob prepared their photons in the x-basis; its error rate is used to bound the information an eavesdropper may have acquired during photon transmission. Furthermore, Alice and Bob form the z-key out of those bits for which both picked the z-basis. Finally, they perform error correction and privacy amplification [1

1. N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, “Quantum cryptography,” Rev. Mod. Phys. 74, 145–195 (2002). [CrossRef]

, 2

2. V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf, M. Dušek, N. Lütkenhaus, and M. Peev, “The security of practical quantum key disitrbution,” Rev. Mod. Phys. 81, 1301–1350 (2009). [CrossRef]

] to the z-key, which results in the secret key.

Fig. 1 Schematics for MDI-QKD. Charlie facilitates the key distribution between Alice and Bob without being able to learn the secret key.

The advantage of the MDI-QKD protocol over conventional prepare-and-measure or entangled photon-based QKD protocols is that, in the case of Charlie performing an ideal (partial) BSM as described above, detection events are uncorrelated with the final secret key bits. This is because a projection onto |ψ〉 only indicates that Alice and Bob sent orthogonal states, but does not reveal who sent which state. As a result, Charlie (or Eve) is unable to gain any information about the key from passively monitoring the detectors. Furthermore, a measurement that is different from the ideal BSM leads to an increased error rate and thus to a smaller, but still secret, key once privacy amplification has been applied. Notably, it does not matter wether the difference is due to experimental imperfections or to an eavesdropper (possibly Charlie himself) trying to gather information about the states that Alice and Bob sent by replacing or modifying the measurement apparatus. Hence, all detector side channels are closed in MDI-QKD.

In the ideal scenario introduced above, Alice and Bob use single photon sources to generate qubits. However, it is possible to implement the protocol using light pulses attenuated to the single photon level. Indeed, as in prepare-and-measure QKD, randomly varying the mean photon number of photons per attenuated light pulse between a few different values (so-called decoy and signal states) allows making the protocol practical while protecting against a possible PNS attack [7

7. H.-K. Lo, M. Curty, and B. Qi, “Measurement-device-independent quantum key distribution,” Phys. Rev. Lett. 108, 130503 (2012). [CrossRef] [PubMed]

, 26

26. X.-B. Wang, “Three-intensity decoy-state method for device-independent quantum key distribution with basis-dependent errors,” Phys. Rev. A 87, 012320 (2013). Note that we have corrected a mistake present in Eq. (17). [CrossRef]

]. The secret key rate is then given by [7

7. H.-K. Lo, M. Curty, and B. Qi, “Measurement-device-independent quantum key distribution,” Phys. Rev. Lett. 108, 130503 (2012). [CrossRef] [PubMed]

]:
S=Q11z(1h2(e11x))Qμσzfh2(eμσz),
(1)
where h2 is the binary entropy function, f indicates the error correction efficiency, Q indicates the gain (the probability of a projection onto |ψ〉 per emitted pair of pulses [27

27. Note that a pulse does not necessarily contain one single photon. In particular, when considering attenuated light pulses, the number of photons in a pulse will, for example, follow the Poissonian distribution.

]) and e indicates error rates (the ratio of erroneous to total projections onto |ψ〉). Furthermore, the superscripts, x or z, denote if gains or error rates are calculated for qubits prepared in the x-or the z-basis, respectively. Similarly, the subscripts, μ and σ, show that the quantity under concern is calculated or measured for pulses with mean photon number μ (sent by Alice) and σ (sent by Bob), respectively. Finally, the subscript 11 indicates quantities stemming from detection events for which the pulses emitted by Alice and Bob contain only one photon each. Note that Q11 and e11 cannot be measured; their values must be bounded using either a decoy state method, or employing qubit tagging [13

13. G. Brassard, N. Lütkenhaus, T. Mor, and B. Sanders, “Limitation on practical quantum cryptography,” Phys. Rev. Lett. 85, 1330 (2000). [CrossRef] [PubMed]

]. However, the latter yields smaller key rates and distances than the former.

Shortly after the original proposal [7

7. H.-K. Lo, M. Curty, and B. Qi, “Measurement-device-independent quantum key distribution,” Phys. Rev. Lett. 108, 130503 (2012). [CrossRef] [PubMed]

], a practical decoy state protocol for MDI-QKD was proposed [26

26. X.-B. Wang, “Three-intensity decoy-state method for device-independent quantum key distribution with basis-dependent errors,” Phys. Rev. A 87, 012320 (2013). Note that we have corrected a mistake present in Eq. (17). [CrossRef]

]. It requires Alice and Bob to randomly pick mean photon numbers between two decoy states and a signal state. One of the decoy states must have a mean photon number lower than the signal state, while the other one must be vacuum. A finite number of decoy states results in a lower bound for Q11x,z and an upper bound for e11x, which in turn gives a lower bound for the secret key rate in Eq. (1). We will elaborate more on decoy states in section 7.1.

4. The model

In the following paragraphs we present a detailed description of our model. It relies on the assumption of phase randomized laser pulses at Charlie’s. While Alice and Bob generate coherent states in our proof-of-principle setup, this assumption is correct as the long fibres used to connect Alice and Bob with Charlie introduce random global phase variations (we will discuss the impact of the lack of phase randomization at Alice’s and Bob’s on the security of distributed keys in section 8). We note that, in order to facilitate explanations, we have adopted the terminology of time-bin encoding. However, our model is general and can also be applied to MDI-QKD systems implementing other types of encoding [11

11. T. F. da Silva, D. Vitoreti, G. B. Xavier, G. P. Temporão, and J. P. von der Weid, “Proof-of-principle demonstration of measurement device independent QKD using polarization qubits,” Phys. Rev. A. 88, 052303 (2013). [CrossRef]

].

4.1. State preparation

4.2. Conditional probability for projections onto |ψ

We build up the model by first considering the probabilities that particular outputs from the beam splitter (at Charlie’s) will generate the detection pattern associated with a projection onto |ψ〉. The outputs are characterized by the number of photons per output port as well as their joint quantum state. The probabilities for each of the possible outputs to occur can then be calculated based on the inputs to the beam splitter (characterized by the number of photons per input port and their quantum states, as defined in Eq. (2)). Note that for the simple cases of inputs containing zero or one photon (summed over both input modes), we calculate the probabilities leading to the desired detection pattern directly, i.e. without going through the intermediate step of calculating outputs from the beam splitter. Finally, the probability for each input to occur is calculated based on the probability for Alice and Bob to send attenuated light pulses containing exactly i photons, all in a state given by Eq. (2). The probability for a particular input to occur also depends on the transmissions of the quantum channels, tA and tB. We note that this model considers up to three photons incident on the beam splitter. This is sufficient as, in the case of heavily attenuated light pulses and lossy transmission, higher order terms do not contribute significantly to projections onto |ψ〉. However, we limit the following description to two photons at most: the extension to three is lengthy but straightforward and follows the methodology presented for two photons.

