Available via license: CC BY 4.0

Content may be subject to copyright.

Long-distance quantum key distribution based on the physical

loss control

N. S. Kirsanov, N. R. Kenbaev, A. B. Sagingalieva, D. A. Kronberg, V. M. Vinokur,

G. B. Lesovik

Terra Quantum AG, St. Gallerstrasse 16A, CH-9400 Rorschach, Switzerland

May 4, 2021

Abstract

Existing quantum cryptography is resistant against secrecy-breaking quantum computers but

suﬀers fast decay of the signal at long distances. The various types of repeaters of propagating

quantum states have been developed to meet the challenge, but the problem is far from being solved.

We step in the breach and put forth long-distance high secrecy optical cryptography, creating the fast

quantum key distribution over distances up to 40,000 kilometers. The key element of the proposed

protocol is the physical control over the transmission line.

1 Introduction

Existing quantum cryptography is robust against secrecy-breaking quantum computers but is sub-

ject to the fast decay of the signal with the distances. To amend the signal losses, the various types

of repeaters of the propagating quantum states have been developed [1–16], but yet the long distance

transmission looks like an impossible task for existing protocols. Directly applying the principle of quan-

tum irreversibility [17–19], we step in the breach and put forth long-distance high secrecy cryptography,

creating the fast quantum key distribution over the globe distances of about 40,000 kilometers.

On a practical level, the information transfer eﬃciency, both in classical and quantum cases, is

hindered by the optical ﬁber losses. The conventional approach to quantum communication is double-

suﬀering: ﬁrstly, the losses themselves harm eﬃciency; secondly, the commonly accepted concept is

that an eavesdropper (Eve) can use all the transmission line losses to decipher the communication

successfully. However, the lion share of losses occurs due to Rayleigh scattering of the signal propagating

through the optical ﬁber. This propagation is similar, to no small extent, to the evolution of the

ensemble of particles experiencing scattering on the quenched disorder potential described by the kinetic

equation [20], generalizing the classical Boltzmann equation. This implies that the particle dynamics

is accompanied by the entropy growth and, therefore, irreversible as expressed by the Second Law of

Thermodynamics. Taking that the line carries a scatterer per a wavelength, we conclude that at least

about 109quantum Maxwell Demon-like devices are required to collect photons scattered in a one

kilometer long ﬁber and to reverse and unify the dynamics of the related quantum states. This makes

collection of the Rayleigh-scattered information an impossible task. These considerations supply us with

a new paradigm for establishing an innovative quantum key distribution (QKD) protocol based on the

physical control of the optical ﬁber line.

In a basic optical QKD scheme electromagnetic states representing diﬀerent bit values are transmitted

from the sender (Alice) to the receiver (Bob) which allows them to securely share a secret random

sequence. As we have just pointed out, the major irreversibility’s implication is that Eve cannot collect

any useful information about the random bits from the scattering. However, the possibility of the local

rerouting of the part of the transmitted signal remains. Physically this can be implemented, for example,

by a local bending the ﬁber, which leads to mixing of the major propagating mode with the higher-order

leaking modes. This local imperfection, in turn, allows for eavesdropping on the information carried by

the major mode. Had the signal been classical, this “bending” would have opened unlimited access to

the full content of the message for Eve. However, any electromagnetic signal is quantized and can be

viewed as a sequence of photons. The discreet statistics of photons imposes a major limitation on Eve’s

1

arXiv:2105.00035v1 [quant-ph] 30 Apr 2021

Alice

Eve

Bob

EDFA

EDFA

EDFA

Figure 1: Schematics of the setup realizing the exemplary protocol. Alice encodes a random bit string

into a sequence of coherent pulses and sends it to Bob via the optical ﬁber. The pulses pass through

a sequence of optical ampliﬁers and the resulting signals are then received and measured by Bob. Eve

can seize part of the signal: for instance, by bending the transmitting optical ﬁber and detecting the

transcending optical modes. However, Alice and Bob monitor the losses in the line, and always know

the proportion of the signal stolen by eavesdropper. Importantly, they can identify the exact losses

caused and exploited by Eve. This knowledge enables Alice and Bob to adopt the most eﬃcient bit

ciphering and measurement scheme: depending on how many photons Eve intercepts, Alice picks certain

values of signal intensities which are optimal as far as the informational advantage over Eve is concerned;

in a concerted manner, Bob adjusts his measurement routine. This in particular gives the authorized

parties additional leverage as far as post-selection is concerned: after transmitting and receiving the

random bit string, Alice and Bob use an authenticated public classical channel to perform information

reconciliation (increasing their informational advantage over Eve) and privacy ampliﬁcation – with the

optimal parameters of ciphering and measurement these procedures allow to eradicate Eve’s information

without sacriﬁcing too many bits.

ability to extract information from measuring seized signal. If the initial signal contains, on average,

Nphotons, and the local leakage is quantiﬁed by transparency rE, only the small fraction of the signal

containing nE=rENphotons comes to Eve. In the case of the coherent signal state, the unavoidable

ﬂuctuation of the photon number follows the Poisson statistics, δnE=√rEN. Therefore, with the

decrease of rE, the relative ﬂuctuations grow as δnE/nE= 1/√rEN. If, for instance, Alice encodes bit

values into pulses with two diﬀerent intensities, high ﬂuctuations make it diﬃcult for Eve to distinguish

them. In turn, if Bob gets the signal pulse comprising NBphotons for which ﬂuctuations δNBNB,

then even a single-shot measurement provides him with a high-probability reliable recognition of whether

the received signal represents 0 or 1. This establishes that the critical condition of security guarantee

is ensuring that Bob gets the share suﬃcient for identifying the recognition of the signal, while the

controlled value of rElimits the distinguishability of the signal portion seized by Eve.

An eﬃcient control over rErests on a careful analysis of the optical ﬁber’s state and the emergent

scattering matrix that can be accomplished by standard telecom technology methods, particularly, using

the optical time-domain reﬂectometry. We propose an eﬃcient technique for controlling the optical ﬁber

based on the direct measurement of the propagation of the signal from Alice to Bob. This technique,

together with the cascade signal ampliﬁcation as a mean for preserving signal intensity lays the foundation

for our QKD protocol unlocking unprecedented key generation rates and global transmission distances.

2 Method description

We propose a method for long-distance QKD based on the signal ampliﬁcation and physical control

of the transmission line (see the schematics in Fig.1). Two principal ideas behind the method are: (i)

2

the random bits are encoded into non-orthogonal coherent pulses which are ampliﬁed by a cascade of

the in-line optical ampliﬁers, e.g., Erbium Doped Fiber Ampliﬁers (EDFAs) to achieve long-distance

transmission, and (ii) Alice and Bob can determine the exact proportion of the signal stolen by the

eavesdropper (Eve) and distinguish it from the natural losses in the line (caused primarily by the Rayleigh

scattering). Alice and Bob use the knowledge about losses to accurately estimate their informational

advantage over Eve which in turn allows them to pick the pulses’ intensities, adopt the measurement

routine and perform post-selection in the most eﬃcient way, leaving Eve no information about the ﬁnal

shared key.

0. Initial preparation.– The reﬂectometry methods allows to determine losses with high precision and

distinguish local losses (which could be caused by Eve) from the intrinsic natural losses homoge-

neous across the whole line and caused mainly by the Rayleigh and Raman scattering. As a part

of the initial equipment setting, Alice and Bob determine the natural losses r0in the transmission

line which cannot be caused by Eve. Bob and Alice share the value of r0via the authenticated

classical communication channel.

1. Alice and Bob determine a total signal loss rtin the communication channel via transmitting test

pulses. After that, they obtain the signal loss rEcaused by an eavesdropper by comparing the

intrinsic signal loss r0with the total signal loss rt. Bob and Alice share the value of rEvia the

authenticated classical communication channel.

