Overcoming lossy channel bounds using a single quantum repeater node

Abstract

We propose a scheme for performing quantum key distribution (QKD) which has the potential to beat schemes based on the direct transmission of photons between the communicating parties. In our proposal, the communicating parties exchange photons with two quantum memories placed between them. This is a very simple quantum repeater scheme and can be implemented with currently available technology. Ideally, its secret key rate scales as the square root of the transmittivity of the optical channel, which is superior to QKD schemes based on direct transmission because key rates for the latter scale at best linearly with transmittivity. Taking into account various imperfections in each component of our setup, we present parameter regimes in which our protocol outperforms protocols based on direct transmission.

Appendices

Appendix 1: benchmark key rates

In this appendix, we give expressions for the secret key rates of benchmarks 2–5 in Sect. 3. For this purpose we model the observables in an experimental demonstration operating normally—that is, in the absence of eavesdropping activity.

For benchmarks 2, 3, and 5, Alice transmits single photons to Bob. In this case the efficient BB84 key rate per mode is lower bounded by [15, 17]

$$\begin{aligned} R = \frac{Y_1}{2} [1 - h(e_1) - f h(e_1)] \end{aligned}$$

(28)

where

$$\begin{aligned} \begin{aligned} \eta&:= \eta _{\text {tot}} e^{-L/L_{\text {att}}} \\ Y_1&:= 1-(1-\eta )(1-p_d)^2 \\ e_1 Y_1&:= Y_1/2 - (1/2 - e_m) \eta (1 - p_d). \end{aligned} \end{aligned}$$

(29)

Here $Y_1$ and $e_1$ are the yield and QBER for single photons, f is the error correction inefficiency, L is the length of the optical channel between Alice and Bob, and $e_m$ is the setup misalignment error probability. The other variables are as defined in Sect. 4. The factor of 1/2 comes from the fact that BB84 uses two optical modes.

For an ideal single-photon source (benchmark 3), $\eta _p = \eta _c = 1$. For an ideal detector setup (benchmark 2), $\eta _d = 1$ and $p_d = e_m = 0$. This amounts to setting $e_1 = 0$ and results in $R = e^{-L/L_{\text {att}}}/2 = \eta _{\text {ch}}/2$.

The key rate for decoy-state BB84 with a laser (benchmark 4) is [23]

$$\begin{aligned} R_{\text {decoy}} = \frac{1}{2}\big ( Q_1[1-h(e_1)] -f Q_\mu h(E_\mu ) \big ) \end{aligned}$$

(30)

where

$$\begin{aligned} \begin{aligned} Q_1&:= Y_1 \mu e^{-\mu } \\ Q_\mu&:= 1 - e^{-\eta \mu } (1-p_d)^2 \\ E_\mu Q_\mu&:= Q_\mu /2 - (1/2 - e_m)(1 - e^{-\eta \mu })(1 - p_d). \end{aligned} \end{aligned}$$

(31)

Here $\mu$ is the average photon number for signal states; $Y_1$, $e_1$, f, and $e_m$ are as defined above.

Appendix 2: approximation of crossover regions in $\eta _{\text {tot}}$-$T_2$ space

Throughout this appendix, we will assume that the QMs are loaded sequentially and that the central station is at L / 2. Let $R_b$ be the key rate for the benchmark whose crossover region we wish to approximate.

We will first derive (25). As outlined in the discussion leading up to that equation, our approach is to equate the intersection of the curves $R_0 e^{-L/(2 L_{\text {att}})}$ and $R_{b,0} e^{-L/L_{\text {att}}}$ with some characteristic dephasing length $L_{\text {dp}}$ in order to find the boundary of the crossover region. ($R_0$ and $R_{b,0}$ are the key rates at $L=0$ of our protocol and of the benchmark, respectively.)

The first step is to find conditions under which

$$\begin{aligned} R_0 \propto \eta _{\text {tot}} R_0^{\eta _{\text {tot}}=1}. \end{aligned}$$

(32)

If $p_d$ is small and $T_p \ll T_2$, then $e_X$ and $e_Z$ are approximately independent of $\eta _{\text {tot}}$—see (7) and (23)—and $R_0$ only depends on $\eta _{\text {tot}}$ through Y. If we further assume that $\eta '_A \approx \eta _A$, then

$$\begin{aligned} Y = p_{\text {BSM}} \frac{\eta _{\text {tot}} (2 - \eta _{\text {tot}})}{3 - 2 \eta _{\text {tot}}} \approx \frac{2}{3} p_{\text {BSM}} \eta _{\text {tot}}. \end{aligned}$$

(33)

to first order in $\eta _{\text {tot}}$. These conditions are therefore sufficient for the approximation in (32) to hold, with proportionality constant 2/3.

