Composable finite-size effects in free-space CV-QKD systems

In the asymptotic regime collective attacks are as powerful as coherent attacks Renner.Cirac.PRL.2009 , and for Gaussian protocols, Gaussian collective attacks are asymptotically optimal Garcia-Patron.Cerf.PRL.06 ; Navascues.Grosshans.PRL.06 ; Wolf.Giedke.Cirac.PRL.06 . Note also that for Gaussian protocols, among individual attacks, Gaussian individual attacks are asymptotically optimal Garcia-Patron.PhD.07 .

In the finite-size regime, the no-switching CV-QKD protocol with $N$ coherent states sent by Alice to Bob is $\epsilon$-secure against Gaussian collective attacks in a reverse reconciliation scenario if $\epsilon{=}2\epsilon_{\rm sm}{+}\bar{\epsilon}{+}\epsilon_{\rm PE}{+}\epsilon_{\rm cor}$ Finite-size-Leverrier-2015 ; Finite-size-Lupo-MDI and if the key length $\ell$ is chosen such that Finite-size-Leverrier-2015 ; Finite-size-Lupo-MDI

where Finite-size-Leverrier-2015 ; Finite-size-Lupo-MDI

where $N^{\prime}=N-k$, with $k$ the number of data points Alice and Bob are required to disclose during the parameter estimation, $d$ is the discretization parameter (i.e., each symbol is encoded with $d$ bits of precision), $\epsilon_{\rm sm}$ is the smoothing parameter, $\epsilon_{\rm cor}$ and $\epsilon_{\rm PE}$ are the maximum failure probabilities for the error correction and parameter estimation, respectively, and $I(a{:}b)$ is the classical mutual information shared between Alice and Bob, and $0\leq\beta\leq 1$ is the reconciliation efficiency. Note that in the finite-size regime the usual $\chi(b{:}E)$ (the maximum mutual information shared between Eve and Bob limited by the Holevo bound for the collective attack) has to be replaced by $\chi^{\epsilon_{\rm PE}}(b{:}E)$, taking into account the finite precision of the parameter estimation. In fact, it is now assumed that Eve’s information is upper bounded by $\chi^{\epsilon_{\rm PE}}(b{:}E)$, except with the probability $\epsilon_{\rm PE}$. The final key rate is then given by $\ell/N$.

Note that for the $\epsilon$-security analysis of the same protocol against Gaussian individual attacks we can still use Eq. (1), where $\chi^{\epsilon_{\rm PE}}(b{:}E)$ must be replaced by the classical mutual information between Eve and Bob, maximised by $I^{\epsilon_{\rm PE}}(b{:}E)$ except with the probability $\epsilon_{\rm PE}$.

Note also that based on the recent security proof in Finite-size-Leverrier2017 ; Finite-size-Leverrier2019 , for analysing the composable finite-size security of the no-switching CV-QKD protocol against general attacks, the security of the protocol can be first analysed against Gaussian collective attacks with a security parameter $\epsilon$ Finite-size-Leverrier-2015 through the use of Eq. (1), and then, by using the Gaussian de Finetti reduction Finite-size-Leverrier2017 , the security can be obtained against general attacks with a polynomially larger security parameter $\tilde{\epsilon}$ Finite-size-Leverrier2017 . Note that the security loss due to the reduction from general attacks to Gaussian collective attacks scales like $\mathit{O}(N^{4})$ Finite-size-Leverrier2017 . More precisely, according to Finite-size-Leverrier2017 , $\epsilon$-security against Gaussian collective attacks implies $\tilde{\epsilon}$-security against general attacks, with $\tilde{\epsilon}/\epsilon=\mathit{O}(N^{4})$.

