High key rate quantum conference key agreement with unconditional security

Security of various communication tasks can be guaranteed by quantum internet, which consists of numerous quantum cryptographic networks. Quantum key distribution (QKD) allows two remote users to share unconditionally secure key based on quantum laws [1, 2], which has stepped into a stage where an integrated network from satellite to ground is waiting to be built. Nevertheless, there are kinds of multiparty cryptographic primitives beyond two users, e.g., conference key agreement (CKA) [3, 4]. Quantum CKA aims to allow at least three users to share the conference key with unconditional security, which can be applied in various practical situations, such as netmeeting, online education and telemedicine. The conference key promises group encryption for legitimate users, in which any member of that group can decipher the message. As it generalizes the QKD to multiple users, it is also called multipartite QKD [5].

Quantum CKA has been a research hot topic [6]. At the very beginning, it enables multiple users to share the conference key with information-theoretic security by employing multipartite entanglement [7, 8, 9]. Besides, the measurement-device-independent CKA protocol [10] has been proposed via post-selected Greenberger-Horne-Zeilinger (GHZ) entanglement [11, 12]. It has been generalized extensively to various cases including finite size [13, 14], continuous variables [15, 16] and four users with $W$ state [17]. Moreover, the finite-key analysis with composable security [18], device independence [19, 20] and other special cases [21, 22, 23] are also considered in quantum CKA. The experimental demonstration of quantum CKA has been implemented recently over 50 km fiber using the state-of-the-art four-photon GHZ entanglement source [24]. By directly distributing GHZ entanglement states, quantum CKA has been proved to drastically outperform QKD in resource expense for group communication [25].

Although progress on quantum CKA has been made, the low conference key rate, short transmission distance, and excessive resource cost seriously restrict its real life applications. It has been shown recently that the conference key rate is rigorously limited by the entanglement state distribution capacity of quantum networks [26, 27, 28]. In order to increase the conference key rate, one may utilize quantum repeaters [29] and multi-user scheme [10] of adaptive measurement-device-independence [30]. However, these approaches remain difficult to be implemented.

Introducing an intermediate node to perform a single-photon interference, twin-field QKD [31] and its variants [32, 33, 34, 35, 36, 37, 38, 39, 40] are able to break the limit of the secret key capacity of quantum channels [41, 42], specifically, the Pirandola-Laurenza-Ottaviani-Banchi (PLOB) bound [42]. Exploiting the twin-field theory [31], some new quantum CKA protocols [43, 44, 45] are proposed to improve the conference key rate and transmission distance. However, the scheme of Ref. [43] can not be experimentally demonstrated with current technology and the key rate of Ref. [44] is relatively low. In addition, zero-error attack on coherent one-way QKD has been proposed [46], therefore the security of Ref. [45] employing the idea of coherent one-way QKD [47], can not be guaranteed.

Here, we propose a three-party quantum CKA protocol inspired by the twin-field theory with vacuum state and single-photon encoding [32, 35], i.e., the sending-or-not-sending scheme [32]. The conference key rate of our protocol scales with the square-root of the total channel transmittance, which enables our scheme to break the limit of entanglement state distribution capacity of quantum networks, and our protocol can be experimentally demonstrated over 600 km with developed technology in twin-field QKD [48, 49, 50, 51, 52, 53]. The key rate of our protocol is three orders of magnitude higher than that of Ref. [44] within a range of 600 km and can remain at a high level even with a large misalignment rate of quantum channels.

As depicted in Fig. 1, our scheme employs the same devices as twin-field QKD [31, 48, 52, 53]. We choose the decoy-state quantum CKA with three intensities to simplify the experiment. Hereafter, $\ket{0}$ and $\ket{1}$ form the photon number Hilbert space for vacuum and single photon. We exploit the post-selected phase-matching method to acquire the effective events with $-\delta+r\pi\leq\theta_{a}-\theta_{b}-\varphi_{ab}\leq\delta+r\pi(\rm{mod}\ 2\pi)$, where $\theta_{a}$ (for Alice) and $\theta_{b}$ (for Bob) are the random global phases and $r=0,1$. $\delta$ is a selected value and $\varphi_{ab}$ is the phase difference between the reference frames of Alice and Bob, which can be obtained by strong light reference [52, 53]. The successful probability of post-selected phase-matching is $p_{\rm pm}=\frac{2\delta}{\pi}$ under the assumption of continuous phase randomization. Our protocol has three legitimate users, Alice, Bob and Charlie. Here, we consider a symmetric case. The detailed protocol is described as follows.

