Notes on a Continuous-Variable Quantum Key Distribution Scheme

We consider a CV QKD protocol using four coherent states and homodyne detection.⁸⁾ The sender, Alice, sends one of four coherent states \(|\alpha\rangle\) with \(\alpha =\sqrt{n} e^{ik\pi/2}\) and \(k\in \{0,1,2,3 \}\). The recipient, Bob, measures the position \(\hat{q}\) quadrature or the momentum \(\hat{p}\) quadrature of the light field. We assume the canonical commutation relation \([\hat{q},\hat{p}] = 2i\) and the quadratures can be related to the bosonic field operators \(\hat{a} = (\hat{q} + i\hat{p})/2\), by which the coherent state is defined as the eigenstate \(\hat{a} |\alpha\rangle =\alpha |\alpha\rangle\), and the mean photon number of the coherent state is given by \(n =\langle \alpha|\hat{a}^{\dagger}\hat{a} |\alpha\rangle\). Sifted keys can be obtained when Bob measures the \(\hat{q}\) (\(\hat{p}\)) quadrature for \(k\in \{0,2\}\) (\(k\in \{1,3\}\)) similarly to in the BB84 protocol. To be concrete, we introduce a threshold \(\lambda\geq 0\), and Bob's bit value is determined to be 1 or 0 according to the measured quadrature value \(x\geq \lambda\) or \(x\leq -\lambda\), while the slot is discarded if \(|x| <\lambda\). In our protocol, the bit error rate (BER) is a function of the absolute value of the quadratures \(|x|\). Therefore, a small error rate can be achieved by postselection of an appropriate range of the measured quadratures when the excess noise is small, although it could reduce the effective transmittance. For the error correction process, there are two options called direct reconciliation (DR) and reverse reconciliation (RR).¹⁰⁾ In the DR scheme, Bob corrects his bit values so as to agree with Alice's bit sequence, whereas Alice corrects her bit sequence in order to reproduce Bob's sequence in the RR scheme. We will calculate the secret key rates both in the DR and RR scenarios.

In the previous works on this protocol,^12,25,26) the length of the key rate for the case of the pure lossy channel was addressed, and it was pointed out that the transmission distance is limited owing to Gaussian excess noise.^25,26) A possible modification of this protocol to reduce the probability of the basis mismatch has been reported.¹²⁾ However, the length of the secret key in the presence of excess noise has not been reported.

The setup we hereafter deal with is shown in Fig. 1(a). The coherent state \(|\alpha\rangle\) of the mode \(\hat{a}_{1}\) propagates through a quantum channel and reaches Bob's homodyne detector. The quantum channel and Bob's detector are characterized by transmittance \(\eta_{i}\in [0,1]\) and excess noise \(\xi_{i}\geq 0\). Here the subscript is \(i=1\) for the quantum channel and \(i=2\) for Bob's detector. It is usual in the security analysis of QKD that all imperfections of the transmission channel and the detector are assumed to be induced by an eavesdropper, Eve, who can use any physically possible operation. This assumption is often called the conservative approach.

»View larger version

Figure 1. Physical model to describe the signal transmission. (a) The coherent state \(|\alpha\rangle\) Alice sends propagates through a symmetric Gaussian quantum channel with transmittance \(\eta_{1}\) and excess noise \(\xi_{1}\). Bob performs a homodyne measurement by a noisy detector with transmittance \(\eta_{2}\) and excess noise \(\xi_{2}\). (b) The beamsplitting attack. Eve emulates the quantum channel by using a phase-insensitive amplifier and a beam splitter. She obtains the information by an ideal homodyne measurement on the outgoing mode \(\hat{a}_{3}\). (c) Bob's non-ideal detector can be modeled by an amplifier followed by a beam splitter.

We consider Eve's attack based on the fact that the action of the quantum channel can be simulated by an action of an amplifier followed by a beamsplitter with vacuum initial modes [see Fig. 1(b)]. She replaces the quantum channel with a lossless fiber, and the channel's output can be mimicked by combining a phase-insensitive amplifier with gain \(g_{1}\) and a beamsplitter with transmittance \(t_{1}\).^25,26) The signal field in the mode \(\hat{a}_{1}\) interacts with the mode \(\hat{a}_{2}\) at the amplifier. After this interaction, the signal is partially split into the mode \(\hat{a}_{3}\) at the beamsplitter. In this paper we assume that Eve uses the signal of the mode \(\hat{a}_{3}\) to obtain her information. The parameters \(g_{1}\) and \(t_{1}\) are chosen to reproduce the original behavior of the quantum channel. Thereby, Eve's attack induces no detectable disturbance.