For the security analysis against collective attacks with the security parameter $\epsilon$ ($\epsilon{=}2\epsilon_{\rm sm}{+}\bar{\epsilon}{+}\epsilon_{\rm PE}{+}\epsilon_{\rm cor}$) one could also write $H_{\min}^{\epsilon_{\rm sm}}(b\left|E\right){=}\sum\nolimits_{i}p_{i}{H_{\min,i}^{\epsilon_{\rm sm},i}(b\left|E\right)}$, where $H_{\min,i}^{\epsilon_{\rm sm},i}(b\left|E\right)$ is the conditional smooth min-entropy for a sub-channel with parameters $\eta_{i}$ and $\xi_{\eta_{i}}$ occurring with probability $p_{i}$, and $\epsilon_{{\rm sm},i}=p_{i}\epsilon_{\rm sm}$. By considering an optimal Gaussian collective attack with parameters $\eta_{i}$ and $\xi_{\eta_{i}}$ over the sub-channel, one can lower bound $H_{\min,i}^{\epsilon_{\rm sm},i}(b\left|E\right)$ by the conditional von Neumann entropy since the attack is i.i.d over the sub-channel (note that this attack is not i.i.d over all sub-channels). More explicitly, one can analyse the security for each sub-channel separately, i.e., calculate the composable finite-size key length for each sub-channel with the security parameter $\epsilon_{i}$ (where $\epsilon_{i}=p_{i}\epsilon$) as $\ell_{i}=N^{\prime}_{s}[\beta I_{i}(a{:}b){-}\chi_{i}^{\epsilon_{\rm PE},i}(b{:}E)]{-}\sqrt{N^{\prime}_{s}}{\Delta_{\rm AEP}}{-}2\log_{2}(\frac{1}{{2\bar{\epsilon}_{i}}})$ (where $N_{s}^{\prime}=p_{i}N^{\prime}$, and where $I_{i}(a{:}b)$ is the classical mutual information between Alice and Bob for the sub-channel, and $\chi_{i}^{\epsilon_{\rm PE},i}(b{:}E)$ is Eve’s information from collective attack over the sub-channel, which is calculated based on the covariance matrix ${{\bf{M}}_{A{B_{1}},\eta}}$ with parameter $\epsilon_{{\rm PE},i}=p_{i}\epsilon_{\rm PE}$), and then average over all sub-channels to obtain the total finite-size key rate with the security parameter $\epsilon$ as $\frac{1}{N}\sum\nolimits_{i}\ell_{i}$. Note that in a realistic finite-size regime this approach might result in pessimistic key rates. This is due to the fact that in practice only a small number of signal states can be transmitted over each sub-channel, which results in a very pessimistic finite key length for each sub-channel, i.e., $\ell_{i}$, since Eve’s information, $\chi_{i}^{\epsilon_{\rm PE},i}(b{:}E)$, which is estimated based on a small number of signals $k_{s}$ (where $k_{s}=p_{i}k$), might be overestimated (when the block size is reduced, the error bar on the estimators of channel parameters increases, which results in estimating higher information for Eve). Note that this type of security analysis can also be used against individual attacks, however as discussed earlier the resulting key rate is expected to be pessimistic.

Note that in practice, it would be more practical to estimate the average SNR of the free-space channel based on the whole revealed data, and then choose an error-correction code rate based on this average SNR for the error correction of the whole remaining data. This means the mutual information should be calculated theoretically based on the effective parameters of the channel, i.e., $\eta_{f}$ and $\xi_{f}$. Alternatively and also ideally, it could be possible to estimate the SNR for each sub-channel separately, and then choose an error-correction code rate based on the sub-channel SNR for the error correction of the sub-channel data, which means the mutual information should be calculated theoretically by averaging over the mutual information obtained from each sub-channel as $\sum\nolimits_{i}p_{i}I_{i}(a{:}b)$. However, estimation of SNR for each sub-channel based on a small number of signals revealed for each sub-channel does not give a good estimation of SNR. Note that in our numerical simulations we calculate the mutual information based on the effective parameters $\eta_{f}$ and $\xi_{f}$, which is a lower bound on $\sum\nolimits_{i}p_{i}I_{i}(a{:}b)$.

Alice and Bob are able to estimate the channel transmissivity and check its stability during the transmission of data cluster-2019 ; PE-freespace2019 . This is experimentally feasible, as the typical rate of free-space channel fluctuations is of the order of KHz, while the modulation and detection rate is typically of the order of several MHz, i.e., at least thousands of signal states can be transmitted during the stability time of the free-space channel Usenko-NJP-12 . The proper sub-channel estimation requires a large number of states to be sent through the channel during its stability. Then, some of the states for each sub-channel occurrence are randomly chosen for the parameter estimation.