Detector noise

Let us begin by considering the simplest case in which no photons are input into the beam splitter. In this case, detection events can only be caused by detector noise. We denote the probability that a detector indicates a spurious detection as Pn. Detector noise stems from two effects: dark counts and afterpulsing [32

32. D. Stucki, G. Ribordy, A. Stefanov, H. Zbinden, J. Rarity, and T. Wall, “Photon counting for quantum key distribution with Peltier cooled InGaAs/InP APDs,” J. Mod. Opt. 48, 1967–1981 (2001). [CrossRef]

]. Dark counts represent the base level of noise in the absence of any light, and we denote the probability that a detector generates a dark count per time-bin as Pd. Afterpulsing is an additional noise source produced by the detector as a result of prior detection events. The probability of afterpulsing depends on the total count rate, hence we denote the afterpulsing probability per time-bin as Pa, which is a function of the mean photon number per pulse from Alice and Bob (μ and σ), the transmission of the channels (tA and tB) and the efficiency of the detectors (η) located at Charlie (see below for afterpulse characterization). The total probability of a noise count in a particular time-bin is thus Pn = Pd + Pa. All together, we find the probability for generating the detection pattern associated with a projection onto the |ψ〉-state, conditioned on having no photons at the input, specified by “in”, of the beam splitter, to be :
P(|ψ|0photons,in)=P(|ψ|0photons,out)=2Pn2,
(3)
Here and henceforward, we have ignored the multiplication factor (1−Pn) ∼ 1 [30

30. Note that this approximation is, in general, not correct. However, in order to obtain the best performance from a QKD implementation, the noise level should be as low as possible, i.e. Pn∼ 0.

], which indicates the probability that a noise event did not occur in the early time-bin (this is required in order to see a detection during the late time-bin assuming detectors with recovery time larger than the separation between the |0〉 and |1〉 temporal modes). Note that the probability conditioned on having no photons at the inputs of the beam splitter equals the one conditioned on having no photons at the outputs (specified in Eq. (3) by the conditional “out”).

One-photon case

Next, we consider the case in which a single photon arrives at the beam splitter. To generate the detection pattern associated with |ψ〉, either the photon must be detected and a noise event must occur in the other detector in the opposite time-bin, or, if the photon is not detected, two noise counts must occur as in Eq. (3). We find
P(|ψ|1photons,in)=ηPn+(1η)P(|ψ|0photons,out),
(4)
where η denotes the probability to detect a photon that occupies an early (late) temporal mode during an early (late) time-bin (we assume η to be the same for both detectors).

Two-photon case

We now consider detection events stemming from two photons entering the beam splitter. The possible outputs can be broken down into three cases. In the first case, both photons exit the beam splitter in the same output port and are directed to the same detector. This yields only a single detection event, even if the photons are in different temporal modes (the latter is due to detector dead time. Note that as our model calculates detections in units of bits per gate, modeling a dead-time free detector is straightforward.). The probability for Charlie to declare a projection onto |ψ〉 is then
P(|ψ|2photons,1spatialmode,out)=(1(1η)2)Pn+(1η)2P(|ψ|0photons,out).
(5)

In the second case, the photons are directed towards different detectors and occupy the same temporal mode. Hence, to find detections in opposite time-bins in the two detectors, at least one photon must not be detected. This leads to
P(|ψ|2photons,2spatialmode,1temporalmode,out)=2η(1η)Pn+(1η)2P(|ψ|0photons,out).
(6)

In order to find the probability for each of these three two-photon outputs to occur, we must examine two-photon inputs to the beam splitter. We note that it is possible for the two photons to be subject to a two-photon interference effect (known as photon bunching) when impinging on the beam splitter. As this quantum interference can lead to an entangled state between the output modes, the calculation must proceed with quantum mechanical operators. We consider three cases: two photons arrive at the same input of the beam splitter, one photon arrives at each input of the beam splitter and the two photons are distinguishable, and one photon arrives at each input of the beam splitter and the two photons are indistinguishable. For ease of analysis, we first introduce some notation:
px,z(0,0)(m1x,z+b1x,z)(m2x,z+b2x,z)px,z(0,1)(m1x,z+b1x,z)(1m2x,z+b2x,z)px,z(1,0)(1m1x,z+b1x,z)(m2x,z+b2x,z)px,z(1,1)(1m1x,z+b1x,z)(1m2x,z+b2x,z)bnormx,z1+2b1x,z+2b2x,z+4b1x,zb2x,z
(8)
where b1,2x,z and m1,2x,z are the parameters introduced in Eq. (2); the subscripts label the photon (one or two) whose state is specified by the parameters. Furthermore, px,z(i, j) is proportional to finding photon one before the beam-splitter in temporal mode i and photon two in temporal mode j, where i, j ∈ [0, 1]. Finally, bnormx,z is a normalization factor.

First, considering the situation in which the two photons impinge from the same input on the beam splitter, one has the state
|ψinput=(11+2bx,z(mx,z+bx,za^(0)+eiϕx,z1mx,z+bx,za^(1)))2|vac,
(9)
where â(0) and â(1) are the creation operators for a photon in the |0〉 or |1〉 state, respectively. Evolving this state through the standard unitary transformation for a lossless, 50/50 beam splitter, described by a^(c^+d^)/2 (where ĉ and are the two output modes of the beam splitter), one finds that with probability 1/2 the two photons exit the beam splitter in the same output port (or spatial mode) and with probability 1/2 in different ports. Furthermore, with probability A=[px,z(0,0)+px,z(1,1)]/2bnormx,z we find the photons in different spatial modes and in the same temporal mode, and with probability B=[px,z(0,1)+px,z(1,0)]/2bnormx,z we find the photons in different spatial and temporal modes. By symmetry, we find the same result if the two photons arrive from the other input mode of the beam splitter.

Thus the probability that Charlie finds the desired detection pattern is:
P(|ψ|2photons,1spatialmode,in)=12P(|ψ|2photons,1spatialmode,out)+A×P(|ψ|2photons,2spatialmodes,1temporalmode,out)+B×P(|ψ|2photons,2spatialmodes,2temporalmodes,out).
(10)

Finally, consider the case in which the two photons impinge from different inputs are indistinguishable, and interfere on the beam splitter. This can be modelled by considering the same input state as in Eq. (11), but using a beam splitter unitary described by a^(c^+d^)/2 (as before) and b^(c^+d^)2. In this case, the probabilities of finding the outputs from the beam splitter discussed in Eqs. (57) depend on the difference between the phases ϕ1x,z and ϕ2x,z that specify the states of photons one and two, Δϕx,zϕ1x,zϕ2x,z. Note that, due to the two-photon interference effect, finding the two photons in different spatial modes and the same temporal mode is impossible. We are thus left with the case of having two photons in the same output port (the same spatial mode), which occurs with probability C=[px,z(0,0)+px,z(1,1)+0.5(px,z(0,1)+px,z(1,0))+px,z(0,1)px,z(1,0)cos(Δϕx,z)]/bnormx,z, and the case of having the photons in different temporal and spatial modes, which occurs with probability D=[0.5(px,z(0,1)+px,z(1,0))px,z(0,1)px,z(1,0)cos(Δϕx,z)]/bnormx,z. This leads to
P(|ψ|2photons,interfering,in)=C×P(|ψ|2photons,1spatialmode,out)+D×P(|ψ|2photons,2spatialmodes,2temporalmodes,out).
(13)

4.3. Aggregate probability for projections onto |ψ

5. Characterizing experimental imperfections

The parameters used to model our system are derived from data established through independent measurements. To test our model, the characterization of experimental imperfections in our MDI-QKD implementation [9

9. A. Rubenok, J. A. Slater, P. Chan, I. Lucio-Martinez, and W. Tittel, “Real-world two-photon interference and proof-of-principle quantum key distribution immune to detector attacks,” Phys. Rev. Lett. 111, 130501 (2013). [CrossRef] [PubMed]

] is very technical at times. It can be broken down into time-resolved energy measurements at the single photon level (required to extract μ, σ, bx,z and mx,z for Alice and Bob, as well as dark count and afterpulsing probabilities), measurements of phase (required to establish ϕx,z for Alice and Bob), and visibility measurements. In the following paragraphs we describe the procedures we followed to obtain these parameters from our system.

