Key rates for quantum key distribution protocols with asymmetric noise

For an implementation of the BB84 or six-state protocols, the only required resources are the preparation, transmission and measurement of single-qubit states. That is, these protocols can be implemented in a prepare-and-measure set-up without the need of entanglement. However, both protocols have an equivalent entanglement-based implementation E91 ; BBM92 , in which a source (that may be in Alice’s lab) produces a state that is distributed to Alice and Bob (ideally the maximally entangled state, $\left|\Phi^{+}\right\rangle=\frac{1}{\sqrt{2}}(\left|00\right\rangle+\left|11\right\rangle)$). Then, upon receiving their systems, Alice and Bob perform measurements in randomly chosen bases (having two choices of basis for the BB84, and three for the six-state protocol). As long as the measurement devices are well characterized and controlled, an entanglement-based implementation allows one to relax the need for a precise characterization of the state preparation. The entanglement-based version of the BB84 and six-state protocols played a key role to formalize their security proofs SP00 ; Lo01 ; RennerThesis . From now on, for the purpose of our analyses, we focus on the entanglement-based version of these protocols. However we remark that for all our results, there is an equivalent implementation that requires only single-qubit states preparation.

The BB84 and the six-state protocols can be described by four main steps:

1. 1.

   Distribution and measurements: Alice uses the source to produce a two-qubit state. She keeps one qubit and sends the other to Bob using a quantum channel. Upon receiving the systems, Alice and Bob, each randomly chooses a basis and performs the corresponding measurement. They repeat this procedure $N$ times. With the outcomes of their measurements they establish a string of $N$ bits each.

2. 2.

   Sifting and parameter estimation: Alice and Bob communicate the measurement bases and discard the rounds in which different bases were used. Moreover, they sacrifice $m$ bits in order to estimate their average correlation and decide whether to abort or proceed with the protocol. If the protocol does not abort, the remaining $n$ bits constitute the raw key.

3. 3.

   Advantage distillation (optional): The goal is to classically post-process the raw key, in order to increase the correlation between Alice and Bob, and get an advantage over the eavesdropper.

4. 4.

   Information reconciliation and privacy amplification: In this step, Alice and Bob first implement an information reconciliation protocol that allows Bob to correct his bit-string for errors. Finally, they apply a privacy amplification protocol to transform a partially secure key of $n$ bits into a secure key of $l<n$ bits.

The parameters estimated in Step 2 are determined by the particular protocol. In an implementation of the BB84 protocol, Alice and Bob can estimate the values of the quantum bit error rates (QBERs) in the $X$ and $Z$ bases, $Q_{X}$ and $Q_{Z}$. For the six-state protocol, they will also have an estimate of the QBER in the $Y$-basis, $Q_{Y}$. The QBER in the $Z$($X$)-basis, $Q_{Z}(Q_{X})$, is the probability that Alice and Bob get different outcomes when they both measure their systems in the basis $Z$($X$). The QBER in the $Y$-basis is defined in a similar way, however, since the target state $\left|\Phi^{+}\right\rangle$ exhibits anti-correlation in the $Y$-basis, Bob flips his outcomes whenever he chooses to measure in the $Y$-basis.

In the originally proposed BB84 and six-state protocols, all the bases were chosen with equal probability among the set of bases specified by the protocols. However, as shown in LCA05 , the efficiency of these protocols can be increased, without compromising security, if one of the bases is chosen with a higher probability. Then, in the asymptotic limit, the preferred basis is used almost all the time. The remaining bases are used only occasionally in order to test for the eavesdropper. This significantly increases the key rates, as only a small fraction of the rounds are discarded in the sifting process. In these protocols, the raw key is usually created from the rounds in which the preferred basis is used. The remaining rounds, in which other bases were chosen, are used for parameter estimation. For this reason, we denote the basis chosen with higher probability as the key generation basis.