Bob's homodyne detector with transmittance \(\eta_{2}\) and excess noise \(\xi_{2}\) can also be modeled by using a pair comprising an amplifier and a beamsplitter similar to Eve's strategy [Fig. 1(c)]: The mode \(\hat{a}_{1}\) before the detector is amplified by a phase-insensitive amplifier with gain \(g_{2}\), and its amplitude is reduced by the action of the beamsplitter with transmittance \(t_{2}\). At the amplifier and the beamsplitter, the signal field is coupled with the mode \(\hat{a}_{4}\) and the mode \(\hat{a}_{5}\), respectively. After these interactions, Bob performs noiseless and lossless homodyne measurement on the outgoing mode \(\hat{a}_{1}\). The parameters \(g_{2}\) and \(t_{2}\) are determined so as to emulate the actual detector's parameters \((\eta_{2},\xi_{2})\). Note that the amplification parameters \(g_{i}\) and the transmittance of the beamsplitters \(t_{i}\) satisfy \begin{equation} g_{i} \geq 1,\quad t_{i} \in [0,1]. \end{equation} (1) For notational simplicity we may use \begin{equation} g_{i}^{\prime} = g_{i}-1,\quad t_{i}^{\prime} = 1-t_{i}. \end{equation} (2)

In the above setup, all the states and operations are Gaussian, and it is convenient to work with the mean values of the canonical variables and the covariance matrices.^27,28) Let us write the canonical variables associated with the modes \(\hat{a}_{i}\) as \(\hat{q}_{i}=\hat{a}_{i}+\hat{a}_{i}^{\dagger}\) and \(\hat{p}_{i}=(\hat{a}_{i}-\hat{a}_{i}^{\dagger})/i\). We collectively define their mean values in a given state \(\hat{\rho}\) by \begin{equation} \bar{\boldsymbol{{x}}} = \text{Tr}(\hat{\rho}\,\hat{\boldsymbol{{x}}}), \end{equation} (3) where \begin{equation} \hat{\boldsymbol{{x}}} = (\hat{x}_{1},\hat{x}_{2},\ldots, \hat{x}_{10})^{T} := (\hat{q}_{1}, \hat{p}_{1},\ldots, \hat{q}_{5}, \hat{p}_{5})^{T}. \end{equation} (4) Note that we hereafter use the bar placed above a letter to denote the mean value, for example, \(\bar{q}_{1}\) is the expectation value of the canonical variable \(\hat{q}_{1}\). The \((j,k)\)-element of the covariance matrix V is given by \begin{equation} V_{jk} = \frac{1}{2}\text{Tr}(\{\Delta \hat{x}_{j}, \Delta \hat{x}_{k}\}\,\hat{\rho}), \end{equation} (5) with \(\{\hat{A},\hat{B}\}=\hat{A}\hat{B}+\hat{B}\hat{A}\) and \begin{equation} \Delta \hat{x}_{j} = \hat{x}_{j}-\bar{x}_{j}. \end{equation} (6) The pair of the mean vector and the covariance matrix \((\bar{\boldsymbol{{x}}},V)\) for the initial state \(|\alpha\rangle|0\rangle^{\otimes 4}\) is determined to be \begin{equation} \bar{\boldsymbol{{x}}}^{\text{in}} = (2\alpha,0,\ldots,0)^{T},\quad V^{\text{in}} = \text{diag}(1,1,\ldots,1). \end{equation} (7) Note that the \((i,i)\)-component of V is the variance of the variable \(\hat{x}_{i}\).

