Enhancing discrete-modulated continuous-variable measurement-device-independent quantum key distribution via quantum catalysis

Quantum key distribution (QKD) 1 ; 2 ; 3 ; 4 , as one of the most mature applications in cryptography, aims to share secret keys between two distant legitimate users (Alice and Bob) even in the presence of an eavesdropper (Eve) 5 ; 6 ; 7 . Thanks to the usage of efficient detection schemes, including the homodyne and heterodyne detections, the continuous variable (CV) QKD systems 8 ; 9 ; 10 ; 11 ; 57 not only promise high key rates, but also can be easily compatible with the current optical communication technologies. In particular, since the Gaussian-modulated (GM) CVQKD protocol 9 has been theoretically proved to be secure against collective attacks 12 and coherent attacks 13 , this protocol paves the way for the development of commercial applications. For example, the field tests of the CVQKD system over 50 km commercial fiber have been achieved in recent years 14 . Whereas, in practical implementations, the existence of imperfect detectors may lead to the potential security loopholes that could be successfully exploited by Eve to take some attack strategies, e.g., the local oscillator calibration attack 15 , the wavelength attack 16 , and the detector saturation attack 17 , which are still problems for realizing the practical CVQKD system.

In response to these problems, the measurement-device-independent (MDI) CVQKD protocols were proposed 20 ; 21 ; 22 ; 23 ; 24 ; 25 ; 26 ; 27 ; 56 , where the secret keys between Alice and Bob can be extracted by relying on the measurement results of an untrusted third party (Charlie). This protocol can be immune to all attacks on detectors, and its practical security proof has been analyzed in both the finite-size effect 25 ; 26 and the composable security 27 . However, in contrast to its discrete-variable (DV) counterpart 18 ; 19 , this MDI-CVQKD has limitations in the transmission distance, which is not sufficient for the requirements of the long-distance communication. Therefore, it is an urgent task to lengthen the maximal transmission distance with underlying technology.

Up till now, most of investigations have focused on performance improvement of the MDI-CVQKD system by means of quantum operations 33 ; 34 ; 35 , such as the phase-sensitive optical amplifier and the photon subtraction. To be more specific, using a phase-sensitive optical amplifier to compensate the imperfection of the Bell-state measurement (BSM) implemented by Charlie can improve the performance of the MDI-CVQKD system 33 . In addition, the photon subtraction operations 34 ; 35 have been used for lengthening the maximal transmission distance of the MDI-CVQKD system, and meanwhile these photon-subtracted operations can be emulated by the non-Gaussian postselection in order to circumvent the complexity of configurations. Despite existing the aforementioned advantages, the success probability of implementing photon-subtracted operations is less than $0.25$, which would lead to the limited performance improvements 36 ; 37 . To eliminate this drawback, recently, the quantum catalysis 36 ; 37 ; 38 ; 39 ; 40 ; 41 has been viewed as another useful method to extend the maximal transmission distance of the MDI-CVQKD system 42 , compared with the single-photon subtraction case. Unfortunately, a major problem, common to the aforementioned GM CVQKD, is that the reconciliation efficiency $\beta$ is low, especially on the long-distance transmission with a low signal-to-noise ratio.

To solve this problem, there are two approaches. One is to design effective reconciliation code, such as low-density parity-check code 43 and multidimensional reconciliation code 44 , but this kind of design has a higher cost of hardwares and is hard to be realized in practice, and the alternative is to employ the discrete-modulated (DM) schemes 28 ; 29 ; 30 ; 31 ; 32 ; 51 ; 54 ; 55 , including the four-state protocol and the eight-state protocol, which allows the distribution of secret keys over long distances in the regime of low signal-to-noise ratio with an efficient reconciliation efficiency. Recently, it has been shown 32 that the DM-based MDI-CVQKD under the extreme asymmetric case rather than the symmetric case has an advantage over the GM-based one with respect to the maximal transmission distance. Motivated by the advantages of the DM schemes with an efficient reconciliation efficiency, in this paper, we put forward a feasible method using a zero-photon catalysis (ZPC) operation in order to further enhance the performance of MDI-CVQKD with discrete modulation. Our results under the same accessible parameters show that, as for the extreme asymmetric and symmetric cases, the usage of the ZPC operation on MDI-CVQKD with discrete modulation can not only give birth to the high secret key rates, but also contributes to the reasonable increase of the corresponding optimal variance. Furthermore, the maximal transmission distance can be lengthened when comparing with the traditional DM scheme. More interestingly, our protocol enables the MDI-CVQKD with discrete modulation to tolerate lower reconciliation efficiency.