Advantage distillation, in Step 3, is an optional step. It consists of Alice and Bob using two-way classical communication to select parts of the raw key that exhibit stronger correlation. This method was introduced in the context of classical protocols Mau93 and was proven to be useful for quantum protocols as well GL03 ; KBR07 . Usually, advantage distillation leads to significant drops in the key rate for the low noise regime, but it can considerably increase the noise tolerance of a protocol. For example, a BB84 implementation subjected to depolarizing noise (in which $Q_{X}=Q_{Z}$) without advantage distillation can tolerate up to $11\%$ of QBER. If some advantage distillation is performed, the noise tolerance can be increased to $20\%$ QBER GL03 . Advantage distillation protocols that have better performance in the low noise regime were also proposed Watanabe .

Information reconciliation, in Step 4, aims at correcting Bob’s string in order to make it equal to Alice’s string. Information reconciliation can be implemented using only one-way communication from Alice to Bob. Interactive protocols BS94 , which are efficient to implement, are broadly used in QKD implementations cascadeApp . These protocols require two-way communication, however, they should not be confused with advantage distillation performed in Step 3. In advantage distillation, two-way communication is essential and, moreover, both Alice’s and Bob’s strings are modified during the protocol.

We first consider the BB84 and the six-state protocols when Alice and Bob skip Step 3. After measuring their quantum systems, Alice and Bob proceed to perform information reconciliation and privacy amplification. Information reconciliation protocols based on two-universal hashing functions leak the minimum amount of information necessary to correct for errors in Bob’s string BS94 . In RW05 , it was proven that the minimum leakage of a one-way information reconciliation protocol is given by $nH(A|B)+\mathcal{O}(\sqrt{n})$, where $H(A|B)$ is the entropy of Alice’s output conditioned on Bob’s output, defined as $H(A|B)=-\sum_{a,b}p(A=a,B=b)\log p(A=a|B=b)$ with $p(A=a,B=b)$ being the probability that Alice and Bob obtain outcomes $a$ and $b$, respectively, for the measurement in consideration, $p(A=a|B=b)=\frac{p(A=a,B=b)}{p(B=b)}$ is the conditional probability, and the logarithms are taken in basis 2.

In order to analyze the key rate of the BB84 and the six-state protocol we can assume w.l.o.g. that the state distributed by the source is a Bell-diagonal state RennerThesis :

where $\Phi_{ij}=\left|\Phi_{ij}\middle\rangle\middle\langle\Phi_{ij}\right|$ and $\left|\Phi_{ij}\right\rangle=X^{i}Z^{j}\otimes I\left|\Phi^{+}\right\rangle$. Restricting the analysis to Bell-diagonal states is sufficiently general because for all states $\rho^{\prime}$ such that $\lambda_{ij}=\left\langle\Phi_{ij}\right|\rho^{\prime}\left|\Phi_{ij}\right\rangle$, the corresponding Bell-diagonal state exhibits the same QBERs as the original state and leads to the lowest key rate RennerThesis .

For the security analysis, it is also assumed that the measurements are perfect and all the noise can be mapped into the distributed state. In this case, the Bell coefficients $\left\{\lambda_{ij}\right\}$ relate to the QBERs $Q_{X}$, $Q_{Y}$, and $Q_{Z}$ by the following:

Note that a Bell-diagonal state is completely characterized by the three QBERs $(Q_{X},Q_{Y},Q_{Z})$.

The key rates for the BB84 and the six-state protocols can be determined as a function of the coefficients of the estimated Bell-diagonal state, and therefore as a function of the QBERs. In a real implementation, in which a finite number of rounds is considered, statistical effects play a role in the value of the key rate. However, for a sufficiently large number of rounds, the key rate of the six-state protocol, with $Z$ being the key generation basis, approaches the asymptotic value given by Lo01 ; KGN05 ; RennerThesis :

where $H(\left\{\lambda_{ij}\right\})=\sum_{ij}-\lambda_{ij}\log\lambda_{ij}$, and the logarithms are taken in basis 2.

For BB84, since information about $Q_{Y}$ is not available, the key rate is given by the minimum over all possible values of $Q_{Y}$. This results in SP00 ; KGN05 ; RennerThesis :

where $h(x)=-x\log x-(1-x)\log(1-x)$ is the binary entropy.