The amplifier \(g_{1}\) acting on the modes \(\hat{a}_{1}\) and \(\hat{a}_{2}\) can be described by the matrix

(8)

(10)

(12)

(14)

For Gaussian states, quadrature distributions are readily determined once the Wigner function is known. From the mean vector \(\bar{\boldsymbol{{x}}}\) and the covariance matrix V, the Wigner function of the Gaussian state is given by²⁸⁾ \begin{equation} W(\boldsymbol{{x}}) = \frac{1}{(2 \pi)^{m} \sqrt{\det V}} e^{-\frac{1}{2} (\boldsymbol{{x}}-\bar{\boldsymbol{{x}}})^{T} V^{-1} (\boldsymbol{{x}}-\bar{\boldsymbol{{x}}})}, \end{equation} (16) where m is the total number of the optical modes. Since the pair comprising the mean vector and the covariance matrix for a subsystem can be simply determined by taking the corresponding elements from the pair \((\bar{\boldsymbol{{x}}},V)\), we can use Eq. (16) to determine the Wigner function of subsystems.

Now, let us determine the relation between the interaction parameters \((g_{i},t_{i})\) and the parameters of the channel and detector \((\eta_{i},\xi_{i})\). Recall that the transmittance is defined by the square of the ratio between the expectation values of the annihilation operator for the input state and the output state. This implies the following condition: \begin{equation} \left| \frac{\bar{x}_{1}^{\text{mid}}+i\bar{x}_{2}^{\text{mid}}}{\bar{x}_{1}^{\text{in}}+i\bar{x}_{2}^{\text{in}}} \right| = \sqrt{\eta_{1}}. \end{equation} (17) The excess noises \(\xi_{i}\) can be defined as the ratio between the variance for the input states and the output states. From this condition, we have \begin{equation} \frac{V^{\text{mid}}_{11}}{V^{\text{in}}_{11}} = 1+\xi_{1}. \end{equation} (18) Solving Eqs. (17) and (18) for \(g_{1}\) and \(t_{1}\) with the help of Eqs. (2), (7), (11), and (12), we obtain \begin{equation} t_{1} = \eta_{1}-\frac{\xi_{1}}{2},\quad g_{1} = \frac{\eta_{1}}{t_{1}}. \end{equation} (19) Similarly, \(g_{2}\) and \(t_{2}\) are determined by \(\eta_{2}\) and \(\xi_{2}\) as \begin{equation} t_{2} = \eta_{2}-\frac{\xi_{2}}{2},\quad g_{2} = \frac{\eta_{2}}{t_{2}}. \end{equation} (20) Note that from the first component of \(\bar{\boldsymbol{{x}}}^{\text{out}}\) in Eq. (13), the net transmittance observed by Bob can be written as \begin{equation} \eta_{\text{tot}} = \eta_{1}\eta_{2}. \end{equation} (21) On the other hand, from the first diagonal element of Eq. (14) [\(v_{11}\) of Eq. (15)], the net excess noise observed by Bob is given by \begin{equation} \xi_{\text{tot}} = \xi_{1} \eta_{2} + \xi_{2}. \end{equation} (22) The expressions in Eqs. (21) and (22) are consistent with the composition rule of Gaussian channels (see, Sect. III of Ref. 29). In practical situations, we may associate the transmission of the detector \(\eta_{2}\) with the product of the quantum efficiency of the detector \(\eta_{\text{eff}}\) and the other coupling efficiency \(\eta_{C}\) as \begin{equation} \eta_{2} = \eta_{C}\eta_{\text{eff}}. \end{equation} (23) In the conservative approach, all observed loss and noises are assumed to be induced by the channel, and Bob's detector is assumed to be an ideal one. To be concrete, we set the condition \((\eta_{2},\xi_{2}) =(1,0)\) for the conservative scenario. This implies \begin{equation} (\eta_{\text{tot}},\xi_{\text{tot}}) = (\eta_{1}, \xi_{1}). \end{equation} (24) In principle, one can measure the channel's parameters \((\eta_{1},\xi_{1})\) and the detector's parameters \((\eta_{2},\xi_{2})\) separately. Therefore, we can avoid an unnecessary overassessment that the detector's noise is controlled by Eve.

Supposing that Eve has a quantum memory, she can measure the mode \(\hat{a}_{3}\) on the correct quadrature basis by delaying her measurement until Bob announces his measurement basis. On the other hand, it is difficult to demonstrate a quantum memory with a long coherence time and quality comparable to currently used classical memories. In this regard, it is interesting to study possible effects on the security of QKD when Eve is unable to access a perfect quantum memory.³⁰⁾ In such a case, Eve's information could be substantially limited because she has to measure her signal before she knows the basis information. Her possible eavesdropping strategy is to monitor both the quadratures simultaneously so that she can observe some signal independent of Bob's measurement basis. A simple model for this can be described by considering a type of simultaneous measurement³¹⁾ as in Fig. 2.