5.1. Our MDI-QKD implementation

In our implementation of MDI-QKD [9

9. A. Rubenok, J. A. Slater, P. Chan, I. Lucio-Martinez, and W. Tittel, “Real-world two-photon interference and proof-of-principle quantum key distribution immune to detector attacks,” Phys. Rev. Lett. 111, 130501 (2013). [CrossRef] [PubMed]

] Alice’s and Bob’s setups are identical. Each setup consists of a CW laser with large coherence time, emitting at 1550nm wavelength. Time-bin qubits, encoded into single photon-level light pulses with Poissonian photon number statistics, are created through an attenuator, an intensity modulator and a phase modulator located in a temperature controlled box. More precisely, the intensity modulator is used to tailor pulse pairs out of the cw laser light, the phase modulator is used to change their relative phase, and the attenuator attenuates these pulses to the single-photon level. The two temporal modes defining each time-bin qubit are of 500 ps (FWHM) duration and are separated by 1.4 ns. Each source generates qubits at 2 MHz rate.

We emphasize that our qubit generation procedure justifies the assumption of a pure state in Eq. (2). Indeed, all photons, including background photons due to light leaking through imperfect intensity modulators, have to be generated by the CW lasers whose coherence times exceeds the separation between the temporal modes |0〉 and |1〉 [31

31. The separation of photons into genuine qubit photons and background photons is somewhat artificial – as a matter of fact, there is no way to distinguish background photons from real photons. As already stated in section 4.1, the distinction is motivated by the need to write down a general expression for all emitted single-photon qubit states using parameters that can be characterized directly through experiments (these measurements are further described below).

]. Note that in all experiments reported to date [9

9. A. Rubenok, J. A. Slater, P. Chan, I. Lucio-Martinez, and W. Tittel, “Real-world two-photon interference and proof-of-principle quantum key distribution immune to detector attacks,” Phys. Rev. Lett. 111, 130501 (2013). [CrossRef] [PubMed]

12

12. Z. Tang, Z. Liao, F. Xu, B. Qi, L. Qian, and H.-K. Lo, “Experimental demonstration of polarization encoding measurement-device-independent quantum key distribution,” arXiv:1306.6134 [quant-ph].

] background photons always add coherently to the modes describing qubits, making our pure-state description widely applicable.

Fig. 2 Time-bin qubits are created at Alice’s and Bob’s through a CW laser (LD), attenuator (ATT), and frequency shifter (FS) and temperature-controlled intensity (IM) and phase (PM) modulator. The projective measurements are done at Charlie’s via a beam splitter (BS) and two single photon detectors (SPDs).

5.2. Time-resolved energy measurements

First, we characterize the dark count probability per time-bin, Pd, of the SPDs (InGaAs-avalanche photodiodes operated in gated Geiger mode [32

32. D. Stucki, G. Ribordy, A. Stefanov, H. Zbinden, J. Rarity, and T. Wall, “Photon counting for quantum key distribution with Peltier cooled InGaAs/InP APDs,” J. Mod. Opt. 48, 1967–1981 (2001). [CrossRef]

]) by observing their count rates when the optical inputs are disconnected. We then send attenuated laser pulses so that they arrive just after the end of the 10 ns long gate that temporarily enables single photon detection. The observed change in the count rate is due to background light transmitted by the intensity modulators (whose extinction ratios are limited) and allows us to establish bx,z (per time-bin) for Alice and Bob. Next, we characterize the afterpulsing probability per time-bin, Pa, by placing the pulses within the gate, and observing the change in count rate in the region of the gate prior to the arrival of the pulse. The afterpulsing model we use to assess Pa from these measurements is described below.

Once the background light and the sources of detector noise are characterized, the values of mx,z can be calculated by generating all required states and observing the count rates in the two time-bins corresponding to detecting photons generated in early and late temporal modes. Observe that mz=1 for photons generated in state |1〉 (the late temporal mode) is zero, since all counts in the early time-bin are attributed to one of the three sources of background described above. Furthermore, we observed that mz=0 for photons generated in the |0〉 state (the early temporal mode) is smaller than one due to electrical ringing in the signals driving the intensity modulators. Note that, in our implementation, the duration of a temporal mode exceeds the width of a time-bin, i.e. it is possible to detect photons outside a time-bin (see Fig. 3 for a schematical representation). Hence, it will be useful to also define the probability for detecting a photon arriving at any time during a detector gate; we will refer to this quantity as ηgate.The count rate per gate, after having subtracted the rates due to background and detector noise, together with the detection efficiency, ηgate (ηgate, as well as η, have been characterized previously based on the usual procedure [32

32. D. Stucki, G. Ribordy, A. Stefanov, H. Zbinden, J. Rarity, and T. Wall, “Photon counting for quantum key distribution with Peltier cooled InGaAs/InP APDs,” J. Mod. Opt. 48, 1967–1981 (2001). [CrossRef]

]), allows calculating the mean number of photons per pulse from Alice or Bob (μ or σ, respectively). The efficiency coefficient relevant for our model, η, is smaller than ηgate. Finally, we point out that the entire characterization described above was repeated for all experimental configurations investigated (the configurations are detailed in Table 2). We found all parameters to be constant in μσtAtB, with the obvious exception of the afterpulsing probability.

Fig. 3 Sketch (not to scale) of the probability density p(t) for a detection event to occur as a function of time within one gate. Detection events can arise from a photon within an optical pulse (depicted here as a pulse in the late temporal mode), or be due to optical background, a dark count, or afterpulsing. Also shown are the 400 ps wide time-bins. Within the early time-bin only optical background, dark counts and afterpulsing give rise to detection events in this case. Note that the width of the temporal mode exceeds the widths of the time-bins.

Table 2. Measured error rates, eμσx,z, and gains, Qμσx,z, for different mean photon numbers, μ and σ (where μ = σ), lengths of fiber connecting Alice and Charlie, and Charlie and Bob, A and B, respectively, and total transmission loss, l. The last set of data details real-world measurements using deployed fiber. Uncertainties are calculated using Poissonian detection statistics.

table-icon
View This Table
| View All Tables

5.3. Phase measurements

5.4. Measurements of afterpulsing

We now turn to the characterization of afterpulsing. After a detector click (or detection event, which includes photon detection, dark counts and afterpulsing), the probability of an afterpulse occuring due to that detection event decays exponentially with time. The SPDs are gated, with the afterpulse probability per gate being a discrete sampling of the exponential decay. This can be expressed using a geometric distribution: supposing a detection event occurred at gate k = −1, the probability of an afterpulse occuring in gate k is given by Pk = αp(1 − p)k. Thus, if there are no other sources of detection events, the probability of an afterpulse occuring due to a detection event is given by k=0αp(1p)k.