For instance, let us consider the free-space channel fluctuation rate of 1 KHz. Then, we can assume that within each millisecond the channel is relatively stable and can be modelled with a fixed-transmissivity sub-channel of transmissivity $\eta$. Let us also consider the transmission and detection rate of 100 MHz. Hence, $N_{s}=10^{5}$ signal states can be transmitted and detected at the receiver during the stability time of the channel. A fraction of these signals ($k_{s}=cN_{s}$) can be randomly chosen to reveal for parameter estimation, with the remaining data contributing to the secret key. Finally, for instance, for 100 seconds of data transmission we will have transmitted $N=10^{10}$ signal states (with $10^{5}$ signal states being transmitted during each stability time of the channel), with a fraction of which, $k=cN$, revealed over all sub-channels for the parameter estimation. Then, a number of $N^{\prime}=N-k=(1-c)N$ signals will contribute to the shared secret key. Note that the security is not analysed for each sub-channel occurrence separately as it results in pessimistic key rates (see Sec. IV.2), instead the security is shown for the ensemble-average state, being obtained from the set of data of size $N-k$ upon all sub-channels.

Since in our security analysis it is sufficient to consider an optimal Gaussian attack with parameters $\eta_{f}$ and $\xi_{f}$, we can generalize the parameter estimation method introduced for a fixed-transmissivity quantum channel in MLE-estimator2010 ; MLE-estimator2012 to estimate the covariance matrix of the ensemble-average state using the data of size $k$ revealed over all sub-channels. For a no-switching CV-QKD protocol with Bob’s heterodyne detector efficiency $\eta_{B}$ and electronic noise $\nu_{B}$, for a channel with fluctuating transmissivity $\eta$, we can consider a normal linear model for Alice and Bob’s correlated variables, $x_{A}$ and $x_{B}$, respectively.

where $t=\sqrt{\frac{\eta_{B}}{2}}{\langle{\sqrt{\eta}}\rangle}=\sqrt{\frac{\eta_{B}\eta_{f}}{2}}$, and $x_{n}$ follows a centred normal distribution with unknown variance $\sigma^{2}=1+\nu_{B}+\frac{\eta_{B}}{2}(\langle{\eta{\xi_{\eta}}}\rangle+{\rm{Var}}(\sqrt{\eta})V_{A})=1+\nu_{B}+\frac{\eta_{B}}{2}\eta_{f}\xi_{f}$ (note that Alice’s variable $x_{A}$ has the variance $V_{A}$). Using the total revealed data of size $k$, we can calculate the maximum-likelihood estimators for $t$ and $\sigma^{2}$, which are given by

where $A_{i}$ and $B_{i}$ are the realizations of $x_{A}$ and $x_{B}$, respectively. The confidence intervals for these parameters are given by $t\in[\hat{t}-\Delta(t),\hat{t}+\Delta(t)]$, and $\sigma^{2}\in[\hat{\sigma}^{2}-\Delta(\sigma^{2}),\hat{\sigma}^{2}+\Delta(\sigma^{2})]$ where

Note that when no signal is exchanged, Bob’s variable with realization $B_{0i}$ follows a centred normal distribution with unknown variance $\sigma_{0}^{2}=1+\nu_{B}$, which is Bob’s shot noise variance. The maximum-likelihood estimator for $\sigma_{0}^{2}$ is given by $\hat{\sigma}_{0}^{2}=\frac{1}{{N}}\sum\nolimits_{i=1}^{N}{{{{{B_{0i}}}}}}$. The confidence intervals for this parameters is given by $\sigma_{0}^{2}\in[\hat{\sigma}_{0}^{2}-\Delta(\sigma_{0}^{2}),\hat{\sigma}_{0}^{2}+\Delta(\sigma_{0}^{2})]$, where $\Delta(\sigma_{0}^{2})={z_{\epsilon_{\rm PE}/2}}\frac{{{\hat{\sigma}_{0}^{2}}\sqrt{2}}}{{\sqrt{N}}}$ ⁴⁴4Note that ${z_{\epsilon_{\rm PE}/2}}$ is such that $1-{\rm erf}(\frac{{z_{\epsilon_{\rm PE}/2}}}{\sqrt{2}})/2=\epsilon_{\rm PE}/2$.. Now we can estimate the effective parameters $\eta_{f}$ and $\xi_{f}$, which are given by

where $\hat{\eta}_{B}$ is the estimator of Bob’s detector efficiency with uncertainty $\Delta(\eta_{B})$. Note that in order to maximise Eve’s information from collective and individual attacks, the worst-case estimators of the effective parameters $\eta_{f}$ and $\xi_{f}$ should be used to evaluate Eve’s information.