For example, let us consider a section of the communication channel which does not comprise

ampliﬁers. If the intrinsic loss in this section is r0and Eve seizes a proportion rEof the signal,

then the total loss rtis determined from the equation (1 −rt) = (1 −rE)(1 −r0). Further below

we describe a beam splitter attack of Eve 5 at a single location along the communication channel.

The proposed method and our analysis presented further below also generalizes to the case where

Eve intrudes the communication channel at several locations.

2. Using a physical random number generator (possibly quantum), Alice generates a bit sequence of

length L.

3. Alice ciphers her bit sequence into a series of Lcoherent light pulses which she sends to Bob. The

bits 0 and 1 are deﬁned by the coherent states |γ0i=|γiand |γ1i=|−γirespectively, – without

loss of generality, assume that γ∈R– and the value of γis chosen optimally given the known

speciﬁc value of rE. This means that Alice uses such coherent states that they correspond to the

maximum key generation speed with respect to the losses in the channel. The intensity of the pulse

|±γiis determined by the average photon number

hni=|γ|2.(1)

4. The signal is ampliﬁed by a cascade of optical ampliﬁers installed equidistantly along the whole

optical line. Each ampliﬁer compensates the losses in such a way that the ampliﬁed signal intensity

equals to the initial one. As a coherent pulse passes through ampliﬁers its state becomes mixed.

Bob receives the signal and performs the homodyne measurement, the parameters of which are

again determined by the known value of rE.

5. Alice and Bob apply information reconciliation. Some of Bob’s measurements will have inconclusive

results and the corresponding bits must be discarded. To do so, Bob announces positions of invalid

bits to Alice publicly via an authenticated public classical channel.

6. Alice and Bob estimate the error rate and perform the error correction procedure.

7. Alice and Bob perform privacy ampliﬁcation. Using a special protocol, Alice and Bob produce a

shorter key, which Eve has no (or negligibly small) information about. Once again, Alice and Bob

may need to use their authenticated public classical channel.

8. Alice and Bob perform steps 1 to 7 until the length of the shared key is appropriate.

The outlined protocol is based on phase ciphering. However, in the case of very long transmission

distances, the preservation of the pulses’ polarization and the eﬃcient phase reference transmission

necessary for homodyne detection may be challenging. These practical diﬃculties can be lifted, by,

for example, using intensity ciphering, in which case the bit values are encoded into the two pulses

3

with diﬀerent intensities. This has already been mentioned in the Introduction and is analyzed below in

Section 3.1. In the main part of the paper, we will concentrate primarily on the phase ciphering approach

which ensures faster information transmission. In the forthcoming publication we will analyse in detail

the special measures necessary for compensating phase ﬂuctuations hence improving considerably the

phase ciphering protocol.

3 Signal ampliﬁcation

The crucial component of the proposed scheme is the cascade of ampliﬁers preserving the signal

intensity necessary for achieving long distance transmission. We start this section with estimates illus-

trating how ampliﬁcation impacts the signal ﬂuctuations and the precision in detecting leakage. We then

introduce the formal framework based on the P-function representation and show how the signal state

evolves under the ideal ampliﬁcation process. After that, we consider the practical case of ampliﬁcation

in doped ﬁbers with the associated losses in the channel. We further show that a cascade of ampliﬁers can

be theoretically reduced to one eﬀective ampliﬁer – we will use this formal property in further sections

for the analysis of legitimate users’ informational advantage over the eavesdropper.

3.1 Preliminary estimates

The challenge to meet is reaching the global distances of the transmission exceeding 20,000km. In

order to estimate possible enhancement of the transmission distance we use, for illustrative purposes,

simple and transparent estimates based on the robustness of the strength of our pulses. Let us estimate

the strength of our pulses that allows for their stable analogue amplifying, transmitting the signal with-

out distorting its shape and phase with the minimal generated noise and, at the same time, preserving

the degree of protection against eavesdropping. A crucial component needed to ensure such an enhance-

ment are just the standard telecom ampliﬁers preserving the analog signal including erbium-doped ﬁber

ampliﬁer and Raman ampliﬁer. To give an idea how it works, we present simple estimates leaving the

detailed description for the technical part of the paper.

Let us consider the control precision for the representative line of 20,000 km. In general, the exact

optimal distance between ampliﬁers is to be calculated. Here for the estimate we take the standard

telecom practice distance of d= 50 km. On this distance the signal drops by factor of 10 (the transmission

probability T= 0.1); correspondingly the amplifying coeﬃcient is to be G= 10. Suppose that the initial

test signal carries nA

T= 1014 photons, which drops down to T·nA

T= 0.1·1014 = 1013 on the 50 km end.

An ampliﬁer restores it back to G·T·nA

T= 10 ·0.1·1014 = 1014 but adds noise. Since photons follow

the Poisson statistics, the ﬂuctuations before the ampliﬁer are qT·nA

T'3·106. These ﬂuctuations are

ampliﬁed with the factor Gas well, giving

δnG

T'GqT nA

T'3·107.(2)

Coming through the sequence of Mampliﬁers which add ﬂuctuations independently, the total ﬂuctuation

raises by factor √M, giving for 400 ampliﬁers on the 20,000 km line the twenty-fold ﬂuctuation increase.

The ﬂuctuation on Bob’s end is thus

δnB

T'√M δnG

T'6·108.(3)

At the end of the day, we have

δnB

T/nB

T'6·10−6.(4)

This determines the minimum detectable leakage rmin

E'6·10−6. Our qualitative considerations agree

with the rigorous calculations provided in Sec. 3.5.

For illustrative purposes, let us use the intensity ciphering instead of the phase ciphering. If Eve gets

∼1 photons (stealing signal in the vicinity of Alice), unity relative error would make it impossible for

her to distinguish between the diﬀerent pulses provided that their intensities are of the same order. A

pulse hard for eavesdropping must thus contain n∼1/rmin

E∼105photons; in this case, the ﬂuctuation

at Bob’s amounts to

δn =√GM n ∼104; (5)

δn/n ∼0.1.(6)

4

This allows, especially taking into account additional informational postprocessing measures exercised

by both Bob and Alice, more elaborate encoding and measuring procedures, the readable Alice to Bob

transmission that cannot be intercepted by Eve. The fact that scalability behaves as square root of the

line length, enables us to execute a major breakthrough in safe communication sending the decipherable

signal over a global distance of 40,000km.

3.2 P-function and its evolution under ampliﬁcation

Let us introduce our theoretical framework for the rigorous description of losses and ampliﬁcations.

Consider a single photonic mode with bosonic operators ˆaand ˆa†acting in the Fock space. To understand

the eﬀect of the ampliﬁcation on the bosonic mode state, it is most convenient to use the P-function

representation of the latter. Such representation allows to express any density operator as a quasi-mixture

of coherent states:

ˆρ=Zd2αP(α)|αihα|,(7)

where d2α≡dRe(α)dIm(α) and the quasi-probability distribution P(α) is not necessarily positive. For

a given state described by density matrix ˆρthe P-function can be written as

P(α) = trˆρ:δ(ˆa−α) : (8)

where

:δ(ˆa−α) := 1

π2Zd2β eαβ∗−α∗βeβˆa†e−β∗ˆa,(9)

see [21] for details.

Phase-ampliﬁcation is described by a quantum channel given by

AmpG=cosh2(g): ˆρ7→ AmpG[ˆρ] = trbˆ

Ugˆρ⊗ |0ih0|bˆ

U†

g

ˆ

Ug=eg(ˆa†ˆ

b†−ˆaˆ

b),(10)

where gis the interaction parameter characterizing the ampliﬁer, G= cosh2(g) is the factor by which

the intensity of the input signal is ampliﬁed (as we will explicitly see in the following formulae), and

annihilation operator ˆ

bcorresponds to the auxiliary mode starting in the vacuum states. An explicit

Kraus representation of the channel can be written as

AmpG(ˆρ) = ∞

X

n=0

ˆ

Knˆρˆ

Kn(11)

with ˆ

Kn=tanhn(g)

√n!ˆa†ncosh(g)−ˆaˆa†see e.g. [22].