In a realistic situation, the geometric distribution for the afterpulses will be cut off by other detection events, either stemming from photons, or dark counts. In addition, the SPDs have a deadtime after each detection event during which the detector is not gated until kkdead (note that time and the number of gates applied to the detector are proportional). The deadtime can simply be accounted for by starting the above summation at k = kdead rather than k = 0. However, for an afterpulse to occur during the kth gate following a particular detection event, no other detection events must have occured in prior gates. This leads to the following equation for the probability of an afterpulse per detection event:
P(a,det)=k=kdead(γ×υ×ρ×Pk)
(15)
where:
γ=(1μavg(μ,σ,tA,tB)ηgate)kkdead
υ=(1Pd,gate)kkdead
ρ=j=kdeadk11αp(1p)j
Pk=αp(1p)k
(16)
and Pd,gate denotes the detector dark count probability per gate (as opposed to per time-bin), and μavg(μ, σ, tA, tB) expresses the average number of photons present on the detector during each gate as follows:
μavg(μ,σ,tA,tB)=(μ+bA)tA+(σ+bB)tB2,
(17)
where bA and bB characterize the amount of background light per gate from Alice and Bob, respectively, and the factor of 12 comes from Charlie’s beam splitter. The terms in the sum of Eq. (15) describe the probabilities of neither having an optical detection (γ), either caused by a modulated pulse or background light, nor a detector dark count (υ) in any gate before and including gate k, and not having an afterpulse in any gate before gate k (ρ), followed by an afterpulse in gate k (Pk). Equation (15) takes into account that afterpulsing within each time-bin is influenced by all detections within each detector gate, and not only those happening within the time-bins that we post-select when acquiring experimental data.

The afterpulse probability, Pa,gate, for given μ, σ, tA and tB can then be found by multiplying Eq. (15) by the total count rate
Pa,gate=(μavg(μ,σ,tA,tB)ηgate+Pd,gate+Pa,gate)P(a,det).
(18)
This equation expresses that afterpulsing can arise from prior afterpulsing, which explains the appearance of Pa,gate on both sides of the equation. Equation (18) simplifies to
Pa,gate=(μavg(μ,σ,tA,tB)ηgate+Pd,gate)P(a,det)1P(a,det).
(19)
Finally, to extract the afterpulsing probability per time-bin, Pa(μ, σ, tA, tB), we note that we found that the distribution of afterpulsing across the gate to be the same as the distribution of dark counts across the gate. Hence,
Pa(μ,σ,tA,tB)=Pa,gatePdPd,gate.
(20)
Fitting our afterpulse model to the measured afterpulse probabilities, we find α = 1.79 × 10−1, p = 2.90 × 10−2, and PdPd,gate=4.97×102 for kdead = 20. The fit, along with the measured values, is shown in Fig. 4 as a function of the average number of photons arriving at the detector per gate μavg(μ, σ, tA, tB).

Fig. 4 Afterpulse probability per time-bin as a function of the average number of photons arriving at the detector per gate.

A summary of all the values obtained through these measurements is shown in Table 1.

Table 1. Experimentally established values for all parameters required to describe the generated quantum states, as defined in Eq. (2), as well as two-photon interference parameters and detector properties.

table-icon
View This Table
| View All Tables

6. Testing the model, and real-world tests

6.1. Comparing modelled with actual performance

To test our model, and to verify our ability to perform, in principle, QKD with deployed (real-world) fiber, we now compare the model’s predictions with experimental data obtained using the QKD system characterized by the parameters listed in Table 1. We performed experiments in two configurations: inside the laboratory using spooled fiber (for four different distances between Alice and Bob ranging between 42 km and 103 km), and over deployed fiber (18 km). The first configuration allows testing the model, and the second configurations shines light on our system’s capability to compensate for environment-induced perturbations, e.g. due to temperature fluctuations. For each test, three different mean photon numbers (0.1, 0.25 and 0.5) were used. All the configurations tested (as well as the specific parameters used in each test) and the results obtained are listed in Table 2. In Fig. 5 we show the simulated values for the error rates (ez,x) and gains (Qz,x) predicted by the model as a function of μσtAtB. The plot includes uncertainties from the measured parameters, leading to a range of values (bands) as opposed to single values. The figure also shows the experimental values of ez,x and Qz,x from our MDI-QKD system in both the laboratory environment and over deployed fiber.

Fig. 5 Modelled and measured results. Figure a) shows the plot for the error rates in the z-basis (green band) and in the x-basis (blue band) as a function of the mean photon number per pulse sent by Alice (μ) and Bob (σ) multiplied by the channel transmissions (tA and tB). Figure b) shows the plot of the gains as a function of µσtAtB. The z-basis is shown in green and the x-basis is shown in blue. For both figures the results of the measurements done in the laboratory are shown with squares (blue or green) and the measurements done over deployed fiber are shown with diamond (red and purple). The difference in gains and error rates in the x- and the z-basis, respectively is due to the fact that, in the case in which one party sends a laser pulse containing more than one photon and the other party sends zero photons, projections onto the |ψ〉 Bell state can only occur if both pulses encode qubits belonging to the x-basis. The Bell state projection cannot occur if both prepare qubits belonging to the z-basis (we ignore detector noise for the sake of this argument). This causes increased gain for the x-basis and, due to an error rate of 50% associated with these projections, also an increased error rate for the x-basis.

Considering the data taken inside the lab, the modelled values and the experimental results agree within experimental uncertainties over three orders of magnitude. This shows that the model is suitable for predicting error rates and gains. In turn, this allows us to optimize performance of our QKD systems in terms of secret key rate (see section 7). In particular, the model allows optimizing the mean photon number per pulse that Alice and Bob use to encode signal and decoy states as a function of transmission loss, and identifying rate-limiting components.

Furthermore, the measurement results over deployed fibre are also well described by the same model, indicating that this more-difficult measurement worked correctly. The increased difficult across real-world fiber arises due to the fact that BSMs require incoming photons to be indistinguishable in all degrees of freedom (i.e. arrive within their respective coherence times, with identical polarization, and with large spectral overlap). As we have shown in [9

9. A. Rubenok, J. A. Slater, P. Chan, I. Lucio-Martinez, and W. Tittel, “Real-world two-photon interference and proof-of-principle quantum key distribution immune to detector attacks,” Phys. Rev. Lett. 111, 130501 (2013). [CrossRef] [PubMed]

], time-varying properties of optical fibers in the outside environment (e.g. temperature dependent polarization and travel-time changes) can remove indistinguishability in less than a minute. Active stabilization of these properties is thus required to achieve functioning BSMs and, in fact, three such stabilization systems were deployed during the MDI-QKD measurements presented here (more details are contained in [9

9. A. Rubenok, J. A. Slater, P. Chan, I. Lucio-Martinez, and W. Tittel, “Real-world two-photon interference and proof-of-principle quantum key distribution immune to detector attacks,” Phys. Rev. Lett. 111, 130501 (2013). [CrossRef] [PubMed]

]). That our measurement results agree with the predicted values of the model demonstrates that the impact of environmental perturbations on the ability to perform Bell state measurements is negligible (which is the same conclusion drawn in [9

9. A. Rubenok, J. A. Slater, P. Chan, I. Lucio-Martinez, and W. Tittel, “Real-world two-photon interference and proof-of-principle quantum key distribution immune to detector attacks,” Phys. Rev. Lett. 111, 130501 (2013). [CrossRef] [PubMed]

]).

