PreprintPDF Available

Long-distance quantum key distribution based on the physical loss control

Authors:
Preprints and early-stage research may not have been peer reviewed yet.

Abstract and Figures

Existing quantum cryptography is resistant against secrecy-breaking quantum computers but suffers fast decay of the signal at long distances. The various types of repeaters of propagating quantum states have been developed to meet the challenge, but the problem is far from being solved. We step in the breach and put forth long-distance high secrecy optical cryptography, creating the fast quantum key distribution over distances up to 40,000 kilometers. The key element of the proposed protocol is the physical control over the transmission line.
Content may be subject to copyright.
Long-distance quantum key distribution based on the physical
loss control
N. S. Kirsanov, N. R. Kenbaev, A. B. Sagingalieva, D. A. Kronberg, V. M. Vinokur,
G. B. Lesovik
Terra Quantum AG, St. Gallerstrasse 16A, CH-9400 Rorschach, Switzerland
May 4, 2021
Abstract
Existing quantum cryptography is resistant against secrecy-breaking quantum computers but
suffers fast decay of the signal at long distances. The various types of repeaters of propagating
quantum states have been developed to meet the challenge, but the problem is far from being solved.
We step in the breach and put forth long-distance high secrecy optical cryptography, creating the fast
quantum key distribution over distances up to 40,000 kilometers. The key element of the proposed
protocol is the physical control over the transmission line.
1 Introduction
Existing quantum cryptography is robust against secrecy-breaking quantum computers but is sub-
ject to the fast decay of the signal with the distances. To amend the signal losses, the various types
of repeaters of the propagating quantum states have been developed [1–16], but yet the long distance
transmission looks like an impossible task for existing protocols. Directly applying the principle of quan-
tum irreversibility [17–19], we step in the breach and put forth long-distance high secrecy cryptography,
creating the fast quantum key distribution over the globe distances of about 40,000 kilometers.
On a practical level, the information transfer efficiency, both in classical and quantum cases, is
hindered by the optical fiber losses. The conventional approach to quantum communication is double-
suffering: firstly, the losses themselves harm efficiency; secondly, the commonly accepted concept is
that an eavesdropper (Eve) can use all the transmission line losses to decipher the communication
successfully. However, the lion share of losses occurs due to Rayleigh scattering of the signal propagating
through the optical fiber. This propagation is similar, to no small extent, to the evolution of the
ensemble of particles experiencing scattering on the quenched disorder potential described by the kinetic
equation [20], generalizing the classical Boltzmann equation. This implies that the particle dynamics
is accompanied by the entropy growth and, therefore, irreversible as expressed by the Second Law of
Thermodynamics. Taking that the line carries a scatterer per a wavelength, we conclude that at least
about 109quantum Maxwell Demon-like devices are required to collect photons scattered in a one
kilometer long fiber and to reverse and unify the dynamics of the related quantum states. This makes
collection of the Rayleigh-scattered information an impossible task. These considerations supply us with
a new paradigm for establishing an innovative quantum key distribution (QKD) protocol based on the
physical control of the optical fiber line.
In a basic optical QKD scheme electromagnetic states representing different bit values are transmitted
from the sender (Alice) to the receiver (Bob) which allows them to securely share a secret random
sequence. As we have just pointed out, the major irreversibility’s implication is that Eve cannot collect
any useful information about the random bits from the scattering. However, the possibility of the local
rerouting of the part of the transmitted signal remains. Physically this can be implemented, for example,
by a local bending the fiber, which leads to mixing of the major propagating mode with the higher-order
leaking modes. This local imperfection, in turn, allows for eavesdropping on the information carried by
the major mode. Had the signal been classical, this “bending” would have opened unlimited access to
the full content of the message for Eve. However, any electromagnetic signal is quantized and can be
viewed as a sequence of photons. The discreet statistics of photons imposes a major limitation on Eve’s
1
arXiv:2105.00035v1 [quant-ph] 30 Apr 2021
Alice
Eve
Bob
EDFA
EDFA
EDFA
Figure 1: Schematics of the setup realizing the exemplary protocol. Alice encodes a random bit string
into a sequence of coherent pulses and sends it to Bob via the optical fiber. The pulses pass through
a sequence of optical amplifiers and the resulting signals are then received and measured by Bob. Eve
can seize part of the signal: for instance, by bending the transmitting optical fiber and detecting the
transcending optical modes. However, Alice and Bob monitor the losses in the line, and always know
the proportion of the signal stolen by eavesdropper. Importantly, they can identify the exact losses
caused and exploited by Eve. This knowledge enables Alice and Bob to adopt the most efficient bit
ciphering and measurement scheme: depending on how many photons Eve intercepts, Alice picks certain
values of signal intensities which are optimal as far as the informational advantage over Eve is concerned;
in a concerted manner, Bob adjusts his measurement routine. This in particular gives the authorized
parties additional leverage as far as post-selection is concerned: after transmitting and receiving the
random bit string, Alice and Bob use an authenticated public classical channel to perform information
reconciliation (increasing their informational advantage over Eve) and privacy amplification – with the
optimal parameters of ciphering and measurement these procedures allow to eradicate Eve’s information
without sacrificing too many bits.
ability to extract information from measuring seized signal. If the initial signal contains, on average,
Nphotons, and the local leakage is quantified by transparency rE, only the small fraction of the signal
containing nE=rENphotons comes to Eve. In the case of the coherent signal state, the unavoidable
fluctuation of the photon number follows the Poisson statistics, δnE=rEN. Therefore, with the
decrease of rE, the relative fluctuations grow as δnE/nE= 1/rEN. If, for instance, Alice encodes bit
values into pulses with two different intensities, high fluctuations make it difficult for Eve to distinguish
them. In turn, if Bob gets the signal pulse comprising NBphotons for which fluctuations δNBNB,
then even a single-shot measurement provides him with a high-probability reliable recognition of whether
the received signal represents 0 or 1. This establishes that the critical condition of security guarantee
is ensuring that Bob gets the share sufficient for identifying the recognition of the signal, while the
controlled value of rElimits the distinguishability of the signal portion seized by Eve.
An efficient control over rErests on a careful analysis of the optical fiber’s state and the emergent
scattering matrix that can be accomplished by standard telecom technology methods, particularly, using
the optical time-domain reflectometry. We propose an efficient technique for controlling the optical fiber
based on the direct measurement of the propagation of the signal from Alice to Bob. This technique,
together with the cascade signal amplification as a mean for preserving signal intensity lays the foundation
for our QKD protocol unlocking unprecedented key generation rates and global transmission distances.
2 Method description
We propose a method for long-distance QKD based on the signal amplification and physical control
of the transmission line (see the schematics in Fig.1). Two principal ideas behind the method are: (i)
2
the random bits are encoded into non-orthogonal coherent pulses which are amplified by a cascade of
the in-line optical amplifiers, e.g., Erbium Doped Fiber Amplifiers (EDFAs) to achieve long-distance
transmission, and (ii) Alice and Bob can determine the exact proportion of the signal stolen by the
eavesdropper (Eve) and distinguish it from the natural losses in the line (caused primarily by the Rayleigh
scattering). Alice and Bob use the knowledge about losses to accurately estimate their informational
advantage over Eve which in turn allows them to pick the pulses’ intensities, adopt the measurement
routine and perform post-selection in the most efficient way, leaving Eve no information about the final
shared key.
0. Initial preparation.– The reflectometry methods allows to determine losses with high precision and
distinguish local losses (which could be caused by Eve) from the intrinsic natural losses homoge-
neous across the whole line and caused mainly by the Rayleigh and Raman scattering. As a part
of the initial equipment setting, Alice and Bob determine the natural losses r0in the transmission
line which cannot be caused by Eve. Bob and Alice share the value of r0via the authenticated
classical communication channel.
1. Alice and Bob determine a total signal loss rtin the communication channel via transmitting test
pulses. After that, they obtain the signal loss rEcaused by an eavesdropper by comparing the
intrinsic signal loss r0with the total signal loss rt. Bob and Alice share the value of rEvia the
authenticated classical communication channel.
For example, let us consider a section of the communication channel which does not comprise
amplifiers. If the intrinsic loss in this section is r0and Eve seizes a proportion rEof the signal,
then the total loss rtis determined from the equation (1 rt) = (1 rE)(1 r0). Further below
we describe a beam splitter attack of Eve 5 at a single location along the communication channel.