Note that for the sub-channel post-selection which we discuss in the next section, Alice and Bob also need to estimate the transmissivity of each sub-channel separately. We can use the similar method as discussed above to estimate the sub-channel transmissivity. Considering a normal linear model $x_{B}=t_{s}x_{A}+x_{n,s}$ for a sub-channel with transmissivity $\eta$, the maximum-likelihood estimators for the sub-channel parameters, $t_{s}$ and $\sigma^{2}_{s}$ (i.e., the variance of $x_{n,s}$), are given by MLE-estimator2010 ; MLE-estimator2012

where $A_{i}$ and $B_{i}$ are the realizations of $x_{A}$ and $x_{B}$ for the sub-channel, respectively, and $k_{s}$ is the number of signals revealed for the sub-channel. The error bar for these parameters are given by

The worst-case estimator of the sub-channel transmissivity $\eta$ is then given by

Note that Alice and Bob have to perform their post-selection based on $\eta^{\rm min}=\hat{\eta}-\Delta(\eta)$.

In the finite-size regime, the size of the post-selected data is $N_{\rm ps}=P_{s}N$, where $P_{s}$ is the post-selection success probability, i.e., the total probability for the channel transmissivity to fall within the post-selected region, $\eta\geq\eta_{\rm th}$, and is given by ${P_{s}}=\int_{{\eta_{\rm th}}}^{\eta_{\rm max}}{p(\eta)}d\eta$. Note that since in the post-selection protocol Eve’s information should be estimated based on the post-selected data, Alice and Bob can only use the revealed data over the post-selected sub-channels to estimate the covariance matrix of the post-selected ensemble-average state, which means a data of size $k_{\rm ps}=P_{s}k$ is used for the parameter estimation. Recall that $k$ is the amount of revealed data over all sub-channels. Hence, the data of size $N^{\prime}_{\rm ps}=N_{\rm ps}-k_{\rm ps}$ contributes to the post-selected key. Explicitly, the finite-size key length of the post-selection protocol which is $\epsilon$-secure against Gaussian collective attacks in the reverse reconciliation scenario is given by

Eve’s information from Gaussian collective attack in the post-selection protocol, is calculated based on the covariance matrix of the post-selected ensemble-average state ${\rho^{\rm ps}_{A{B_{1}}}}$, which is given by

where the symbol $\left\langle.\right\rangle_{\rm ps}$ denotes the mean value over the post-selected sub-channels, i.e.,

Similarly, the finite-size key length of the post-selection protocol which is $\epsilon$-secure against Gaussian individual attacks in the reverse reconciliation scenario is given by

where Eve’s information from Gaussian individual attack in the post-selection protocol has to also be calculated based on the effective parameters $\eta^{\rm ps}_{f}$ and $\xi^{\rm ps}_{f}$. Note that Eve’s information $\chi^{\epsilon_{\rm PE}}_{\rm ps}(b{:}E)$ and $I^{\epsilon_{\rm PE}}_{\rm ps}(b{:}E)$ should be calculated based on the worst-case estimators of the effective parameters $\eta^{\rm ps}_{f}$ and $\xi^{\rm ps}_{f}$, where the estimations in Eqs. (12) to (14) have to be calculated based on the revealed data over the post-selected sub-channels of size $k_{\rm ps}$. Note also that the classical mutual information between Alice and Bob obtained from the post-selection, $I_{\rm ps}(a{:}b)$, is calculated based on the effective parameters $\eta^{\rm ps}_{f}$ and $\xi^{\rm ps}_{f}$, and ${\Delta_{\rm AEP}}$ is calculated using Eq. (2) with $N^{\prime}$ being replaced by $N^{\prime}_{\rm ps}$. Finally, the finite-size key rate of the post-selection protocol is given by $\ell_{\rm ps}/N$. See Appendix A for the detailed calculation of Eve’s information and Alice and Bob’s mutual information.