1. Preparation. Alice and Bob independently and randomly choose the $Z$ and $X$ bases. Alice prepares phase-randomized weak coherent pulses using intensities 0 and $\mu$, with probability $1-t$ and $t$, for logic bit $0$ and $1$ in the $Z$ basis. Bob does the same. Alice (Bob) generates phase-randomized weak coherent pulses $\ket{e^{i(\theta_{a}+x_{a}\pi)}\sqrt{k_{a}}}$ ($\ket{e^{i(\theta_{b}+x_{b}\pi)}\sqrt{k_{b}}}$) for logic bit $x_{a}$ ($x_{b}$) in the $X$ basis, with $x_{a},x_{b}\in\{0,1\}$, $\theta_{a},\theta_{b}\in[0,2\pi)$ and $k_{a},k_{b}\in\{\mu,\nu,0\}$. They send the optical pulses to Charlie through the insecure quantum channels.

2. Measurement. Charlie randomly measures the received pulse pairs in the $Z$ and $X$ bases. For the $Z$ basis, one and only one click between detectors D1 and D2 reveals a successful event. For the $X$ basis, one and only one click between detectors D3 and D4 indicates a successful outcome.

3. Reconciliation. For each successful measurement event, Alice, Bob, and Charlie announce the basis information. Alice and Bob publish the intensity information unless Alice, Bob, and Charlie all select the $Z$ basis. Alice and Bob disclose the global phase and perform post-selected phase-matching when they both choose intensity $\nu$ and Charlie selects the $X$ basis. All classical communications among Alice, Bob, and Charlie are transmitted via the authenticated classical channels. Alice always flips her logic bit if choosing the $Z$ basis. She will flip her logic bit if selecting the $X$ basis and $r=1$.

4. Parameter estimation. Alice, Bob, and Charlie adopt the data of the $Z$ basis as the raw key. The data of the $X$ basis is exploited to estimate the leaked information. They exploit the decoy-state method [54, 55] to the yield and phase error rate of joint single-photon state $\rho_{AB}^{1}=\frac{1}{2}(\ket{01}_{ab}\bra{01}+\ket{10}_{ab}\bra{10})$.

5. Postprocessing. They extract the common conference key using classical error correction, error verification and privacy amplification.

For the case of the $Z$ basis, the joint quantum states $\ket{01}_{ab}$ and $\ket{10}_{ab}$ form the joint single-photon state $\rho_{AB}^{1}=\frac{1}{2}(\ket{01}_{ab}\bra{01}+\ket{10}_{ab}\bra{10})$ with probability $2t(1-t)\mu e^{-\mu}$, which can be utilized to extract key [56] since the coherent states prepared by Alice and Bob are phase-randomized. The joint quantum state $\ket{01}_{ab}$ ($\ket{10}_{ab}$) can be acquired by Alice sending vacuum (single-photon) state and Bob sending single-photon (vacuum) state.

For the case of $X$ basis, Alice and Bob implement post-selected phase-matching and only consider the case of single photon component [35], such as

where $\theta_{a},\theta_{b}\in[0,2\pi)$. The joint quantum states $\ket{\psi^{\pm}(\theta)}_{ab}=(\ket{10}_{ab}\pm e^{i\theta}\ket{01}_{ab})/\sqrt{2}$ can also form the joint single-photon state $\rho_{AB}^{1}=\frac{1}{2}(\ket{\psi^{+}(\theta)}_{ab}\bra{\psi^{+}(\theta)}+\ket{\psi^{-}(\theta)}_{ab}\bra{\psi^{-}(\theta)})$.

Here, we will exploit the entanglement distillation argument of the GHZ state [11, 12, 10] to provide security against coherent attacks. We introduce a virtual protocol to prove the security of practical protocol as shown in Fig. 1. For the joint single-photon state case, no one can distinguish the practical protocol and the virtual protocol P1, which is similar to the twin-field QKD [32, 35].