To show how the P-function of a state changes under the ampliﬁcation process let us consider a

simple situation where the input signal is in the pure coherent state |γihγ|with the corresponding initial

P-function Pi(α) = δ(α−γ) (delta-function on complex numbers). After the ampliﬁcation the P-function

becomes

P(α;γ, g ) = tr : δ(ˆa−α) : AmpG[|γihγ|].(12)

Bearing in mind that

Amp∗

G[ˆa] = ˆ

U†

gˆaˆ

Ug= cosh(g)ˆa+ sinh(g)ˆ

b†,(13)

it is easy to see that

P(α;γ, g ) = 1

π(G−1) exp −|α−√Gγ|2

G−1!.(14)

In other words, the output state is a mixture of normally distributed states centered around |√Gγi; the

width of the distribution is (G−1)/√2.

5

Figure 2: (a) Two loss or ampliﬁcation channels can be reduced to one. (b) Loss and ampliﬁcation

channels can be eﬀectively rearranged. (c) A series of losses and ampliﬁers can be reduced to one pair

of loss and ampliﬁcation.

3.3 Ampliﬁcation in doped ﬁbers and losses

In Er/Yt doped ﬁber the photonic mode propagates through the inverted atomic medium. To keep

the medium inverted, a seed laser of a diﬀerent frequency co-propagates with the signal photonic mode

in the ﬁber and is then ﬁltered out at the output by means of wavelength-division multiplexing (WDM).

The interaction between the inverted atoms at position zand propagating light ﬁeld mode ˆais precisely

given by the Hamiltonian

H= i(ˆa†ˆ

b†

z−ˆaˆ

bz),(15)

where ˆ

bzcorresponds to a collective decay of one of the atoms at z. Hence, the evolution of the signal

mode after its propagation through EDFA is set by a composition of inﬁnitesimal phase-ampliﬁcations

which, as we show in the next subsection, can be eﬀectively reduced to a single ampliﬁcation channel.

In practice, the performance of EDFA suﬀers from technical limitations, which come in addition to

the ampliﬁcation limits on added quantum noise. These limitations are mainly caused by two factors: (i)

the atomic population may be not completely inverted throughout the media, (ii) coupling imperfection

between the optical mode and EDFA or optical ﬁber. Both of these mechanisms can be taken into

account as a loss channel acting on the state before the ampliﬁcation, as shown in [23].

Let us introduce the loss channel describing all possible losses in the line. Equation (13) describes

the action of ampliﬁer on the annihilation operator in the Heisenberg picture. In the same way we can

express the canonical transformation associated with losses

Loss∗

T[ˆa] = ˆ

¯

U†

λˆaˆ

¯

Uλ= cos(λ)ˆa+ sin(λ)ˆc

=√Tˆa+√1−Tˆc,

T= cos2(λ),

(16)

where λis the interaction parameter, Tis the proportion of the transmitted signal, the annihilation

operator ˆccorresponds to the initially empty mode which the lost photons go to, and ˆ

¯

Uλ=eλˆa†ˆc−λˆaˆc†.

3.4 Composition of ampliﬁers and losses

In our cryptographic scheme, the ampliﬁcation is used to recover the optical signal after it suﬀers

from losses. Long-distance QKD requires a cascade of ampliﬁers, in which case signal’s evolution is

determined by a sequence of multiple loss and ampliﬁcation channels. In this section we prove that

any such sequence can be mathematically reduced to a composition of one loss and one ampliﬁcation

channels. We will later adopt this simple representation for the informational analysis of our protocol.

6

Statement 1. Two loss or ampliﬁcation channels can be reduced to one

First, we show that a pair of loss or ampliﬁcation channels can be eﬀectively reduced to the one

channel, see Fig.2(a). To that end, let us consider two consequent loss channels:

(LossT2◦LossT1)∗[ˆa] = ˆ

¯

U†

λ1

ˆ

¯

U†

λ2ˆaˆ

¯

Uλ2

ˆ

¯

Uλ1

= LossT1(pT2ˆa+p1−T2ˆc2)

=pT2T1ˆa+pT2(1 −T1)ˆc1+p1−T2ˆc2

=pT2T1ˆa+p1−T1T2ˆc,

(17)

where we deﬁned operator

ˆc=pT2(1 −T1)ˆc1+√1−T2ˆc2)

√1−T1T2

,(18)

acting on the vacuum state and satisfying the canonical commutation relation [ˆc, ˆc†] = 1. We can thus

represent two channels in a form of one eﬀective channel:

LossT2◦LossT1= Loss(T=T1T2)(19)

The same reasoning applies to ampliﬁers:

AmpG2◦AmpG1= Amp(G=G2G1)(20)

Statement 2. Loss and ampliﬁcation channels can be eﬀectively rearranged

Let us show that a composition of an ampliﬁcation channel followed by a loss channel can be math-

ematically replaced with a pair of certain loss and ampliﬁcation channels acting in the opposite order,

see Fig.2(b). Consider the transformation corresponding to the ampliﬁcation followed by the loss

(LossT0◦AmpG0)∗[ˆa] = ˆ

U†

g0ˆ

¯

U†

λ0ˆaˆ

¯

Uλˆ

Ug

= Amp∗

G0[√T0ˆa+√1−T0ˆc]

=√T0G0ˆa+p(1 −T0)ˆc+pT0(G0−1)ˆ

b†.

(21)

In the case of the opposite order we have

(AmpG◦LossT)∗[ˆa] = ˆ

¯

U†

λˆ

U†

gˆaˆ

Ugˆ

¯

Uλ

= Loss∗

T[√Gˆa+√G−1ˆ

b†]

=√T Gˆa+pG(1 −T)ˆc+√G−1ˆ

b†.

(22)

It is easy to see that the two transformations are identical if

LossT0◦AmpG0= AmpG◦LossT

T=G0T0

(G0−1)T0+ 1,

G= (G0−1)T0+ 1.

(23)

In other words, the two types of channels ”commute” provided that the parameters are modiﬁed in

accord with these relation. In particular, the parameters in the equation above are always physically

meaningful G≥1,0≤T≤1, meaning that we can always represent loss and ampliﬁcation in form of a

composition where loss is followed by ampliﬁcation (the converse is not true).

7

Statement 3. A series of losses and ampliﬁers can be reduced to one pair of loss and

ampliﬁcation

Let us ﬁnally show that a sequence of loss and ampliﬁcation channels can be mathematically repre-

sented as one pair of loss and ampliﬁcation, see Fig.2(c). Consider the transformation

ΦM= (AmpG◦LossT)◦M,(24)

corresponding to the series of Midentical loss and ampliﬁcation channels, for which we want to ﬁnd a

simple representation. According to Statement 2, we can eﬀectively move all losses to the right end of the

composition, i.e., permute the channels in such a way that all the losses act before ampliﬁcation. Every

time a loss channel with transmission probability T(i)is moved before an ampliﬁer with ampliﬁcation

factor G(i), the parameters are transformed in accord with Eq. (23):

T(i)7→ T(i+1) =G(i)T(i)

(G(i)−1)T(i)+ 1,

G(i)7→ G(i+1) = (G(i)−1)T(i)+ 1.

(25)

In our sequence we can pairwise transpose all neighbouring loss with ampliﬁer (starting with the ﬁrst

ampliﬁer and the second loss). After repeating this operation M−1 times, bearing in mind Statement

1, we ﬁnd that

ΦM= AmpG(0) ◦AmpG(1) ◦ · ·· ◦ AmpG(M−1)

◦LossT(M−1) ◦LossT(M−2) ◦ · ·· ◦ LossT(0)

= AmpG◦◦LossT◦,

(26)

where

T◦=

M−1

Y

i=0

T(i),

G◦=

M−1

Y

i=0

G(i),

(27)

i.e., a series of losses and ampliﬁers is equivalent to the loss channel of transmission T◦followed by the

ampliﬁer with ampliﬁcation factor G◦.