7. Optimization of system performance

7.1. Decoy-state analysis

To calculate secret key rates for various system parameters, which allows optimizing these parameters, first, it is necessary to compute the gain, Q11z, and the error rate, e11x, that stem from events in which both sources emit a single photon. We consider the three-intensity decoy state method for the MDI-QKD protocol proposed in [26

26. X.-B. Wang, “Three-intensity decoy-state method for device-independent quantum key distribution with basis-dependent errors,” Phys. Rev. A 87, 012320 (2013). Note that we have corrected a mistake present in Eq. (17). [CrossRef]

], which derives a lower bound for the secret key rate using lower bounds for Q11x,z and an upper bound for e11x. Note that we assume here that the the only effect of imperfectly generated qubit states on the secret key rate that we consider here is that it increases the error rates (further considerations require advancements to security proofs, which are under way [26

26. X.-B. Wang, “Three-intensity decoy-state method for device-independent quantum key distribution with basis-dependent errors,” Phys. Rev. A 87, 012320 (2013). Note that we have corrected a mistake present in Eq. (17). [CrossRef]

, 35

35. K. Tamaki, H.-K. Lo, C.-H. F. Fung, and B. Qi, “Phase encoding schemes for measurement device independent quantum key distribution and basis-dependent flaw,” arxiv:1111.3413v4 (2013).

]) increases of error rates.

We denote the signal, decoy, and vacuum intensities by μs, μd, and μv, respectively, for Alice, and, similarly, as σs, σd, and σv for Bob. Note that μv = σv = 0 by definition. This decoy analysis assumes that perfect vacuum intensities are achievable, which may not be correct in an experimental implementation. However, note that, first, intensity modulators with more than 50 dB extinction ratio exist, which allows obtaining almost zero vacuum intensity, and second, that a similar decoy state analysis with non-zero vacuum intensity values is possible as well [28

28. F. Xu, M. Curty, B. Qi, and H.-K. Lo, “Practical aspects of measurement-device-independent quantum key distribution,” New J. Phys. 15, 113007 (2013). [CrossRef]

]. For the purpose of this analysis, we take both channels to have the same transmission coefficients (that is tA = tBt), according to our experimental configuration, and Alice and Bob hence both select the same mean photon numbers for each of the three intensities (that is μs = σsτs, μd = σdτd, and μv = σvτv). Additionally, for compactness of notation, we omit the μ and σ when describing the gains and error rates (e.g. we write Qssz to denote the gain in the z-basis when Alice and Bob both send photons using the signal intensity). Under these assumptions, the lower bound on Q11x,z is given by
Q11x,z𝔻1(τs)𝔻2(τs)(Qddx,zQ0x,z(τd))𝔻1(τd)𝔻2(τd)(Qssx,zQ0x,z(τs))𝔻1(τs)𝔻1(τd)(𝔻1(τd)𝔻2(τs)𝔻1(τs)𝔻2(τd)),
(21)
where the various 𝔻i(τ) denote the probability that a pulse with photon number distribution 𝔻 and mean τ contains exactly i photons, and Q0x,z(τd) and Q0x,z(τs) are given by
Q0x,z(τd)=𝔻0(τd)Qvdx,z+𝔻0(τd)Qdvx,z𝔻0(τd)2Qvvx,z,
(22)
Q0x,z(τs)=𝔻0(τs)Qvsx,z+𝔻0(τs)Qsvx,z𝔻0(τs)2Qvvx,z.
(23)
The error rate e11x can then be computed as
e11xeddxQddx𝔻0(τd)evdxQvdx𝔻0(τd)edvxQdvx+𝔻0(τd)2evvxQvvx𝔻1(τd)2Q11x,
(24)
where the upper bound holds if a lower bound is used for Q11x. Note that Q11x,z, Q0x,z(τd), Q0x,z(τs) and e11x (Eqs. (2124)) are uniquely determined through measurable gains and error rates.

7.2. Optimization of signal and decoy intensities

In our optimization, we found that, in all cases, τd = 0.01 is the optimal decoy intensity. We attribute this to the fact that τd has a large impact on the tightness of the upper bound on e11x in Eq. (24) (this is due to the fact that all errors in the cases in which both parties sent at least one photon, which increases with τd, are attributed to the case in which both parties sent exactly one photon). Fig. 6 shows, as a function of total loss (or distance), the optimum values of the signal state intensity, τs, and the corresponding secret key rate, S, for decoy intensities of τd ∈ [0.01, 0.05, 0.1], as well as for a perfect decoy state protocol (i.e. using values of Q11z and e11x computed from the model, as detailed in the preceeding section).

Fig. 6 a) Optimum signal state intensity, τs, and b) corresponding secret key rate as a function of total loss in dB. The secondary axis shows distances assuming typical loss of 0.2 dB/km in optical fiber without splices. The optimum values for μs for small loss have to be taken with caution as in this regime the model needs to be expanded to higher photon number terms.

7.3. Rate-limiting components

Finally, we use our model to simulate the performance of the MDI-QKD protocol given improved components. We consider two straightforward modifications to the system: replacing the InGaAs single photon detectors (SPDs) with superconducting single photon detectors (SSPDs) [37

37. F. Marsili, V. B. Verma, J. A. Stern, S. Harrington, A. E. Lita, T. Gerrits, I. Vayshenker, B. Baek, M. D. Shaw, R. P. Mirin, and S. W. Nam, “Detecting single infrared photons with 93% system efficiency,” Nat. Photonics 7, 210–214 (2013). [CrossRef]

], and improving the intensity modulation (IM). For various combinations of these improvements, the optimized signal intensities and secret key rates for μd = 0.05 are shown in Fig. 7. First, using state-of-the-art SSPDs in [37

37. F. Marsili, V. B. Verma, J. A. Stern, S. Harrington, A. E. Lita, T. Gerrits, I. Vayshenker, B. Baek, M. D. Shaw, R. P. Mirin, and S. W. Nam, “Detecting single infrared photons with 93% system efficiency,” Nat. Photonics 7, 210–214 (2013). [CrossRef]

], the detection efficiency (η) is improved from 14.5% to 93%, and the dark count probability (Pd) is reduced by nearly two orders of magnitude. Furthermore, the mechanisms leading to afterpulsing in InGaAs SPDs are not present in SSPDs (that is Pa = 0). This improvement results in a drastic increase in the secret key rate and maximum distance as both the probability of projection onto |ψ〉 and the signal-to-noise-ratio are improved significantly. Second, imperfections in the intensity modulation system used to create pulses in our implementation contribute significantly to the observed error rates, particularly in the z-basis. Using commercially-available, state-of-the-art intensity modulators [38

38. For instance, EOSpace sells intensity modulators with 50 dB extinction ratio.

] allow suppressing the background light (represented by bx,z in general quantum state given in Eq. (2)) by an additional 10–20 dB, corresponding to an extinction ration of 40 dB. Furthermore, we considered improvements to the driving electronics that reduces ringing in our pulse generation by a factor of 5, bringing the values of mx,z in Eq. (2) closer to the ideal values. As seen in Fig. 7, this provides a modest improvement to the secret key rate, both when applied to our existing implementation, and when applied in conjunction with the SSPDs. Note that in the case of improved detectors and intensity modulation system the optimized τs for small loss (under 10 dB) is likely overestimated due to neglected higher-order terms.