If one of the other available bases is used for the key generation, the corresponding key rate can be obtained by simply permuting the QBERs in expressions (3) and (4). Note that choosing the basis for key generation implies a choice of protocol. Once the key generation basis is fixed, Alice and Bob can run the protocol using this basis for almost all the rounds. The key rate now depends on the information available to the eavesdropper when the estimated state, given in eq. (1), is measured in the chosen key generation basis. A measurement in the $X$-basis, or the $Y$-basis, performed on the estimated state, eq. (1), can be seen as a $Z$-basis measurement performed on a rotated state. The corresponding rotated state for when the $X$-basis, or the $Y$-basis, is used for the key generation measurement relates to eq. (1) by a permutation of the coefficients $\left\{\lambda_{ij}\right\}$. Eqs. (3) and (4) are invariant under permutation of the QBERs. Therefore, the resulting key rate for protocols that use information reconciliation with minimum leakage is the same regardless of which of the available bases, $\left\{X,Z\right\}$ for BB84 and $\left\{X,Y,Z\right\}$ for six-state, is chosen for the key generation rounds. This is stated in Proposition 1.

Now we state an interesting fact regarding the key rates of the six-states protocol when an information reconciliation protocol with minimum leakage is used.

Observation 1 is illustrated in Figure 1 for the family of Bell-diagonal states $(Q_{X}=0.1,Q_{Y},Q_{Z}=0.1)$.

Note that the minimum of the curve in Figure 1 gives the key rate for the BB84 protocol when $Q_{X}=Q_{Z}=0.1$.

Observation 1 together with the continuity of the key rate for the six-state protocol implies the following corollary.

As an example of Corollary 1, take $\rho^{(1)}$ to be the state with QBERs $Q_{X}^{(1)}=Q_{Z}^{(1)}=10\%$ and $Q_{Y}^{(1)}=20\%$, and $\rho^{(2)}$ to be the state with $Q_{X}^{(2)}=Q_{Z}^{(2)}=9.8\%$ and $Q_{Y}^{(2)}=18\%$. It holds that $R_{\rm 6state}(\rho^{(1)})>R_{\rm 6state}(\rho^{(2)})$.

We now investigate the behavior of the singlet fidelity and the entanglement of formation BDSW96 for the family of states considered in Figure 1.

For an entangled Bell-diagonal state $\rho$, eq. (1), with $\lambda_{00}>\frac{1}{2}$, the entanglement of formation BDSW96 , $EoF$, is given by

and the singlet fidelity $F$ is

Figure 2 illustrates that both quantities are monotonically decreasing functions of $Q_{Y}$. This supports the intuition that a state with higher QBER is less close to the ideal state. However, as stated in Observation 1 - see also Figure 1, this monotonic behavior is not always observed in the key rates of the six-state protocol.

We now consider the BB84 and the six-state protocols when advantage distillation is employed in Step 3. In particular, we consider the following advantage distillation protocol BA07 ; KBR07 ; RennerThesis :

The key rates for BB84 and six-state protocol with advantage distillation, Protocol I, were derived in KBR07 ; RennerThesis . For the six-state protocol, the key rate is given by

where $p_{\rm succ}^{AD}$ is the probability that Protocol I succeeds, i.e that Alice and Bob do not discard a block. This occurs if either the two bits of Alice and Bob are equal or if both bits in the block are flipped. Note that steps 3 and 4 of Protocol I check whether the pair of bits of Alice and the pair of bits of Bob have the same parity. If the raw key is generated by measurements in the $Z$-basis, then

And the coefficients $\left\{\tilde{\lambda}_{ij}\right\}$ are given by

where $\left\{\lambda_{ij}\right\}$ relate to the QBERs by eq. (2).

In KBR07 ; RennerThesis it was shown that applying advantage distillation, Protocol I, has the same effect as if Alice and Bob would apply a quantum operation that brings two copies of a Bell-diagonal state with coefficients $\left\{\lambda_{ij}\right\}$ into one copy of a Bell-diagonal state with coefficients $\left\{\tilde{\lambda}_{ij}\right\}$ and then perform the measurement in this final state. This operation succeeds with probability $p_{\rm succ}^{AD}$. We will see, in Section III, that the corresponding quantum operation is the application of bi-local CNOT gates (i.e. Alice applies a CNOT to her two subsystems, and Bob does the same to his subsystems), followed by measurements of the target qubits and post-selection of the results.