»View larger version

Figure 2. When Eve is unable to access a quantum memory, she may further split the output signal in the mode \(\hat{a}_{3}\) of Fig. 1(c) by a \(50:50\) beamsplitter and measure one half to monitor the \(\hat{q}\) quadrature and the other half to monitor the \(\hat{p}\) quadrature.

Let us introduce another mode \(\hat{a}_{6}\) with quadrature \((\hat{x}_{11},\hat{x}_{12})\) and a \(50:50\) beamspliter, so that Eve's signal is equally split into the modes \(\hat{a}_{3}\) and \(\hat{a}_{6}\), where the initial state of the mode \(\hat{a}_{6}\) is a vacuum. The mean quadrature values for the three modes \((\hat{a}_{1},\hat{a}_{3},\hat{a}_{6})\) in the setup of Fig. 2 can be written as

(25)

(26)

Let us derive the formula for the mutual information between Alice and Bob, \(I_{\text{AB}}\). In order to do this we first construct the Wigner function with respect to the mode \(\hat{a}_{1}\) for the input coherent state \(|\alpha\rangle\). Then, we find the quadrature distribution of Bob. From this distribution, we can readily calculate the BER between Alice and Bob. Finally, this rate determines the form of \(I_{\text{AB}}\).

At the output instance in Eqs. (13) and (14) for the input state \(|\alpha\rangle\), the mean vector and the covariance matrix for the mode \(\hat{a}_{1}\) are given as \begin{equation} \bar{\boldsymbol{{y}}} = (\bar{x}_{1},\bar{x}_{2})^{T} = 2\alpha(\sqrt{g_{1}t_{1}g_{2}t_{2}},0)^{T} \end{equation} (27) and

(28)

(29)

»View larger version

Figure 3. The bit correlation can be characterized by binary symmetric channels for Alice and Bob (a) as well as for Alice and Eve (b). (c) Conditioned on Bob's outcome \(x =\pm x_{1}\), there are essentially four possible processes that determine Alice and Eve's bit correlation.

Let us determine the mutual information between Alice and Eve. Similar to the case of \(I_{\text{AB}}\), we can understand the physical process based on a binary symmetric channel with the BER r as in Fig. 3(b). Furthermore we can consider that the signal transmission is composed of four paths of the process associated with the Bob's measurement outcome \(x_{1}\) as in Fig. 3(c). Hence, we can determine the BER r by considering the probabilities of the paths.

Suppose that Eve's measurement outcome of her homodyne measurement is \(x_{5}\). When the slot is postselected, Bob announces the absolute value \(|x_{1}|\) of his outcome. This does not reveal his bit information since it is determined by the sign of the measured value. Eve determines her bit value from the sign of her measurement outcome. She assigns her bit value depending on whether \(x_{5}\in [0,\infty)\) or \(x_{5}\in (-\infty, 0)\). Recalling that she can correctly read the bit information when \(x_{5}\) is negative for Alice's preparation \(\alpha > 0\) (this is because the beam splitter transformation induces a minus sign for her quadrature), her BER can be written as \begin{align} r(|x_{1}|) &= \frac{\displaystyle\int_{0}^{\infty} p(x_{5}|\alpha,|x_{1}|)\,dx_{5}}{\displaystyle\int_{0}^{\infty} (p(x_{5}|\alpha,|x_{1}|)+p(x_{5}|-\alpha,|x_{1}|))\,dx_{5}}\notag\\ &= \frac{\displaystyle\int_{0}^{\infty} (p(x_{1}, x_{5}|\alpha) + p(- x_{1}, x_{5}|\alpha))\,dx_{5}}{\displaystyle\int_{-\infty}^{\infty} (p(x_{1}, x_{5}|\alpha) + p(- x_{1}, x_{5}|\alpha))\,dx_{5}}, \end{align} (37) where the conditional probability distribution \(p(x_{1}, x_{5}|\alpha)\) will be determined later in Eq. (45). The final expression in Eq. (37) can be associated with the portion that Alice's \(|\alpha\rangle\) results in Eve's positive quadrature value in the four possible paths in Fig. 3(c). Then, we may write the mutual information between Alice and Eve for the given \(|x_{1}|\) as \begin{equation} I_{\text{AE}}(|x_{1}|) = 1 - h(r(|x_{1}|)), \end{equation} (38) where \(h(x)\) is given in Eq. (33). Integration of \(I_{\text{AE}}(x_{5})\) multiplied by the probability that Alice's and Bob's measurement bases coincide gives the total mutual information: \begin{equation} I_{\text{AE}} = \frac{1}{2}\int_{|x_{1}|\geq \lambda} dx_{1}\,p(x_{1})I_{\text{AE}}(|x_{1}|), \end{equation} (39) where λ is a postselection threshold and the prior distribution \(p(x_{1})\) is given in Eq. (36).