Fig. 7 a) Optimum signal state intensity, τs, and b) corresponding secret key rate as a function of total loss in dB. The secondary axis shows distances assuming typical loss of 0.2 dB/km in optical fiber without splices. The optimum values for μs for small loss, are not shown as the model needs to be expanded to higher photon number terms in this regime.

8. Discussion and conclusion

We have developed a widely applicable model for systems implementing the Measurement-Device-Independent QKD protocol. Our model is based on facts about the experimental setup and takes into account carefully characterized experimental imperfections in sources and measurement devices as well as transmission loss. It is evaluated against data taken with a real, time-bin qubit-based QKD system. The excellent agreement between observed values and predicted data confirms the model. In turn, this allows optimizing mean photon numbers for signal and decoy states and finding rate-limiting components for future improvements. We believe that our model, which is straightforward to generalize to other types of qubit encoding, as well as the detailed description of the characterization of experimental imperfections will be useful to improve QKD beyond its current state of the art.

To finish, let us emphasize that tests of a model that describes the performance of a QKD system in terms of secret key rates has to happen in a setting in which eavesdropping can be excluded (i.e. within a secure lab and using spooled fibre) – otherwise, the measured data, which depends on the (unknown) type and amount of eavesdropping, may deviate from the predicted performance and no conclusion about the suitability of the model can be drawn. Interestingly, this implies that neither phase randomization, nor random selection of qubit states or intensities of attenuated laser pulses used to encode qubit states is necessary to test a model, as their presence (or absence) does not impact the measured data. However, it is obvious that these modulations are crucial to ensure the security of a key that is distributed through a hostile environment. We note that in this article, all effects of imperfections in the system on the measured quantities are still attributed to an eavesdropper, and accounted for in the calculation of the secret key rate as well in the optimization of system parameters.

Acknowledgments

References and links

1.

N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, “Quantum cryptography,” Rev. Mod. Phys. 74, 145–195 (2002). [CrossRef]

2.

V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf, M. Dušek, N. Lütkenhaus, and M. Peev, “The security of practical quantum key disitrbution,” Rev. Mod. Phys. 81, 1301–1350 (2009). [CrossRef]

3.

A. Dixon, Z. L. Yuan, J. Dynes, A. W. Sharpe, and A. Shields, “Continuous operation of high bit rate quantum key distribution,” Appl. Phys. Lett. 96, 161102 (2010). [CrossRef]

4.

D. Stucki, N. Walenta, F. Vannel, R. T. Thew, N. Gisin, H. Zbinden, S. Gray, C. R. Towery, and S. Ten, “High rate, long-distance quantum key distribution over 250 km of ultra low loss fibres,” New J. Phys. 11, 075003 (2009). [CrossRef]

5.

T. Schmitt-Manderbach, H. Weier, M. Fürst, R. Ursin, F. Tiefenbacher, T. Scheidl, J. Perdigues, Z. Sodnik, C. Kurtsiefer, J. G. Rarity, A. Zeilinger, and H. Weinfurter, “Experimental demonstration of free-space decoy-state quantum key distribution over 144 km,” Phys. Rev. Lett. , 98, 010504 (2007). [CrossRef] [PubMed]

6.

L. Masanes, S. Pironio, and A. Acín, “Secure device-independent quantum key distribution with causally independent measurement devices,” Nat. Commun. 2, 238 (2011). [CrossRef] [PubMed]

7.

H.-K. Lo, M. Curty, and B. Qi, “Measurement-device-independent quantum key distribution,” Phys. Rev. Lett. 108, 130503 (2012). [CrossRef] [PubMed]

8.

S. L. Braunstein and S. Pirandola, “Side-channel-free quantum key distribution,” Phys. Rev. Lett. 108, 130502 (2012). [CrossRef] [PubMed]

9.

A. Rubenok, J. A. Slater, P. Chan, I. Lucio-Martinez, and W. Tittel, “Real-world two-photon interference and proof-of-principle quantum key distribution immune to detector attacks,” Phys. Rev. Lett. 111, 130501 (2013). [CrossRef] [PubMed]

10.

Y. Liu, T.-Y. Chen, L.-J. Wang, H. Liang, G.-L. Shentu, J. Wang, K. Cui, H.-L. Yin, N.-L. Liu, L. Li, X. Ma, J. S. Pelc, M. M. Fejer, Q. Zhang, and J.-W. Pan, “Experimental measurement-device-independent quantum key distribution,” Phys. Rev. Lett. 111, 130502 (2013). [CrossRef] [PubMed]

11.

T. F. da Silva, D. Vitoreti, G. B. Xavier, G. P. Temporão, and J. P. von der Weid, “Proof-of-principle demonstration of measurement device independent QKD using polarization qubits,” Phys. Rev. A. 88, 052303 (2013). [CrossRef]

12.

Z. Tang, Z. Liao, F. Xu, B. Qi, L. Qian, and H.-K. Lo, “Experimental demonstration of polarization encoding measurement-device-independent quantum key distribution,” arXiv:1306.6134 [quant-ph].

13.

G. Brassard, N. Lütkenhaus, T. Mor, and B. Sanders, “Limitation on practical quantum cryptography,” Phys. Rev. Lett. 85, 1330 (2000). [CrossRef] [PubMed]

14.

W. Hwang, “Quantum key distribution with high loss: towards global secure communication,” Phys. Rev. Lett. 91, 057901 (2003). [CrossRef]

15.

H.-K. Lo, X. Ma, and K. Chen, “Decoy state quantum key distribution,” Phys. Rev. Lett. 94, 230504 (2005). [CrossRef] [PubMed]

16.

X. Wang, “Beating the photon-number-splitting attack in practical quantum cryptography,” Phys. Rev. Lett. 94, 230503 (2005). [CrossRef] [PubMed]

17.

N. Gisin, S. Fasel, B. Kraus, H. Zbinden, and G. Ribordy, “Trojan-horse attacks on quantum-key-distribution systems,” Phys. Rev. A 73, 022320 (2006). [CrossRef]

18.

C.-H. F. Fung, B. Qi, K. Tamaki, and H.-K. Lo, “Phase-remapping attack in practical quantum key distribution systems,” Phys. Rev. A 75, 032314 (2007). [CrossRef]

19.