Note that the post-selection of high-transmissivity sub-channels has two different effects on the finite-size key rate. In fact, on the positive side the post-selection makes the ensemble-average state more Gaussian and more strongly correlated, while on the negative side the post-selection reduces the block size, and also makes the error bars larger in the parameter estimation.

As discussed earlier in Sec. IV.3, Alice and Bob can estimate the transmissivity of each sub-channel by revealing a fraction of the data allocated to each sub-channel. In the post-selection protocol, based on such an estimation of sub-channel transmissivity, they decide to keep or discard the sub-channel data. Note that the sub-channel transmissivity can be estimated using different schemes, e.g., by transmitting auxiliary coherent (classical) light probe signals that are intertwined with the quantum information channel-estimation-2012 ; channel-estimation-2015 , or by monitoring the local oscillator at the receiver, where the signal and the local oscillator have been sent in two orthogonally polarized modes through the free-space channel channel-estimation-LO . However, in all these scenarios it would be very likely for Eve to manipulate the classical probe signal or the local oscillator in such a way to gain an advantage, for instance, forcing Alice and Bob to post-select a particular sub-channel, which is not actually within the post-selection region, can result in underestimating Eve’s information by Alice and Bob.

Fig. 6 shows the post-selected key rate in both the asymptotic and composable finite-size regime as a function of the post-selection threshold $\eta_{\rm th}$, where the security is analysed against both collective and individual attacks. As can be seen for both asymptotic and finite-size regime, the key rate resulting from both collective and individual attacks first improves up to an optimized value, as the threshold value increases, and then the key rate decreases. As the threshold value increases, the variance of the channel fluctuations, $\rm{Var}(\sqrt{\eta})$ decreases, while the effective efficiency, $\langle{\sqrt{\eta}}\rangle$ increases. As a result, the post-selected state becomes more Gaussian (i.e., with less non-Gaussian noise) and more strongly correlated, which increases the mutual information between Alice and Bob. However, this increase in the mutual information happens at the cost of lower success probability, $P_{s}$, and larger error bars for the estimated parameters. Hence, there is an optimal threshold value which maximizes the post-selected key rate. As can be seen, from left to right, the post-selection becomes more effective. In fact, this type of post-selection is more useful for recovering the key rate in cases where it was strongly diminished by the free-space channel. Fig. 6 also shows the significant improvement of the finite-size key rate from collective attacks due to the post-selection compared to the asymptotic regime. While without the post-selection, positive finite key rates cannot be generated against collective attacks for $\langle{\eta}\rangle=0.08$, by performing the post-selection beyond $\eta_{\rm th}=0.05$, Alice and Bob are able to move from an insecure regime to a secure regime, and generate non-trivial positive finite key rates.

For the clusterisation technique, in order to compute the key rate with security parameter $\epsilon$ (where $\epsilon=2\epsilon_{\rm sm}+\bar{\epsilon}+\epsilon_{\rm PE}+\epsilon_{\rm cor}$), the conditional smooth min-entropy $H_{\min}^{\epsilon_{\rm sm}}(b|E)$ can be written as the convex sum of the conditional smooth min-entropy of $n$ different clusters of data, i.e., $H_{\min}^{\epsilon_{\rm sm}}(b|E)=\sum_{j=1}^{n}{P_{j}\,\,H_{\min,j}^{\epsilon_{\rm sm},j}(b|E)}$, with $P_{j}=\int_{\frac{(j-1)\eta_{\rm max}}{n}}^{\frac{j\eta_{\rm max}}{n}}{p(\eta)}d\eta$ is the probability for the channel transmissivity to fall within the $j$th cluster, and $\epsilon_{{\rm sm},j}=P_{j}\epsilon_{\rm sm}$. Note that for each cluster Eve’s attack can be considered as an i.i.d Gaussian attack with effective parameters $\eta^{j}_{f}$ and $\xi^{j}_{f}$, given by

where the symbol $\left\langle.\right\rangle_{j}$ denotes the mean value over all sub-channels within the $j$th cluster, i.e.,

