Page 1
arXiv:quantph/0607129v3 9 Jan 2007
Experimental LongDistance DecoyState Quantum Key Distribution Based On
Polarization Encoding
ChengZhi Peng,1,2, ∗Jun Zhang,2, ∗Dong Yang,1, ∗WeiBo Gao,2HuaiXin Ma,1,3
Hao Yin,3HePing Zeng,4Tao Yang,2XiangBin Wang,1and JianWei Pan1,2,5
1Department of Physics, Tsinghua University, Beijing 100084, China
2Hefei National Laboratory for Physical Sciences at Microscale and Department of Modern Physics,
University of Science and Technology of China, Hefei, Anhui 230026, China
3China Electronics System Engineering Company, Beijing 100039, China
4Key Laboratory of Optical and Magnetic Resonance Spectroscopy and Department of Physics,
East China Normal University, Shanghai 200062, China
5Physikalisches Institut, Universit¨ at Heidelberg, Philosophenweg 12, 69120 Heidelberg, Germany
(Dated: February 1, 2008)
We demonstrate the decoystate quantum key distribution (QKD) with oneway quantum com
munication in polarization space over 102 km. Further, we simplify the experimental setup and
use only one detector to implement the oneway decoystate QKD over 75 km, with the advantage
to overcome the security loopholes due to the efficiency mismatch of detectors. Our experimental
implementation can really offer the unconditionally secure final keys. We use 3 different intensities
of 0, 0.2 and 0.6 for the light sources in our experiment. In order to eliminate the influences of po
larization mode dispersion in the longdistance singlemode optical fiber, an automatic polarization
compensation system is utilized to implement the active compensation.
PACS numbers:03.67.Dd, 42.81.Gs, 03.67.Hk
Quantum key distribution [1, 2, 3] can in principle of
fer the unconditionally secure private communications
between two remote parties, Alice and Bob. However,
the security proofs for the ideal BB84 protocol [4, 5] do
not guarantee the security of a specific setup in prac
tice due to various imperfections there. One important
problem in practical QKD is the effects of the imper
fect source, say, the coherent states. The decoy state
method [6, 7, 8, 9, 10] or some other methods [11, 12]
can help to generate the unconditionally secure final keys
even an imperfect source is used by Alice in practical
QKD. Basically, QKD can be realized in both free space
and optical fiber [2]. Each option has its own advantages.
The fiber QKD can be run in the alwayson mode: it runs
in both day and night and is not affected by the weather.
Also, the future local QKD networks are supposed to be
using fiber. So far, there are many experiments of fiber
QKD with weak coherent lights [13]. However, these re
sults actually do not offer the unconditional security be
cause of the possible photonnumbersplitting attack [14].
Recently, there are also experimental implementations of
the decoystate method [15], with twoway quantum com
munication. However, since these implementations have
not taken the specific operations as requested by Ref. [16],
the security of the final keys is still unclear due to the
socalled Trojan horse attacks [2]. One can implement
active countermeasures [16] to overcome this problem,
which is deserved experimental implementations in the
future. The other way is to use oneway quantum com
munication which we have adopted in this work.
Here we present the first polarizationbased decoy
state QKD implementation over 102 km with only one
way quantum communication using two detectors and
75 km using only one detector. Our results are uncondi
tionally secure (For the unconditional security, we mean
that the probability that Eve has nonnegligible amount
of information about the final key is exponentially close
to 0, say, e−O(100)).Here we must clarify that given
the existing technologies [13], if the distance is shorter
than about 20 km, through the simple worstcase estima
tion [17] of the fraction of tagged bits it is still possible
for one to implement the unconditionally secure QKD
without using the decoystate method.
We can know how to distill the secure final keys with
imperfect source given the separate theoretical results
from Ref. [17], if we know the upper bound of the fraction
of tagged bits (those raw bits generated by multiphoton
pulses from Alice) or equivalently, the lower bound of the
fraction of untagged bits (those raw bits generated by
singlephoton pulses from Alice). In Wang’s 3intensity
decoystate protocol [7, 8], one can randomly use 3 differ
ent intensities (average photon numbers) of each pulses
(0, µ, µ′) and then observe the counting rates (the count
ing probability of Bob’s detector whenever Alice sends
out a state) of pulses of each intensities (S0,Sµ,Sµ′). The
density operators for the states of µ and µ′(µ′> µ) are
?ρµ= e−µ0??0 + µe−µ1??1 + cρc
ρµ′ = e−µ′0??0 + µ′e−µ′1??1 +µ′2e−µ′
here c = 1 − e−µ− µe−µ,ρc=e−µ
a density operator and d > 0 (here we use the same no
tations in Ref. [7, 8]). We denote s0(s′
the counting rates of those vacuum pulses, singlephoton
pulses and ρc pulses from ρµ(ρµ′). Asymptotically, the
µ2e−µcρc+ dρd,(1)
c
?∞
0),s1(s′
n=2
µn
n!n??n, ρdis
1),sc(s′
c) for
Page 2
2
values of primed symbols here should be equal to those
values of unprimed symbols. However, in an experiment
the number of samples is finite therefore they could be
a bit different. The bound values of s1,s′
mined by the following joint constraints corresponding to
Eq.(15) of Ref. [8]
1can be deter
?
