arXiv:quant-ph/0607129v3 9 Jan 2007
Experimental Long-Distance Decoy-State Quantum Key Distribution Based On
Cheng-Zhi Peng,1,2, ∗Jun Zhang,2, ∗Dong Yang,1, ∗Wei-Bo Gao,2Huai-Xin Ma,1,3
Hao Yin,3He-Ping Zeng,4Tao Yang,2Xiang-Bin Wang,1and Jian-Wei Pan1,2,5
1Department of Physics, Tsinghua University, Beijing 100084, China
2Hefei National Laboratory for Physical Sciences at Microscale and Department of Modern Physics,
University of Science and Technology of China, Hefei, Anhui 230026, China
3China Electronics System Engineering Company, Beijing 100039, China
4Key Laboratory of Optical and Magnetic Resonance Spectroscopy and Department of Physics,
East China Normal University, Shanghai 200062, China
5Physikalisches Institut, Universit¨ at Heidelberg, Philosophenweg 12, 69120 Heidelberg, Germany
(Dated: February 1, 2008)
We demonstrate the decoy-state quantum key distribution (QKD) with one-way quantum com-
munication in polarization space over 102 km. Further, we simplify the experimental setup and
use only one detector to implement the one-way decoy-state QKD over 75 km, with the advantage
to overcome the security loopholes due to the efficiency mismatch of detectors. Our experimental
implementation can really offer the unconditionally secure final keys. We use 3 different intensities
of 0, 0.2 and 0.6 for the light sources in our experiment. In order to eliminate the influences of po-
larization mode dispersion in the long-distance single-mode optical fiber, an automatic polarization
compensation system is utilized to implement the active compensation.
PACS numbers: 03.67.Dd, 42.81.Gs, 03.67.Hk
Quantum key distribution [1, 2, 3] can in principle of-
fer the unconditionally secure private communications
between two remote parties, Alice and Bob. However,
the security proofs for the ideal BB84 protocol [4, 5] do
not guarantee the security of a specific setup in prac-
tice due to various imperfections there. One important
problem in practical QKD is the effects of the imper-
fect source, say, the coherent states. The decoy state
method [6, 7, 8, 9, 10] or some other methods [11, 12]
can help to generate the unconditionally secure final keys
even an imperfect source is used by Alice in practical
QKD. Basically, QKD can be realized in both free space
and optical fiber . Each option has its own advantages.
The fiber QKD can be run in the always-on mode: it runs
in both day and night and is not affected by the weather.
Also, the future local QKD networks are supposed to be
using fiber. So far, there are many experiments of fiber
QKD with weak coherent lights . However, these re-
sults actually do not offer the unconditional security be-
cause of the possible photon-number-splitting attack .
Recently, there are also experimental implementations of
the decoy-state method , with two-way quantum com-
munication. However, since these implementations have
not taken the specific operations as requested by Ref. ,
the security of the final keys is still unclear due to the
so-called Trojan horse attacks . One can implement
active counter-measures  to overcome this problem,
which is deserved experimental implementations in the
future. The other way is to use one-way quantum com-
munication which we have adopted in this work.
Here we present the first polarization-based decoy-
state QKD implementation over 102 km with only one-
way quantum communication using two detectors and
75 km using only one detector. Our results are uncondi-
tionally secure (For the unconditional security, we mean
that the probability that Eve has non-negligible amount
of information about the final key is exponentially close
to 0, say, e−O(100)).Here we must clarify that given
the existing technologies , if the distance is shorter
than about 20 km, through the simple worst-case estima-
tion  of the fraction of tagged bits it is still possible
for one to implement the unconditionally secure QKD
without using the decoy-state method.