Note now that the value µ≡G(i)T(i)=GT cannot be changed by permutations. Let us deﬁne

F(i)= (G(i)−1)T(i)+ 1,(28)

and bear in mind that

F(i+1) = (G(i+1) −1)T(i+1) + 1 = (F(i)−1)

F(i)

T G + 1 = µF(i)−1

F(i)+ 1.(29)

We can write

T(i+1) =T G

F(i)

,

G(i+1) =F(i),

(30)

and

G◦=G

M−2

Y

i=0

F(i),

T◦=T(T G)M−1

QM−2

i=0 F(i)

=(T G)M

G◦

.

(31)

Let us ﬁnd the explicit form of G◦and T◦by solving the recurrence relation. Deﬁne Anand Bnthrough

the relation

F(n−1) =An

Bn

.(32)

8

Then

F(n+1) =(µ+ 1)F(n)−µ

F(n)

=(µ+ 1)An+1 −µBn+1

An+1

.(33)

It follows from (32) and (33) that Bn+1 =Anand

An+1 = (µ+ 1)An−µBn= (µ+ 1)An−µAn−1.(34)

We see that the solution of this equation has a form

An=c1+c2µn,(35)

where c1and c2are the constants, which are determined by F0= (G−1)T+1: we take A1= (G−1)T+1

and A0= 1, and obtain

c1=T−1

GT −1c2=(G−1)T

GT −1.(36)

Notably, the product ΠM−2

n=0 F(n)appearing in the ﬁnal expression becomes relatively simple

M−2

Y

n=0

F(n)=

M−2

Y

n=0

An+1

An

=AM−1

A0

=(G−1)(GT )M+G(T−1)

G(GT −1) ,

(37)

and we have

ΦM= (AmpG◦LossT)◦M= AmpG◦◦LossT◦,

G◦=(G−1)(GT )M+G(T−1)

GT −1,

T◦=(T G)M

G◦

.

(38)

The case of T G = 1 is particularly interesting as the average intensity of the transmitted signal

remains preserved (which is diﬀerent from the total output intensity as it has the noise contribution).

In the limit G→1/T we have

G◦=G(M(1 −T) + T),

T◦=T

M(1 −T) + T.(39)

3.5 Fluctuations

Let us calculate the ﬂuctuation of the number of photons in a pulse after it passes through a sequence

of Mloss regions and ampliﬁers. Let |γ|2be the input intensity; as follows from(7) and (14), the average

number of photons nin the output signal is

n=hˆa†ˆai=|γ|2+G◦−1,(40)

where G◦and T◦are given by Eq.(39). The variance of the output photon number is

δn2=h(ˆa†ˆa)2i − (hˆa†ˆai)2=GM (1 −T)(GM (1 −T) + 1) + |γ|2(2GM (1 −T) + 1).(41)

In the limit |γ|2GM 1 we obtain the same result as we got from the qualitative considerations in

Sec. 3.1:

δn '√nGM . (42)

9

4 Control of the transmission line

To monitor the eavesdropper’s activity, Alice sends, at appropriate intervals, special test pulses

(individual or many, see the discussion below) and cross-checks the intensities with Bob. The test pulses

should comprise a large number of photons, but must not, however, damage Bob’s detection equipment.

By producing and analysing the corresponding scattering matrix, Alice and Bob can determine the losses

in the channel. To prevent an inconspicuous Eve’s intrusion into the optical ﬁber, the physical loss control

should be conducted constantly and should not halt even during the pauses in the key distribution. We

emphasize that the authorized parties can discriminate between the losses of the general origin and losses

that are caused and can be exploited by Eve.

If the optical ﬁber is properly installed, it should not have points of signiﬁcant inﬂections and crude

junctions. Then, most of the intrinsic natural losses in the line occur due to Rayleigh scattering. Such

losses are distributed across the whole line. Therefore, Eve cannot pick up the dissipated signal eﬀectively,

unless she has an antenna covering a signiﬁcant part of the line; moreover, as we discussed in the

Introduction, the eﬀective deciphering of the dissipated signal requires a multitude of Maxwell demon-

like devices, which is not practically feasible. The only option remaining to the eavesdropper is to take

away part of the signal deliberately, that is to create and exploit the losses additional to the natural

ones (namely, by bending the optical ﬁber intentionally). Alice and Bob can identify and measure such

artiﬁcial losses. To do that, they must ﬁrst determine the magnitude of losses not associated with the

eavesdropper’s activity; this can be done by measuring the losses appearing homogeneously across the

whole line before the beginning of the protocol. After that, Alice and Bob can precisely determine

the newly appearing local leaks of the signal (with proportion rE) possibly intercepted by Eve. This

knowledge ensures the most eﬃcient ciphering and measurements routines, determining in turn the

post-selection procedure.

In the case that Eve knows the parameters of the test pulses, she can completely seize them and send

the fake ones to mask her presence. In order to prevent that, Alice should parametrize the test sequences

randomly and compare the parameters with Bob only after he measures the pulses. This arrangement

would force Eve to ﬁrst measure the pulses and then reproduce them which in turn would prolong the

transmission. Such a delay can be easily detected by Alice and Bob. Possible testing protocols:

1. Individual pulses.– Alice sends a single testing pulse the parameters of which are chosen randomly.

The preparation of the pulse implies generating an auxiliary random bit sequence and translating

it into the random intensity, phase, length and shape of the pulse. After Bob measures the test

pulse, he veriﬁes its parameters with Alice, and they determine the losses in the channel.

2. Sequence of pulses.– Alice sends a sequence of test pulses in which she encodes an auxiliary random

sequence. This involves generating an auxiliary random sequence and ciphering it in a sequence of

pulses. Bob measures the pulses, veriﬁes the encoded message with Alice, after what they determine

the losses.

Let τSbe the length of the signal pulse, and τTbe the total length of a sequence of test pulses (test

pulses may look completely like the signal ones, but their sequence must contain much more photons

than one signal pulse). Both types of pulses can be characterized by the same constant power, e.g.,

P= 20 mW, but τTmust be much greater than τS, e.g., τT= 1 ms and τS= 1 ns. The average number

of photons in the test pulse is nA

T=P τT

hν ∼1014, where νis the light frequency. The measurement

error on Bob’s side is determined by Eq. (42): δnB

T∼6·108. The test pulse allows to detect leakage of

magnitudes

rE≥δTT=δnT/hnTi= 6 ·10−6.(43)

Similar control and analysis of the reﬂected signal must be performed on Alice’s end.

5 Measurement scheme

The state of the optical signal can be described in terms of its quadratures given by operators

ˆq=ˆa†+ ˆa

2,

ˆp=i(ˆa†−ˆa)

2.

(44)

10

Figure 3: Optical phase diagram of states corresponding to bit values 0 and 1 after they pass through

the sequence of losses and ampliﬁcations. The two output states constitute Gaussians centered at

±√1−rEγ, where rEis the proportion of signal stolen by Eve.

These operators represent the real and imaginary parts of the signal’s complex amplitude, and by mea-

suring one of the quadratures one can distinguish between diﬀerent signals.

Bob needs to distinguish between two states |γ0i=|γiand |γ1i=|−γi(with γ∈R) transformed by

losses and ampliﬁers, – two Gaussians with centers laying on the real axis (q-axis) of the optical phase

space, see the phase diagram displayed in Fig.3 – and for this he measures the ˆq-quadrature. Bob does

his measurements by means of homodyne detection described by the following operators:

ˆ

E0=

∞

Z

Θ

dq |qihq|,

ˆ

E1=

−Θ

Z

−∞

dq |qihq|,

ˆ

Efail =ˆ

I−ˆ

E0−ˆ

E1,

(45)

where |qiis the eigenstate of ˆq, and the parameter Θ is tuned by Bob depending on the amount of losses

possibly stolen by Eve, see the discussion below. Here, ˆ

E0(1) determines the bit value 0(1), whereas ˆ

Efail

is associated with the bad outcome and the respective bit must be discarded by Alice and Bob on the

stage of post-selection. By looking at Fig. 4, one can see that ˆ

Efail corresponds to the phase space region

where the two states (Gaussians) overlap the most, and thus the associated outcome is inconclusive.