Sµ= e−µs0+ µe−µs1+ csc
cs′
c≤
µ2e−µ
µ′2e−µ′(Sµ′ − µ′e−µ′s′
1− e−µ′s′
0),
(2)
where s′
1= (1−
10eµ/2
√
µs1Nµ)s1, s′
c= (1−
10
scNµ)sc, s′
√
0= 0,
s0= (1+r0)S0and r0=
results [7, 8]. Nµ,N0are the pulse numbers of intensity
µ,0. Given these, one can calculate s1,s′
The experimental setup is shown in Fig.1, mainly in
cluding transmitter (Alice), quantum channel, receiver
(Bob) and electronics system. All the electronics mod
ules are designed by ourselves. The synchrodyne (SD) is
designed by field programmable gate array (FPGA, Al
tera Co.) and outputs multiple channels of synchronous
clocks with independent programmable parameter set
tings, which is equivalent to an arbitrary function gen
erator, to drive the modules of random number genera
tor (RNG), data acquisition (DAQ, designed by FPGA)
and singlephoton detector (SPD) respectively. The sig
nals with FWHM of about 1 ns are generated by laser
diode driver (LDD) to drive 10 distributed feedback
laser diodes (LD) at the central wavelength of 1550 nm,
where 4 LDs are used for decoy states (µ) and another 4
LDs are used for signal states (µ′) and the other 2 LDs
are used for polarization calibration. The polarization
states of photons emitting from LDs can be transformed
to arbitrary polarization state by polarization controller
(PC). For decoy states and signal states, the four polar
ization states are H?,V ?,+?,−?, where H?,V ? rep
resent horizontal polarization and vertical polarization,
+? = 1/√2(H? + V ?) and −? = 1/√2(H? − V ?), as
the four states for the standard BB84 protocol [1]. For
test states, the two polarization states are H? and +?
to calibrate the two sets of polarization basis. The pho
tons of every channel are coupled to an optical fiber via
fiber coupling network (FCN), which is composed of mul
tiple beam splitters (BS) and polarization beam splitters
(PBS) and optical attenuators. In FCN, the fiber length
of every channel must be adjusted precisely so that the
arrival time differences to SPD caused by the fiber length
differences can be less than 100 ps.
In the setup, a dense wavelength division multiplexing
fiber filter (FF) is inserted in Alice’s side. On the one
hand, it can guarantee that the wavelengths of emitted
photons in all channels are equal to avoid the possibility
of Eve’s attack utilizing the variance of photon wave
lengths. On the other hand, it can reduce the influences
of chromatic dispersion in fiber.
In the experiment, the pulse numbers ratio of the 3
10
√S0N0to obtain the worstcase
1,scnumerically.
FF
BS
TP
SMF
H
V
+

Decoy
Signal
H
V
+

FCN
Test
H
+
PC
Bob
Alice
EPC
PBS
OS SPD1
LDD
RNG SD
DAQ
HVA
DAC
RNG
Computer
USB
USB
USB
USB
Electronics
RNG
OneDetector?Scheme
RNG
SPD1
SPD2
TwoDetector?Scheme
FIG. 1: Schematic diagram of the experimental setup. Solid
line and dashed line represent optical fiber and electric cable
respectively. See the text for the abbreviations.
intensities is 5 : 4 : 1 and the intensities of signal states
and decoy states are fixed at µ′= 0.6 and µ = 0.2 respec
tively, which are not necessarily the optimized parame
ters with our setup. The fluctuations of intensities are
monitored at the test point (TP). If the varying range
of fluctuation is larger than about 5% we will stop the
system and adjust the light sources. In fact, the effects
of intensity fluctuation is indeed a very important theo
retical problem for the decoystate QKD, which had not
been solved by theorists prior to our experiment. Very re
cently theoretical progress has shown that the effects are
moderate with certain modifications of the experimental
setup [18].
