Discrete-modulation continuous-variable quantum key distribution with high key rate

The schematic of single-ring signal constellation for discrete-modulation CV-QKD of 8-PSK and 12-PSK is illustrated in Fig. 1. For 8-PSK, the sender Alice prepares the coherent state $\left|{{\alpha}_{x}}\right\rangle=\left|\alpha{{e}^{{ix\pi}/{4}}}\right\rangle$ with $x\in\left\{0,1,2,3,4,5,6,7\right\}$, each coherent state is chosen with an equal probability ${{p}_{x}}={1}/{8}$. Similarly, for 12-PSK, Alice randomly selects a state from the set $\left\{\left|{{\alpha}_{x}}\right\rangle=\left|\alpha{{e}^{{ix\pi}/{6}}}\right\rangle,\text{ }x=0,\cdot\cdot\cdot,11\right\}$, where $\alpha$ is a pre-determined amplitude and can be optimized. The prepared states are sent to Bob through an insecure quantum channel to generate secret keys. Bob measures the received states with heterodyne detection and records the measurement outcome $y\in\mathbb{C}$.

After obtaining enough data, Alice and Bob randomly select a small part of the data for parameter estimation. If the parameter estimation passes, they use the remaining data to extract the keys. Bob obtains his raw key string by a key map. Specifically, Bob labels each outcome $y=\left|y\right|{{e}^{i\theta}}$ according to the region ${{R}_{j}}$ as

where $j\in\left\{0,\cdot\cdot\cdot,7\right\}$ for 8-PSK and $j\in\left\{0,\cdot\cdot\cdot,11\right\}$ for 12-PSK. The raw key string of Alice consists of the label $x$ of her randomly selected state ${{\alpha}_{x}}$. Finally, Alice and Bob implement error correction and privacy amplification procedures to extract secret keys.

For convenience of security analysis, we consider the equivalent entanglement-based (EB) scheme. Here, we mainly use the numerical security proof method presented in Ref. [49, 50] to obtain the secure key rate. In the EB scheme, Alice initially prepares the bipartite state

where $\left|x\right\rangle$ is an orthonormal basis for register $A$. Alice keeps $A$ and sends the register ${A}^{\prime}$ to Bob. To establish the equivalence between the EB scheme and the original prepare-and-measure scheme, Alice applies a local projective measurement on register $A$, which can be described by a POVM ${{M}^{A}}=\left\{M_{x}^{A}=\left|x\right\rangle\left\langle x\right|\right\}$. When obtaining a measurement outcome $x$ with probability ${{p}_{x}}$, the state sent to Bob is effectively collapsed to $\left|{{\alpha}_{x}}\right\rangle$. After the quantum channel transmission, the joint state shared by Alice and Bob is

where ${{\operatorname{id}}_{A}}$ is the identity channel acting on $A$ and ${{\mathcal{E}}_{{A}^{\prime}\to B}}$ describes the quantum channel, which is a completely positive and trace-preserving (CPTP) map. Bob uses his POVM ${{G}_{y}}$ on register $B$ to perform realistic trusted noisy detection.

With the reverse reconciliation, the asymptotic secret key rate against collective attacks is expressed as [49]

where $D\left(\left.\rho\right\|\sigma\right)=\operatorname{Tr}\left(\rho{{\log}_{2}}\rho\right)-\operatorname{Tr}\left(\rho{{\log}_{2}}\sigma\right)$ is the quantum relative entropy; $\mathcal{G}$ describes a completely positive and trace nonincreasing map for postprocessing steps; $\mathcal{Z}$ denotes a pinching quantum channel that reads out the result of key map; $\mathcal{S}$ represents the set of available density operators compatible with experimental observations; ${{p}_{\operatorname{pass}}}$ is the sifting probability of data for key generation; ${{\delta}_{\operatorname{EC}}}$ stands for the leaked information of per signal pulse during the error correction phase and can be computed as follows

where $\beta$ is the reconciliation efficiency. $X$ and $Z$ represent the raw key string of Alice and Bob, respectively.

In order to compute the expected secret key rate, the key point is to find the minimum value of $D\left(\left.\mathcal{G}\left({{\rho}_{AB}}\right)\right\|\mathcal{Z}\left[\mathcal{G}\left({{\rho}_{AB}}\right)\right]\right)$, which is a convex optimization problem matching some constraints and expressed as [50]

where ${{\hat{F}}_{Q}}$ and ${{\hat{F}}_{P}}$ (${{\hat{S}}_{Q}}$ and ${{\hat{S}}_{P}}$) represent the first-moment (second-moment) observables of quadrature operators $\hat{q}$ and $\hat{p}$, respectively. Also notice that Eve cannot access Alice’s system, thus there is an additional constraint

where $n$ takes 7 or 11 according to 8-PSK or 12-PSK.

The postprocessing map $\mathcal{G}$ and pinching quantum channel $\mathcal{Z}$ can be written as [50]

To numerically minimize the objective function, available ${{\rho}_{AB}}$ must be a finite dimension. The dimension of Alice’s system is determined by the number of different signal states that she prepares, which is finite. However the receiver Bob’s state is in an infinite dimensional Hilbert space. This can be circumvented by applying the photon-number cutoff assumption. When the photon number cutoff parameter ${{N}_{c}}$ is chosen to be large enough, this assumption is reasonable. Here, we set an appropriate parameter value of ${{N}_{c}}$ such that the probability of photon number of the received signal state smaller than ${{N}_{c}}$ is close to 1, and larger ${{N}_{c}}$ has no meaningful improvement for the key rate. Then, the matrix expressions of the first-moment observables ${{\hat{F}}_{Q}}$, ${{\hat{F}}_{P}}$, the second-moment observables ${{\hat{S}}_{Q}}$, ${{\hat{S}}_{P}}$, and the region operators ${{R}_{j}}$ in the photon-number basis can be obtained [50].

