Coherent one-way quantum conference key agreement based on twin field

The establishment of quantum network is the ultimate goal of quantum communication, where QKD is the most mature subfield for applications. QKD allows secret key sharing between two distant authorized participants with unconditional security Bennett and Brassard (1984); Ekert (1991). But the number of participants in QKD is merely two. In many other scenarios on quantum networks, such as web conference and online courses, there are far more than two users who need to share keys. Quantum CKA  Bose et al. (1998); Cabello (2000); Chen and Lo (2007); Matsumoto (2007) gives the solution, which aims to distribute common secret keys among multiple parties. The advantages of quantum CKA over repeating QKD in quantum networks are that quantum CKA requires fewer resource qubits, transmits fewer classical bits and performs fewer rounds of error correction and privacy amplification steps, which have been illustrated by researchers Epping et al. (2017). After more than two decades of development, many quantum CKA protocols have been proposed Fu et al. (2015); Epping et al. (2017); Proietti et al. (2020); Zhu et al. (2015); Wu et al. (2016); Ottaviani et al. (2019); Chen et al. (2016, 2017); Ribeiro et al. (2018); Li et al. (2018); Pivoluska et al. (2018); Jo and Son (2019); Zhao et al. (2020); Yin and Chen (2020), including measurement-device-independent Fu et al. (2015) and device-independent Ribeiro et al. (2018) protocols. Details can be found in the review article Murta et al. (2020).

Nevertheless, the conference key rates in a majority of quantum CKA protocols are rigorously restricted by the total efficiency among quantum channels, which is an upper bound of the conference key rates Das et al. (2019). Although some techniques may be utilized to break this upper bound, such as quantum repeaters Duan et al. (2001), adaptive measurement-device-independence Azuma et al. (2015) and W states with single-photon interference Grasselli et al. (2019), these approaches are difficult to be implemented practically. Recently, a three-party quantum CKA Yin and Chen (2020), inspired by the twin-field QKD Lucamarini et al. (2018); Wang et al. (2018); Yin and Fu (2019), is presented to overcome this limit in a practical way. However, this protocol Yin and Chen (2020) requires to exploit the decoy-state method Wang (2005); Lo et al. (2005), including the active and high precision phase randomization and multiple intensity modulation, which increases the experimental complexity in quantum state preparation.

Here, we propose a simple scheme for three-party quantum CKA protocol to break this limit by combining the methods of coherent one-way QKD Stucki et al. (2005) and twin-field QKD Lucamarini et al. (2018). The simulation results show that this protocol can be demonstrated over 450 km with available technology. Our protocol employs weak coherent states with intensity 0 or $\mu$ to encode logic bits. Therefore, phase randomization and pulse modulation with different intensities are circumvented in our protocol, which results in a much simpler experimental setup and decreased security risks caused by imperfect phase randomization. The security proof of our protocol, surprisingly, can directly utilize the security analysis of coherent one-way QKD Stucki et al. (2005); Branciard et al. (2008); Korzh et al. (2015). Our protocol promotes the practical process of quantum CKA and may have a good application prospect.

As shown in figure 1, there exist three parties in our protocol, named Alice, Bob and Charlie. Alice and Bob serve as senders while Charlie serves as a receiver. Since participants in our protocol encode logic bits with weak coherent states instead of single-photon states, our scheme features a simple experimental setup where senders only require a laser source and an intensity modulator to generate pulses.

Each sender prepares a pulse with intensity $\mu$ (0) for logic bit 1 (0). They both send pulses with a period of $2T$. Charlie measures the received pulses in time-interference bases and applies a passive-basis choice. Bits are encoded in the time basis and coherence is checked in the interference basis. For Charlie, we set that ${\lvert 0\rangle}_{\rm A}{\lvert\alpha\rangle}_{\rm B}$ ($|\alpha|^{2}=\mu$) means 0 and ${\lvert\alpha\rangle}_{\rm A}{\lvert 0\rangle}_{\rm B}$ means 1. Charlie employs $D_{1}$ and $D_{2}$ to perform passive measurements in the time basis. Specifically, the bit value is 0 when only $D_{2}$ clicks in the time basis while the bit value is 1 when only $D_{1}$ clicks. The distance between BS2-BS3 is longer than that between BS1-BS3 so as to delay Bob’s pulses for a fixed time $T$ before entering the interferometer, which helps transform Alice’s and Bob’s pulse trains with the period of 2T into pulse trains with the period of T in two arms of the interferometer after BS3. The delay introduced in one arm of the interferometer is used to make the neighboring pulses interfere with each other. Coherence can be quantified through the visibility of the interference. We denote the time slot when Charlie performs interferometric measurements as $i$, with $i\in\{T,2T,3T,...,2NT\}$, where $N$ is the is the total number of pulses sent by Alice (Bob). And we set $k$ is an integer ranging from 1 to N. Visibility can be calculated by Stucki et al. (2005):