Given this fact, the intersection of the two curves is at

$$\begin{aligned} L_{\text {int}} = 2 L_{\text {att}} \ln \left( \frac{Q}{\eta _{\text {tot}}}\right) \end{aligned}$$

(34)

where Q is defined in (26). Note that $T_p \ll T_2$ implies that Q is independent of $T_2$.

We now derive a characteristic dephasing length by determining the distance at which Alice’s QM dephases for a significant fraction of $T_2$. (Recall that Alice’s QM always dephases longer than Bob’s.) That is, we put

$$\begin{aligned} \frac{T_2}{K} = \mathbb {E}(t_A^{\text {seq}}) = \frac{L_{\text {dp}}}{c} + \frac{T_p + L_{\text {dp}}/c}{\eta _{\text {tot}} e^{-L_{\text {dp}}/(2L_{\text {att}})}} \end{aligned}$$

(35)

where we have again used $\eta '_A \approx \eta _A$. The fitting parameter K determines the amount of time $T_2/K$ that the QMs can dephase for before dephasing errors become significant. It was found in Sect. 6.2 that $K = 14$ fits well.

Equation (35) cannot be solved for the dephasing length $L_{\text {dp}}$ using elementary functions, but this is unnecessary: to find the crossover boundary, we need only substitute $L_{\text {int}}$ for $L_{\text {dp}}$. After a minor rearrangement of terms, this yields (25).

It may appear that a small $p_d$ implies that $\eta '_A \approx \eta _A$. It is true that $p_d \ll 1$ implies $|\eta '_A - \eta _A| \ll 1$, but since $\eta _A \ll 1$ and $\eta _A' \ll 1$ in general, this is not strong enough to meaningfully say that $\eta '_A \approx \eta _A$. We require instead that $|\eta '_A - \eta _A|/\eta _A \ll 1$. Moreover, because we have used $\eta '_A \approx \eta _A$ in deriving (35), we require this to hold for all L up to $L_{\text {dp}}$—or, equivalently, up to $L_{\text {int}}$. By manipulating (13), we can write

$$\begin{aligned} \frac{|\eta '_A - \eta _A|}{\eta _A} = \left( \frac{1}{\eta _A} - 1 \right) (2p_d - p_d^2) \approx \left( \frac{1}{\eta _A} - 1 \right) p_d. \end{aligned}$$

(36)

If $\eta _A$ is close to 1, then $(1/\eta _A - 1) p_d$ is already small and the approximation holds. If $\eta _A \ll 1$, then $(1/\eta _A - 1)p_d \approx p_d/\eta _A$, which is small for all L up to $L_{\text {int}}$ when $p_d \ll \eta _{\text {tot}}^2/Q$. This condition, then, together with $T_p \ll T_2$, guarantees the validity of (25).

Let us now derive (27). This time, we will compare $L_{\text {int}}$ with a length $L_d$ at which errors due to dark counts become significant.

The error due to dark counts is related to $\alpha (\eta _A)$, defined in (13). We will put $1-\xi = \alpha (\eta _A)$ where $\xi$ is a parameter indicating the amount of error the system can tolerate due to dark counts. Rearranging this equation, we obtain

$$\begin{aligned} L_d = 2 L_{\text {att}} \ln \left( \frac{\eta _{\text {tot}} (1-p_d)(p_d+\xi -p_d\xi )}{p_d (2-p_d)(1-\xi )} \right) . \end{aligned}$$

(37)

By equating $L_d$ and $L_{\text {int}}$, we obtain (27).

In deriving this equation, we have made no assumptions beyond those required for (32). In particular, we do not require $\eta '_A \approx \eta _A$ for all L up to $L_{\text {int}}$, but only at $L = 0$. This means that the condition on $p_d$ is less strict: $p_d \ll \eta _{\text {tot}}$.

Finally, we note that the condition $p_d \ll \eta _{\text {tot}}^2/Q$, required for (25), can be obtained from a linearization of the square of (27).