We can know how to distill the secure final keys with
imperfect source given the separate theoretical results
from Ref. , if we know the upper bound of the fraction
of tagged bits (those raw bits generated by multi-photon
pulses from Alice) or equivalently, the lower bound of the
fraction of untagged bits (those raw bits generated by
single-photon pulses from Alice). In Wang’s 3-intensity
decoy-state protocol [7, 8], one can randomly use 3 differ-
ent intensities (average photon numbers) of each pulses
(0, µ, µ′) and then observe the counting rates (the count-
ing probability of Bob’s detector whenever Alice sends
out a state) of pulses of each intensities (S0,Sµ,Sµ′). The
density operators for the states of µ and µ′(µ′> µ) are
?ρµ= e−µ|0??0| + µe−µ|1??1| + cρc
ρµ′ = e−µ′|0??0| + µ′e−µ′|1??1| +µ′2e−µ′
here c = 1 − e−µ− µe−µ,ρc=e−µ
a density operator and d > 0 (here we use the same no-
tations in Ref. [7, 8]). We denote s0(s′
the counting rates of those vacuum pulses, single-photon
pulses and ρc pulses from ρµ(ρµ′). Asymptotically, the
values of primed symbols here should be equal to those
values of unprimed symbols. However, in an experiment
the number of samples is finite therefore they could be
a bit different. The bound values of s1,s′
mined by the following joint constraints corresponding to
Eq.(15) of Ref. 
1can be deter-
Sµ= e−µs0+ µe−µs1+ csc
µ′2e−µ′(Sµ′ − µ′e−µ′s′
s0= (1+r0)S0and r0=
results [7, 8]. Nµ,N0are the pulse numbers of intensity
µ,0. Given these, one can calculate s1,s′
The experimental setup is shown in Fig.1, mainly in-
cluding transmitter (Alice), quantum channel, receiver
(Bob) and electronics system. All the electronics mod-
ules are designed by ourselves. The synchrodyne (SD) is
designed by field programmable gate array (FPGA, Al-
tera Co.) and outputs multiple channels of synchronous
clocks with independent programmable parameter set-
tings, which is equivalent to an arbitrary function gen-
erator, to drive the modules of random number genera-
tor (RNG), data acquisition (DAQ, designed by FPGA)
and single-photon detector (SPD) respectively. The sig-
nals with FWHM of about 1 ns are generated by laser
diode driver (LDD) to drive 10 distributed feed-back
laser diodes (LD) at the central wavelength of 1550 nm,
where 4 LDs are used for decoy states (µ) and another 4
LDs are used for signal states (µ′) and the other 2 LDs
are used for polarization calibration. The polarization
states of photons emitting from LDs can be transformed
to arbitrary polarization state by polarization controller
(PC). For decoy states and signal states, the four polar-
ization states are |H?,|V ?,|+?,|−?, where |H?,|V ? rep-
resent horizontal polarization and vertical polarization,
|+? = 1/√2(|H? + |V ?) and |−? = 1/√2(|H? − |V ?), as
the four states for the standard BB84 protocol . For
test states, the two polarization states are |H? and |+?
to calibrate the two sets of polarization basis. The pho-
tons of every channel are coupled to an optical fiber via
fiber coupling network (FCN), which is composed of mul-
tiple beam splitters (BS) and polarization beam splitters
(PBS) and optical attenuators. In FCN, the fiber length
of every channel must be adjusted precisely so that the
arrival time differences to SPD caused by the fiber length
differences can be less than 100 ps.
In the setup, a dense wavelength division multiplexing
fiber filter (FF) is inserted in Alice’s side. On the one
hand, it can guarantee that the wavelengths of emitted
photons in all channels are equal to avoid the possibility
of Eve’s attack utilizing the variance of photon wave-
lengths. On the other hand, it can reduce the influences
of chromatic dispersion in fiber.
In the experiment, the pulse numbers ratio of the 3
√S0N0to obtain the worst-case
FIG. 1: Schematic diagram of the experimental setup. Solid
line and dashed line represent optical fiber and electric cable
respectively. See the text for the abbreviations.