After passing through the longdistance singlemode
fiber (SMF, Corning Co., fiber attenuation is about
0.2 dB/km), at Bob’s side we adopt two kinds of mea
surement scheme. In onedetector scheme, firstly a fiber
BS is used to select the two polarization basis called HV
basis and +− basis randomly. Secondly due to the polar
ization mode dispersion (PMD) effects in longdistance
SMF, we develop an automatic polarization compensa
tion (APC) system to compensate for the PMD actively.
The principles of APC are: Alice sends fixed H? states
or +? states.
ing rates in the corresponding basis using DAQ system
and transmits them to the computer via universal serial
bus (USB). After algorithmic processing, the computer
gives out the data, which can be converted to voltages of
electric polarization controllers (EPC, General Photon
ics Co.) through digitaltoanalog converter (DAC) and
high voltage amplifier (HVA). Then the fiber squeezers
in EPC are driven by the voltages and change the po
larization [19]. After repeating feedback controls the vis
ibility of test states can reach the target value and the
APC system stops. The average adjusting time is about
3 minutes. However, this time can be greatly shortened
using a continuous coherent light and wavelength division
multiplexing techniques and optimized algorithms. Fig
ure 2(a) shows the test results of the APC system with
75 km fiber. In the experiment, Alice starts APC to cal
Then Bob records the accepted count
Page 3
3
0 20 4060 80100
10
5
10
4
10
3
Final Key Rate
Fiber Length (km)
Theoretical Value
Experimental Value
b)
0 1020
Time (min)
304050
0.0
0.2
0.4
0.6
0.8
1.0
3
12
APC
APC after artificial
disturbance
Free running
APC
Visiblity
Free running
a)
FIG. 2: a) Test of the APC system with 75 km fiber. In posi
tion 1 and 2 the APC system monitors the visibility changes
of polarization states and adjusts the voltages of EPC actively
to reach the target visibility. Subsequently, the visibility of
polarization states becomes worse slowly when free running.
In position 3, artificial disturbance induces drastic change of
visibility and the APC system can still work well. The time
interval of points is 2 seconds. b) Comparison of the final key
rate of signal states per pulse between the theoretical calcula
tion and experimental results with four different distance set
tings L (13.448 km, 50.524 km, 75.774 km and 102.714 km),
where their corresponding total attenuations are (24.9 dB,
32.2 dB, 34.8 dB, 37.0 dB) including channel losses, all the
insertion losses of components, detector efficiencies etc. The
first three settings use onedetector scheme and the last one
uses twodetector scheme. The first two settings’ repetition
frequency is f=4 MHz and the last two is f=2.5 MHz.
ibrate the system first. After calibration she transmits
the pulses for several minutes. Then this process is re
peated. Thirdly we use two magnetic optical switch (OS,
Primanex Co.) with switching time of less than 20 µs
driven by two independent RNG to randomly switch the
basis and the output ports of PBS respectively. The one
detector scheme can overcome the security loopholes due
to the efficiency mismatch of detectors [20] since the fiber
lengths of each state can be adjusted identically. On the
other hand, two OS driven by the same RNG and two
SPDs [21] are used in twodetector scheme to reduce the
transmission losses in Bob’s side.
We use this allfiber quantum cryptosystem to imple
ment the decoystate QKD over 102 km and 75 km us
ing twodetector scheme and onedetector scheme respec
tively. The experimental parameters and their corre
sponding values are listed in Table I. In the experiment,
Alice totally transmits about N pulses to Bob. After
the transmission Bob announces the pulse sequence num
bers and basis information of received states. Then Alice
broadcasts to Bob the actual state class information and
basis information of the corresponding pulses. Alice and
Bob can calculate the experimentally observed quantum
bit error rate (QBER) values Eµ,Eµ′ of decoy states and
signal states according to all the decoy bits and a small
fraction of the signal bits respectively [22].
Then we can numerically calculate a tight lower bound
of the counting rate of singlephoton s′
next step is to estimate the fraction of singlephoton ∆1
1using Eq. 2. The
TABLE I: Experimental parameters (P.) and their corre
sponding values of 75.774 km (Value1) and 102.714 km
(Value2) decoystate QKD.