In order to determine the conditional probability distribution in Eq. (37), we use the Wigner function of the modes \((\hat{a}_{1},\hat{a}_{3})\). Let \(\boldsymbol{{z}}=(x_{1},x_{2},x_{5},x_{6})^{T}\) and take a subvector of the mean-value vector \(\bar{\boldsymbol{{x}}}^{\text{out}}\) in Eq. (13) as \begin{equation} \bar{\boldsymbol{{z}}} = (\bar{x}_{1}, \bar{x}_{2}, \bar{x}_{5}, \bar{x}_{6})^{T} = 2\alpha(\sqrt{g_{1}t_{1}g_{2}t_{2}},0,-\sqrt{g_{1}t_{1}^{\prime}},0)^{T}. \end{equation} (40) Let us define a submatrix of \(V^{\text{out}}\) in Eq. (14) as

(41)

(43)

We proceed to the evaluation of the mutual information between Bob and Eve, which is responsible for the key rate in the case of the RR schemes. From the Wigner distribution in Eq. (44), the joint quadrature distribution between Bob and Eve can be written as \begin{equation} p(x_{1},x_{5}) = \frac{1}{2}\iint_{\mathbb{R}^{2}}(W_{\bar{\boldsymbol{{z}}}}(\boldsymbol{{z}}) +W_{-\bar{\boldsymbol{{z}}}}(\boldsymbol{{z}}))\,dx_{2}\,dx_{6}. \end{equation} (46)

Given the absolute value of Bob's quadrature \(|x_{1}|\), the correlation between Bob and Eve can be characterized by a binary symmetric channel with error probability \begin{equation} r (x_{1}) = \frac{\displaystyle\int_{0}^{\infty} p(x_{1},x_{5})\,dx_{5}}{\displaystyle\int_{-\infty}^{\infty} p(x_{1},x_{5})\,dx_{5}}. \end{equation} (47) This implies that the mutual information between Bob and Eve for Bob's outcome \(x =\pm x_{1}\) is \begin{equation} I_{\text{BE}}(x_{1}) = 1 - h (r(x_{1})), \end{equation} (48) where the binary entropy function \(h(x)\) is defined in Eq. (33). The total mutual information between Bob and Eve with the postselection threshold \(\lambda>0\) is the average of \(I_{\text{BE}}(x_{1})\) over \(x_{1}\): \begin{equation} I_{\text{BE}} = \frac{1}{2}\int_{|x_{1}|\geq\lambda}dx_{1}\,p(x_{1})I_{\text{BE}}(x_{1}), \end{equation} (49) where \(p(x_{1})\) is given in Eq. (36).

Suppose that Eve does not have a quantum memory, and executes heterodyne measurement as in Fig. 2. Suppose that Eve measures \(\hat{q}\) for the mode \(\hat{a}_{3}\) and \(\hat{p}\) for the mode \(\hat{a}_{6}\). When Alice sends \(\alpha =\pm \sqrt{n}\), the \(\hat{p}\) quadrature conveys no signal information and Eve will use her measurement result on the mode \(\hat{a}_{3}\). Hence, relevant mutual information can be determined by the joint state of the modes \(\hat{a}_{1}\) and \(\hat{a}_{3}\). From Eqs. (26) and (25), the covariance matrix and mean values of the modes \(\hat{a}_{1}\) and \(\hat{a}_{3}\) are respectively given by

(50)