intensities is 5 : 4 : 1 and the intensities of signal states
and decoy states are fixed at µ′= 0.6 and µ = 0.2 respec-
tively, which are not necessarily the optimized parame-
ters with our setup. The fluctuations of intensities are
monitored at the test point (TP). If the varying range
of fluctuation is larger than about 5% we will stop the
system and adjust the light sources. In fact, the effects
of intensity fluctuation is indeed a very important theo-
retical problem for the decoy-state QKD, which had not
been solved by theorists prior to our experiment. Very re-
cently theoretical progress has shown that the effects are
moderate with certain modifications of the experimental
After passing through the long-distance single-mode
fiber (SMF, Corning Co., fiber attenuation is about
0.2 dB/km), at Bob’s side we adopt two kinds of mea-
surement scheme. In one-detector scheme, firstly a fiber
BS is used to select the two polarization basis called HV
basis and +− basis randomly. Secondly due to the polar-
ization mode dispersion (PMD) effects in long-distance
SMF, we develop an automatic polarization compensa-
tion (APC) system to compensate for the PMD actively.
The principles of APC are: Alice sends fixed |H? states
or |+? states.
ing rates in the corresponding basis using DAQ system
and transmits them to the computer via universal serial
bus (USB). After algorithmic processing, the computer
gives out the data, which can be converted to voltages of
electric polarization controllers (EPC, General Photon-
ics Co.) through digital-to-analog converter (DAC) and
high voltage amplifier (HVA). Then the fiber squeezers
in EPC are driven by the voltages and change the po-
larization . After repeating feedback controls the vis-
ibility of test states can reach the target value and the
APC system stops. The average adjusting time is about
3 minutes. However, this time can be greatly shortened
using a continuous coherent light and wavelength division
multiplexing techniques and optimized algorithms. Fig-
ure 2(a) shows the test results of the APC system with
75 km fiber. In the experiment, Alice starts APC to cal-
Then Bob records the accepted count-
Final Key Rate
Fiber Length (km)
APC after artificial
FIG. 2: a) Test of the APC system with 75 km fiber. In posi-
tion 1 and 2 the APC system monitors the visibility changes
of polarization states and adjusts the voltages of EPC actively
to reach the target visibility. Subsequently, the visibility of
polarization states becomes worse slowly when free running.
In position 3, artificial disturbance induces drastic change of
visibility and the APC system can still work well. The time
interval of points is 2 seconds. b) Comparison of the final key
rate of signal states per pulse between the theoretical calcula-
tion and experimental results with four different distance set-
tings L (13.448 km, 50.524 km, 75.774 km and 102.714 km),
where their corresponding total attenuations are (24.9 dB,
32.2 dB, 34.8 dB, 37.0 dB) including channel losses, all the
insertion losses of components, detector efficiencies etc. The
first three settings use one-detector scheme and the last one
uses two-detector scheme. The first two settings’ repetition
frequency is f=4 MHz and the last two is f=2.5 MHz.
ibrate the system first. After calibration she transmits
the pulses for several minutes. Then this process is re-
peated. Thirdly we use two magnetic optical switch (OS,
Primanex Co.) with switching time of less than 20 µs
driven by two independent RNG to randomly switch the
basis and the output ports of PBS respectively. The one-
detector scheme can overcome the security loopholes due
to the efficiency mismatch of detectors  since the fiber
lengths of each state can be adjusted identically. On the
other hand, two OS driven by the same RNG and two
SPDs  are used in two-detector scheme to reduce the
transmission losses in Bob’s side.
We use this all-fiber quantum cryptosystem to imple-
ment the decoy-state QKD over 102 km and 75 km us-
ing two-detector scheme and one-detector scheme respec-
tively.The experimental parameters and their corre-
sponding values are listed in Table I. In the experiment,
Alice totally transmits about N pulses to Bob. After
the transmission Bob announces the pulse sequence num-
bers and basis information of received states. Then Alice
broadcasts to Bob the actual state class information and
basis information of the corresponding pulses. Alice and
Bob can calculate the experimentally observed quantum
bit error rate (QBER) values Eµ,Eµ′ of decoy states and
signal states according to all the decoy bits and a small
fraction of the signal bits respectively .
Then we can numerically calculate a tight lower bound
of the counting rate of single-photon s′
next step is to estimate the fraction of single-photon ∆1
1using Eq. 2. The
TABLE I: Experimental parameters (P.) and their corre-
sponding values of 75.774 km (Value1) and 102.714 km
(Value2) decoy-state QKD.