A. Lamas-Linares and C. Kurtsiefer, “Breaking a quantum key distribution system through a timing side channel,” Opt. Express 15, 9388–9393 (2007). [CrossRef] [PubMed]

20.

Y. Zhao, C.-H. F. Fung, B. Qi, C. Chen, and H.-K. Lo, “Quantum hacking: experimental demonstration of time-shift attack against practical quantum key distribution systems,” Phys. Rev. A , 78, 042333 (2008). [CrossRef]

21.

L. Lydersen, C. Wiechers, C. Wittmann, D. Elser, J. Skaar, and V. Makarov, “Thermal blinding of gated detectors in quantum cryptography,” Opt. Express 18, 27938–27954 (2010). [CrossRef]

22.

L. Lydersen, C. Wiechers, C. Wittmann, D. Elser, J. Skaar, and V. Makarov, “Hacking commercial quantum cryptography systems by tailored bright illumination,” Nat. Photonics 4, 686–689 (2010). [CrossRef]

23.

Z. L. Yuan, J. F. Dynes, and A. J. Shields, “Avoiding the blinding attack in QKD,” Nat. Photonics 4, 800–801 (2010). [CrossRef]

24.

L. Lydersen, C. Wiechers, C. Wittmann, D. Elser, J. Skaar, and V. Makarov, “Avoiding the blinding attack in QKD,” Nat. Photonics 4, 801 (2010). [CrossRef]

25.

C. Bennett and G. Brassard, “Quantum cryptography: public key distribution and coin tossing,” Proceedings of IEEE International Conference on Computers Systems and Signal Processing, 175 (1984).

26.

X.-B. Wang, “Three-intensity decoy-state method for device-independent quantum key distribution with basis-dependent errors,” Phys. Rev. A 87, 012320 (2013). Note that we have corrected a mistake present in Eq. (17). [CrossRef]

27.

Note that a pulse does not necessarily contain one single photon. In particular, when considering attenuated light pulses, the number of photons in a pulse will, for example, follow the Poissonian distribution.

28.

F. Xu, M. Curty, B. Qi, and H.-K. Lo, “Practical aspects of measurement-device-independent quantum key distribution,” New J. Phys. 15, 113007 (2013). [CrossRef]

29.

To the best of our knowledge, this assumption correctly describes all existing experimental implementations. See section 5 for more information.

30.

Note that this approximation is, in general, not correct. However, in order to obtain the best performance from a QKD implementation, the noise level should be as low as possible, i.e. Pn∼ 0.

31.

The separation of photons into genuine qubit photons and background photons is somewhat artificial – as a matter of fact, there is no way to distinguish background photons from real photons. As already stated in section 4.1, the distinction is motivated by the need to write down a general expression for all emitted single-photon qubit states using parameters that can be characterized directly through experiments (these measurements are further described below).

32.

D. Stucki, G. Ribordy, A. Stefanov, H. Zbinden, J. Rarity, and T. Wall, “Photon counting for quantum key distribution with Peltier cooled InGaAs/InP APDs,” J. Mod. Opt. 48, 1967–1981 (2001). [CrossRef]

33.

C. K. Hong, Z. Y. Ou, and L. Mandel, “Measurement of subpicosecond time intervals between two photons by interference,” Phys. Rev. Lett. 59, 2044 (1987). [CrossRef] [PubMed]

34.

L. Mandel, “Photon interference and correlation effects produced by independent quantum sources,” Phys. Rev. A , 28, 929 (1983). [CrossRef]

35.

K. Tamaki, H.-K. Lo, C.-H. F. Fung, and B. Qi, “Phase encoding schemes for measurement device independent quantum key distribution and basis-dependent flaw,” arxiv:1111.3413v4 (2013).

36.

M. Sasaki, “Field test of quantum key distribution in the Tokyo QKD network,” Opt. Express , 19, 10387–10409 (2011). [CrossRef] [PubMed]

37.

F. Marsili, V. B. Verma, J. A. Stern, S. Harrington, A. E. Lita, T. Gerrits, I. Vayshenker, B. Baek, M. D. Shaw, R. P. Mirin, and S. W. Nam, “Detecting single infrared photons with 93% system efficiency,” Nat. Photonics 7, 210–214 (2013). [CrossRef]

38.

For instance, EOSpace sells intensity modulators with 50 dB extinction ratio.

OCIS Codes
(040.5570) Detectors : Quantum detectors
(060.2330) Fiber optics and optical communications : Fiber optics communications
(270.5565) Quantum optics : Quantum communications
(270.5568) Quantum optics : Quantum cryptography

ToC Category:
Quantum Optics

History
Original Manuscript: January 13, 2014
Revised Manuscript: March 24, 2014
Manuscript Accepted: March 25, 2014
Published: May 19, 2014

Citation
P. Chan, J. A. Slater, I. Lucio-Martinez, A. Rubenok, and W. Tittel, "Modeling a measurement-device-independent quantum key distribution system," Opt. Express 22, 12716-12736 (2014)
http://www.opticsinfobase.org/oe/abstract.cfm?URI=oe-22-11-12716