P.Value1
75.774 km
2.5 MHz
1.607 × 1095.222 × 109S0
Eµ′ 3.231%
Eµ 9.039%
Eµ′
1
6.099%
RT 46.167 Hz
Value2
102.714 km Sµ′ 2.076 × 10−41.262 × 10−4
2.5 MHz
Sµ
7.534 × 10−54.611 × 10−5
9.174 × 10−66.711 × 10−6
3.580%
s′
1
2.460 × 10−41.558 × 10−4
9.098%
Rµ′ 1.143 × 10−56.706 × 10−6
5.854%
RE 11.668 Hz
29.427 Hz
RT
0.253
P.Value1 Value2
L
f
N
8.090 Hz
0.275
RE
and the QBER upper bound of singlephoton E1. We use
∆µ′
1= s′
1µ′e−µ′/Sµ′,∆µ
1= s1µe−µ/Sµ
(3)
to conservatively calculate ∆1of signal states and decoy
states respectively [7, 8]. And E1 of signal states and
decoy states can be estimated by the following formula,
Eµ′(µ)
1
= (Eµ′(µ)−(1 − r0)S0e−µ′(µ)
2Sµ′(µ)
)/∆µ′(µ)
1
.(4)
Here we consider the statistical fluctuations of the vac
uum states to obtain the worstcase results.
Lastly we can calculate the final key rates of signal
states using the formula [7, 8] of
Rµ′ = Sµ′(∆µ′
1− H(Eµ′) − ∆µ′
1H(Eµ′
1)),(5)
here H(x) = −xlog2(x) − (1 − x)log2(1 − x). Then we
compare the experimental final key rate of signal states
RE with the theoretically allowed value RT, i.e., in the
case both ∆1and E1are known without any overestima
tion. The theoretically allowed values of ∆1and E1for
signal states are
?
∆µ′
Eµ′
1T= (Sµ′ − (1 − µ′)S0)e−µ′/Sµ′
1T= (Eµ′ −S0e−µ′
2Sµ′)/∆µ′
1T,
(6)
with the assumptions that the ideal value of the single
photon counting rate is s1T = η+S0and Sµ′ = ηµ′+S0,
where η is the overall transmittance. We find out that
our experimental results in the two cases are both close
to 30% of the theoretically allowed maximum value.
During the above calculation, we have used the worst
case results in every step for the security. Obviously,
there are more economic methods for the calculation of
final key rate. Here we have not considered the consump
tion of raw keys for QBER test. Now we reconsider the
key rate calculation of decoy states above. We assumed
the worst case of s0= (1+r0)S0and s0= (1−r0)S0for
calculating ∆µ
1respectively. Although we don’t
exactly know the true value of s0, there must be one fixed
1and Eµ
Page 4
4
0.20.10.0
r0
0.10.2
1.0x10
4
1.1x10
4
1.2x10
4
1.3x10
4
Final Key Rate of Decoy States
FIG. 3: The final key rate of decoy pulses varies with the
vacuum counting rate of s0 in the case of 13.448 km, where
s0 = (1 + r0)S0.
value for both calculations. Therefore we can choose ev
ery possible value in the range of (1 − r0)S0 ≤ s0 ≤
(1 + r0)S0and use it to calculate ∆µ
key rate, and then pick out the smallest value as the lower
bound of decoy states key rate. Figure 3 demonstrates
the results with a larger range of r0 (r0can be negative
here) than the actual range in the case of 13.448 km. This
economic calculation method can obtain a more tight
ened value of the lower bound, which is larger than the
result using the simple calculation method above with
twostep worstcase assumption for s0values.
We have tested the system with different fiber lengths
and compared the final key rates with the theoretical
values, see Fig.2(b). The differences between them are
mainly due to the imperfect polarization compensation
and the possible statistical fluctuation.
The two measurement schemes have their own advan
tages. Onedetector scheme can overcome the security
loopholes of the detector efficiency mismatch and gener
ate the unconditionally secure final keys while the other
can implement longer distance. If we use fourdetector
scheme with four high quality SPDs the final key rate
and maximum distance will be improved. Also, the bal
ance between the efficiency and the dark counts of SPD
is important. During the experiment, we have even re
duced the efficiency of SPD purposely to reduce the dark
counts to obtain better balance. Hopefully, a lownoise
and highefficiency detector at telecommunication wave
lengths can be used in the future to further improve the
final key rate. The superconducting transitionedge sen
sor is one of the promising candidates [23].
In summary, we implement the polarizationbased one
way decoystate QKD over 102 km and also implement
75 km oneway decoystate QKD using only one detector
to really offer the unconditionally secure final keys.
This work is supported by the NNSF of China, the
CAS and the National Fundamental Research Program.