The proposed method and our analysis presented further below also generalizes to the case where
Eve intrudes the communication channel at several locations.
2. Using a physical random number generator (possibly quantum), Alice generates a bit sequence of
length L.
3. Alice ciphers her bit sequence into a series of Lcoherent light pulses which she sends to Bob. The
bits 0 and 1 are defined by the coherent states |γ0i=|γiand |γ1i=|−γirespectively, – without
loss of generality, assume that γR– and the value of γis chosen optimally given the known
specific value of rE. This means that Alice uses such coherent states that they correspond to the
maximum key generation speed with respect to the losses in the channel. The intensity of the pulse
γiis determined by the average photon number
hni=|γ|2.(1)
4. The signal is amplified by a cascade of optical amplifiers installed equidistantly along the whole
optical line. Each amplifier compensates the losses in such a way that the amplified signal intensity
equals to the initial one. As a coherent pulse passes through amplifiers its state becomes mixed.
Bob receives the signal and performs the homodyne measurement, the parameters of which are
again determined by the known value of rE.
5. Alice and Bob apply information reconciliation. Some of Bob’s measurements will have inconclusive
results and the corresponding bits must be discarded. To do so, Bob announces positions of invalid
bits to Alice publicly via an authenticated public classical channel.
6. Alice and Bob estimate the error rate and perform the error correction procedure.
7. Alice and Bob perform privacy amplification. Using a special protocol, Alice and Bob produce a
shorter key, which Eve has no (or negligibly small) information about. Once again, Alice and Bob
may need to use their authenticated public classical channel.
8. Alice and Bob perform steps 1 to 7 until the length of the shared key is appropriate.
The outlined protocol is based on phase ciphering. However, in the case of very long transmission
distances, the preservation of the pulses’ polarization and the efficient phase reference transmission
necessary for homodyne detection may be challenging. These practical difficulties can be lifted, by,
for example, using intensity ciphering, in which case the bit values are encoded into the two pulses
3
with different intensities. This has already been mentioned in the Introduction and is analyzed below in
Section 3.1. In the main part of the paper, we will concentrate primarily on the phase ciphering approach
which ensures faster information transmission. In the forthcoming publication we will analyse in detail
the special measures necessary for compensating phase fluctuations hence improving considerably the
phase ciphering protocol.
3 Signal amplification
The crucial component of the proposed scheme is the cascade of amplifiers preserving the signal
intensity necessary for achieving long distance transmission. We start this section with estimates illus-
trating how amplification impacts the signal fluctuations and the precision in detecting leakage. We then
introduce the formal framework based on the P-function representation and show how the signal state
evolves under the ideal amplification process. After that, we consider the practical case of amplification
in doped fibers with the associated losses in the channel. We further show that a cascade of amplifiers can
be theoretically reduced to one effective amplifier – we will use this formal property in further sections
for the analysis of legitimate users’ informational advantage over the eavesdropper.
3.1 Preliminary estimates
The challenge to meet is reaching the global distances of the transmission exceeding 20,000km. In
order to estimate possible enhancement of the transmission distance we use, for illustrative purposes,
simple and transparent estimates based on the robustness of the strength of our pulses. Let us estimate
the strength of our pulses that allows for their stable analogue amplifying, transmitting the signal with-
out distorting its shape and phase with the minimal generated noise and, at the same time, preserving
the degree of protection against eavesdropping. A crucial component needed to ensure such an enhance-
ment are just the standard telecom amplifiers preserving the analog signal including erbium-doped fiber
amplifier and Raman amplifier. To give an idea how it works, we present simple estimates leaving the
detailed description for the technical part of the paper.
Let us consider the control precision for the representative line of 20,000 km. In general, the exact
optimal distance between amplifiers is to be calculated. Here for the estimate we take the standard
telecom practice distance of d= 50 km. On this distance the signal drops by factor of 10 (the transmission
probability T= 0.1); correspondingly the amplifying coefficient is to be G= 10. Suppose that the initial
test signal carries nA
T= 1014 photons, which drops down to T·nA
T= 0.1·1014 = 1013 on the 50 km end.
An amplifier restores it back to G·T·nA
T= 10 ·0.1·1014 = 1014 but adds noise. Since photons follow
the Poisson statistics, the fluctuations before the amplifier are qT·nA
T'3·106. These fluctuations are
amplified with the factor Gas well, giving
δnG
T'GqT nA
T'3·107.(2)
Coming through the sequence of Mamplifiers which add fluctuations independently, the total fluctuation
raises by factor M, giving for 400 amplifiers on the 20,000 km line the twenty-fold fluctuation increase.
The fluctuation on Bob’s end is thus
δnB
T'M δnG
T'6·108.(3)
At the end of the day, we have
δnB
T/nB
T'6·106.(4)
This determines the minimum detectable leakage rmin
E'6·106. Our qualitative considerations agree
with the rigorous calculations provided in Sec. 3.5.
For illustrative purposes, let us use the intensity ciphering instead of the phase ciphering. If Eve gets
1 photons (stealing signal in the vicinity of Alice), unity relative error would make it impossible for
her to distinguish between the different pulses provided that their intensities are of the same order. A
pulse hard for eavesdropping must thus contain n1/rmin
E105photons; in this case, the fluctuation
at Bob’s amounts to
δn =GM n 104; (5)
δn/n 0.1.(6)
4
This allows, especially taking into account additional informational postprocessing measures exercised
by both Bob and Alice, more elaborate encoding and measuring procedures, the readable Alice to Bob
transmission that cannot be intercepted by Eve. The fact that scalability behaves as square root of the
line length, enables us to execute a major breakthrough in safe communication sending the decipherable
signal over a global distance of 40,000km.
3.2 P-function and its evolution under amplification
Let us introduce our theoretical framework for the rigorous description of losses and amplifications.
Consider a single photonic mode with bosonic operators ˆaand ˆaacting in the Fock space. To understand
the effect of the amplification on the bosonic mode state, it is most convenient to use the P-function
representation of the latter. Such representation allows to express any density operator as a quasi-mixture
of coherent states:
ˆρ=Zd2αP(α)|αihα|,(7)
where d2αdRe(α)dIm(α) and the quasi-probability distribution P(α) is not necessarily positive. For
a given state described by density matrix ˆρthe P-function can be written as
P(α) = trˆρ:δaα) : (8)
where
:δaα) := 1
π2Zd2β eαβαβeβˆaeβˆa,(9)
see [21] for details.
Phase-amplification is described by a quantum channel given by
AmpG=cosh2(g): ˆρ7→ AmpG[ˆρ] = trbˆ
Ugˆρ⊗ |0ih0|bˆ
U
g
ˆ
Ug=egaˆ
bˆaˆ
b),(10)
where gis the interaction parameter characterizing the amplifier, G= cosh2(g) is the factor by which
the intensity of the input signal is amplified (as we will explicitly see in the following formulae), and
annihilation operator ˆ
bcorresponds to the auxiliary mode starting in the vacuum states. An explicit
Kraus representation of the channel can be written as
AmpG(ˆρ) =
X
n=0
ˆ
Knˆρˆ
Kn(11)
with ˆ
Kn=tanhn(g)
n!ˆancosh(g)ˆaˆasee e.g. [22].
To show how the P-function of a state changes under the amplification process let us consider a
simple situation where the input signal is in the pure coherent state |γihγ|with the corresponding initial
P-function Pi(α) = δ(αγ) (delta-function on complex numbers). After the amplification the P-function
becomes
P(α;γ, g ) = tr : δaα) : AmpG[|γihγ|].(12)
Bearing in mind that
Amp
Ga] = ˆ
U
gˆaˆ
Ug= cosh(ga+ sinh(g)ˆ
b,(13)
it is easy to see that
P(α;γ, g ) = 1
π(G1) exp |α|2
G1!.(14)
In other words, the output state is a mixture of normally distributed states centered around |i; the
width of the distribution is (G1)/2.
5
Figure 2: (a) Two loss or amplification channels can be reduced to one. (b) Loss and amplification
channels can be effectively rearranged. (c) A series of losses and amplifiers can be reduced to one pair
of loss and amplification.