Since the attack can be considered i.i.d over each cluster, we can lower bound $H_{\min,j}^{\epsilon_{\rm sm},j}(b|E)$ with the conditional von Neumann entropy and compute the key length with security parameter $\epsilon_{j}=P_{j}\epsilon$ for the $j$th cluster as $\ell^{\rm col}_{j}=P_{j}N^{\prime}[\beta I_{j}(a{:}b){-}\chi_{j}^{\epsilon_{\rm PE},j}(b{:}E)]{-}\sqrt{P_{j}N^{\prime}}{\Delta_{\rm AEP}}{-}2\log_{2}(\frac{1}{{2\bar{\epsilon}_{j}}})$ against collective attacks, and $\ell^{\rm ind}_{j}=P_{j}N^{\prime}[\beta I_{j}(a{:}b){-}I_{j}^{\epsilon_{\rm PE},j}(b{:}E)]{-}\sqrt{P_{j}N^{\prime}}{\Delta_{\rm AEP}}{-}2\log_{2}(\frac{1}{{2\bar{\epsilon}_{j}}})$ against individual attacks, where $I_{j}(a{:}b)$ is the classical mutual information between Alice and Bob for the $j$th cluster calculated based on the effective parameters $\eta^{j}_{f}$ and $\xi^{j}_{f}$, and $\chi_{j}^{\epsilon_{\rm PE},j}(b{:}E)$ is Eve’s information from collective attack over the $j$th cluster, which is calculated based on the covariance matrix ${{\bf{M}}^{j}_{A{B_{1}}}}$

and $I_{j}^{\epsilon_{\rm PE},j}(b{:}E)$ is Eve’s information from individual attack over the $j$th cluster, which is calculated based on the effective parameters $\eta^{j}_{f}$ and $\xi^{j}_{f}$. Note that Eve’s information, $\chi_{j}^{\epsilon_{\rm PE},j}(b{:}E)$ and $I_{j}^{\epsilon_{\rm PE},j}(b{:}E)$, is now estimated based on the worst-case estimators of the effective parameters $\eta^{j}_{f}$ and $\xi^{j}_{f}$, where the estimations in Eqs. (12) to (14) have to be calculated based on the revealed data over cluster $j$ of size $P_{j}k$, with the maximum failure probability $\epsilon_{{\rm PE},j}=P_{j}\epsilon_{\rm PE}$. Note also that $\Delta_{\rm AEP}$ is calculated using Eq. (2) with $N^{\prime}$ being replaced by $P_{j}N^{\prime}$, and $\Delta_{\rm AEP}$ is now calculated based on the parameters $\epsilon_{j}$, $\epsilon_{{\rm sm},j}$, and $\bar{\epsilon}_{j}=P_{j}\epsilon$. The total key rate with security parameter $\epsilon$ is then given by $\frac{1}{N}\sum_{j=1}^{n}\ell_{j}$.

Fig. 2 shows the key rate in both the asymptotic and composable finite-size regime secure against collective/individual attacks as a function of the number of clusters $n$. Note that $n=1$ indicates no clusterization, where security is analysed over all data. As can be seen clusterization always increases the asymptotic key rate against collective/individual attacks. However, by considering composable finite-size effects in the security analysis, there is an optimal number of clusters which maximises the key rate. In fact, as the number of clusters increases, the variance of channel fluctuation within each cluster decreases. As a result, the non-Gaussian noise becomes smaller for each cluster, which makes the state obtained over each cluster more Gaussian. However, as the number of clusters increases, the number of signals for each cluster decreases. As a result, the composable finite-size effects (i.e., the effect of $\Delta$-term, and the effect of parameter estimation which is now performed based on $P_{j}k$ signals with $\epsilon_{{\rm PE},j}$) become more significant, which reduces the key rate. Fig. 2 shows that while for $\langle{\eta}\rangle=0.08$, without clusterization (i.e., $n=1$) the protocol is not secure against collective attacks in the composable finite-size regime, if Alice and Bob perform clusterisation as described above, the protocol becomes secure against collective attacks and finite key rate is maximised for $n=2$. Note that when the number of clusters, $n$, becomes sufficiently large, the security analysis is performed as if the security is analysed over each sub-channel separately (as described in Sec. IV.2).