Sort:  Author  |  Year  |  Journal  |  Reset  

References

  1. N. Gisin, G. Ribordy, W. Tittel, H. Zbinden, “Quantum cryptography,” Rev. Mod. Phys. 74, 145–195 (2002). [CrossRef]
  2. V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf, M. Dušek, N. Lütkenhaus, M. Peev, “The security of practical quantum key disitrbution,” Rev. Mod. Phys. 81, 1301–1350 (2009). [CrossRef]
  3. A. Dixon, Z. L. Yuan, J. Dynes, A. W. Sharpe, A. Shields, “Continuous operation of high bit rate quantum key distribution,” Appl. Phys. Lett. 96, 161102 (2010). [CrossRef]
  4. D. Stucki, N. Walenta, F. Vannel, R. T. Thew, N. Gisin, H. Zbinden, S. Gray, C. R. Towery, S. Ten, “High rate, long-distance quantum key distribution over 250 km of ultra low loss fibres,” New J. Phys. 11, 075003 (2009). [CrossRef]
  5. T. Schmitt-Manderbach, H. Weier, M. Fürst, R. Ursin, F. Tiefenbacher, T. Scheidl, J. Perdigues, Z. Sodnik, C. Kurtsiefer, J. G. Rarity, A. Zeilinger, H. Weinfurter, “Experimental demonstration of free-space decoy-state quantum key distribution over 144 km,” Phys. Rev. Lett., 98, 010504 (2007). [CrossRef] [PubMed]
  6. L. Masanes, S. Pironio, A. Acín, “Secure device-independent quantum key distribution with causally independent measurement devices,” Nat. Commun. 2, 238 (2011). [CrossRef] [PubMed]
  7. H.-K. Lo, M. Curty, B. Qi, “Measurement-device-independent quantum key distribution,” Phys. Rev. Lett. 108, 130503 (2012). [CrossRef] [PubMed]
  8. S. L. Braunstein, S. Pirandola, “Side-channel-free quantum key distribution,” Phys. Rev. Lett. 108, 130502 (2012). [CrossRef] [PubMed]
  9. A. Rubenok, J. A. Slater, P. Chan, I. Lucio-Martinez, W. Tittel, “Real-world two-photon interference and proof-of-principle quantum key distribution immune to detector attacks,” Phys. Rev. Lett. 111, 130501 (2013). [CrossRef] [PubMed]
  10. Y. Liu, T.-Y. Chen, L.-J. Wang, H. Liang, G.-L. Shentu, J. Wang, K. Cui, H.-L. Yin, N.-L. Liu, L. Li, X. Ma, J. S. Pelc, M. M. Fejer, Q. Zhang, J.-W. Pan, “Experimental measurement-device-independent quantum key distribution,” Phys. Rev. Lett. 111, 130502 (2013). [CrossRef] [PubMed]
  11. T. F. da Silva, D. Vitoreti, G. B. Xavier, G. P. Temporão, J. P. von der Weid, “Proof-of-principle demonstration of measurement device independent QKD using polarization qubits,” Phys. Rev. A. 88, 052303 (2013). [CrossRef]
  12. Z. Tang, Z. Liao, F. Xu, B. Qi, L. Qian, H.-K. Lo, “Experimental demonstration of polarization encoding measurement-device-independent quantum key distribution,” arXiv:1306.6134 [quant-ph].
  13. G. Brassard, N. Lütkenhaus, T. Mor, B. Sanders, “Limitation on practical quantum cryptography,” Phys. Rev. Lett. 85, 1330 (2000). [CrossRef] [PubMed]
  14. W. Hwang, “Quantum key distribution with high loss: towards global secure communication,” Phys. Rev. Lett. 91, 057901 (2003). [CrossRef]
  15. H.-K. Lo, X. Ma, K. Chen, “Decoy state quantum key distribution,” Phys. Rev. Lett. 94, 230504 (2005). [CrossRef] [PubMed]
  16. X. Wang, “Beating the photon-number-splitting attack in practical quantum cryptography,” Phys. Rev. Lett. 94, 230503 (2005). [CrossRef] [PubMed]
  17. N. Gisin, S. Fasel, B. Kraus, H. Zbinden, G. Ribordy, “Trojan-horse attacks on quantum-key-distribution systems,” Phys. Rev. A 73, 022320 (2006). [CrossRef]
  18. C.-H. F. Fung, B. Qi, K. Tamaki, H.-K. Lo, “Phase-remapping attack in practical quantum key distribution systems,” Phys. Rev. A 75, 032314 (2007). [CrossRef]
  19. A. Lamas-Linares, C. Kurtsiefer, “Breaking a quantum key distribution system through a timing side channel,” Opt. Express 15, 9388–9393 (2007). [CrossRef] [PubMed]
  20. Y. Zhao, C.-H. F. Fung, B. Qi, C. Chen, H.-K. Lo, “Quantum hacking: experimental demonstration of time-shift attack against practical quantum key distribution systems,” Phys. Rev. A, 78, 042333 (2008). [CrossRef]
  21. L. Lydersen, C. Wiechers, C. Wittmann, D. Elser, J. Skaar, V. Makarov, “Thermal blinding of gated detectors in quantum cryptography,” Opt. Express 18, 27938–27954 (2010). [CrossRef]
  22. L. Lydersen, C. Wiechers, C. Wittmann, D. Elser, J. Skaar, V. Makarov, “Hacking commercial quantum cryptography systems by tailored bright illumination,” Nat. Photonics 4, 686–689 (2010). [CrossRef]
  23. Z. L. Yuan, J. F. Dynes, A. J. Shields, “Avoiding the blinding attack in QKD,” Nat. Photonics 4, 800–801 (2010). [CrossRef]
  24. L. Lydersen, C. Wiechers, C. Wittmann, D. Elser, J. Skaar, V. Makarov, “Avoiding the blinding attack in QKD,” Nat. Photonics 4, 801 (2010). [CrossRef]
  25. C. Bennett, G. Brassard, “Quantum cryptography: public key distribution and coin tossing,” Proceedings of IEEE International Conference on Computers Systems and Signal Processing, 175 (1984).
  26. X.-B. Wang, “Three-intensity decoy-state method for device-independent quantum key distribution with basis-dependent errors,” Phys. Rev. A 87, 012320 (2013). Note that we have corrected a mistake present in Eq. (17). [CrossRef]
  27. Note that a pulse does not necessarily contain one single photon. In particular, when considering attenuated light pulses, the number of photons in a pulse will, for example, follow the Poissonian distribution.
  28. F. Xu, M. Curty, B. Qi, H.-K. Lo, “Practical aspects of measurement-device-independent quantum key distribution,” New J. Phys. 15, 113007 (2013). [CrossRef]
  29. To the best of our knowledge, this assumption correctly describes all existing experimental implementations. See section 5 for more information.
  30. Note that this approximation is, in general, not correct. However, in order to obtain the best performance from a QKD implementation, the noise level should be as low as possible, i.e. Pn∼ 0.
  31. The separation of photons into genuine qubit photons and background photons is somewhat artificial – as a matter of fact, there is no way to distinguish background photons from real photons. As already stated in section 4.1, the distinction is motivated by the need to write down a general expression for all emitted single-photon qubit states using parameters that can be characterized directly through experiments (these measurements are further described below).
  32. D. Stucki, G. Ribordy, A. Stefanov, H. Zbinden, J. Rarity, T. Wall, “Photon counting for quantum key distribution with Peltier cooled InGaAs/InP APDs,” J. Mod. Opt. 48, 1967–1981 (2001). [CrossRef]
  33. C. K. Hong, Z. Y. Ou, L. Mandel, “Measurement of subpicosecond time intervals between two photons by interference,” Phys. Rev. Lett. 59, 2044 (1987). [CrossRef] [PubMed]
  34. L. Mandel, “Photon interference and correlation effects produced by independent quantum sources,” Phys. Rev. A, 28, 929 (1983). [CrossRef]
  35. K. Tamaki, H.-K. Lo, C.-H. F. Fung, B. Qi, “Phase encoding schemes for measurement device independent quantum key distribution and basis-dependent flaw,” arxiv:1111.3413v4 (2013).
  36. M. Sasaki et al., “Field test of quantum key distribution in the Tokyo QKD network,” Opt. Express, 19, 10387–10409 (2011). [CrossRef] [PubMed]
  37. F. Marsili, V. B. Verma, J. A. Stern, S. Harrington, A. E. Lita, T. Gerrits, I. Vayshenker, B. Baek, M. D. Shaw, R. P. Mirin, S. W. Nam, “Detecting single infrared photons with 93% system efficiency,” Nat. Photonics 7, 210–214 (2013). [CrossRef]
  38. For instance, EOSpace sells intensity modulators with 50 dB extinction ratio.

Cited By

Alert me when this paper is cited

OSA is able to provide readers links to articles that cite this paper by participating in CrossRef's Cited-By Linking service. CrossRef includes content from more than 3000 publishers and societies. In addition to listing OSA journal articles that cite this paper, citing articles from other participating publishers will also be listed.


Next Article »

OSA is a member of CrossRef.

CrossCheck Deposited