3.3 Amplification in doped fibers and losses
In Er/Yt doped fiber the photonic mode propagates through the inverted atomic medium. To keep
the medium inverted, a seed laser of a different frequency co-propagates with the signal photonic mode
in the fiber and is then filtered out at the output by means of wavelength-division multiplexing (WDM).
The interaction between the inverted atoms at position zand propagating light field mode ˆais precisely
given by the Hamiltonian
H= i(ˆaˆ
b
zˆaˆ
bz),(15)
where ˆ
bzcorresponds to a collective decay of one of the atoms at z. Hence, the evolution of the signal
mode after its propagation through EDFA is set by a composition of infinitesimal phase-amplifications
which, as we show in the next subsection, can be effectively reduced to a single amplification channel.
In practice, the performance of EDFA suffers from technical limitations, which come in addition to
the amplification limits on added quantum noise. These limitations are mainly caused by two factors: (i)
the atomic population may be not completely inverted throughout the media, (ii) coupling imperfection
between the optical mode and EDFA or optical fiber. Both of these mechanisms can be taken into
account as a loss channel acting on the state before the amplification, as shown in [23].
Let us introduce the loss channel describing all possible losses in the line. Equation (13) describes
the action of amplifier on the annihilation operator in the Heisenberg picture. In the same way we can
express the canonical transformation associated with losses
Loss
Ta] = ˆ
¯
U
λˆaˆ
¯
Uλ= cos(λa+ sin(λc
=Tˆa+1Tˆc,
T= cos2(λ),
(16)
where λis the interaction parameter, Tis the proportion of the transmitted signal, the annihilation
operator ˆccorresponds to the initially empty mode which the lost photons go to, and ˆ
¯
Uλ=eλˆaˆcλˆaˆc.
3.4 Composition of amplifiers and losses
In our cryptographic scheme, the amplification is used to recover the optical signal after it suffers
from losses. Long-distance QKD requires a cascade of amplifiers, in which case signal’s evolution is
determined by a sequence of multiple loss and amplification channels. In this section we prove that
any such sequence can be mathematically reduced to a composition of one loss and one amplification
channels. We will later adopt this simple representation for the informational analysis of our protocol.
6
Statement 1. Two loss or amplification channels can be reduced to one
First, we show that a pair of loss or amplification channels can be effectively reduced to the one
channel, see Fig.2(a). To that end, let us consider two consequent loss channels:
(LossT2LossT1)a] = ˆ
¯
U
λ1
ˆ
¯
U
λ2ˆaˆ
¯
Uλ2
ˆ
¯
Uλ1
= LossT1(pT2ˆa+p1T2ˆc2)
=pT2T1ˆa+pT2(1 T1c1+p1T2ˆc2
=pT2T1ˆa+p1T1T2ˆc,
(17)
where we defined operator
ˆc=pT2(1 T1)ˆc1+1T2ˆc2)
1T1T2
,(18)
acting on the vacuum state and satisfying the canonical commutation relation [ˆc, ˆc] = 1. We can thus
represent two channels in a form of one effective channel:
LossT2LossT1= Loss(T=T1T2)(19)
The same reasoning applies to amplifiers:
AmpG2AmpG1= Amp(G=G2G1)(20)
Statement 2. Loss and amplification channels can be effectively rearranged
Let us show that a composition of an amplification channel followed by a loss channel can be math-
ematically replaced with a pair of certain loss and amplification channels acting in the opposite order,
see Fig.2(b). Consider the transformation corresponding to the amplification followed by the loss
(LossT0AmpG0)a] = ˆ
U
g0ˆ
¯
U
λ0ˆaˆ
¯
Uλˆ
Ug
= Amp
G0[T0ˆa+1T0ˆc]
=T0G0ˆa+p(1 T0c+pT0(G01)ˆ
b.
(21)
In the case of the opposite order we have
(AmpGLossT)a] = ˆ
¯
U
λˆ
U
gˆaˆ
Ugˆ
¯
Uλ
= Loss
T[Gˆa+G1ˆ
b]
=T Gˆa+pG(1 Tc+G1ˆ
b.
(22)
It is easy to see that the two transformations are identical if
LossT0AmpG0= AmpGLossT
T=G0T0
(G01)T0+ 1,
G= (G01)T0+ 1.
(23)
In other words, the two types of channels ”commute” provided that the parameters are modified in
accord with these relation. In particular, the parameters in the equation above are always physically
meaningful G1,0T1, meaning that we can always represent loss and amplification in form of a
composition where loss is followed by amplification (the converse is not true).
7
Statement 3. A series of losses and amplifiers can be reduced to one pair of loss and
amplification
Let us finally show that a sequence of loss and amplification channels can be mathematically repre-
sented as one pair of loss and amplification, see Fig.2(c). Consider the transformation
ΦM= (AmpGLossT)M,(24)
corresponding to the series of Midentical loss and amplification channels, for which we want to find a
simple representation. According to Statement 2, we can effectively move all losses to the right end of the
composition, i.e., permute the channels in such a way that all the losses act before amplification. Every
time a loss channel with transmission probability T(i)is moved before an amplifier with amplification
factor G(i), the parameters are transformed in accord with Eq. (23):
T(i)7→ T(i+1) =G(i)T(i)
(G(i)1)T(i)+ 1,
G(i)7→ G(i+1) = (G(i)1)T(i)+ 1.
(25)
In our sequence we can pairwise transpose all neighbouring loss with amplifier (starting with the first
amplifier and the second loss). After repeating this operation M1 times, bearing in mind Statement
1, we find that
ΦM= AmpG(0) AmpG(1) ◦ · ·· ◦ AmpG(M1)
LossT(M1) LossT(M2) ◦ · ·· ◦ LossT(0)
= AmpGLossT,
(26)
where
T=
M1
Y
i=0
T(i),
G=
M1
Y
i=0
G(i),
(27)
i.e., a series of losses and amplifiers is equivalent to the loss channel of transmission Tfollowed by the
amplifier with amplification factor G.
Note now that the value µG(i)T(i)=GT cannot be changed by permutations. Let us define
F(i)= (G(i)1)T(i)+ 1,(28)
and bear in mind that
F(i+1) = (G(i+1) 1)T(i+1) + 1 = (F(i)1)
F(i)
T G + 1 = µF(i)1
F(i)+ 1.(29)
We can write
T(i+1) =T G
F(i)
,
G(i+1) =F(i),
(30)
and
G=G
M2
Y
i=0
F(i),
T=T(T G)M1
QM2
i=0 F(i)
=(T G)M
G
.
(31)
Let us find the explicit form of Gand Tby solving the recurrence relation. Define Anand Bnthrough
the relation
F(n1) =An
Bn
.(32)
8
Then
F(n+1) =(µ+ 1)F(n)µ
F(n)
=(µ+ 1)An+1 µBn+1
An+1
.(33)
It follows from (32) and (33) that Bn+1 =Anand
An+1 = (µ+ 1)AnµBn= (µ+ 1)AnµAn1.(34)
We see that the solution of this equation has a form
An=c1+c2µn,(35)
where c1and c2are the constants, which are determined by F0= (G1)T+1: we take A1= (G1)T+1
and A0= 1, and obtain
c1=T1
GT 1c2=(G1)T
GT 1.(36)
Notably, the product ΠM2
n=0 F(n)appearing in the final expression becomes relatively simple
M2
Y
n=0
F(n)=
M2
Y
n=0
An+1
An
=AM1
A0
=(G1)(GT )M+G(T1)
G(GT 1) ,
(37)
and we have
ΦM= (AmpGLossT)M= AmpGLossT,
G=(G1)(GT )M+G(T1)
GT 1,
T=(T G)M
G
.
(38)
The case of T G = 1 is particularly interesting as the average intensity of the transmitted signal
remains preserved (which is different from the total output intensity as it has the noise contribution).