1, Eµ
1and the final
∗These authors contributed equally to this work.
[1] C.H. Bennett and G. Brassard, in Proc. of IEEE Int.
Conf. on Computers, Systems, and Signal Processing
(IEEE, New York, 1984), pp. 175179.
[2] N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Rev.
Mod. Phys. 74, 145 (2002).
[3] M. Dusek, N. L¨ utkenhaus, M. Hendrych, in Progress in
Optics VVVX, edited by E. Wolf (Elsevier, 2006).
[4] D. Mayers, J. ACM 48, 351 (2001).
[5] P. W. Shor and J. Preskill, Phys. Rev. Lett. 85, 441
(2000).
[6] W.Y. Hwang, Phys. Rev. Lett. 91, 057901 (2003).
[7] X.B. Wang, Phys. Rev. Lett. 94, 230503 (2005).
[8] X.B. Wang, Phys. Rev. A 72, 012322 (2005).
[9] H.K. Lo, X. Ma, and K. Chen, Phys. Rev. Lett. 94,
230504 (2005); X. Ma et al., Phys. Rev. A 72, 012326
(2005).
[10] J.W. Harrington et al., quantph/0503002.
[11] V. Scarani et al., Phys. Rev. Lett. 92, 057901 (2004);
C. Branciard et al., Phys. Rev. A 72, 032301 (2005).
[12] M.Koashi, Phys.Rev.
K. Tamaki, et al., quantph/0607082.
[13] M. Bourennane et al., Opt. Express 4, 383 (1999);
D. Stucki et al., New. J. Physics, 4, 41, (2002); H. Kosaka
et al., Electron. Lett. 39, 1199 (2003);
Z.L. Yuan, and A.J. Shields, Appl. Phys. Lett. 84, 3762
(2004); X.F Mo et al., Opt. Lett. 30, 2632 (2005).
[14] B. Huttner et al., Phys. Rev. A 51, 1863 (1995);
H.P. Yuen, Quantum Semiclassic. Opt. 8, 939 (1996);
G. Brassard et al., Phys. Rev. Lett. 85, 1330 (2000);
N. L¨ utkenhaus,Phys. Rev. A 61,
N. L¨ utkenhaus and M. Jahma, New J. Phys. 4, 44 (2002).
[15] Y. Zhao et al., Phys. Rev. Lett. 96, 070502 (2006);
Y. Zhao et al., quantph/0601168.
[16] N. Gisin et al., Phys. Rev. A 73, 022320 (2006).
[17] H. Inamori,N. L¨ utkenhaus,
quantph/0107017; D.
N. L¨ utkenhaus, and J. Preskill, Quantum Inf. Comput.
4, 325 (2004).
[18] X.B. Wang, quantph/0609081; X.B. Wang, C.Z. Peng,
quantph/0609137.
[19] R. No´ e, Electron. Lett. 22, 772773 (1986); N. G. Walker
and G. R. Walker, Electron. Lett. 23, 290292 (1987);
R. No´ e, H. Heidrich, and D. Hoffmann, J. Lightwave
Technol. 6, 11991207 (1988).
[20] V. Makarov, A. Anisimov, J. Skaar, Phys. Rev. A 74,
022313 (2006); B. Qi et al., quantph/0512080.
[21] Detection efficiency ηD1 ≈ 7%, ηD2 ≈ 6%, the timing
windows are both 2.5 ns, and the dark count rates are
about 2 × 10−6/pulse and 3 × 10−6/pulse respectively.
The actual observed value of S0 is larger than these pa
rameters due to the imperfect light sources.
[22] Like other papers, e.g., Ref [15], the treatment of QBER
here is simple. However, we can use stricter calculation
methods. For instance, we use all the X (+−) basis bits
for testing the phase flip error and 10% of Z (HV ) basis
bits for testing bit flip error, while in estimating the phase
flip and bit flip error rate for the remaining Z basis bits
we use 10 standard deviations and 1 standard deviation,
respectively. And a factor of 0.45 should be multiplied to
calculate the final key rate. Even applying this strict way
we can still obtain positive final keys with thousands of
final bits from our experiment in the case of 102.714 km.
[23] K.D. Irwin, Appl. Phys. Lett. 66, 1998 (1995); B. Cabr
era et al., Appl. Phys. Lett. 73, 735 (1998); D. Rosenberg
et al., Phys. Rev. A 71, 061803(R) (2005).
Lett.
93, 120501(2004);
C. Gobby,
052304 (2000);
D.Mayers,
Gottesman,H.K.Lo,