where $P(D_{t})$ is the probability that detector $D_{3}$ clicks when $i=(2k+1)T$ or $D_{4}$ clicks at $i=2kT$ and $P(D_{f})$ is the probability that detector $D_{4}$ clicks at $(2k+1)T$ or $D_{3}$ clicks at $2kT$. The definition of visibility is similar to that in coherent one-way QKD and we relate the two schemes in Section III. If the coherence of the signals is perfectly preserved, $P(D_{f})=0$ and $V=1$.

The whole process of our protocol is stated as follows:

1. Preparation. Alice (Bob) randomly prepares weak coherent pulses ${\lvert\alpha\rangle}$ with probability $t$, and ${\lvert 0\rangle}$ with probability $1-t$. Bob flips his logic bits after sending his pulses. They send the optical pulses to Charlie through insecure quantum channels.

2. Measurement. Charlie measures the received pulses in time-interference bases. Alice’s (Bob’s) pulse is split into two sub-pulses by BS1 (BS2). For Alice (Bob), one of two sub-pulses is sent to D1 (D2) for measurements in the time basis and the other two bunches of pulses are used for interferometric measurements. Charlie records when and which detector clicks. If different detectors click at the same time in the time basis, Charlie randomly chooses a bit value. If detectors click at the same time in different bases, Charlie discards relevant data.

3. Reconciliation. Charlie announces the moment when detectors click and the corresponding basis information. Alice and Bob publicly announce the intensity information only when detectors in interference basis click. Participants calculate visibility when there exist two neighboring ${\lvert\alpha\rangle}$, i.e. ${\lvert\alpha\rangle}_{b_{k}}{\lvert\alpha\rangle}_{a_{k}}$ or ${\lvert\alpha\rangle}_{a_{k+1}}{\lvert\alpha\rangle}_{b_{k}}$.

4. Parameter estimation. Participants disclose a part of bit values from time basis to estimate the bit error rate and the gain of states, ${\lvert 0\rangle}{\lvert\alpha\rangle}$ and ${\lvert\alpha\rangle}{\lvert 0\rangle}$, which are used to encode logic bits. They evaluate the information Eve gets by calculating the visibility.

5. Key distillation. They extract the common conference key after classical error correction and privacy amplification.

We discuss the security of our protocol in this section. As depicted in figure 2, we reduce our scheme to previous coherent one-way QKD Stucki et al. (2005). We first present the typical coherent one-way QKD set-up in figure 2(a). Alice sends pulses and Bob detects them. For both of them, logic bits are encoded with two-pulse sequences. As an intermediate step towards our scheme, the common path of coherent one-way QKD is unfolded in figure 2(b). In this case, the two pulses travel on separate channels and are encoded together. The rule of encoding logic bits is similar to above. Blue pulses are one-pulse time later than red ones. After BS3, red and blue pulses with the period of 2T are transformed into pulse trains with the period of T in two arms of the interferometer, respectively. On short arm of the interferometer, the blue pulses have the opposite phase with other pulses, which is the only difference between figure 2(a) and figure 2(b) in the interference basis. Therefore, we calculate visibility according to the parity of pulse’s time slot which can be seen in equation (1). The two schemes are equivalent from a security perspective. In figure 2(c), we present the quantum CKA scheme. The detecting section have been outsourced to Charlie and the users’ stations have been separated. Alice and Bob send pulses at the same time and Bob’s (blue) pulses are postponed before entering the interferometer, which makes no difference in the measurements. Therefore, attacks on two different protocols have same influence. Thus we can take advantage of the security analysis of the existing protocol which is secure against a large class of collective attacks  Branciard et al. (2008); Korzh et al. (2015).