In the limit G1/T we have
G=G(M(1 T) + T),
T=T
M(1 T) + T.(39)
3.5 Fluctuations
Let us calculate the fluctuation of the number of photons in a pulse after it passes through a sequence
of Mloss regions and amplifiers. Let |γ|2be the input intensity; as follows from(7) and (14), the average
number of photons nin the output signal is
n=hˆaˆai=|γ|2+G1,(40)
where Gand Tare given by Eq.(39). The variance of the output photon number is
δn2=haˆa)2i − (hˆaˆai)2=GM (1 T)(GM (1 T) + 1) + |γ|2(2GM (1 T) + 1).(41)
In the limit |γ|2GM 1 we obtain the same result as we got from the qualitative considerations in
Sec. 3.1:
δn 'nGM . (42)
9
4 Control of the transmission line
To monitor the eavesdropper’s activity, Alice sends, at appropriate intervals, special test pulses
(individual or many, see the discussion below) and cross-checks the intensities with Bob. The test pulses
should comprise a large number of photons, but must not, however, damage Bob’s detection equipment.
By producing and analysing the corresponding scattering matrix, Alice and Bob can determine the losses
in the channel. To prevent an inconspicuous Eve’s intrusion into the optical fiber, the physical loss control
should be conducted constantly and should not halt even during the pauses in the key distribution. We
emphasize that the authorized parties can discriminate between the losses of the general origin and losses
that are caused and can be exploited by Eve.
If the optical fiber is properly installed, it should not have points of significant inflections and crude
junctions. Then, most of the intrinsic natural losses in the line occur due to Rayleigh scattering. Such
losses are distributed across the whole line. Therefore, Eve cannot pick up the dissipated signal effectively,
unless she has an antenna covering a significant part of the line; moreover, as we discussed in the
Introduction, the effective deciphering of the dissipated signal requires a multitude of Maxwell demon-
like devices, which is not practically feasible. The only option remaining to the eavesdropper is to take
away part of the signal deliberately, that is to create and exploit the losses additional to the natural
ones (namely, by bending the optical fiber intentionally). Alice and Bob can identify and measure such
artificial losses. To do that, they must first determine the magnitude of losses not associated with the
eavesdropper’s activity; this can be done by measuring the losses appearing homogeneously across the
whole line before the beginning of the protocol. After that, Alice and Bob can precisely determine
the newly appearing local leaks of the signal (with proportion rE) possibly intercepted by Eve. This
knowledge ensures the most efficient ciphering and measurements routines, determining in turn the
post-selection procedure.
In the case that Eve knows the parameters of the test pulses, she can completely seize them and send
the fake ones to mask her presence. In order to prevent that, Alice should parametrize the test sequences
randomly and compare the parameters with Bob only after he measures the pulses. This arrangement
would force Eve to first measure the pulses and then reproduce them which in turn would prolong the
transmission. Such a delay can be easily detected by Alice and Bob. Possible testing protocols:
1. Individual pulses.– Alice sends a single testing pulse the parameters of which are chosen randomly.
The preparation of the pulse implies generating an auxiliary random bit sequence and translating
it into the random intensity, phase, length and shape of the pulse. After Bob measures the test
pulse, he verifies its parameters with Alice, and they determine the losses in the channel.
2. Sequence of pulses.– Alice sends a sequence of test pulses in which she encodes an auxiliary random
sequence. This involves generating an auxiliary random sequence and ciphering it in a sequence of
pulses. Bob measures the pulses, verifies the encoded message with Alice, after what they determine
the losses.
Let τSbe the length of the signal pulse, and τTbe the total length of a sequence of test pulses (test
pulses may look completely like the signal ones, but their sequence must contain much more photons
than one signal pulse). Both types of pulses can be characterized by the same constant power, e.g.,
P= 20 mW, but τTmust be much greater than τS, e.g., τT= 1 ms and τS= 1 ns. The average number
of photons in the test pulse is nA
T=P τT
1014, where νis the light frequency. The measurement
error on Bob’s side is determined by Eq. (42): δnB
T6·108. The test pulse allows to detect leakage of
magnitudes
rEδTT=δnT/hnTi= 6 ·106.(43)
Similar control and analysis of the reflected signal must be performed on Alice’s end.
5 Measurement scheme
The state of the optical signal can be described in terms of its quadratures given by operators
ˆq=ˆa+ ˆa
2,
ˆp=iaˆa)
2.
(44)
10
Figure 3: Optical phase diagram of states corresponding to bit values 0 and 1 after they pass through
the sequence of losses and amplifications. The two output states constitute Gaussians centered at
±1rEγ, where rEis the proportion of signal stolen by Eve.
These operators represent the real and imaginary parts of the signal’s complex amplitude, and by mea-
suring one of the quadratures one can distinguish between different signals.
Bob needs to distinguish between two states |γ0i=|γiand |γ1i=|−γi(with γR) transformed by
losses and amplifiers, – two Gaussians with centers laying on the real axis (q-axis) of the optical phase
space, see the phase diagram displayed in Fig.3 – and for this he measures the ˆq-quadrature. Bob does
his measurements by means of homodyne detection described by the following operators:
ˆ
E0=
Z
Θ
dq |qihq|,
ˆ
E1=
Θ
Z
−∞
dq |qihq|,
ˆ
Efail =ˆ
Iˆ
E0ˆ
E1,
(45)
where |qiis the eigenstate of ˆq, and the parameter Θ is tuned by Bob depending on the amount of losses
possibly stolen by Eve, see the discussion below. Here, ˆ
E0(1) determines the bit value 0(1), whereas ˆ
Efail
is associated with the bad outcome and the respective bit must be discarded by Alice and Bob on the
stage of post-selection. By looking at Fig. 4, one can see that ˆ
Efail corresponds to the phase space region
where the two states (Gaussians) overlap the most, and thus the associated outcome is inconclusive.
6 Error estimate and correction
After the measurements and post-selection procedure of discarding invalid bits, Alice and Bob must
perform error correction procedure. The quadrature value qobtained from homodyne measurement, al-
lows to estimate the probability of error in the corresponding bit – one can easily compute the conditional
error probability for every q. In reality, the error rate is also determined by channel imperfections and
Eve’s detrimental activities. Therefore, in practice, instead of the theoretical prognosis, the error cor-
rection procedure should be mainly predicated on the direct measurement of an error, e.g., by disclosing
a part of the raw key to observe the error.
One option for the practical error estimation is to disclose one half of the raw key. But if the raw
key is long enough, already a relatively short part can provide an accurate error estimate. According to
this method, Alice and Bob use their public authenticated channel to select a number of bit positions in
the raw key and publicly announce the corresponding bit values. Then, using Bayes’ theorem, they can
make a guess about the expected error rate for the remaining part of the raw key. Alternatively, instead
of the bit values Alice and Bob can disclose the parity bits for some selected blocks of raw key positions.
This method gives a better estimate for small error rate values, but is worse for high error rates. The
decision about the block size can be made taking into account the theoretical estimates based on the
observed values of q. For example, if the raw error estimate is approximately 6%, blocks of length 10 can
be used, since the probability for parity bits mismatch in this case is approximately 36%, which is large,
but still below 50%, meaning that the parity data reveal a lot of information about the real error rate.
11
Figure 4: Schematic representation of the measurement operators employed by Bob. The two signal
states are Gaussians overlapping the most in the region of phase space corresponding to ˆ
Efail. Therefore,
Alice and Bob consider the associated outcome inconclusive and discard it on the post-selection stage.
The outcomes associated with ˆ
E0and ˆ
E1are considered conclusive. The value of Θ is varied to perform
the most efficient post-selection procedure as far as the final key generation rate is concerned.
After estimating the error rate, Alice and Bob can carry out the error correction procedure. To do
that, they can use the low-density parity-check (LDPC) codes [24]. The input for such codes are the
probabilities of zero or one at each bit position and the syndrome of the correct bit string – the set of
parity bits which are sufficient to correct the errors, taking into account the a priori probabilities for each
position. LDPC codes are particularly good for error correction after homodyne measurement, since the
measurement result qitself allows to calculate the probabilities for correct and erroneous results.
After Alice and Bob correct errors in a (possibly small) part of the raw key, they have to take into
account the number of errors in this part to yield a more accurate error estimate for the remaining
key. We propose the following adaptive procedure: Alice and Bob first take a relatively short subset
of the original raw key (which size depends on the codeword’s length, e.g., 1000 bits), and apply error
correcting procedure which is designed for high error rates (e.g., 10% in the case that the preliminary
crude estimation gave just 5% error probability). After correcting error in this small subset, Alice and
Bob know the number of errors therein, and have a better error rate estimate for the remaining part
of the key. Then, they should take another short (e.g., once again, 1000 bits) subset and perform error
correction according to the new improved error rate estimate, and so on. With each iteration, the error
estimate becomes more accurate making the error correction procedure more efficient. This method can
be applied without having initial error estimate at all which can save Alice and Bob a large part of the
raw key.