Virtual protocol P1. Let P1 represent a virtual entanglement-based protocol. (i) Alice prepares an entangled state

where $A$ and $a$ are the qubit system and optical mode, respectively. Note that $\ket{\pm}_{A}=(\ket{0}_{A}+\ket{1}_{A})/\sqrt{2}$. Likewise, Bob does the same. A sifting step is needed to be performed, i.e., Alice and Bob only reserve the case that the total photon number is one between optical modes $a$ and $b$. After this step, the normalized joint state is

Then, Alice (Bob) sends optical mode $a$ ($b$) to Charlie and keeps the qubit system $A$ ($B$). Let optical modes $\ket{10}_{ab}$ and $\ket{01}_{ab}$ denote the qubit system $\ket{0}_{C}$ and $\ket{1}_{C}$. Therefore, the joint quantum state among Alice, Bob and Charlie can be written as a GHZ state, $\ket{\phi}_{ABC}=\frac{1}{\sqrt{2}}(\ket{100}_{ABC}+\ket{011}_{ABC})$. (ii) Alice, Bob and Charlie independently and randomly choose the $Z$ basis or the $X$ basis to measure the received optical modes or kept qubit system. (iii) They disclose the basis information. (iv) They utilize data of the $Z$ basis as raw key while data of the $X$ basis are used to estimate Eve’s eavesdropping [10]. (v) They generate final key with classical post-processing.

For $Y_{1}^{x}$, we employ the fact that $\frac{1}{2}(\ket{10}_{ab}\bra{10}+\ket{01}_{ab}\bra{01})=\frac{1}{2}(\ket{\psi^{+}}_{ab}\bra{\psi^{+}}_{ab}+\ket{\psi^{-}}_{ab}\bra{\psi^{-}}_{ab})$. The bit error rate $e_{1}^{x}$ can be bounded by

where $\mathsf{E}_{\nu\nu}^{x}$ and $\mathsf{Q}_{\nu\nu}^{x}$ are the bit error rate and gain of Charlie selecting the $X$ basis when Alice and Bob both send intensity $\nu$ and they successfully perform the post-selected phase-matching.

Note that quantum bit error rate $E^{z}$ is the maximum value between the marginal error rates of Alice-Charlie and Bob-Charlie as Charlie’s raw key is the reference key in the error correction step. For the case of our practical protocol, we have the gain $Q^{z}=Q_{c}^{z}+Q_{e}^{z}$ and quantum bit error rate $E^{z}=Q_{e}^{z}/Q^{z}$. Therein, $Q_{c}^{z}$ and $Q_{e}^{z}$ are the correct and incorrect gains between Alice and Bob,

For the case of Alice and Bob both choosing intensity $\nu$, they should perform the post-selected phase-matching. The corresponding gain and error rate can be written as $\mathsf{Q}_{\nu\nu}^{x}=\mathsf{Q}_{c,\nu\nu}^{x}+\mathsf{Q}_{e,\nu\nu}^{x}$ and $\mathsf{E}_{\nu\nu}^{x}=[e_{d}^{x}\mathsf{Q}_{c,\nu\nu}^{x}+(1-e_{d}^{x})\mathsf{Q}_{e,\nu\nu}^{x}]/\mathsf{Q}_{\nu\nu}^{x}$. Therein, the correct gain $\mathsf{Q}_{c,\nu\nu}^{x}$ and incorrect gain $\mathsf{Q}_{e,\nu\nu}^{x}$ are

and

where the approximate results are always true for $0<\delta\leq\frac{\pi}{4}$. Therein, ${\rm erf}(x)$ and ${\rm erfi}(x)$ are the error function and imaginary error function.

Following the entanglement distillation argument [10], the asymptotic conference key rate of the single-photon protocol is given by

where $Y_{1}^{d}$ and $e_{1}^{d}$ are the yield and bit error rate of the joint single-photon state given that all users choose the $d$ basis, with $d\in\{Z,X\}$. For example, $Y_{1}^{z}$ is the probability that Charlie has a successful detection in the $Z$ basis given that Alice and Bob send the state $\rho_{ab}^{1}$. Let $x_{a}\oplus x_{b}\neq x_{c}$ denote the bit error of the $X$ basis, where $x_{c}$ is the logic bit value of Charlie in the $X$ basis. $\widetilde{\lambda}_{\rm EC}$ is the leaked information in classical error correction. $h(x)=-x\log_{2}(x)-(1-x)\log_{2}(1-x)$ is the binary Shannon entropy. There is always a marginal bit error rate in the $Z$ basis between every two users. Taking the raw key of Charlie as the reference key, the $Z$ basis bit error rate of this protocol is the maximum value between the marginal bit error rates of Alice-Charlie and Bob-Charlie.