6 Error estimate and correction

After the measurements and post-selection procedure of discarding invalid bits, Alice and Bob must

perform error correction procedure. The quadrature value qobtained from homodyne measurement, al-

lows to estimate the probability of error in the corresponding bit – one can easily compute the conditional

error probability for every q. In reality, the error rate is also determined by channel imperfections and

Eve’s detrimental activities. Therefore, in practice, instead of the theoretical prognosis, the error cor-

rection procedure should be mainly predicated on the direct measurement of an error, e.g., by disclosing

a part of the raw key to observe the error.

One option for the practical error estimation is to disclose one half of the raw key. But if the raw

key is long enough, already a relatively short part can provide an accurate error estimate. According to

this method, Alice and Bob use their public authenticated channel to select a number of bit positions in

the raw key and publicly announce the corresponding bit values. Then, using Bayes’ theorem, they can

make a guess about the expected error rate for the remaining part of the raw key. Alternatively, instead

of the bit values Alice and Bob can disclose the parity bits for some selected blocks of raw key positions.

This method gives a better estimate for small error rate values, but is worse for high error rates. The

decision about the block size can be made taking into account the theoretical estimates based on the

observed values of q. For example, if the raw error estimate is approximately 6%, blocks of length 10 can

be used, since the probability for parity bits mismatch in this case is approximately 36%, which is large,

but still below 50%, meaning that the parity data reveal a lot of information about the real error rate.

11

Figure 4: Schematic representation of the measurement operators employed by Bob. The two signal

states are Gaussians overlapping the most in the region of phase space corresponding to ˆ

Efail. Therefore,

Alice and Bob consider the associated outcome inconclusive and discard it on the post-selection stage.

The outcomes associated with ˆ

E0and ˆ

E1are considered conclusive. The value of Θ is varied to perform

the most eﬃcient post-selection procedure as far as the ﬁnal key generation rate is concerned.

After estimating the error rate, Alice and Bob can carry out the error correction procedure. To do

that, they can use the low-density parity-check (LDPC) codes [24]. The input for such codes are the

probabilities of zero or one at each bit position and the syndrome of the correct bit string – the set of

parity bits which are suﬃcient to correct the errors, taking into account the a priori probabilities for each

position. LDPC codes are particularly good for error correction after homodyne measurement, since the

measurement result qitself allows to calculate the probabilities for correct and erroneous results.

After Alice and Bob correct errors in a (possibly small) part of the raw key, they have to take into

account the number of errors in this part to yield a more accurate error estimate for the remaining

key. We propose the following adaptive procedure: Alice and Bob ﬁrst take a relatively short subset

of the original raw key (which size depends on the codeword’s length, e.g., 1000 bits), and apply error

correcting procedure which is designed for high error rates (e.g., 10% in the case that the preliminary

crude estimation gave just 5% error probability). After correcting error in this small subset, Alice and

Bob know the number of errors therein, and have a better error rate estimate for the remaining part

of the key. Then, they should take another short (e.g., once again, 1000 bits) subset and perform error

correction according to the new improved error rate estimate, and so on. With each iteration, the error

estimate becomes more accurate making the error correction procedure more eﬃcient. This method can

be applied without having initial error estimate at all which can save Alice and Bob a large part of the

raw key.

The error correction procedure discloses some information about the key. For linear codes like LDPC

codes, one syndrome bit discloses no more than one bit of information about the key, thus the syndrome

length is appropriate upper bound for the information leakage.

7 Privacy ampliﬁcation

Although after the error correction procedure, Alice and Bob share the same bit string, which is

still correlated with Eve, thus it cannot be used as the ﬁnal secret key. The privacy ampliﬁcation

procedure [25–27], aimed at eradicating Eve’s information, produces a new, shorter, bit string. This new

string can ﬁnally be used as a secret key as Eve does not possess any (or almost any) information about

it.

To eliminate the eavesdropper information, Alice and Bob can, for instance, use universal hashing

method [28]. This method requires them to initially agree on the family Hof hash functions h∈H.

At the privacy ampliﬁcation stage, they randomly select such a function h:{0,1}l1→ {0,1}l2from this

12

Figure 5: (a) Beam splitter attack on the protocol. Eve seizes part of the signal somewhere along the

optical line. (b) Scheme equivalent to (a). The losses and ampliﬁers before and after the point of Eve’s

intervention are represented by two pairs of loss and ampliﬁcation channels deﬁned by the parameters

{T1, G1}and {T2, G2}respectively.

family, that it maps the original bit string of length l1to the ﬁnal key of length l2. If Eve is estimated

to have ebits of information about the raw key, l2must be equal to l1−e.

One example of His the Toeplitz matrices family [29]. Alice and Bob can use a random binary

Toeplitz matrix Twith l1rows and l2columns. Then they represent their bit string as a binary vector

v, and the ﬁnal key kis given by

k=T·v.

8 Eve’s attack

In this section, we demonstrate how the protocol works in the case where Eve performs the beam

splitter attack seizing the part of the signal somewhere along the optical line as shown in Fig.5(a) (we

will use the term ”beam splitter” in referring to the point of Eve’s intervention into the line). The beam

splitter is ideal, meaning that there is no reﬂection in Alice’s direction. If the signal intensity incident

to the beam splitter is 1, then intensity rEgoes to Eve, and 1 −rEgoes to Bob’s direction.

Quantum cryptography also studies attacks exercising the partial blocking of the signal and the

subsequent unauthorised substitution of the blocked part. However, any attack like this will inevitably

and permanently (even if Eve at some point decides to disconnect from the line) aﬀect the scattering

matrix of the transmission line, and hence will be detected by the legitimate users. Therefore, we do

not concentrate on this kind of attacks here. Furthermore, at this point we accept that the attacks

speciﬁcally focusing on ampliﬁers can be reduced to the beam splitter kind of attacks. The associated

subtleties and details will be the subject of our forthcoming publication.

8.1 Losses and ampliﬁers

The proportion of the transmitted signal on the distance dbetween two neighbouring ampliﬁers is

determined by

T= 10−µd,(46)

where µ= 1/50 km−1is the parameter of losses typical for the optical ﬁbers. As was mentioned before,

the ampliﬁcation factor of each ampliﬁer is G= 1/T . Let DAB(AE )be the distance between Alice and

Bob (Alice and Eve), then the numbers of ampliﬁers before and after the beam splitter M1and M2are

given by

M1=DAE /d, (47)

M2= (DAB −DAE )/d. (48)

13

As we showed previously, the scheme can be simpliﬁed by reducing the losses and ampliﬁcations before

and after the beam splitter to two loss and apliﬁcation pairs with the parameters {T1, G1}and {T2, G2}

respectively

T1=T

M1(1 −T) + T=10−µd

(1 −10−µd)DAE /d + 10−µd , G1=1

T1

,

T2=T

M2(1 −T) + T=10−µd

(1 −10−µd)(DAB −DAE )/d + 10−µd , G2=1

T2

.

(49)

8.2 Evolution of systems’ state

Let us describe the progressive evolution of the combined systems’ state. The initial state of Alice’s

random bit (A) – her random number generator – and the corresponding signal (S) is given by

ˆρi

AS =1

2|0ih0|A⊗ |γi hγ|S+1

2|1ih1|A⊗ |−γi h−γ|S.(50)

As the signal undergoes transformations associated with losses and ampliﬁcations, the state of the AS-

system just before the signal passes the beam splitter is given by

ˆρ→

AS =1

2|0ih0|A⊗Zd2αP√T1γ ,G1(α)|αihα|S

+1

2|1ih1|A⊗Zd2αP−√T1γ ,G1(α)|αihα|S.