The error correction procedure discloses some information about the key. For linear codes like LDPC
codes, one syndrome bit discloses no more than one bit of information about the key, thus the syndrome
length is appropriate upper bound for the information leakage.
7 Privacy amplification
Although after the error correction procedure, Alice and Bob share the same bit string, which is
still correlated with Eve, thus it cannot be used as the final secret key. The privacy amplification
procedure [25–27], aimed at eradicating Eve’s information, produces a new, shorter, bit string. This new
string can finally be used as a secret key as Eve does not possess any (or almost any) information about
it.
To eliminate the eavesdropper information, Alice and Bob can, for instance, use universal hashing
method [28]. This method requires them to initially agree on the family Hof hash functions hH.
At the privacy amplification stage, they randomly select such a function h:{0,1}l1→ {0,1}l2from this
12
Figure 5: (a) Beam splitter attack on the protocol. Eve seizes part of the signal somewhere along the
optical line. (b) Scheme equivalent to (a). The losses and amplifiers before and after the point of Eve’s
intervention are represented by two pairs of loss and amplification channels defined by the parameters
{T1, G1}and {T2, G2}respectively.
family, that it maps the original bit string of length l1to the final key of length l2. If Eve is estimated
to have ebits of information about the raw key, l2must be equal to l1e.
One example of His the Toeplitz matrices family [29]. Alice and Bob can use a random binary
Toeplitz matrix Twith l1rows and l2columns. Then they represent their bit string as a binary vector
v, and the final key kis given by
k=T·v.
8 Eve’s attack
In this section, we demonstrate how the protocol works in the case where Eve performs the beam
splitter attack seizing the part of the signal somewhere along the optical line as shown in Fig.5(a) (we
will use the term ”beam splitter” in referring to the point of Eve’s intervention into the line). The beam
splitter is ideal, meaning that there is no reflection in Alice’s direction. If the signal intensity incident
to the beam splitter is 1, then intensity rEgoes to Eve, and 1 rEgoes to Bob’s direction.
Quantum cryptography also studies attacks exercising the partial blocking of the signal and the
subsequent unauthorised substitution of the blocked part. However, any attack like this will inevitably
and permanently (even if Eve at some point decides to disconnect from the line) affect the scattering
matrix of the transmission line, and hence will be detected by the legitimate users. Therefore, we do
not concentrate on this kind of attacks here. Furthermore, at this point we accept that the attacks
specifically focusing on amplifiers can be reduced to the beam splitter kind of attacks. The associated
subtleties and details will be the subject of our forthcoming publication.
8.1 Losses and amplifiers
The proportion of the transmitted signal on the distance dbetween two neighbouring amplifiers is
determined by
T= 10µd,(46)
where µ= 1/50 km1is the parameter of losses typical for the optical fibers. As was mentioned before,
the amplification factor of each amplifier is G= 1/T . Let DAB(AE )be the distance between Alice and
Bob (Alice and Eve), then the numbers of amplifiers before and after the beam splitter M1and M2are
given by
M1=DAE /d, (47)
M2= (DAB DAE )/d. (48)
13
As we showed previously, the scheme can be simplified by reducing the losses and amplifications before
and after the beam splitter to two loss and aplification pairs with the parameters {T1, G1}and {T2, G2}
respectively
T1=T
M1(1 T) + T=10µd
(1 10µd)DAE /d + 10µd , G1=1
T1
,
T2=T
M2(1 T) + T=10µd
(1 10µd)(DAB DAE )/d + 10µd , G2=1
T2
.
(49)
8.2 Evolution of systems’ state
Let us describe the progressive evolution of the combined systems’ state. The initial state of Alice’s
random bit (A) – her random number generator – and the corresponding signal (S) is given by
ˆρi
AS =1
2|0ih0|A⊗ |γi hγ|S+1
2|1ih1|A⊗ |−γi h−γ|S.(50)
As the signal undergoes transformations associated with losses and amplifications, the state of the AS-
system just before the signal passes the beam splitter is given by
ˆρ
AS =1
2|0ih0|AZd2αPT1γ ,G1(α)|αihα|S
+1
2|1ih1|AZd2αPT1γ ,G1(α)|αihα|S.
(51)
Defining
ˆρ
AS [α] = 1
2|0ih0|A⊗ |αi hα|S+1
2|1ih1|A⊗ |−αi h−α|S,(52)
we can rewrite Eq. (51) as
ˆρ
AS =Zd2αPT1γ,G1(α) ˆρ
AS [α].(53)
Just after the signal passes the beam splitter, the state of the joint system comprising Alice’s random
bit (A), the signal going to Bob (S) and signal seized by Eve (E) is described by
ˆρ
ASE =Zd2αPT1γ ,G1(α)ˆρ
ASE [α] (54)
where
ˆρ
ASE [α] = 1
2|0ih0|A⊗ |1rEαi h1rEα|S⊗ |rEαihrEα|E
+1
2|1ih1|A⊗ |−1rEαi h−1rEα|S⊗ |−rEαih−rEα|E,
(55)
and rEis the proportion of signal stolen by Eve. After the signal undergoes the second sequence of losses
and amplifiers and just before it is measured by Bob, the state of the joint system is
ˆρBob
ASE =Zd2αPT1γ ,G1(α)ˆρBob
ASE [α] (56)
with
ˆρBob
ASE [α] = 1
2X
a=0,1|aiha|AZd2βP(1rE)T2(1)aα,G2(β)|βihβ|S⊗ |(1)arEαih(1)arEα|E.
(57)
Bob receives the signal, measures it and, together with Alice, performs post-selection, which lays in
discarding the bits associated with the fail-outcome by communicating through the classical channel.
The probability that Bob’s measurement outcome is b={0,1}given that Alice sent bit is a={0,1}
can be written as
p(b|a) = trASE h2· |aiha|Aˆ
Eb1EˆρBob
ASE i=Zd2αPT1γ ,G1(α)p(1)aα(b|a),(58)
14
where
p(1)aα(b|a) = Zd2βP(1rE)T2(1)aα,G2(β)hβ|ˆ
Eb|βiS.(59)
Thus, the probability of a conclusive outcome which means that the bit will not be discarded on the
stage of post-selection is
p(X) = 1
2X
a,b=0,1
p(b|a) = Zd2αPT1γ,G1(α)X
b=0,1
pα(b|0) + pα(b|1)
2.(60)
The final state of Alice’s random bit (A), Bob’s memory device storing the measurement outcome (B)
and the signal stolen by Eve (E) after the post-selection, i.e., conditional to the successful measurement
outcome, is
ˆρf
ABE =Zd2αPT1γ,G1(α)ˆρf
ABE [α] (61)
where
ˆρf
ABE [α] = 1
2|0ih0|A
X
b=0,1
pα(b|0)
p(X)|bihb|B
⊗ |rEαihrEα|E
+1
2|1ih1|A
X
b=0,1
pα(b|1)
p(X)|bihb|B
⊗ |−rEαih−rEα|E.
(62)
8.3 Probabilities
To obtain the probabilities p(b|a), a, b ∈ {0,1}, we must first calculate |hβ|qi|2:
|hβ|qi|2=hβ|1
2πZdpeipqq)|βi=1
2πZdp hβ|eipˆaa
2q|βi=r2
πe2(Reβq)2.(63)
After substituting |hβ|qi|2into Eqs. (58, 59) we obtain
p(0|0) = 1
2
1erf
2hΘγpG1T1G2T2(1 rE)i
p1 + 2(G21) + 2G2T2(1 rE)(G11)
,(64)
p(1|0) = 1
2
1erf
2hΘ + γpG1T1G2T2(1 rE)i
p1 + 2(G21) + 2G2T2(1 rE)(G11)
,(65)
p(0|1) = 1
2
1erf
2hΘ + γpG1T1G2T2(1 rE)i
p1 + 2(G21) + 2G2T2(1 rE)(G11)
,(66)
p(1|1) = 1
2
1erf
2hΘγpG1T1G2T2(1 rE)i
p1 + 2(G21) + 2G2T2(1 rE)(G11)
,(67)
where
erf(x) = 2
π
x
Z
0
et2dt. (68)
8.4 Eve’s information
Hereafter we will use the concepts of the quantum von Neumann entropy and conditional entropy.