For the case of the scheme with single-photon source, Alice and Bob directly prepare optical mode $\ket{1}$ with single photon. We also have the gain $Q^{z}=Q_{c}^{z}+Q_{e}^{z}$ and quantum bit error rate $E^{z}=Q_{e}^{z}/Q^{z}$. Therein, $Q_{c}^{z}$ and $Q_{e}^{z}$ are the correct and incorrect gains between Alice and Bob,

where these yields can be expressed as

and $Y_{00}^{z}=2p_{d}(1-P_{d})$. Thereby, the revealed information in classical error correction is $\widetilde{\lambda}_{\rm EC}=Q^{z}fh(E^{z})$. Besides, we have the yields $Y_{1}^{z}=\frac{1}{2}(Y_{10}^{z}+Y_{01}^{z})$. Note that $Y_{1}^{x}=\frac{1}{2}(Y_{10}^{x}+Y_{01}^{x})$ due to $\frac{1}{2}(\ket{10}_{ab}\bra{10}+\ket{01}_{ab}\bra{01})=\frac{1}{2}(\ket{\psi^{+}}_{ab}\bra{\psi^{+}}_{ab}+\ket{\psi^{-}}_{ab}\bra{\psi^{-}}_{ab})$, where $Y_{10}^{x}$ and $Y_{01}^{x}$ can be given by

We assume that the efficiencies and dark count rates of Charlie’s detectors are the same and the distances of Alice-Charlie and Bob-Charlie are both $L/2$. We numerically optimize the conference key rate over the free parameters $t$, $\mu$ and $\nu$ by utilizing Genetic Algorithm. To display the conference key rate of our protocol scaling with the square-root of the total channel transmittance, we define $\sqrt{\eta}=\eta_{d}\times 10^{-\alpha L/20}$, where $\eta_{d}$ is the detector efficiency. In order to show the performance of our quantum CKA protocol, we utilize the practical parameters in Table 1 for simulation, which has been recently realized over 500 km fiber in twin-field QKD [52]. The conference key rate of our practical quantum CKA protocol as a function of the total transmission distance $L$ among three users is shown in Fig. 2. The transmission distance of our practical protocol reaches over 600 km and its key rate can surpass that of distributing GHZ states among 3 parties [25] at the distance of 160 km. For the case of distributing GHZ states [25], we set the misalignment rate of its channels is 0 and only dark counts contribute to its error rate, which aims to make its key rate close to the GHZ entanglement distribution capacity. Compared with the scheme of Ref. [44], although our scheme is not a measurement-device-independent protocol, unlike Ref. [44], the key rate of our protocol has improved significantly and is three orders of magnitude higher within 600 km. Additionally, the single-photon protocol can be theoretically demonstrated over 800 km, which also shows the importance to develop ideal single-photon source.

Besides, the bit error rate $E^{z}$ can be bounded by adjusting probability $t$, which is irrelevant to the misalignment of channel. Therefore, our practical protocol can always extract conference key as long as the misalignment rate of $X$ basis $e_{d}^{x}<50\%$ in principle. As shown in Fig. 3, the secure transmission distance is larger than 500 km in the case of $e_{d}^{x}=18\%$. Besides, the conference key rate of the practical protocol can surpass that of distributing GHZ states over the networks [25] even when the misalignment rate is larger than $25\%$. These results indicate that our quantum CKA is practical and feasible even in the field environment.

In summary, by employing a special GHZ-class state, we have proposed a practical quantum CKA protocol that allows three users to share the information-theoretically secure conference key. Its conference key rate scales as $O(\sqrt{\eta})$ rather than the total transmittance, which can beat the fundamental linear limit on the private capacity of quantum network [26]. This protocol exploits the same devices and technology as twin-field QKD [31, 48, 52, 53] and as such, it can be demonstrated over 600 km. New results are significantly beyond what one could expect for quantum CKA in previous works, whose key rate is three orders of magnitude higher within 600 km compared to Ref. [44] and keeps at a high level even with large misalignment rate. We believe that this quantum CKA protocol can be widely implemented to build the large-scale quantum cryptographic network.

Here, we would like to clarify that our quantum CKA is not a measurement-device-independent scheme and will suffer from the standard quantum hacking attacks, including blinding attack [57]. In order to treat double-click attack, one should exploit the squashing model [56], i.e., random basis and random measurement outcomes should be assigned. Our protocol also requires the phase stability of two independent pulses, which can be circumvented by using active phase stabilisation [49, 48], phase tracking and post-selection [51]. Different from the scheme with post-selected W state [43], our scheme with arbitrary $N$ parties is an interesting and nontrivial work.

We gratefully acknowledge support from the National Natural Science Foundation of China (under Grant No. 61801420); the Key-Area Research and Development Program of Guangdong Province (under Grant No. 2020B0303040001); the Fundamental Research Funds for the Central Universities (under Grant No. 020414380182).