From this Wigner function, we can determine the joint quadrature distribution by straightforwardly reusing the relation in Eq. (45), namely, the joint distribution between Bob and Eve conditioned on the input \(|\alpha\rangle\) becomes \begin{equation} \tilde{p}(x_{1},x_{5}| \alpha) = \iint_{\mathbb{R}^{2}} W_{\bar{\boldsymbol{{z}}}}^{(h)}(\boldsymbol{{z}})\,dx_{2}\,dx_{6}. \end{equation} (53) Then, we can find the mutual information between Alice and Eve by repeating the flow of Eqs. (37), (38), and (39). To be concrete, instead of Eq. (37) we have \begin{equation} \tilde{r}(|x_{1}|) = \frac{\displaystyle\int_{0}^{\infty} (\tilde{p}(x_{1}, x_{5}|\alpha) + \tilde{p}(- x_{1}, x_{5}|\alpha))\,dx_{5}}{\displaystyle\int_{-\infty}^{\infty} (\tilde{p}(x_{1}, x_{5}|\alpha) + \tilde{p}(- x_{1}, x_{5}|\alpha))\,dx_{5}}. \end{equation} (54) Then, similarly to Eqs. (38) and (39), we obtain the total mutual information in the following form: \begin{equation} \tilde{I}_{\text{AE}} = \frac{1}{2}\int_{|x_{1}|\geq \lambda} dx_{1}\,p(x_{1})(1- h(\tilde{r}(|x_{1}|))), \end{equation} (55) where λ is a postselection threshold and the prior distribution \(p(x_{1})\) is given in Eq. (36).

Let us determine the mutual information between Bob and Eve in the case Eve is heterodyning. We can essentially repeat the argument in Sect. 3.3 with the Wigner function given in Eq. (52). Similar to Eq. (46), the joint quadrature distribution can be written as \begin{equation} p^{\prime}(x_{1},x_{5}) = \frac{1}{2}\iint_{\mathbb{R}^{2}}(W_{\bar{\boldsymbol{{z}}}}^{(h)}(\boldsymbol{{z}}) +W_{-\bar{\boldsymbol{{z}}}}^{(h)}(\boldsymbol{{z}}))\,dx_{2}\,dx_{6}, \end{equation} (56) where \(W_{\bar{\boldsymbol{{z}}}}^{(h)}\) is given in Eq. (52) with \(N^{\prime}\) and \(\bar{\boldsymbol{{z}}}^{\prime}\) in Eqs. (50) and (51).

Given the absolute value of Bob's quadrature \(|x_{1}|\), the correlation between Bob and Eve can be characterized by a binary symmetric channel with error probability \begin{align} r^{\prime}(x_{1}) &= \frac{\displaystyle\int_{0}^{\infty} p^{\prime}(x_{1},x_{5})\,dx_{5}}{\displaystyle\int_{0}^{\infty} (p^{\prime}(x_{1},x_{5})+p^{\prime}(-x_{1},x_{5}))\,dx_{5}}\notag\\ &= \frac{\displaystyle\int_{0}^{\infty} p^{\prime}(x_{1},x_{5})\,dx_{5}}{\displaystyle\int_{-\infty}^{\infty} p^{\prime}(x_{1},x_{5})\,dx_{5}}. \end{align} (57) Therefore, the mutual information between Bob and Eve for Bob's outcome \(x =\pm x_{1}\) is \begin{equation} I_{\text{BE}}^{\prime}(x_{1}) = 1 - h (r^{\prime}(x_{1})), \end{equation} (58) where the binary entropy function \(h(x)\) is given in Eq. (33). The total mutual information between Alice and Bob with the postselection threshold \(\lambda>0\) is the average of \(I_{\text{BE}}^{\prime} (x_{1})\) over \(x_{1}\): \begin{equation} I_{\text{BE}}^{\prime} = \frac{1}{2}\int_{|x_{1}|\geq\lambda} dx_{1}\,p(x_{1})I_{\text{BE}}(x_{1}), \end{equation} (59) where \(p(x_{1})\) is given in Eq. (36).

For the DR schemes, the key rate is given by \begin{equation} R^{\text{(DR)}} = \begin{cases} I_{\text{AB}} - I_{\text{AE}} &\text{for Eve's homodyne}\\ I_{\text{AB}} - \tilde{I}_{\text{AE}} &\text{for Eve's heterodyne}\end{cases}, \end{equation} (60) where \(I_{\text{AB}}\) is the information quantity for Alice and Bob given in Eq. (35). Moreover, \(I_{\text{AE}}\) and \(\tilde{I}_{\text{AE}}\) are the mutual information between Alice and Eve given in Eqs. (39) and (55), respectively.