For quantum system Xwith the density matrix ˆρXthe entropy is defined as
HˆρX(X) = tr [ˆρXlog ˆρX],(69)
15
where log log2. For the pair of quantum systems Xand Y, with the states of X-system and the
joint system described by the density matrices ˆρXand ˆρX Y , respectively, the conditional entropy can be
written as
HˆρX Y (Y|X) = HˆρXY (X Y )HˆρX(X).(70)
Let us estimate Eve’s information about the raw key (per 1 bit) after post-selection but before the
error correction stage
I(A, E) = Hˆρf
A(A)Hˆρf
AE (A|E)=1Hˆρf
AE (A|E).(71)
Conditional entropy Hˆρf
AE (A|E) is determined by the final density matrix of AE-system which given
Eq. (61) and the fact that
pα(0|0) + pα(1|0) = pα(0|1) + pα(1|1),(72)
can be written as
ˆρf
AE = trBˆρf
ABE =Zd2αQX[α] ˆρf
AE [α] (73)
with
ˆρf
AE [α] = 1
2|0ih0|A⊗ |rEαi hrEα|E+1
2|1ih1|A⊗ |−rEαi h−rEα|E,
QX[α] = [pα(0|0) + pα(1|0)]PT1γ,G1(α)
p(X).
(74)
To find the lower bound of Eve’s entropy (and therefore estimate the maximum of her information
about the key) we consider a situation where Eve has some auxiliary register of variable α(RE) and
introduce the joint AEREstate:
ˆρf
AERE=1
2Zd2αQX[α]X
a=0,1|aiha|A⊗ |(1)arEαih(1)arEα|E⊗ |reg(α)ihreg(α)|RE.(75)
Here the register’s states satisfy hreg(α)|reg(α0)i=δ(2)(αα0). We note that first, by tracing out the
register we recover the original state of AE-system
trREˆρf
AERE= ˆρf
AE ,(76)
and second, the monotonicity of conditional entropy implies
Hˆρf
AE (A|E)Hˆρf
AERE
(A|ERE) = Hˆρf
AERE
(AERE)Hˆρf
ERE
(ERE).(77)
The latter inequality simply states that after discarding the register, Eve can only lose information about
the sent bit. To this end, Hˆρf
AERE
(A|ERE) is the lower bound of Hˆρf
AE (A|E).
Matrix ˆρf
AEREcan be rewritten as
ˆρf
AERE=X
iZd2α QX[α]λ(α)
i|ψ(α)
iihψ(α)
i|⊗|reg(α)ihreg(α)|RE,(78)
where λ(α)
iand |ψ(α)
iiare the eigenvalues and eigenstates of ˆρf
AE [α]. We thus yield
Hˆρf
AERE
(AERE) = X
iZd2αQX[α]λ(α)
ilog(QX[α]λ(α)
i) + C
=X
iZd2αQX[α]λ(α)
i(log(QX[α]) + log(λ(α)
i)) + C
=Zd2αQX[α] log(QX[α]) Zd2αQX[α]X
i
λ(α)
ilog(λ(α)
i) + C
=Zd2αQX[α] log(QX[α]) + Zd2αQX[α]Hˆρf
AE [α](AE) + C,
(79)
where Cis an additional correcting term, which we do not need to calculate explicitly. In the same way
we obtain
Hˆρf
ERE
(ERE) = Zd2αQX[α] log(QX[α]) + Zd2αQX[α]Hˆρf
E[α](E) + C. (80)
16
Combining the two expressions we obtain
Hˆρf
AE (A|E)Hˆρf
AERE
(A|ERE) = Hˆρf
AERE
(AERE)Hˆρf
ERE
(ERE)
=Zd2αQX[α](Hˆρf
AE [α](AE)Hˆρf
E[α](E))
=Zd2αQX[α]Hˆρf
AE [α](A|E)
= 1 Zd2αQX[α]h1− |hrEα| − rEαi|
2
= 1 Zd2α QX[α]h 1 + e2rE|α|2
2!.
(81)
where
h(p) = plog(p)(1 p) log(1 p) (82)
is the binary entropy. Now, we can use the Jensen’s inequality
hh(x)i ≤ h(hxi) =1− hh(x)i ≥ 1h(hxi),(83)
where hxi ≡ Rd2α QX[α]x:
Hˆρf
AE (A|E)1h 1 + he2rE|α|2i
2!(84)
where he2rE|α|2i=Rd2α QX[α]e2rE|α|2. We find
he2rE|α|2i=e2rEG1T1|γ|2
1+2rE1
p(X)[1 + 2rE1](11
2erf p2(1 + 2rE1)hΘ(1rE)G2T2G1T1γ
1+2rE1i
p22+ 1 + 2(1 rE)G2T21+ 2rE(22+ 1)1!
1
2erf p2(1 + 2rE1)hΘ + (1rE)G2T2G1T1γ
1+2rE1i
p22+ 1 + 2(1 rE)G2T21+ 2rE(22+ 1)1!),
(85)
where 1,2G1,21.
By substituting Eq. (85) into Eq. (84) and using Eq. (71) we obtain the upper bound for Eve’s infor-
mation.
8.5 Bob’s error rate
Let us estimate Bob’s error rate. Bob’s information per 1 bit about the key after post-selection but
before error correction is given by
I(A, B) = Hˆρf
A(A)Hˆρf
AB (A|B) = 1 Hˆρf
AB (A|B) (86)
should ideally be equal to 1. Bob’s error rate is therefore determined by the conditional entropy
Hˆρf
AB (A|B):
Hˆρf
AB (A|B) = Hˆρf
AB (AB)Hˆρf
B(B).(87)
It follows from Eq. (61) that
Hˆρf
AB (AB) = X
a,b=0,1
p(b|a)
2p(X)log p(b|a)
2p(X),(88)
Hˆρf
B(B) = X
b=0,1
p(b|a= 0) + p(b|a= 1)
2p(X)log p(b|a= 0) + p(b|a= 1)
2p(X),(89)
and the probabilities p(b|a) and p(X) are given by Eqs.(64-67) and (60). Notice, that post-selection is
symmetric
p(0|0) + p(1|0) = p(0|1) + p(1|1) = p(X).(90)
17
0.00 0.01 0.02 0.03 0.04 0.05
rE
10 10
10 8
10 6
10 4
10 2
100
Lf/L
DAB = 1000 km, d = 10 km, T = 0.63
DAE = 10 km
DAE = 50 km
DAE = 250 km
DAE = 500 km
DAE = 990 km
0.00 0.01 0.02 0.03 0.04 0.05
rE
10 10
10 8
10 6
10 4
10 2
100
Lf/L
DAB = 1000 km, d = 20 km, T = 0.40
DAE = 20 km
DAE = 80 km
DAE = 200 km
DAE = 500 km
DAE = 980 km
0.00 0.01 0.02 0.03 0.04 0.05
rE
10 10
10 8
10 6
10 4
10 2
100
Lf/L
DAB = 1000 km, d = 30 km, T = 0.25
DAE = 30 km
DAE = 90 km
DAE = 300 km
DAE = 480 km
DAE = 930 km
Figure 6: Lf/L as function of rEfor different values of distance dbetween two neighbouring amplifiers:
(a) d= 10 km; (b) d= 20 km; (c) d= 30 km; DAB = 1000 km is fixed. The optimal parameters:
γθ10 for rE0.01, and γθ104for rE= 0.00. We see that the final rate depends on Eve’s
position in the line: the closer she is to Bob (small DAE ), the more information she knows about the bit
sequence, due to the correlations imposed by the amplifiers.