A tight lower bound on the key rate can be achieved by using a two-step procedure developed in Ref. [51]. At the first step, the Frank-Wolfe algorithm is used to approximately minimize the convex function, and hence obtaining an upper bound on the key rate. At the second step, converting this upper bound to a reliable lower bound by taking the numerical imprecision into account. By using the two-step procedure and defining $f\left(\rho\right)=D\left(\left.\mathcal{G}\left(\rho\right)\right\|\mathcal{Z}\left[\mathcal{G}\left(\rho\right)\right]\right)$, we have

where ${{\rho}_{1}}$ is the suboptimal state obtained in the first step. $\epsilon$ is the perturbation parameter and ${{f}_{\epsilon}}\left({{\rho}_{1}}\right):=D\left(\left.{{\mathcal{G}}_{\epsilon}}\left({{\rho}_{1}}\right)\right\|\mathcal{Z}\left[{{\mathcal{G}}_{\epsilon}}\left({{\rho}_{1}}\right)\right]\right)$. ${{\zeta}_{\epsilon}}=2\epsilon\left({d}^{\prime}-1\right){{\log}_{2}}\frac{{{d}^{\prime}}}{\epsilon\left({d}^{\prime}-1\right)}$, where ${d}^{\prime}$ is the dimension of $\mathcal{G}\left(\rho\right)$. The gradient $\nabla{{f}_{\epsilon}}\left({{\rho}_{1}}\right)$ is given by

$f_{d}^{\max}$ is the dual function and written as

where ${{\Gamma}_{i}}$ and ${{\gamma}_{i}}$ refer to both sides of the equality constraint, respectively, with the form $\operatorname{Tr}\left({{\Gamma}_{i}}\rho\right)={{\gamma}_{i}}$. $nc$ represents the number of all constraints. ${\epsilon}^{\prime}$ is the security parameter related to the numerical imprecision.

We are now in a position to assess the performance of the protocol based on the above approach.

Considering a typical phase-insensitive Gaussian channel in the context of the optical fiber communication. The simulated statistics are given by [50]

where $T$ and $\xi$ represent the transmittance and excess noise of the channel, respectively, and $\eta$ and ${{v}_{el}}$ denote the detection efficiency and electronic noise of the detector.

The probability density function for the result $y$ of a heterodyne measurement conditioned on Alice’s choice $x$ is

Then, according to the key mapping area, the probability that Bob obtains the discretized key value $Z=z$ conditioned on Alice’s choice $x$ is

To extract the optimal secret key rate and fairly compare the performance of different protocols, we first investigate the dependence of the key rate on the coherent state amplitude $\alpha$. In Fig. 2(a), we plot the key rate versus the choice of $\alpha$ for 8-PSK and 12-PSK protocols, at a transmission distance of 50 km. Here, we consider the realistic parameters: reconciliation efficiency $\beta=0.95$, excess noise $\xi=0.01$, detection efficiency $\eta=0.552$, and electronic noise ${{v}_{el}}=0.015$. The dashed line represents the result of step 1 of our algorithm, which gives an upper bound on the key rate, and solid line is the result after step 2, which provides an achievable lower secure bound on the key rate. The gap between step 1 and step 2 is small, hence the obtained bound is tight. We carry out a coarse-grained search for $\alpha$ in the interval [0.7, 1.1] with a step size of 0.05. It is clear that there is an optimal value of $\alpha$ to maximize the key rate. At 50 km, the optimal $\alpha$ for 8-PSK and 12-PSK is 0.9 and 0.92, respectively. In Fig. 2(b), we give the optimal values of $\alpha$ at different transmission distances and the results of 4-PSK protocol are also shown for comparison. Compared with the 4-PSK protocol, 8-PSK allows larger optimal value of $\alpha$, thus providing higher signal-to-noise ratio (SNR). The difference between the optimal $\alpha$ for the 8-PSK and 12-PSK protocols gradually decreases with the increase of transmission distance and is almost indistinguishable over long distances.

In Fig. 3, we present the achievable key rates at different transmission distances for different discrete-modulation protocols and Gaussian modulation protocol. The key rate has been optimized by adopting the optimal modulation amplitude (Fig. 2(b)) and variance. In addition, we have applied the postselection technology to the 4-PSK protocol to obtain the optimal key rate [50]. We can see that the 8-PSK protocol improves the key rate by about 60% over the 4-PSK protocol. Within 10 km, the key rate can be further improved by 10% - 30% if 12-PSK is employed. However, beyond 10 km, the key rate can only be increased by about 4%, which means that the performance of 8-PSK modulation is close to saturation and adding more signal states will not make much difference. Compared with the Gaussian-modulation protocol, the achievable key rate of discrete-modulation is still relatively low. Taking 50 km as an example, the key rates per pulse of the 4-PSK, 8-PSK, 12-PSK and Gaussian modulation protocols are 0.00602, 0.00966, 0.01008, and 0.02103 bits/pulse, respectively. The 4-PSK and 8-PSK protocols can reach approximately 28% and 45% of the key rate of Gaussian modulation. The data postselection is also an interesting strategy to further improve the key rate by 8% for 8-PSK and 12-PSK protocols (see Appendix).