(51)

Deﬁning

ˆρ→

AS [α] = 1

2|0ih0|A⊗ |αi hα|S+1

2|1ih1|A⊗ |−αi h−α|S,(52)

we can rewrite Eq. (51) as

ˆρ→

AS =Zd2αP√T1γ,G1(α) ˆρ→

AS [α].(53)

Just after the signal passes the beam splitter, the state of the joint system comprising Alice’s random

bit (A), the signal going to Bob (S) and signal seized by Eve (E) is described by

ˆρ→

ASE =Zd2αP√T1γ ,G1(α)ˆρ→

ASE [α] (54)

where

ˆρ→

ASE [α] = 1

2|0ih0|A⊗ |√1−rEαi h√1−rEα|S⊗ |√rEαih√rEα|E

+1

2|1ih1|A⊗ |−√1−rEαi h−√1−rEα|S⊗ |−√rEαih−√rEα|E,

(55)

and rEis the proportion of signal stolen by Eve. After the signal undergoes the second sequence of losses

and ampliﬁers and just before it is measured by Bob, the state of the joint system is

ˆρ→Bob

ASE =Zd2αP√T1γ ,G1(α)ˆρ→Bob

ASE [α] (56)

with

ˆρ→Bob

ASE [α] = 1

2X

a=0,1|aiha|A⊗Zd2βP√(1−rE)T2(−1)aα,G2(β)|βihβ|S⊗ |(−1)a√rEαih(−1)a√rEα|E.

(57)

Bob receives the signal, measures it and, together with Alice, performs post-selection, which lays in

discarding the bits associated with the fail-outcome by communicating through the classical channel.

The probability that Bob’s measurement outcome is b={0,1}given that Alice sent bit is a={0,1}

can be written as

p(b|a) = trASE h2· |aiha|A⊗ˆ

Eb⊗1Eˆρ→Bob

ASE i=Zd2αP√T1γ ,G1(α)p(−1)aα(b|a),(58)

14

where

p(−1)aα(b|a) = Zd2βP√(1−rE)T2(−1)aα,G2(β)hβ|ˆ

Eb|βiS.(59)

Thus, the probability of a conclusive outcome which means that the bit will not be discarded on the

stage of post-selection is

p(X) = 1

2X

a,b=0,1

p(b|a) = Zd2αP√T1γ,G1(α)X

b=0,1

pα(b|0) + p−α(b|1)

2.(60)

The ﬁnal state of Alice’s random bit (A), Bob’s memory device storing the measurement outcome (B)

and the signal stolen by Eve (E) after the post-selection, i.e., conditional to the successful measurement

outcome, is

ˆρf

ABE =Zd2αP√T1γ,G1(α)ˆρf

ABE [α] (61)

where

ˆρf

ABE [α] = 1

2|0ih0|A⊗

X

b=0,1

pα(b|0)

p(X)|bihb|B

⊗ |√rEαih√rEα|E

+1

2|1ih1|A⊗

X

b=0,1

p−α(b|1)

p(X)|bihb|B

⊗ |−√rEαih−√rEα|E.

(62)

8.3 Probabilities

To obtain the probabilities p(b|a), a, b ∈ {0,1}, we must ﬁrst calculate |hβ|qi|2:

|hβ|qi|2=hβ|1

2πZdpeip(ˆq−q)|βi=1

2πZdp hβ|eipˆa†+ˆa

2−q|βi=r2

πe−2(Reβ−q)2.(63)

After substituting |hβ|qi|2into Eqs. (58, 59) we obtain

p(0|0) = 1

2

1−erf

√2hΘ−γpG1T1G2T2(1 −rE)i

p1 + 2(G2−1) + 2G2T2(1 −rE)(G1−1)

,(64)

p(1|0) = 1

2

1−erf

√2hΘ + γpG1T1G2T2(1 −rE)i

p1 + 2(G2−1) + 2G2T2(1 −rE)(G1−1)

,(65)

p(0|1) = 1

2

1−erf

√2hΘ + γpG1T1G2T2(1 −rE)i

p1 + 2(G2−1) + 2G2T2(1 −rE)(G1−1)

,(66)

p(1|1) = 1

2

1−erf

√2hΘ−γpG1T1G2T2(1 −rE)i

p1 + 2(G2−1) + 2G2T2(1 −rE)(G1−1)

,(67)

where

erf(x) = 2

√π

x

Z

0

e−t2dt. (68)

8.4 Eve’s information

Hereafter we will use the concepts of the quantum von Neumann entropy and conditional entropy.

For quantum system Xwith the density matrix ˆρXthe entropy is deﬁned as

HˆρX(X) = tr [ˆρXlog ˆρX],(69)

15

where log ≡log2. For the pair of quantum systems Xand Y, with the states of X-system and the

joint system described by the density matrices ˆρXand ˆρX Y , respectively, the conditional entropy can be

written as

HˆρX Y (Y|X) = HˆρXY (X Y )−HˆρX(X).(70)

Let us estimate Eve’s information about the raw key (per 1 bit) after post-selection but before the

error correction stage

I(A, E) = Hˆρf

A(A)−Hˆρf

AE (A|E)=1−Hˆρf

AE (A|E).(71)

Conditional entropy Hˆρf

AE (A|E) is determined by the ﬁnal density matrix of AE-system which given

Eq. (61) and the fact that

pα(0|0) + pα(1|0) = p−α(0|1) + p−α(1|1),(72)

can be written as

ˆρf

AE = trBˆρf

ABE =Zd2αQX[α] ˆρf

AE [α] (73)

with

ˆρf

AE [α] = 1

2|0ih0|A⊗ |√rEαi h√rEα|E+1

2|1ih1|A⊗ |−√rEαi h−√rEα|E,

QX[α] = [pα(0|0) + pα(1|0)]P√T1γ,G1(α)

p(X).

(74)

To ﬁnd the lower bound of Eve’s entropy (and therefore estimate the maximum of her information

about the key) we consider a situation where Eve has some auxiliary register of variable α(RE) and

introduce the joint AEREstate:

ˆρf

AERE=1

2Zd2αQX[α]X

a=0,1|aiha|A⊗ |(−1)a√rEαih(−1)a√rEα|E⊗ |reg(α)ihreg(α)|RE.(75)

Here the register’s states satisfy hreg(α)|reg(α0)i=δ(2)(α−α0). We note that ﬁrst, by tracing out the

register we recover the original state of AE-system

trREˆρf

AERE= ˆρf

AE ,(76)

and second, the monotonicity of conditional entropy implies

Hˆρf

AE (A|E)≥Hˆρf

AERE

(A|ERE) = Hˆρf

AERE

(AERE)−Hˆρf

ERE

(ERE).(77)

The latter inequality simply states that after discarding the register, Eve can only lose information about

the sent bit. To this end, Hˆρf

AERE

(A|ERE) is the lower bound of Hˆρf

AE (A|E).