By using the result of coherent one-way QKD (see also in A), the asymptotic conference key rate of our protocol can be written as

where Q_xy is the gain for the case of Alice choosing intensity x and Bob choosing intensity y, with x, y $\in\{0,\mu\}$. $E_{\rm T}$ is the error rate under time basis and $h(x)$ is the binary Shannon entropy. $V$ is visibility in the interference basis. $Q_{\mu}fh(E_{\mu})$ is the leaked information during classical error correction. Here, $Q_{\mu}$ and $f$ are the overall gain under time basis and the error correction efficiency, respectively. $E_{\mu}$ is the max error rate between X (X $\in\{{\rm Alice,Bob}\}$) and Charlie. $\zeta(\mu,V)=(2V-1)e^{-\mu}-2\sqrt{(1-e^{-2\mu})V(1-V)}$ from Korzh et al. (2015). More simulation details can be seen in B.

Here, we assume that the sources and channels are all symmetric. The distances between Alice-Charlie and Bob-Charlie are L/2. Besides, the detection efficiencies and dark count rates of Charlie’s detectors are the same. The total efficiency of quantum channel is $\prod\limits_{i=1}^{n}\eta_{i}$, where $\eta_{i}$ is the efficiency of one quantum channel. The repeaterless bound between two users is PLOB bound and its form is $-\log_{2}(1-\eta)$ Pirandola et al. (2017), where $\eta$ is the channel efficiency between two users. Denote $\eta_{\rm lim}=\eta_{\rm d}\times 10^{-\alpha L/10}$ as the total efficiency among quantum channels and $\eta_{\rm rpl}=-\log_{2}(1-\eta_{\rm d}\times 10^{-\alpha L/20})$ as repeaterless bound Pirandola (2020); Takeoka et al. (2019), which is a generalized form of the two-user repeaterless bound Takeoka et al. (2014); Pirandola et al. (2017). We utilize the practical parameters which are presented in table 1 and optimize the conference key rate over the free parameters t and $\mu$. By applying above-mentioned steps, the performance of our protocol is shown in figure 3. Conference key rates in our protocol can break the limit of the total efficiency among quantum channels when the misalignment rate of interference basis $e^{\prime}_{\rm d}$ is lower than $3\%$. Under this circumstance, the transmission distance of our protocol reaches over 450 km theoretically.

In summary, by employing coherent states, we have proposed a practical quantum CKA protocol that allows three parties to share secure conference keys. Since Charlie encodes logic bits with a nonempty coherent state and a vacuum state, the key feature of our scheme is removing the requirement of coincidence detection, which is similar to the key idea of twin-field QKD. Scaling as O($\sqrt{\eta}$) rather than O($\eta$), the conference key rate of our practical protocol can surpass the limit of the overall efficiency among quantum channels when the misalignment rate of the interference basis is lower than $3\%$. The key rates of existing quantum CKA protocols are lower than that of repeating QKD and our protocol makes a contribution to narrowing the gap. Our protocol can be theoretically demonstrated over 450 km, whose performance is significantly beyond that in most previous works. Furthermore, encoding logic bits with coherent pulses, without the process of phase randomization and multiple intensity modulation, decreases the experimental difficulty and avoids the possible attacks caused by imperfect phase randomization. Besides, a strong reference pulse for synchronization and the phase stabilization are also required in our protocol.

We believe that our practical quantum CKA protocol has wide application prospect and can be widely implemented in the approaching large-scale quantum network. But note that our scheme still fails to beat the repeaterless bound and extending our scheme to N (${\rm N}>3$) parties is a nontrivial work. Unlike the twin-field QKD, our protocol is not a measurement-device-independent scheme. We hope evolving technologies can improve our protocol’s performance.

We gratefully acknowledge support from the National Natural Science Foundation of China (under Grant No. 61801420); the Key Research and Development Program of Guangdong Province (under Grant No. 2020B0303040001); the Fundamental Research Funds for the Central Universities.