The rest of this paper is structured as follows. In Sec. II, we first review the entanglement-based (EB) version of the original DM MDI-CVQKD protocol and then demonstrate the effects of the ZPC operation on MDI-CVQKD with discrete modulation in detail. In Sec. III, according to the optimality of Gaussian attack, we derive the asymptotic secret key rate of the ZPC-involved MDI-CVQKD with discrete modulation. In Sec. IV, the simulation results and discussions are provided. Finally, our conclusions are drawn in Sec. V.

The EB version of MDI-CVQKD with discrete modulation is shown in Fig. 1(a), where Alice and Bob respectively generate a two-mode entangled state $\left|\Phi_{4}\right\rangle_{AA_{1}}$ and $\left|\Phi_{4}\right\rangle_{BB_{1}}$, and then both of them respectively hold modes $A$ and $B$ while sending modes $A_{1}$ and $B_{1}$, along with the quantum channels of lengths $L_{AC}$ and $L_{BC}$, to an untrusted third party Charlie who proceeds to interfere with the incoming modes $A_{1}$ and $B_{1}$ at a symmetric beam splitter, and attains two output modes $C_{1}$ and $C_{2}$. After the $x$ ($p$) quadrature of mode $C_{1}$ ($C_{2}$) is measured by the BSM, Charlie proclaims the measured results $\left\{X_{C_{1}},P_{C_{2}}\right\}$. Subsequently, Bob modifies mode $B$ to $\widetilde{B}$ by using a displacement operation $D\left(\gamma\right)$ according to the public results $\left\{X_{C_{1}},P_{C_{2}}\right\},$ where $\gamma=g\left(X_{C_{1}}+iP_{C_{2}}\right)$ with the gain $g$ of a displacement operation. Through heterodyne detections, Alice and Bob respectively measure mode $A$ and $\widetilde{B}$ to attain the outcome results $\left\{X_{A},P_{A}\right\}$ and $\left\{X_{B},P_{B}\right\},$ and finally both of them have to implement the postprocessing to get a string of secret keys.

In what follows, we focus on the ZPC-involved MDI-CVQKD with discrete modulation. For the sake of discussions, here we take the EB version of the four-state protocol into account. As shown in Fig. 1(b), in the Alice’s station, Alice prepares for the two-mode entangled state $\left|\Phi_{4}\right\rangle_{AA_{1}}$ on modes $A$ and $A_{1}$ with a modulated variance $V_{M}=2\alpha^{2}=V_{A}-1$ given by

where the non-Gaussian orthogonal state $\left|\varphi_{l}\right\rangle_{A}$ on mode $A$ is expressed as

with

and $\left|\alpha_{l}\right\rangle_{A_{1}}=$ $\left|\alpha e^{i(2l+1)\pi/4}\right\rangle$ ($l=0,1,2,3$) on mode $A_{1}$ is a modulated coherent state with a positive number $\alpha$. Note that, one of the states $\left|\alpha_{l}\right\rangle_{A_{1}}$with the same probability $1/4$ is randomly sent to Charlie through an unsecure quantum channel. Thus, the corresponding covariance matrix $\Gamma_{AA_{1}}$ of the resending state $\left|\Phi_{4}\right\rangle_{AA_{1}}$ is

where $I_{2}=$diag$\left(1,1\right),\sigma_{z}=$diag$\left(1,-1\right),$ and

In order to lower requirements for device perfection of the quantum catalysis, we assume that, for our protocol, an untrusted third party, David, who is near Alice, controls the ZPC operation (magenta box) where a vacuum state $\left|0\right\rangle_{D}$ in an auxiliary mode $D$ is injected into the beam splitter (BS) with a transmittance $T$, and simultaneously an ideal on/off detector placed at the output port of mode $D$ is used for registering the same state $\left|0\right\rangle_{D}$. As shown in Refs. 36 ; 37 , the vacuum state $\left|0\right\rangle_{D}$ between the input and output ports seems to be unchanged, but promotes the transformation of quantum states between modes $A_{1}$ and $A_{2}$. Moreover, this ZPC operation can be described as an equivalent operator