Matrix ˆρf

AEREcan be rewritten as

ˆρf

AERE=X

iZd2α QX[α]λ(α)

i|ψ(α)

iihψ(α)

i|⊗|reg(α)ihreg(α)|RE,(78)

where λ(α)

iand |ψ(α)

iiare the eigenvalues and eigenstates of ˆρf

AE [α]. We thus yield

Hˆρf

AERE

(AERE) = −X

iZd2αQX[α]λ(α)

ilog(QX[α]λ(α)

i) + C

=−X

iZd2αQX[α]λ(α)

i(log(QX[α]) + log(λ(α)

i)) + C

=−Zd2αQX[α] log(QX[α]) −Zd2αQX[α]X

i

λ(α)

ilog(λ(α)

i) + C

=−Zd2αQX[α] log(QX[α]) + Zd2αQX[α]Hˆρf

AE [α](AE) + C,

(79)

where Cis an additional correcting term, which we do not need to calculate explicitly. In the same way

we obtain

Hˆρf

ERE

(ERE) = −Zd2αQX[α] log(QX[α]) + Zd2αQX[α]Hˆρf

E[α](E) + C. (80)

16

Combining the two expressions we obtain

Hˆρf

AE (A|E)≥Hˆρf

AERE

(A|ERE) = Hˆρf

AERE

(AERE)−Hˆρf

ERE

(ERE)

=Zd2αQX[α](Hˆρf

AE [α](AE)−Hˆρf

E[α](E))

=Zd2αQX[α]Hˆρf

AE [α](A|E)

= 1 −Zd2αQX[α]h1− |h√rEα| − √rEαi|

2

= 1 −Zd2α QX[α]h 1 + e−2rE|α|2

2!.

(81)

where

h(p) = −plog(p)−(1 −p) log(1 −p) (82)

is the binary entropy. Now, we can use the Jensen’s inequality

hh(x)i ≤ h(hxi) =⇒1− hh(x)i ≥ 1−h(hxi),(83)

where hxi ≡ Rd2α QX[α]x:

Hˆρf

AE (A|E)≥1−h 1 + he−2rE|α|2i

2!(84)

where he−2rE|α|2i=Rd2α QX[α]e−2rE|α|2. We ﬁnd

he−2rE|α|2i=e−2rEG1T1|γ|2

1+2rE1

p(X)[1 + 2rE1](1−1

2erf p2(1 + 2rE1)hΘ−√(1−rE)G2T2G1T1γ

1+2rE1i

p22+ 1 + 2(1 −rE)G2T21+ 2rE(22+ 1)1!

−1

2erf p2(1 + 2rE1)hΘ + √(1−rE)G2T2G1T1γ

1+2rE1i

p22+ 1 + 2(1 −rE)G2T21+ 2rE(22+ 1)1!),

(85)

where 1,2≡G1,2−1.

By substituting Eq. (85) into Eq. (84) and using Eq. (71) we obtain the upper bound for Eve’s infor-

mation.

8.5 Bob’s error rate

Let us estimate Bob’s error rate. Bob’s information per 1 bit about the key after post-selection but

before error correction is given by

I(A, B) = Hˆρf

A(A)−Hˆρf

AB (A|B) = 1 −Hˆρf

AB (A|B) (86)

should ideally be equal to 1. Bob’s error rate is therefore determined by the conditional entropy

Hˆρf

AB (A|B):

Hˆρf

AB (A|B) = Hˆρf

AB (AB)−Hˆρf

B(B).(87)

It follows from Eq. (61) that

Hˆρf

AB (AB) = −X

a,b=0,1

p(b|a)

2p(X)log p(b|a)

2p(X),(88)

Hˆρf

B(B) = −X

b=0,1

p(b|a= 0) + p(b|a= 1)

2p(X)log p(b|a= 0) + p(b|a= 1)

2p(X),(89)

and the probabilities p(b|a) and p(X) are given by Eqs.(64-67) and (60). Notice, that post-selection is

symmetric

p(0|0) + p(1|0) = p(0|1) + p(1|1) = p(X).(90)

17

0.00 0.01 0.02 0.03 0.04 0.05

rE

10 10

10 8

10 6

10 4

10 2

100

Lf/L

DAB = 1000 km, d = 10 km, T = 0.63

DAE = 10 km

DAE = 50 km

DAE = 250 km

DAE = 500 km

DAE = 990 km

0.00 0.01 0.02 0.03 0.04 0.05

rE

10 10

10 8

10 6

10 4

10 2

100

Lf/L

DAB = 1000 km, d = 20 km, T = 0.40

DAE = 20 km

DAE = 80 km

DAE = 200 km

DAE = 500 km

DAE = 980 km

0.00 0.01 0.02 0.03 0.04 0.05

rE

10 10

10 8

10 6

10 4

10 2

100

Lf/L

DAB = 1000 km, d = 30 km, T = 0.25

DAE = 30 km

DAE = 90 km

DAE = 300 km

DAE = 480 km

DAE = 930 km

Figure 6: Lf/L as function of rEfor diﬀerent values of distance dbetween two neighbouring ampliﬁers:

(a) d= 10 km; (b) d= 20 km; (c) d= 30 km; DAB = 1000 km is ﬁxed. The optimal parameters:

γ∼θ∼10 for rE∼0.01, and γ∼θ∼104for rE= 0.00. We see that the ﬁnal rate depends on Eve’s

position in the line: the closer she is to Bob (small DAE ), the more information she knows about the bit

sequence, due to the correlations imposed by the ampliﬁers.

Then

Hˆρf

AB (A|B) = hp(0|0)

p(X).(91)

After the error correction procedure, Bob’s information about the key becomes ˜

I(A, B) = 1, but

Eve’s information increases and one can estimate it as

˜

I(A, E) = I(A, E ) + Hˆρf

AB (A|B)≤1−min Hˆρf

AE (A|E) + Hˆρf

AB (A|B).(92)

9 Key rate

Now, we can estimate the length Lfof the ﬁnal key after post-selection, error correction and privacy

ampliﬁcation:

Lf=p(X)L·1−˜

I(A, E)=p(X)L·min Hˆρf

AE (A|E)−Hˆρf

AB (A|B),(93)

where Lis the length of the random bit string, originally generated by Alice. If Lis understood as the

number of bits generated in a unit of time, then Eq. (93) reﬂects the ﬁnal key generation rate. This

equation in its explicit form, which is too cumbersome to be written here, includes two parameters – the

amplitude of signal γand the measurement parameter Θ – which Alice and Bob can vary depending on

rEto ensure the best rate (e.g., by numerically maximizing the function in Eq. (93)). Furthermore, the

equation also includes the distance dbetween two neighboring ampliﬁers and the distances DAB and

DAE between the participants of the action – these are parameters which we consider ﬁxed.

Figure 6 plots Lf/L as function of rEfor diﬀerent values of distance dbetween two neighbouring

ampliﬁers. For every value of rEthe parameters γand Θ are such that they maximize Lf/L. Since

there are correlations imposed by the ampliﬁers, for Eve it is beneﬁcial to intercept signal near Bob.

The secure and fast communication can be established if Lf/L &10−6(provided that the initial random

number generation rate L∼1 Gbit/s), thus Alice and Bob can allow Eve to steal no more than few

percent.

Figure 7 shows Lf/L as function of rEfor large DAB in the assumption that we can technically

measure rEwith theoretically allowed precision. We see that no matter from what point in the line Eve

steals the signal, the precision detection of local losses allow for the secure communication over global

distances ≥20,000 km.

References

[1] H. J. Kimble. The quantum internet. Nature, 453(7198):1023–1030, Jun 2008. doi:10.1038/

nature07127.

18

0 2 4 6 8 10

rE, 10 5

0.2

0.4

0.6

0.8

1.0

Lf/L

DAB = 10000 km, d = 50 km, G = 10, M = 200

DAE = 50 km

DAE = 1000 km

DAE = 2500 km

DAE = 5000 km

DAE = 9000 km

0 2 4 6 8 10

rE, 10 5

0.0

0.2

0.4

0.6

0.8

1.0

Lf/L

DAB = 20000 km, d = 50 km, G = 10, M = 400

DAE = 50 km

DAE = 1000 km

DAE = 2500 km

DAE = 5000 km

DAE = 10000 km

0 2 4 6 8 10

rE, 10 5

0.0

0.2

0.4

0.6

0.8

1.0

Lf/L

DAB = 40000 km, d = 50 km, G = 10, M = 800

DAE = 50 km

DAE = 5000 km

DAE = 10000 km

DAE = 20000 km

DAE = 30000 km

Figure 7: Lf/L as function of rEfor diﬀerent values of distance DAB between Alice and Bob: (a)

DAB = 10,000 km; (b) DAB = 20,000 km; (c) DAB = 40,000 km; d= 50 km is ﬁxed. The scales of the

plot imply the theoretically allowed loss detection precision. The optimal parameters: γ∼θ∼102for

rE∼10−5, and γ∼θ∼104for rE= 0.