1.607 × 1095.222 × 109S0
RT 46.167 Hz
102.714 km Sµ′ 2.076 × 10−41.262 × 10−4
7.534 × 10−54.611 × 10−5
9.174 × 10−66.711 × 10−6
2.460 × 10−41.558 × 10−4
Rµ′ 1.143 × 10−56.706 × 10−6
RE 11.668 Hz
and the QBER upper bound of single-photon E1. We use
to conservatively calculate ∆1of signal states and decoy
states respectively [7, 8]. And E1 of signal states and
decoy states can be estimated by the following formula,
= (Eµ′(µ)−(1 − r0)S0e−µ′(µ)
Here we consider the statistical fluctuations of the vac-
uum states to obtain the worst-case results.
Lastly we can calculate the final key rates of signal
states using the formula [7, 8] of
Rµ′ = Sµ′(∆µ′
1− H(Eµ′) − ∆µ′
here H(x) = −xlog2(x) − (1 − x)log2(1 − x). Then we
compare the experimental final key rate of signal states
RE with the theoretically allowed value RT, i.e., in the
case both ∆1and E1are known without any overestima-
tion. The theoretically allowed values of ∆1and E1for
signal states are
1T= (Sµ′ − (1 − µ′)S0)e−µ′/Sµ′
1T= (Eµ′ −S0e−µ′
with the assumptions that the ideal value of the single-
photon counting rate is s1T = η+S0and Sµ′ = ηµ′+S0,
where η is the overall transmittance. We find out that
our experimental results in the two cases are both close
to 30% of the theoretically allowed maximum value.
During the above calculation, we have used the worst-
case results in every step for the security. Obviously,
there are more economic methods for the calculation of
final key rate. Here we have not considered the consump-
tion of raw keys for QBER test. Now we reconsider the
key rate calculation of decoy states above. We assumed
the worst case of s0= (1+r0)S0and s0= (1−r0)S0for
1respectively. Although we don’t
exactly know the true value of s0, there must be one fixed
Final Key Rate of Decoy States
FIG. 3: The final key rate of decoy pulses varies with the
vacuum counting rate of s0 in the case of 13.448 km, where
s0 = (1 + r0)S0.
value for both calculations. Therefore we can choose ev-
ery possible value in the range of (1 − r0)S0 ≤ s0 ≤
(1 + r0)S0and use it to calculate ∆µ
key rate, and then pick out the smallest value as the lower
bound of decoy states key rate. Figure 3 demonstrates
the results with a larger range of |r0| (r0can be negative
here) than the actual range in the case of 13.448 km. This
economic calculation method can obtain a more tight-
ened value of the lower bound, which is larger than the
result using the simple calculation method above with
two-step worst-case assumption for s0values.
We have tested the system with different fiber lengths
and compared the final key rates with the theoretical
values, see Fig.2(b). The differences between them are
mainly due to the imperfect polarization compensation
and the possible statistical fluctuation.
The two measurement schemes have their own advan-
tages. One-detector scheme can overcome the security
loopholes of the detector efficiency mismatch and gener-
ate the unconditionally secure final keys while the other
can implement longer distance. If we use four-detector
scheme with four high quality SPDs the final key rate
and maximum distance will be improved. Also, the bal-
ance between the efficiency and the dark counts of SPD
is important. During the experiment, we have even re-
duced the efficiency of SPD purposely to reduce the dark
counts to obtain better balance. Hopefully, a low-noise
and high-efficiency detector at telecommunication wave-
lengths can be used in the future to further improve the
final key rate. The superconducting transition-edge sen-
sor is one of the promising candidates .
In summary, we implement the polarization-based one-
way decoy-state QKD over 102 km and also implement
75 km one-way decoy-state QKD using only one detector
to really offer the unconditionally secure final keys.
This work is supported by the NNSF of China, the
CAS and the National Fundamental Research Program.
1and the final
∗These authors contributed equally to this work.
 C.H. Bennett and G. Brassard, in Proc. of IEEE Int.