where $B\left(T\right)=\exp\left[\left(ad^{{\dagger}}-a^{{\dagger}}d\right)\arccos\sqrt{T}\right]$ is a BS operator and $\Pi^{off}=\left|0\right\rangle_{D}\left\langle 0\right|$ is a projective operator on mode $D$. In addition, when such an operation is applied to an arbitrary coherent state $\left|\alpha\right\rangle$, one can obtain

where $P_{d}=\exp[-\left|\alpha\right|^{2}\left(1-T\right)]$ presents the success probability of implementing such an operation. Evidently, with the assistant of the ZPC, the conversion of quantum states from $\left|\alpha\right\rangle$ to $\left|\sqrt{T}\alpha\right\rangle$ can be achieved with the probability $P_{d}$. Thus, when one mode $A_{1}$ of the states $\left|\Phi_{4}\right\rangle_{AA_{1}}$ is sent by Alice, the travelling state after succeeding in the ZPC operation can be expressed as $\left|\Phi_{4}\right\rangle_{AA_{2}}=\sum_{l=0}^{3}\sqrt{\lambda_{l}}/2\left|\varphi_{l}\right\rangle_{A}\left|\widetilde{\alpha}_{l}\right\rangle_{A_{2}}$ with a covariance matrix

where $\widetilde{X}$ and $\widetilde{Z}_{4}$ can be obtained by replacing $\alpha$ with $\widetilde{\alpha}$ in Eq. (5), and $\left|\widetilde{\alpha}_{l}\right\rangle_{A_{2}}=\left|\widetilde{\alpha}e^{i(2l+1)\pi/4}\right\rangle_{A_{2}}$ with $\widetilde{\alpha}=\sqrt{T}\alpha$. It should be noted that after performing the ZPC operation, the actual modulated variance of the travelling state $\left|\Phi_{4}\right\rangle_{AA_{2}}$ turns out to be $\widetilde{V}_{M}=T\left(V_{A}-1\right).$ At the Bob’s station, for simplicity, we assume that the variance of the two-mode entangled state $\left|\Phi_{4}\right\rangle_{BB_{1}}$ is the same as that of the state $\left|\Phi_{4}\right\rangle_{AA_{1}}$, i.e., $V_{A}=V_{B}=V$ throughout this paper. Besides, due to the fact that Alice and Bob carry out the same discrete modulation, the way of attaining the covariance matrix $\Gamma_{BB_{1}}$ is the same as the Eq. (5).

So far, we have established the schematic structure of the EB version of the ZPC-involved MDI-CVQKD system with discrete modulation. In this section, for the reverse reconciliation algorithm, we pay attention to the derivation of asymptotic secret key rates against one-mode collective Gaussian attacks 12 ; 45 where two Markovian memoryless Gaussian quantum channels are not related 46 . Here we consider the results that the both channels between Alice (or Bob) and Charlie are Gaussian under the condition of the modulated variance $V_{M}=V-1<0.5$ 28 ; 29 ; 30 ; 31 ; 32 , which arises from the indistinguishability of $Z_{4}$ and $Z_{G}=\sqrt{V^{2}-1}$. It means that the DM scheme can be viewed as the GM one when satisfying the condition of $V_{M}<1.5$. In Fig. 1(b), we assume that the losses of both channels are $\kappa=0.2$ dB/km, while $T_{A}=10^{-\kappa L_{AC}/10}$ ($T_{B}=10^{-\kappa L_{BC}/10}$) and $\xi_{A}$ ($\xi_{B}$) respectively represent the transmittance and excess noise of the channel between Alice (Bob) and Charlie. As referred to Refs. 20 ; 21 ; 22 ; 23 ; 24 ; 25 ; 26 ; 27 ; 33 ; 34 ; 35 , the EB version of the MDI-CVQKD system can be equivalent to a conventional one-way CVQKD system with the assumption that both the state $\left|\Phi_{4}\right\rangle_{BB_{1}}$ and the displacement operation $D\left(\gamma\right)$ in Bob’s station are untrusted except for the heterodyne detection, as shown in Fig. 1(c). For the equivalent system, $T_{C}$ and $\varepsilon_{th}$ are respectively the equivalent quantum channel transmittance and excess noise through the relations

where $\chi_{j}=\left(1-T_{j}\right)/T_{j}+\xi_{j}$ $(j=A,B)$. Further, by setting $g^{2}=2\left(V_{B}-1\right)/\left[\left(V_{B}+1\right)T_{B}\right]$, one can derive the minimum $\varepsilon_{th}$, i.e.,

Although the imperfection of the BSM in Charlie is an inescapable event, such an imperfection can be compensated by optical preamplifiers 35 ; 50 ; 53 . For simplicity, we consider the assumption of the perfection detection for performance analysis. Consequently, the total noise of the channel input in the shot-noise units (SNU) can be expressed as $\chi_{t}=$ $\left(1-T_{C}\right)/T_{C}+\varepsilon_{th}$.