[2] Nicolas Sangouard, Christoph Simon, Hugues de Riedmatten, and Nicolas Gisin. Quantum repeaters

based on atomic ensembles and linear optics. Rev. Mod. Phys., 83(1):33–80, Mar 2011. doi:

10.1103/RevModPhys.83.33.

[3] Christoph Simon, Hugues de Riedmatten, Mikael Afzelius, Nicolas Sangouard, Hugo Zbinden, and

Nicolas Gisin. Quantum repeaters with photon pair sources and multimode memories. Phys. Rev.

Lett., 98(19):190503, May 2007. doi:10.1103/PhysRevLett.98.190503.

[4] L.-M. Duan, M. D. Lukin, J. I. Cirac, and P. Zoller. Long-distance quantum communication with

atomic ensembles and linear optics. Nature, 414(6862):413–418, Nov 2001. doi:10.1038/35106500.

[5] H.-J. Briegel, W. D¨ur, J. I. Cirac, and P. Zoller. Quantum repeaters: The role of imperfect local

operations in quantum communication. Phys. Rev. Lett., 81(26):5932–5935, Dec 1998. doi:10.

1103/PhysRevLett.81.5932.

[6] Pieter Kok, Colin P. Williams, and Jonathan P. Dowling. Construction of a quantum repeater with

linear optics. Phys. Rev. A, 68(2):022301, Aug 2003. doi:10.1103/PhysRevA.68.022301.

[7] L. Childress, J. M. Taylor, A. S. Sørensen, and M. D. Lukin. Fault-tolerant quantum communication

based on solid-state photon emitters. Phys. Rev. Lett., 96(7):070504, Feb 2006. doi:10.1103/

PhysRevLett.96.070504.

[8] P. van Loock, T. D. Ladd, K. Sanaka, F. Yamaguchi, Kae Nemoto, W. J. Munro, and Y. Yamamoto.

Hybrid quantum repeater using bright coherent light. Phys. Rev. Lett., 96(24):240501, Jun 2006.

doi:10.1103/PhysRevLett.96.240501.

[9] Tie-Jun Wang, Si-Yu Song, and Gui Lu Long. Quantum repeater based on spatial entanglement

of photons and quantum-dot spins in optical microcavities. Phys. Rev. A, 85(6):062311, Jun 2012.

doi:10.1103/PhysRevA.85.062311.

[10] Nicolas Sangouard, Romain Dubessy, and Christoph Simon. Quantum repeaters based on single

trapped ions. Phys. Rev. A, 79(4):042340, Apr 2009. doi:10.1103/PhysRevA.79.042340.

[11] Koji Azuma, Hitoshi Takeda, Masato Koashi, and Nobuyuki Imoto. Quantum repeaters and compu-

tation by a single module: Remote nondestructive parity measurement. Phys. Rev. A, 85(6):062309,

Jun 2012. doi:10.1103/PhysRevA.85.062309.

[12] M. Zwerger, W. D¨ur, and H. J. Briegel. Measurement-based quantum repeaters. Phys. Rev. A,

85(6):062326, Jun 2012. doi:10.1103/PhysRevA.85.062326.

[13] W. J. Munro, K. A. Harrison, A. M. Stephens, S. J. Devitt, and Kae Nemoto. From quantum

multiplexing to high-performance quantum networking. Nature Photonics, 4(11):792–796, Nov 2010.

doi:10.1038/nphoton.2010.213.

19

[14] Liang Jiang, J. M. Taylor, Kae Nemoto, W. J. Munro, Rodney Van Meter, and M. D. Lukin.

Quantum repeater with encoding. Phys. Rev. A, 79(3):032325, Mar 2009. doi:10.1103/PhysRevA.

79.032325.

[15] W. J. Munro, A. M. Stephens, S. J. Devitt, K. A. Harrison, and Kae Nemoto. Quantum commu-

nication without the necessity of quantum memories. Nature Photonics, 6(11):777–781, Nov 2012.

doi:10.1038/nphoton.2012.243.

[16] Andrzej Grudka, Karol Horodecki, Micha l Horodecki, Pawe l Horodecki, Marcin Paw lowski, and

Ravishankar Ramanathan. Free randomness ampliﬁcation using bipartite chain correlations. Phys.

Rev. A, 90(3):032322, Sep 2014. doi:10.1103/PhysRevA.90.032322.

[17] G. B. Lesovik, I. A. Sadovskyy, M. V. Suslov, A. V. Lebedev, and V. M. Vinokur. Arrow of

time and its reversal on the ibm quantum computer. Scientiﬁc Reports, 9(1):4396, Mar 2019.

doi:10.1038/s41598-019-40765-6.

[18] N. S. Kirsanov, A. V. Lebedev, M. V. Suslov, V. M. Vinokur, G. Blatter, and G. B. Lesovik. Entropy

dynamics in the system of interacting qubits. Journal of Russian Laser Research, 39(2):120–127,

Mar 2018. doi:10.1007/s10946-018-9698-0.

[19] G. B. Lesovik, A. V. Lebedev, I. A. Sadovskyy, M. V. Suslov, and V. M. Vinokur. H-theorem in

quantum physics. Scientiﬁc Reports, 6(1):32815, Sep 2016. doi:10.1038/srep32815.

[20] Evgenii Mikhailovich Lifshitz and Lev Petrovich Pitaevskii. Physical kinetics. Course of theoretical

physics. Pergamon, Oxford, 1981. Translated from the Russian by J B Sykes and R N Franklin.

URL: https://cds.cern.ch/record/99987.

[21] W. Vogel, D.G. Welsch, and S. Wallentowitz. Quantum Optics: An Introduction. Wiley, 2001. URL:

https://books.google.ru/books?id=5jFHAQAAIAAJ.

[22] Pavel Sekatski, Bruno Sanguinetti, Enrico Pomarico, Nicolas Gisin, and Christoph Simon. Cloning

entangled photons to scales one can see. Phys. Rev. A, 82(5):053814, Nov 2010. doi:10.1103/

physreva.82.053814.

[23] Bruno Sanguinetti, Enrico Pomarico, Pavel Sekatski, Hugo Zbinden, and Nicolas Gisin. Quan-

tum cloning for absolute radiometry. Phys. Rev. Lett., 105(8):080503, Aug 2010. doi:10.1103/

PhysRevLett.105.080503.

[24] D.J.C. MacKay, D.J.C.M. Kay, and Cambridge University Press. Information Theory, Inference

and Learning Algorithms. Cambridge University Press, 2003. URL: https://books.google.bi/

books?id=AKuMj4PN_EMC.

[25] Charles H. Bennett, Gilles Brassard, and Jean-Marc Robert. Privacy ampliﬁcation by public dis-

cussion. SIAM J. Comput., 17(2):210–229, Apr 1988. doi:10.1137/0217014.

[26] Charles H Bennett, Gilles Brassard, Claude Cr´epeau, and Ueli M Maurer. Generalized privacy

ampliﬁcation. IEEE Transactions on Information Theory, 41(6):1915–1923, 1995.

[27] Gilles Brassard and Louis Salvail. Secret-key reconciliation by public discussion. In Workshop on

the Theory and Application of Cryptographic Techniques on Advances in Cryptology, EUROCRYPT

’93, page 410–423, Berlin, Heidelberg, 1994. Springer-Verlag.

[28] J Lawrence Carter and Mark N Wegman. Universal classes of hash functions. Journal of computer

and system sciences, 18(2):143–154, 1979.

[29] Hugo Krawczyk. Lfsr-based hashing and authentication. In Annual International Cryptology Con-

ference, pages 129–139. Springer, 1994.

20