Conf. on Computers, Systems, and Signal Processing
(IEEE, New York, 1984), pp. 175-179.
 N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Rev.
Mod. Phys. 74, 145 (2002).
 M. Dusek, N. L¨ utkenhaus, M. Hendrych, in Progress in
Optics VVVX, edited by E. Wolf (Elsevier, 2006).
 D. Mayers, J. ACM 48, 351 (2001).
 P. W. Shor and J. Preskill, Phys. Rev. Lett. 85, 441
 W.-Y. Hwang, Phys. Rev. Lett. 91, 057901 (2003).
 X.-B. Wang, Phys. Rev. Lett. 94, 230503 (2005).
 X.-B. Wang, Phys. Rev. A 72, 012322 (2005).
 H.-K. Lo, X. Ma, and K. Chen, Phys. Rev. Lett. 94,
230504 (2005); X. Ma et al., Phys. Rev. A 72, 012326
 J.W. Harrington et al., quant-ph/0503002.
 V. Scarani et al., Phys. Rev. Lett. 92, 057901 (2004);
C. Branciard et al., Phys. Rev. A 72, 032301 (2005).
K. Tamaki, et al., quant-ph/0607082.
 M. Bourennane et al., Opt. Express 4, 383 (1999);
D. Stucki et al., New. J. Physics, 4, 41, (2002); H. Kosaka
et al., Electron. Lett. 39, 1199 (2003);
Z.L. Yuan, and A.J. Shields, Appl. Phys. Lett. 84, 3762
(2004); X.-F Mo et al., Opt. Lett. 30, 2632 (2005).
 B. Huttner et al., Phys. Rev. A 51, 1863 (1995);
H.P. Yuen, Quantum Semiclassic. Opt. 8, 939 (1996);
G. Brassard et al., Phys. Rev. Lett. 85, 1330 (2000);
N. L¨ utkenhaus, Phys. Rev. A 61,
N. L¨ utkenhaus and M. Jahma, New J. Phys. 4, 44 (2002).
 Y. Zhao et al., Phys. Rev. Lett. 96, 070502 (2006);
Y. Zhao et al., quant-ph/0601168.
 N. Gisin et al., Phys. Rev. A 73, 022320 (2006).
 H. Inamori,N.L¨ utkenhaus,
N. L¨ utkenhaus, and J. Preskill, Quantum Inf. Comput.
4, 325 (2004).
 X.-B. Wang, quant-ph/0609081; X.-B. Wang, C.-Z. Peng,
 R. No´ e, Electron. Lett. 22, 772-773 (1986); N. G. Walker
and G. R. Walker, Electron. Lett. 23, 290-292 (1987);
R. No´ e, H. Heidrich, and D. Hoffmann, J. Lightwave
Technol. 6, 1199-1207 (1988).
 V. Makarov, A. Anisimov, J. Skaar, Phys. Rev. A 74,
022313 (2006); B. Qi et al., quant-ph/0512080.
 Detection efficiency ηD1 ≈ 7%, ηD2 ≈ 6%, the timing
windows are both 2.5 ns, and the dark count rates are
about 2 × 10−6/pulse and 3 × 10−6/pulse respectively.
The actual observed value of S0 is larger than these pa-
rameters due to the imperfect light sources.
 Like other papers, e.g., Ref , the treatment of QBER
here is simple. However, we can use stricter calculation
methods. For instance, we use all the X (+−) basis bits
for testing the phase flip error and 10% of Z (HV ) basis
bits for testing bit flip error, while in estimating the phase
flip and bit flip error rate for the remaining Z basis bits
we use 10 standard deviations and 1 standard deviation,
respectively. And a factor of 0.45 should be multiplied to
calculate the final key rate. Even applying this strict way
we can still obtain positive final keys with thousands of
final bits from our experiment in the case of 102.714 km.
 K.D. Irwin, Appl. Phys. Lett. 66, 1998 (1995); B. Cabr-
era et al., Appl. Phys. Lett. 73, 735 (1998); D. Rosenberg
et al., Phys. Rev. A 71, 061803(R) (2005).