Quantum Secrecy in Thermal States

We propose to perform quantum key distribution using quantum correlations occurring within thermal states produced by low power sources such as LED's. These correlations are exploited through the Hanbury Brown and Twiss effect. We build an optical central broadcast protocol using a superluminescent diode which allows switching between laser and thermal regimes, enabling us to provide experimental key rates in both regimes. We provide a theoretical analysis and show that quantum secrecy is possible, even in high noise situations.

where Y (t) is the radiation intensity. Radiation can then be characterised using g (2) as: antibunched (purely non classical) when g (2) (0) < 1, coherent when g (2) (0) = 1, and bunched when g (2) (0) > 1 [13]. We use this classification in order to experimentally verify that we are operating in the thermal regime, as can be seen later in Figure ??.
To exploit the correlations within bunched pairs requires the photon pairs to be separated and shared between two parties (e.g. Alice and Bob); this is done using the Hanbury Brown and Twiss (HBT) interferometer [14,15], designed in the 50's to remedy the shortcomings of amplitude interferometers, such as the Michelson interferometer [16,17], used in astronomy to determine the radius of stellar objects. The HBT's table-top set-up is simple: a source shines onto a beamsplitter, creating two arms, each shining onto a separate detector. The theory behind the observed interference effect has been studied by a number of authors, amongst the first Purcell [18] and Mandel [19,20], whose papers provide a nicely intuitive pre quantum optical description (see [21]) of the statistics.
Mandel's analysis relies on the fact that what we count are not the photons themselves, but the photoelectrons ejected by the detector. Fluctuations in that number have two origins: very fast fluctuations in the intensity of the incoming signal, and the stochasticity of the reaction of the photo-sensitive material to its interaction with the radiation field (namely the ejection of a photoelectron). However, the detector is also fundamentally limited by its reaction time (or bandwidth) and therefore, very fast fluctuations may occur undetected.
Yet, if these fluctuations are invisible, the correlations between them are not; in the original experiment and in current radio astronomy, the data used for calculations is often data which has been fed through a correlator (either hardware or software).
The production of photoelectrons is completely characterised by its average number n T and several experiments have been performed to estimate it, such as [22][23][24]. These photoncounting experiments highlight that the bandwidth of the detector relates to the coherence time τ c of the source, and that when the observation time T τ c , n T follows a Bose-Einstein distribution. This is in fact how thermal states are usually modelled in quantum optics, especially since this distribution naturally arises through the modelling of blackbody radiation. However, the distribution is also generally used without acknowledgments of its caveats. If the source's coherence time is suitably long (i.e. the source has a linewidth in the order of kHz), then a detector bandwidth in GHz will allow for the use of the Bose-Einstein distribution, and the resolving of thermal behaviour. However, if the laser linewidth approaches 1Hz, a GHz bandwidth is simply too wide to observe thermal behaviour; all the relevant correlations will be lost. Such a caveat was neglected in articles such as [25] and contributes to limited conclusions.
A natural objection to the use of thermal states for quantum cryptography is the lifetime of the correlations, perhaps in light of the fragility of entanglement. However, current common implementations include very large telescope arrays such as VLA, ATCA or soon the SKA; another famous usage is the observation of the cosmic microwave background.
Furthermore, the original HBT experiment was performed in the optical regime. In either regime, the correlations literally survive astronomical distances in free space. The use of thermal states therefore, naturally emerges as a potential partner to optical QKD techniques, especially with the rise of technologies such as WiFi and Bluetooth, which offer ever-increasing possibilities, such as through wall or medium range free space communications. Furthermore, we will show in the following, that in either the optical or the microwave regime, the protocol described below is quantum secure.
Next we describe the protocol we propose. We continue with a discussion of the eavesdropper (Eve), which will naturally lead us to analysing the security of the protocol and its theoretical modelling. As such, we show experimental results, as well as further theoretical discussions, including on the issue of detector noise.

PROTOCOL
We propose a central broadcast protocol, reminiscent of Maurer and Wolf's scenario 1 in [26], shown on Figure 1. It is described as follows : • Alice creates a beam from a trusted thermal source.
• They then use a trusted beamsplitter with transmittance η 1 to divert and detect part of the transmission and send the rest on to Bob (Eve).