Then
Hˆρf
AB (A|B) = hp(0|0)
p(X).(91)
After the error correction procedure, Bob’s information about the key becomes ˜
I(A, B) = 1, but
Eve’s information increases and one can estimate it as
˜
I(A, E) = I(A, E ) + Hˆρf
AB (A|B)1min Hˆρf
AE (A|E) + Hˆρf
AB (A|B).(92)
9 Key rate
Now, we can estimate the length Lfof the final key after post-selection, error correction and privacy
amplification:
Lf=p(X)L·1˜
I(A, E)=p(X)L·min Hˆρf
AE (A|E)Hˆρf
AB (A|B),(93)
where Lis the length of the random bit string, originally generated by Alice. If Lis understood as the
number of bits generated in a unit of time, then Eq. (93) reflects the final key generation rate. This
equation in its explicit form, which is too cumbersome to be written here, includes two parameters – the
amplitude of signal γand the measurement parameter Θ – which Alice and Bob can vary depending on
rEto ensure the best rate (e.g., by numerically maximizing the function in Eq. (93)). Furthermore, the
equation also includes the distance dbetween two neighboring amplifiers and the distances DAB and
DAE between the participants of the action – these are parameters which we consider fixed.
Figure 6 plots Lf/L as function of rEfor different values of distance dbetween two neighbouring
amplifiers. For every value of rEthe parameters γand Θ are such that they maximize Lf/L. Since
there are correlations imposed by the amplifiers, for Eve it is beneficial to intercept signal near Bob.
The secure and fast communication can be established if Lf/L &106(provided that the initial random
number generation rate L1 Gbit/s), thus Alice and Bob can allow Eve to steal no more than few
percent.
Figure 7 shows Lf/L as function of rEfor large DAB in the assumption that we can technically
measure rEwith theoretically allowed precision. We see that no matter from what point in the line Eve
steals the signal, the precision detection of local losses allow for the secure communication over global
distances 20,000 km.
References
[1] H. J. Kimble. The quantum internet. Nature, 453(7198):1023–1030, Jun 2008. doi:10.1038/
nature07127.
18
0 2 4 6 8 10
rE, 10 5
0.2
0.4
0.6
0.8
1.0
Lf/L
DAB = 10000 km, d = 50 km, G = 10, M = 200
DAE = 50 km
DAE = 1000 km
DAE = 2500 km
DAE = 5000 km
DAE = 9000 km
0 2 4 6 8 10
rE, 10 5
0.0
0.2
0.4
0.6
0.8
1.0
Lf/L
DAB = 20000 km, d = 50 km, G = 10, M = 400
DAE = 50 km
DAE = 1000 km
DAE = 2500 km
DAE = 5000 km
DAE = 10000 km
0 2 4 6 8 10
rE, 10 5
0.0
0.2
0.4
0.6
0.8
1.0
Lf/L
DAB = 40000 km, d = 50 km, G = 10, M = 800
DAE = 50 km
DAE = 5000 km
DAE = 10000 km
DAE = 20000 km
DAE = 30000 km
Figure 7: Lf/L as function of rEfor different values of distance DAB between Alice and Bob: (a)
DAB = 10,000 km; (b) DAB = 20,000 km; (c) DAB = 40,000 km; d= 50 km is fixed. The scales of the
plot imply the theoretically allowed loss detection precision. The optimal parameters: γθ102for
rE105, and γθ104for rE= 0.
[2] Nicolas Sangouard, Christoph Simon, Hugues de Riedmatten, and Nicolas Gisin. Quantum repeaters
based on atomic ensembles and linear optics. Rev. Mod. Phys., 83(1):33–80, Mar 2011. doi:
10.1103/RevModPhys.83.33.
[3] Christoph Simon, Hugues de Riedmatten, Mikael Afzelius, Nicolas Sangouard, Hugo Zbinden, and
Nicolas Gisin. Quantum repeaters with photon pair sources and multimode memories. Phys. Rev.
Lett., 98(19):190503, May 2007. doi:10.1103/PhysRevLett.98.190503.
[4] L.-M. Duan, M. D. Lukin, J. I. Cirac, and P. Zoller. Long-distance quantum communication with
atomic ensembles and linear optics. Nature, 414(6862):413–418, Nov 2001. doi:10.1038/35106500.
[5] H.-J. Briegel, W. D¨ur, J. I. Cirac, and P. Zoller. Quantum repeaters: The role of imperfect local
operations in quantum communication. Phys. Rev. Lett., 81(26):5932–5935, Dec 1998. doi:10.
1103/PhysRevLett.81.5932.
[6] Pieter Kok, Colin P. Williams, and Jonathan P. Dowling. Construction of a quantum repeater with
linear optics. Phys. Rev. A, 68(2):022301, Aug 2003. doi:10.1103/PhysRevA.68.022301.
[7] L. Childress, J. M. Taylor, A. S. Sørensen, and M. D. Lukin. Fault-tolerant quantum communication
based on solid-state photon emitters. Phys. Rev. Lett., 96(7):070504, Feb 2006. doi:10.1103/
PhysRevLett.96.070504.
[8] P. van Loock, T. D. Ladd, K. Sanaka, F. Yamaguchi, Kae Nemoto, W. J. Munro, and Y. Yamamoto.
Hybrid quantum repeater using bright coherent light. Phys. Rev. Lett., 96(24):240501, Jun 2006.
doi:10.1103/PhysRevLett.96.240501.
[9] Tie-Jun Wang, Si-Yu Song, and Gui Lu Long. Quantum repeater based on spatial entanglement
of photons and quantum-dot spins in optical microcavities. Phys. Rev. A, 85(6):062311, Jun 2012.
doi:10.1103/PhysRevA.85.062311.
[10] Nicolas Sangouard, Romain Dubessy, and Christoph Simon. Quantum repeaters based on single
trapped ions. Phys. Rev. A, 79(4):042340, Apr 2009. doi:10.1103/PhysRevA.79.042340.
[11] Koji Azuma, Hitoshi Takeda, Masato Koashi, and Nobuyuki Imoto. Quantum repeaters and compu-
tation by a single module: Remote nondestructive parity measurement. Phys. Rev. A, 85(6):062309,
Jun 2012. doi:10.1103/PhysRevA.85.062309.
[12] M. Zwerger, W. D¨ur, and H. J. Briegel. Measurement-based quantum repeaters. Phys. Rev. A,
85(6):062326, Jun 2012. doi:10.1103/PhysRevA.85.062326.
[13] W. J. Munro, K. A. Harrison, A. M. Stephens, S. J. Devitt, and Kae Nemoto. From quantum
multiplexing to high-performance quantum networking. Nature Photonics, 4(11):792–796, Nov 2010.
doi:10.1038/nphoton.2010.213.
19
[14] Liang Jiang, J. M. Taylor, Kae Nemoto, W. J. Munro, Rodney Van Meter, and M. D. Lukin.
Quantum repeater with encoding. Phys. Rev. A, 79(3):032325, Mar 2009. doi:10.1103/PhysRevA.
79.032325.
[15] W. J. Munro, A. M. Stephens, S. J. Devitt, K. A. Harrison, and Kae Nemoto. Quantum commu-
nication without the necessity of quantum memories. Nature Photonics, 6(11):777–781, Nov 2012.
doi:10.1038/nphoton.2012.243.
[16] Andrzej Grudka, Karol Horodecki, Micha l Horodecki, Pawe l Horodecki, Marcin Paw lowski, and
Ravishankar Ramanathan. Free randomness amplification using bipartite chain correlations. Phys.
Rev. A, 90(3):032322, Sep 2014. doi:10.1103/PhysRevA.90.032322.
[17] G. B. Lesovik, I. A. Sadovskyy, M. V. Suslov, A. V. Lebedev, and V. M. Vinokur. Arrow of
time and its reversal on the ibm quantum computer. Scientific Reports, 9(1):4396, Mar 2019.
doi:10.1038/s41598-019-40765-6.
[18] N. S. Kirsanov, A. V. Lebedev, M. V. Suslov, V. M. Vinokur, G. Blatter, and G. B. Lesovik. Entropy
dynamics in the system of interacting qubits. Journal of Russian Laser Research, 39(2):120–127,
Mar 2018. doi:10.1007/s10946-018-9698-0.
[19] G. B. Lesovik, A. V. Lebedev, I. A. Sadovskyy, M. V. Suslov, and V. M. Vinokur. H-theorem in
quantum physics. Scientific Reports, 6(1):32815, Sep 2016. doi:10.1038/srep32815.
[20] Evgenii Mikhailovich Lifshitz and Lev Petrovich Pitaevskii. Physical kinetics. Course of theoretical
physics. Pergamon, Oxford, 1981. Translated from the Russian by J B Sykes and R N Franklin.
URL: https://cds.cern.ch/record/99987.