On the other hand, the key rate for the RR schemes is given by \begin{equation} R^{\text{(RR)}} = \begin{cases} I_{\text{AB}} - I_{\text{BE}} &\text{for Eve's homodyne}\\ I_{\text{AB}} - I_{\text{BE}}^{\prime} &\text{for Eve's heterodyne}\end{cases}, \end{equation} (61) where \(I_{\text{BE}}\) and \(I_{\text{BE}}^{\prime}\) are the mutual information between Bob and Eve given in Eq. (49) and Eq. (59), respectively.

Figure 4 shows key rates \(R^{\text{(DR)}}\) and \(R^{\text{(RR)}}\) for the photon number \(n= |\alpha |^{2} =1.0\) in the cases of both Eve's homodyne measurement and her heterodyne measurement with the perfect detector \((\eta_{2},\xi_{2}) =(1,0)\). We can see that the RR schemes typically give better key rates than the DR schemes. In particular, the key rates for the RR schemes are shown to be substantially higher than those for the DR schemes for \(l\geq 50\) km. In order to determine the key rates \(R^{\text{(DR)}}\) and \(R^{\text{(RR)}}\) numerically, we need to assign a couple of parameters. We set the error correction efficiency \(f =1.08\) in \(I_{\text{AB}}\) of Eq. (35), which is based on the working error correction scheme in Ref. 19. The threshold λ was determined to maximize the key rates for each scenario. This means that the regime to be integrated is \(\{x | I_{\text{AB}}(x)- I_{\text{AE}}(x)\geq 0 \}\) for the DR schemes, and \(\{x | I_{\text{AB}}(x)- I_{\text{BE}}(x)\geq 0 \}\) for the RR scheme, for instances. The transmission loss is set to \(\gamma_{1} = 0.2\) dB/km. The distance l in the unit of km is related to the transmittance as \(\eta_{1} = 10^{-\gamma_{1} l/10}\). In the case of the ideal detector, \((\eta_{2},\xi_{2})= (1,0)\), the total transmittance \(\eta_{\text{tot}}\) in Eq. (21) and the total excess noise \(\xi_{\text{tot}}\) in Eq. (22) are given by Eq. (24). As we have already mentioned, this corresponds to the conservative scenario in our setup in the sense that the actual loss and noise of the detector are utilized to increase Eve's signal. In principle, we can determine the channel's parameter and detector's parameter, independently, and the detector's side can be decoupled with Eve's strategy.

»View larger version

Figure 4. (Color online) Key rates \(R^{\text{(DR)}}\) in Eq. (60) and \(R^{\text{(RR)}}\) in Eq. (61) for the mean photon number \(n= |\alpha |^{2}=1.0\) are shown as functions of the transmission distance for the four different setups of Sects. 3.2, 3.3, 3.4, and 3.5. Squares represent the key rates for the reverse reconciliation (RR) scheme with Eve's Heterodyne measurement. Circles represent the key rates for the RR scheme with Eve's homodyne measurement. Triangles represent the key rates for the direct reconciliation (DR) scheme with Eve's heterodyne measurement. Diamonds represent the key rates for the DR scheme with Eve's homodyne measurement. The transmission loss is set to \(\gamma_{1} = 0.2\) dB/km. The distance l in the unit of km is related to the channel's transmittance \(\eta_{1}\) as \(\eta_{1} = 10^{-\gamma_{1} l/10}\). The other parameters are set to be \(\xi_{1}=0.001\), \(\eta_{2}=1\), \(\xi_{2}=0\), and \(f =1.08\). We can observe that the RR schemes typically give better key rates than the DR schemes for the transmission distance \(l\geq 50\) km.