• The bunched nature of a thermal source means that fluctuations present at Alice's detector are correlated with those at Bob's detector.
• These fluctuations can be sliced into bits any number of ways, but with no loss of generality, we assume here that a fluctuation above the signal mean is a 1 and one ) and polarising beam splitter (PBS) acts as a controllable beam splitter, allowing a controlled amount of light through. This first combination acts as η 1 , directing part of the beam to Alice, and the second combination acts as η 2 , directing a further part of the beam to Eve.
below the mean is a 0.
• In order to detect an eavesdropper, Alice sends small random chunks of data to Bob who performs a g (2) calculation to verify thermality.
• Alice and Bob now have a stream of independent and randomly correlated bits from which they can derive a key, the security of which they can improve with Cascade and Advantage Distillation, as per any QKD scheme.
This scheme was implemented as shown on Figure 2. In order to simulate high levels of noise, we consider an attenuator channel between η 2 and Bob, equivalent to adding a beamsplitter of transmittance η 4 between η 2 and Bob, with a input state of variance N at the second input arm.
Let us emphasise that this is not a prepare-and-send scheme, but instead relies on central broadcasting. This means that although we assume that Alice controls the source, they do not in fact, prepare their states.
Even if Eve interferes with the signal on its way to Bob via the most powerful attack available, we assume that she has no control over any part of Alice's apparatus, including the source, the beamsplitter (η 1 ) or the detector. Similarly, she has no control over Bob's detector.
The security of this protocol arises from the quantum correlations within the thermal fluctuations, those responsible for the Hanbury Brown and Twiss effect. Upon arrival at η 1 from the source, a bunched pair will either travel whole to Alice, travel whole onwards to face η 2 or split between Alice and η 2 . Any pair travelling onwards to η 2 (and then η 4 ) will suffer the same fate, but the pairs we can exploit are those splitting between Alice and either Bob or Eve. Using the quantum correlations within the pairs is what allows us to cascade the beamsplitters this way, however, at the cost of photons pairs, and so of correlations. For instance, when η 1 is at 50%, half the light goes to Alice, the rest is to be shared between Eve and Bob. If η 2 is also at 50%, only a quarter of the original source signal is available to Bob (provided full transmission at η 4 ).
To model our protocol, we must know how to model Eve and for that, we must understand what actions she can take. Alice controls everything, from the source to their detector, including η 1 . This means that the only place for Eve to "insert" herself is on Bob's branch of the distribution, much like on most current prepare-and-send QKD schemes.
By current standards, the most powerful attack at Eve's disposal is a collective Gaussian attack. This is typically modelled by Eve mixing one mode out of an EPR sate with Bob's signal and recording the outcome for measurement upon Alice and Bob's classical communication [27]. As such, it is the attack modelled in this paper.
However, it is doubtful that Eve can, in fact, obtain any relevant information in a central broadcast scheme (CBS). The reason for that lies in the physics of the correlations themselves.
One conceivable attack would be for Eve to measure the signal going to Bob and reproduce it. We rely on bunched pairs, correlated via second-order temporal coherence. Should Eve be able to measure and reproduce Bob's photons fast enough, what prevents her from escaping detection?
The operative words in that sentence are "fast enough". Eve cannot beat Heisenberg's uncertainty principle, which limits her ability to detect and recreate withing a specific time, which is the signal coherence time τ c . In the case of our experiment, τ c = 1µs. Correlations in bunched pairs exist only for detection during that time. Simply applying Heisenberg's uncertainty principle, setting ∆t = τ c /2, yields ∆E ≥ 6.6 · 10 −10 eV for a photon of energy E = 1.59eV . This is the maximum uncertainty which Eve is allowed for detecting and recreating the photon, to have a chance at fooling Alice and Bob by making Bob's detector click within the allotted time. This uncertainty does not of course, account for shot noise, and Eve can only allow for detection and/or preparation noise within the ∆E margin.
Vacuum energy here is E 0 = 1 2 c/λ ≈ 0.13eV ; this means that a single inescapable unit of shot noise is enough to push Eve past her limit. This is a very crude argument, but it demonstrates that a simple intercept-and-resend scenario is useless. Actually, as we have explained before, Eve gains very little in using even an entangling cloner, because of the probabilistic ways that the photon pairs will split at η 1 then at η 2 .