[21] W. Vogel, D.G. Welsch, and S. Wallentowitz. Quantum Optics: An Introduction. Wiley, 2001. URL:
https://books.google.ru/books?id=5jFHAQAAIAAJ.
[22] Pavel Sekatski, Bruno Sanguinetti, Enrico Pomarico, Nicolas Gisin, and Christoph Simon. Cloning
entangled photons to scales one can see. Phys. Rev. A, 82(5):053814, Nov 2010. doi:10.1103/
physreva.82.053814.
[23] Bruno Sanguinetti, Enrico Pomarico, Pavel Sekatski, Hugo Zbinden, and Nicolas Gisin. Quan-
tum cloning for absolute radiometry. Phys. Rev. Lett., 105(8):080503, Aug 2010. doi:10.1103/
PhysRevLett.105.080503.
[24] D.J.C. MacKay, D.J.C.M. Kay, and Cambridge University Press. Information Theory, Inference
and Learning Algorithms. Cambridge University Press, 2003. URL: https://books.google.bi/
books?id=AKuMj4PN_EMC.
[25] Charles H. Bennett, Gilles Brassard, and Jean-Marc Robert. Privacy amplification by public dis-
cussion. SIAM J. Comput., 17(2):210–229, Apr 1988. doi:10.1137/0217014.
[26] Charles H Bennett, Gilles Brassard, Claude Cr´epeau, and Ueli M Maurer. Generalized privacy
amplification. IEEE Transactions on Information Theory, 41(6):1915–1923, 1995.
[27] Gilles Brassard and Louis Salvail. Secret-key reconciliation by public discussion. In Workshop on
the Theory and Application of Cryptographic Techniques on Advances in Cryptology, EUROCRYPT
’93, page 410–423, Berlin, Heidelberg, 1994. Springer-Verlag.
[28] J Lawrence Carter and Mark N Wegman. Universal classes of hash functions. Journal of computer
and system sciences, 18(2):143–154, 1979.
[29] Hugo Krawczyk. Lfsr-based hashing and authentication. In Annual International Cryptology Con-
ference, pages 129–139. Springer, 1994.
20
ResearchGate has not been able to resolve any citations for this publication.
Article
Full-text available
The classical Second Law of Thermodynamics demands that an isolated system evolves with a non-diminishing entropy. This holds as well in quantum mechanics if the evolution of the energy-isolated system can be described by a unital quantum channel. At the same time, the entropy of a system evolving via a non-unital channel can, in principle, decrease. Here, we analyze the behavior of the entropy in the context of the H-theorem. As exemplary phenomena, we discuss the action of a Maxwell demon (MD) operating a qubit and the processes of heating and cooling in a two-qubit system. We further discuss how small initial correlations between a quantum system and a reservoir affect the increase in the entropy under the evolution of the quantum system.
Article
Full-text available
Uncovering the origin of the arrow of time remains a fundamental scientific challenge. Within the framework of statistical physics, this problem was inextricably associated with the Second Law of Thermodynamics, which declares that entropy growth proceeds from the system's entanglement with the environment. It remains to be seen, however, whether the irreversibility of time is a fundamental law of nature or whether, on the contrary, it might be circumvented. Here we show that, while in nature the complex conjugation needed for time reversal is exponentially improbable, one can design a quantum algorithm that includes complex conjugation and thus reverses a given quantum state. Using this algorithm on an IBM quantum computer enables us to experimentally demonstrate a backward time dynamics for an electron scattered on a two-level impurity.
Article
Full-text available
Remarkable progress of quantum information theory (QIT) allowed to formulate mathematical theorems for conditions that data-transmitting or data-processing occurs with a non-negative entropy gain. However, relation of these results formulated in terms of entropy gain in quantum channels to temporal evolution of real physical systems is not thoroughly understood. Here we build on the mathematical formalism provided by QIT to formulate the quantum H-theorem in terms of physical observables. We discuss the manifestation of the second law of thermodynamics in quantum physics and uncover special situations where the second law can be violated. We further demonstrate that the typical evolution of energy-isolated quantum systems occurs with non-diminishing entropy.
Article
Full-text available
Quantum physics is known to allow for completely new ways to create, manipulate and store information. Quantum communication - the ability to transmit quantum information - is a primitive necessary for any quantum internet. At its core, quantum communication generally requires the formation of entangled links between remote locations. The performance of these links is limited by the classical signaling time between such locations - necessitating the need for long lived quantum memories. Here we present the design of a communications network which neither requires the establishment of entanglement between remote locations nor the use of long-lived quantum memories. The rate at which quantum data can be transmitted along the network is only limited by the time required to perform efficient local gate operations. Our scheme thus potentially provides higher communications rates than previously thought possible.
Article
Full-text available
By amplifying photonic qubits it is possible to produce states that contain enough photons to be seen with the human eye, potentially bringing quantum effects to macroscopic scales [ P. Sekatski, N. Brunner, C. Branciard, N. Gisin and C. Simon Phys. Rev. Lett. 103 113601 (2009)]. In this paper we theoretically study quantum states obtained by amplifying one side of an entangled photon pair with different types of optical cloning machines for photonic qubits. We propose a detection scheme that involves lossy threshold detectors (such as the human eye) on the amplified side and conventional photon detectors on the other side. We show that correlations obtained with such coarse-grained measurements prove the entanglement of the initial photon pair and do not prove the entanglement of the amplified state. We emphasize the importance of the detection loophole in Bell violation experiments by giving a simple preparation technique for separable states that violate a Bell inequality without closing this loophole. Finally, we analyze the genuine entanglement of the amplified states and its robustness to losses before, during, and after amplification.
Article
We study the mechanism and complexity of an efficient quantum repeater, employing double-photon guns, for long-distance optical quantum communication. The guns create polarization-entangled photon pairs on demand. One such source might be a semiconducter quantum dot, which has the distinct advantage over parametric down-conversion that the probability of creating a photon pair is close to 1, while the probability of creating multiple pairs vanishes. The swapping and purifying components are implemented by polarizing beam splitters and probabilistic optical controlled-NOT gates. We also show that the bottleneck in the efficiency of this repeater is due to detector losses.
Article
We introduce a simple photonic probing scheme of remote nondestructive parity measurement (RNPM) on a pair of matter qubits. The protocol works as a single module for key operations such as entanglement generation, Bell measurement, and parity check measurement, which are sufficient not only for building up a quantum repeater but also for equipping it with entanglement distillation. Moreover, the RNPM protocol can also be used for generating cluster states toward measurement-based quantum computation.
Article
We present an efficient quantum repeater protocol that uses coupled systems of quantum-dot spins and optical microcavities, in which the spatial entanglement of a photon system can be converted into polarization entanglement of electron spins. The bit-flip and phase-flip errors on the polarization state of each qubit caused by noisy channels can be rejected, without resorting to additional qubits. Two remote parties can obtain the maximally entangled electron-spin state and store it deterministically after the transmission of photons, independent of the noise parameters. The transmission distance of photons will not be limited by the coherence time of memory units in the present protocol, unlike the previous atomic-ensemble-based quantum repeater protocols, and it can be applied directly in long-distance quantum-communication protocols.
Article
In quantum communication via noisy channels, the error probability scales exponentially with the length of the channel. We present a scheme of a quantum repeater that overcomes this limitation. The central idea is to connect a string of (imperfect) entangled pairs of particles by using a novel nested purification protocol, thereby creating a single distant pair of high fidelity. Our scheme tolerates general errors on the percent level, it works with a polynomial overhead in time and a logarithmic overhead in the number of particles that need to be controlled locally.
Article
We introduce measurement-based quantum repeaters, where small-scale measurement-based quantum processors are used to perform entanglement purification and entanglement swapping in a long-range quantum communication protocol. In the scheme, pre-prepared entangled states stored at intermediate repeater stations are coupled with incoming photons by simple Bell-measurements, without the need of performing additional quantum gates or measurements. We show how to construct the required resource states, and how to minimize their size. We analyze the performance of the scheme under noise and imperfections, with focus on small-scale implementations involving entangled states of few qubits. We find measurement-based purification protocols with significantly improved noise thresholds. Furthermore we show that already resource states of small size suffice to significantly increase the maximal communication distance. We also discuss possible advantages of our scheme for different set-ups.