As in the literature,^25,32,33) one can optimize the mean photon number \(n = |\alpha |^{2}\) so as to maximize the key rate for each distance. Figure 5 shows optimized key rates for the excess noise \(\xi_{1} =0.01\) and the optimal photon number for the four different scenarios. As an optimization, the key rates \(R^{\text{(DR)}}\) and \(R^{\text{(RR)}}\) are calculated by tweaking the mean photon number n by steps of 0.05 or 0.025 for a given set of transmission distances. Then, the maximum of the key rates and the optimal photon number are determined numerically. Figure 6 shows optimized key rates for the excess noise \(\xi_{1} =0.1\) and the optimal mean photon number for the four different scenarios. We can see that RR schemes are more stable under an increase in the excess noise and are thought to be valuable for long-distance QKD. In addition, Fig. 6(c) shows the mutual information between Alice and Eve with the mean photon number \(|\alpha |^{2}= 1.0\) and with a BER of 0.03 for the DR scheme, i.e., \(I_{\text{AE}}\) in Eq. (60).

»View larger version

Figure 5. (Color online) (a) The key rates \(R^{\text{(DR)}}\) in Eq. (60) and \(R^{\text{(RR)}}\) in Eq. (61) are maximized with regard to the mean photon number \(n = |\alpha |^{2}\) for each distance given that the excess noise is \(\xi_{1} =0.01\). (b) The optimal mean photon number that maximizes the key rates.

»View larger version

Figure 6. (Color online) (a) The key rates \(R^{\text{(DR)}}\) in Eq. (60) and \(R^{\text{(RR)}}\) in Eq. (61) are maximized with regards to the mean photon number \(n = |\alpha |^{2}\) for each distance given that the excess noise is \(\xi_{1} =0.1\). (b) The optimal mean photon number that maximizes the key rates. (c) The mutual information between Alice and Eve with the mean photon number \(|\alpha |^{2} =1.0\) and with the BER 0.03 for the DR scheme.

Thus far, we have assumed that Eve has lossless optical fibers and is able to replace the transmission channel so that she can obtain the portion of the signal corresponding to the net channel loss. Similar to the possible limitation that quantum memories are unavailable for Eve, it may be plausible to assume that Eve is unable to deploy a lossless fiber. In fact, if one has a lossless fiber, one can demonstrate a perfect quantum memory for light by using a lossless loop to store an optical signal. Suppose that Eve is unable to use a lossless fiber but she can use a good optical fiber, for instance, the transmission loss is \(\gamma_{2}=0.15\) dB/km.^34,35) For the transmission distance l, this implies the transmittance \(\eta_{s} = 10^{-\gamma_{2} l/10}\), and Eve can gain the portion \(P_{\text{Eve}}=10^{(\gamma_{2} -\gamma_{1})l/10}\) by using this fiber instead of the original fiber with transmission loss \(\gamma_{1}\). This situation can be described by inserting a pure loss channel with transmittance \(\eta_{s}\) between the channel and the detector in Fig. 1(a). This setup results in the following transformation: \begin{equation} (\eta_{1}, \xi_{1},\eta_{2}) \to (\eta_{1}/\eta_{s}, \xi_{1}/\eta_{s}, \eta_{s} \eta_{2}). \end{equation} (62) Note that the net transmittance \(\eta_{\text{tot}}\) and the net excess noise \(\xi_{\text{tot}}\) in Eqs. (21) and (22) are invariant under this transformation. Consequently, we can investigate the key rate taking Eve's practical fiber loss into account based on the replacement in Eq. (62).

Figure 7 shows key rates calculated for the excess noises \(\xi_{1} =\xi_{2}= 0.01\), a practical detector efficiency of \(\eta_{2} =\eta_{C}\eta_{\text{eff}}=0.7\), and \(\eta_{s} = 10^{-\gamma_{2} l/10}\) based on the transformation in Eq. (62). Compared with Fig. 5, the key rate for the DR schemes does not change significantly, although there is finite noise and loss at the detector.

»View larger version

Figure 7. (Color online) (a) The key rates \(R^{\text{(DR)}}\) and \(R^{\text{(RR)}}\) when Eve uses a practical fiber for her beamsplitting, where we set \(\xi_{1} =0.01\), \(\xi_{2} =0.01\), \(\eta_{2} = 0.7\), and \(\eta_{s} = 10^{-\gamma_{2} l/10}\) with the distance l in the unit of km and the transmission loss \(\gamma_{2} = 0.15\) dB/km [see Eq. (62)]. (b) The optimal mean photon number that maximizes the key rates.

Note that our key rates were determined by assuming a set of specific setups for Eve's attacks. This does not preclude the possibility that the key rates become substantially small when a different setup is assigned. The security for a general attack will be addressed elsewhere.^36,37)