MODELLING
Thermal states are Gaussian states; these states can be easily defined and manipulated through their first and second moments [28,29]. The former are contained in the displacement vector r , wherer is the system's operator, and ρ the state's density operator. The second moments are contained in the covariance matrix γ defined as where we write the anti-commutator using {}.
A thermal state has covariance matrix γ in = 2(n + 1)I, wheren is the average photon number and I the identity matrix, and null displacement. We consider in the present work, a displaced thermal state, with covariance matrix as before, but with non-null displacement (it can also be construed as a noisy coherent state).
We use the Bose Einstein distribution acknowledging all the caveats highlighted in the introduction, and consider narrowband detectors measuring radiation at 30GHz and T = 300K, so thatn = 1309.
A beamsplitter is modelled as The input state at the first beamsplitter contains the thermal source and a vacuum state; it has covariance matrix and operator vector Since we give Eve an entangling cloner, she inputs one mode of her state at η 2 so the input state is of the form In fact, Eve's full input state can be written as with Z the Pauli-Z matrix. However, only one mode of the EPR mixes with the legal signal at η 2 . Since the rest of their state is unavailable to us, and of little practical value, we can trace it out for the sake of clarity. We can make further assumptions on Eve's state; she can be merely there and tap the channel, in which case, her inputs is one shot noise unit V e = 1SN U . If she inputs a state, the minimum variance she can get away with is V e = 2SN U , where 1SNU comes from her coherent state and the complementary 1SNU through shot noise.
We make the channel between η 2 and Bob a thermal noise channel by inputting a state of variance and the channel excess noise [29]. The input state at η 4 is where γ η 2 out is the state at the output of η 2 and N as defined previously. The output covariance matrix is where the sub-matrices of interest are The remaining block sub-matrices are given in the Appendix.
The secrecy will be witnessed using the secret key rate K We define the mutual information as where S(Γ) is the Von Neumann entropy. The Von Neumann entropy S(ρ) = −Tr (ρ log ρ), for a Gaussian state, is simply determined in terms of the symplectic eigenvalues x i of its covariance matrix Γ [29], as S The correlation in the pairs shared between Alice and Bob is described with the quantum where we estimate Γ e|x b as above, using the submatrices we have derived through our modelling.

RESULTS
The protocol was realised experimentally, using a tuneable laser consisting of a superluminescent diode and an external cavity. When run above the operating current, the laser emitted non-thermal coherent light, and when run below this operating current, it acted as a diode, producing thermal light. This effectively acts as a switch allowing the addition or removal of thermality in the source without altering any other part. We apply no modulation to the signal beyond that of the source. Just as shown on Figure 2, the source diode shines onto a variable beamsplitter. The various signals are detected by photodiodes and the signals then fed to an oscilloscope. The superluminescent diode has a typical lasing linewidth of 100kHz, the photodiodes' bandwidth is 100MHz and the oscilloscope's 150MHz.
This thermality is seen in Figures 3 and 4 where the second order correlations at each regime are shown. We can easily see that which we expected. Figure 4 shows that in the thermal regime, g (2) (0) > 1, which means that we are dealing with bunched radiation, fluctuations and as a result, correlations. Due to the relatively slow photodiode bandwidth in comparison to the linewidth of the laser, the second order correlations observed will be considerably less than 2. We calculate them to be of the order 1.0001 [31], which is in agreement with the experimental results. Furthermore, we see that since g (2) | coherent ≈ 1, there are no correlations in coherent light because there are no fluctuations, as we expect theoretically. Now that we have established that we have a thermal source, we shine it through two variable beamsplitters, the first dividing a portion to Alice, and the second splitting the remaining light between Eve and Bob.
We plot the secret key rate K  Eve gets more of the signal) but nonetheless, it remains positive, meaning that key exchange is always possible, albeit with reduced rate in the high loss regimes. Furthermore, unlike conventional continuous variable schemes, a central broadcast scheme has the advantage that it does not exhibit a sharp drop off, so a secret key can always be produced.