According to the aforementioned analysis, after performing the BSM and the displacement operation, the covariance matrix $\Gamma_{A\widetilde{B}}$ of the state $\left|\Phi_{4}\right\rangle_{A\widetilde{B}}$ is

We note that the ZPC operation belongs to a kind of Gaussian operation, which makes it possible to derive the secret key rates by using the results of the extremality of Gaussian quantum states 47 . Thus, we have the secret key rate of the ZPC-involved MDI-CVQKD system with discrete modulation under reverse reconciliation against one-mode collective Gaussian attacks, i.e.,

where the success probability $P_{d}$ has been given in Eq. (8), $\beta$ denotes a reverse-reconciliation efficiency, $I\left(A\text{:}B\right)$ denotes the Shannon mutual information between Alice and Bob, which can be derived as

and $\chi\left(B\text{:}E\right)$ denotes the Holevo bound between Bob and Eve. To obtain this Holevo bound, we assume that Eve is aware of the untrusted third party David, and can purify the whole system $\rho_{A\widetilde{B}ED}$, so that

where $G\left[x\right]=\left(x+1\right)\log_{2}\left(x+1\right)-x\log_{2}x,S\left(A\widetilde{B}\right)$ is a function of the symplectic eigenvalues $\lambda_{1,2}$ of $\Gamma_{A\widetilde{B}}$ given by

with $\vartheta=a^{2}+b^{2}-2c^{2}$ and $\zeta=ab-c^{2}$, and Eve’s condition entropy $S(A|\widetilde{B}^{m_{B}})$ based on Bob’s measurement result $m_{B}$, is a function of the symplectic eigenvalues $\lambda_{3}$ of $\Gamma_{A}^{m_{B}}=aI_{2}-c\sigma_{z}\left(YI_{2}+I_{2}\right)^{-1}c\sigma_{z}$, which is given by

In the traditional MDI-CVQKD system, most of investigations show that the extreme asymmetric case has the best performance when comparing with the symmetric case ($L_{AC}=L_{BC}$) 20 ; 21 ; 22 ; 23 ; 24 ; 25 ; 26 ; 27 ; 33 ; 34 ; 35 . That is, if Charlie is close to Bob, then the extreme asymmetric case $\left(L_{BC}=0\right)$ is more suitable for the point-to-point communication in contrast to the symmetric case, enabling us to achieve the maximal transmission distance. Different from the former, the latter has an unique short-distance network application, e.g., the quantum repeater where the relay (Charlie) has to be placed in the middle of the legitimate communication parties. To extract the maximal secret key rates as many as possible, in the following, we demonstrate the optimal area and value of the variance $V$ that is an important factor of affecting the performance of MDI-CVQKD systems with discrete modulation, and then proceed with the security analysis, including the extreme asymmetric and symmetric cases.

We have suggested the performance improvement of the MDI-CVQKD with discrete modulation by performing the ZPC operation. We focus on the conventional four-state scheme as the representation of the DM-based CVQKD system. Due to the benefits of a high-efficiency error correction code in the reconciliation process, this four-state-based scheme may offers a possible way to extend the maximal transmission distance. In the context of an asymptotic-regime security analysis including the extreme asymmetric and symmetric cases, our results under the same accessible parameters show that the secret key rate of the ZPC-involved DM MDI-CVQKD protocol can be increased, compared with the original protocol. In addition, the performance of the ZPC-involved protocol is always superior to that of the original one in terms of the maximal transmission distance. Furthermore, we find that our protocol enables the DM MDI-CVQKD system to tolerate more lower reconciliation efficiency. However, the tolerable excess noise of the both protocols, especially for the symmetric case, decreases with the increase of the transmission distance, which restrains the effects of extending the security transmission distance. Fortunately, the two-way CVQKD protocol to tolerate more excess noise than the one-way protocol was first proposed by S. Pirandola 49 , which paves the way for our future investigations in the development of lengthening the security transmission distance.