The key rate for the BB84 protocol is obtained by taking the minimum of eq. (9) over all possible values of $Q_{Y}$.

Note that, for protocols with advantage distillation, the key rate, eq. (9), is not symmetric over permutation of the QBERs. Therefore, choosing a different basis (among the set of available bases) for key generation may lead to different key rates. We now state a curious observation about QKD protocols in which advantage distillation, given by Protocol I, is performed.

Figure 3 illustrates Observation 2 for the family of states $Q_{X}=Q_{Z}=0.1$ considered in the previous section. In comparison with Figure 1, we note that, for lower values of $Q_{Y}$, higher rates are obtained when no advantage distillation is performed. However, as $Q_{Y}$ increases, an advantage is obtained with the use of advantage distillation and, specially, if the basis with higher QBER is used for the key generation rounds. Note also that, similar to Observation 1, an increase in the key rate with $Q_{Y}$ for high values of $Q_{Y}$ is also observed for the key generated with measurements in the $Y$-basis.

In order to explore Observation 2 in more detail, we have performed an extensive numerical check over the range of possible values of QBERs $(Q_{X},Q_{Y},Q_{Z})$. For the BB84 protocol, Figure 4 illustrates that, for almost all the values of $Q_{X}$ and $Q_{Z}$ that lead to positive key, the highest asymptotic key rate is obtained when the key generation basis is the one with higher QBER. This behavior inverts only for a small range of parameters, next to the limiting region where positive key can no longer be obtained. It is interesting to note that the success probability of the advantage distillation protocol, given in eq. (10), is a monotonically decreasing function of the QBER of the key generation basis. However, even with the contribution of this factor to the key rate, see eq. (9), Figure 4 shows that it is typically advantageous to use the basis with higher QBER for the key generation rounds.

For the six-state protocol, we numerically compared, for the range of allowed parameters, the rates achieved when each of the three bases is used for key generation. Similarly to the BB84 case, we observed that higher key rates are obtained for key generation in the basis with higher QBER except for a small range of parameters. We found that it is not advantageous to use the basis with higher QBER for key generation only for some range of QBERs $(Q_{X},Q_{Y},Q_{Z})$ next to the region where no key can be obtained. As an example, for a state with QBERs $(Q_{X}=0.39,Q_{Y}=0.39,Q_{Z}=0.01)$, one can obtain a secret key only if the $Z$-basis is used for key generation in the six-state protocol with advantage distillation given by Protocol I.

It is interesting to remark that the advantage of using the basis with higher QBER for protocols with advantage distillation can also occur in practical implementations where information reconciliation is performed using an one-way protocol vDK97 ; ELAB09 ; TMPE17 with non-optimal asymptotic leakage $f\cdot h(Q_{M})$, for $f\leq 1.2$. Indeed, the advantage obtained by the use of a basis with higher QBER can be sufficiently large to compensate for the penalty of using an efficient information reconciliation protocol with higher leakage.

Protocol I can be generalized to blocks of arbitrary size $b$ Mau93 . Even though this leads to a significant decrease in the key rate in the low noise regime, higher noise tolerance can be achieved GL03 ; KBR07 ; BA07 . Figure 5 illustrates the behavior of the key rates for the BB84 with advantage distillation using blocks of size 7. We now find that it is advantageous to use the basis with higher QBER for key generation in all the range of parameters that lead to positive key rate.

In Ref. Watanabe , Watanabe et al. introduced an advantage distillation protocol that does not suffer from a big drop of the key rate in the low noise regime. The protocol introduced in Watanabe contains Protocol I as a sub-routine, and in the high noise regime the key rate coincides with the one obtained using Protocol I. Therefore, we expected that Observation 2 may also have an impact in this protocol. Indeed, in Figure 6 we illustrate that choosing the basis with higher QBER for key generation leads to higher rates for the family of states $Q_{X}=Q_{Z}=0.1$ when the advantage distillation protocol of Ref. Watanabe is performed. This effect played a role on the key rates estimated in Ref. rozpkedek2018near , for near-term implementations based on nitrogen-vacancy platforms and quantum repeaters.