As seen on Figure 6, the secret key rate is always positive, and so we conclude that there FIG. 5: (Colour online) Experimental results : secret key rate for coherent states (left) versus thermal states (right). η 1 is controlled by Alice; when η 1 = 1, she has no signal and therefore, the key rate becomes negative. Similarly, as η 1 → 0, she gains the advantage over Bob and Eve. As expected, the most advantageous value is when η 1 = 0.5.
is always secrecy. It does, however, stagnate until η 2 approaches unity, i.e. until Eve lets most of the signal through. Key exchange is slow until Eve lets signal out; as a result, Eve is easily detectable. Let us recall also, that K(A : B||E) is a lower bound; we can therefore expect better key rates. The secret key rate improves if Eve inputs a coherent state V e = 2SN U , albeit marginally. This improvement is more pronounced if Eve inputs a thermal state V e = 5SN U .
A crossover is obvious on the figure; at η 2 = 30% (so actually fairly low), Alice and Bob lose out if Eve inputs anything. As η 2 increases, Bob gets more and more of the signal; as a result, Alice and Bob's mutual information increases, and as can be seen on Figure 8,  importance to us is that the discord is always positive. This means that the correlations between Alice and Bob are always quantum, and as a result, so is our security. As the transmittance η 2 increases, Eve gets less and less signal, so naturally, the discord increases.
When Eve's input is higher than 1SNU (so when she inputs a coherent state), the discord gets worse, but not significantly.  provide her with any more information, since it will not increase her correlation with either Alice nor Bob.
On Figure 8, we also explore briefly the influence of channel excess noise (dashed lines).
We note that χ(A : E) is not affected by ; since the thermal noise channel is that which separates Eve and Bob, Alice is not affected. This is not the case for I The full line shows the discord when the complementary input at η 2 is a vacuum state.
The dashed-dotted line shows the discord when Eve inputs a coherent state; the dashed line, when V e = 5SN U . As η 2 increases, so does the portion of the signal which goes to Bob and therefore, so does the discord. A non-vacuum complementary input at η 2 reduces the discord as it interferes with the correlated signal which Bob shares with Alice.
which are both reduced by the channel excess noise. However, that reduction is insufficient to cause the key rate great damage. It is reduced but not significantly enough to impede key distribution.

CONCLUDING REMARKS
The outcome of this analysis is that our scheme can always be considered quantum secure, since both the secret key rate and the discord are positive. Furthermore, we have shown that Eve's input is merely a disturbance, not only to the legal parties but most importantly to herself. This is simply a result of the physics; the thermal radiation is correlated and since Eve can only place herself after it has been split at η 1 (and therefore she has no access to Alice's information), she can gain little information. Eve's attack might be construed as a jamming attack; she is detected prior to reconciliation, can construct no key, but she can prevent Alice and Bob from building key.
Although we have included thermal channel noise, we have so far neglected the issue of preparation noise and of detector noise. We note that any preparation noise from the source is thermal, and so a part of the thermal state input at η 1 , therefore affects both Alice and Bob (and Eve).
Detector noise, on the other hand, affects Alice and Bob individually and independently.
Adding detector noise to Alice's and Bob's signal yields V a = V pure a +N a and We assume that Eve has no detector noise. and Bob from detecting their correlations, but will not increase the correlations between Alice (Bob) and Eve. Therefore, it reduces the secret key rate, but also the Holevo bounds χ(A : E) and χ(B : E), as illustrated on Figure 9. Although the key rate remains positive, detector noise is the greatest threat to it.
There remains to be had perhaps, a discussion about distance. This issue is a subtle one. Bunched pairs (and quantum correlations) survive astronomical distances; in fact, they only vanish upon measurement. However, the correlations themselves will disappear if the photons are detected outside the coherence time. This means that the distance between η 1 and either Alice or Bob itself is not important; however, the path from η 1 to Alice and from η 1 to Bob should be of more or less equal length, i.e within the coherence time of the source.
This of course, places restrictions on Eve's attack, such as we have already described.
A central broadcast scheme is attractive because the source need not be controlled to the extent of a point-to-point scheme, and two parties can negotiate a key based on their correlated local noise. This leads to a number of potential applications for key exchange in a microwave system, such as long distance satellite communications and for example, between mobile phones in a mobile network, mass synchronisation of secure keys within an office space connected to a WiFi node, or even key synchronisation between a mobile phone and an implanted medical device. On the output of η 2 , the submatrices are as follows