Quantum key distribution with triggering parametric down conversion sources

Parametric down-conversion (PDC) sources can be used for quantum key distribution (QKD). One can use a PDC source as a triggered single photon source. Recently, there are various practical proposals of the decoy state QKD with triggering PDC sources. In this paper, we generalize the passive decoy state idea, originally proposed by Mauerer and Silberhorn. The generalized passive decoy state idea can be applied to cases where either threshold detectors or photon number resolving detectors are used. The decoy state protocol proposed by Adachi, Yamamoto, Koashi and Imoto (AYKI) can be treated as a special case of the generalized passive decoy state method. By simulating a recent PDC experiment, we compare various practical decoy state protocols with the infinite decoy protocol and also compare the cases using threshold detectors and photon-number resolving detectors. Our simulation result shows that with the AYKI protocol, one can achieve a key generation rate that is close to the theoretical limit of infinite decoy protocol. Furthermore, our simulation result shows that a photon-number resolving detector appears to be not very useful for improving QKD performance in this case. Although our analysis is focused on the QKD with PDC sources, we emphasize that it can also be applied to other QKD setups with triggered single photon sources.


I. INTRODUCTION
Quantum key distribution (QKD) [1,2] allows two legitimate parties, Alice and Bob, to create a random secret key even when the channel is accessible to an eavesdropper, Eve. The security of QKD is built on the fundamental laws of physics in contrast to existing classical public key encryption schemes that are based on unproven computational assumptions.
Bennett and Brassard proposed a best-known protocol -BB84 [1]. Proving the security of QKD is a hard problem. Fortunately, this problem has been solved in the last decade, see for example, [3,4,5,6]. Many security proofs are based on the assumption of idealized QKD system components, such as a perfect single photon source and well-characterized detectors. In practice, inevitable device imperfections may compromise the security unless these imperfections are well investigated. Meanwhile, the security of QKD with realistic devices has been proven. See [7,8,9,10,11,12] for example.
In the original proposal of BB84 protocol, a single photon source is used. Unfortunately, single photon sources are still not commercially available with current technology. Alternatively, a weak coherent state is widely used as a photon source. We call this implementation coherent state QKD. Many coherent state QKD experiments have been done since the first QKD experiment [13].
Nevertheless, it has been proven unconditionally secure by Inamori, Lütkenhaus and Mayers [10]. This work is improved by Gottesman, Lo, Lütkenhaus, and Preskill (GLLP) [12], though the performance in terms of the achievable secure distance and the key rate is limited.
Decoy state method [16] has been proposed to improve the performance of the coherent state QKD. The security of QKD with decoy states has been proven [17,18,19]. The simulation result shows us that the coherent state QKD with decoy states is able to operate as good as QKD with perfect single photon sources in the sense that the key generation rates given by both setups depend linearly on the channel transmittance [19]. Afterwards, some practical decoy-state protocols with only one or two decoy states are proposed [20], see also [21,22,23]. The experimental demonstrations for decoy state method have been done recently [24,25,26,27,28,29].
The motivation of decoy states is to estimate the channel properties (e.g., transmittance and error proability) better. To do that, Alice uses extra states with different light intensities during key transmission. Then Alice and Bob can consider detection statistics from signal and decoy states separately, from which they can estimate the channel transmittance and error probability better. We call the situation when Alice actively prepare decoy states active decoy state method to differentiate from the passive decoy state method where Alice choose decoy and signal states by passive measurements. Details can be found in Section IV. We note that in coherent state QKD, one can only use active decoy state method.
Other than the decoy state method, we remark that there are other approaches to enhance the performance of the coherent state QKD, such as QKD with strong reference pulses [30,31] and differential-phase-shift QKD [32].
Besides a coherent state source, a parametric down-conversion (PDC) source can be used for QKD as well. There are two ways to use a PDC source for QKD. The first is to use it as a triggered (heralded) single photon source. Alice detects one of the two modes from a PDC source as a trigger [47] and actively encodes her qubit information into another mode. We call this implementation triggering PDC QKD. The second way is to use it as an entangled photon source for entanglement-based QKD protocols. See Ref. [33] and references cited therein. We call this implementation entanglement PDC QKD.
The triggering PDC QKD, similar to the coherent state QKD, suffers from PNS attacks.
By applying the GLLP security proof, one can find that the optimal average photon number µ is in the same order of overall transmittance η. Then the key generation rate will be on the order of η 2 . For a rigorous derivation, one can refer to Appendix A. Thus, the performance of the triggering PDC QKD is very limited.
Since decoy states idea can substantially enhance the performance of the coherent state QKD, a natural question will be: "can decoy states idea be applied to the triggering PDC QKD?" The answer is yes. One can apply the infinite decoy state idea [19] to the triggering PDC QKD. Not surprisingly, with decoy states, the key generation rate can be O(η), which is the same as the order achieved by a single-photon source. Therefore, we expect the decoy state QKD to become a standard technique not only in the coherent state QKD, but also in QKD with triggering PDC sources. The infinite decoy state protocol requires an infinite number of decoy states to be used, which is not practical. A few practical decoy proposals for triggering PDC requiring a finite number of decoy states have been proposed [34,35,36,37].
We are interested in comparing various protocols for the triggering PDC QKD. Among the practical decoy protocols for triggering PDC QKD, we find that the one proposed by Adachi, Yamamoto, Koashi and Imoto (AYKI) [35] is simple to implement. The AYKI protocol is conceptually similar to the one-decoy-state scheme [20]. In the AYKI protocol, Alice and Bob only need to consider the statistics of triggered and non-triggered detection events [48] separately, instead of preparing new signals for decoy states. We emphasize that the AYKI protocol is easy to implement since there is no need for a hardware change.
Other decoy state proposals for the triggering PDC QKD require hardware modifications.
For example, the one proposed by Mauerer and Silberhorn [34] requires photon-number resolving detectors, and the one proposed by Wang, Wang and Guo [36] requires Alice's pumping the laser source at various intensities.
We generalize the passive decoy state idea proposed by Mauerer and Silberhorn [34]. The main idea is that, Bob can group his detection events according to the public announcement of Alice's detection events. For example, when Alice uses a threshold detector, Bob can group his detection results according to whether Alice gets a detection or not. The generalized passive decoy state idea can be applied to both cases of using threshold detectors and photon-number resolving detectors. The AYKI protocol can be treated as a special case of the generalized passive decoy state protocol.
By simulating a recent PDC experiment [38], we compare one case with a perfect photonnumber resolving detector and four cases with threshold detectors: no decoy, infinite decoy, weak decoy and AYKI. Our simulation result shows that in a large parameter regime, the performance of AYKI protocol is close to that of the infinite decoy protocol and thus there is not much room left for improvement after the AYKI protocol has been implemented.
Also, the QKD performance of the case with the infinite decoy protocol using threshold detectors is close to the case using a perfect photon-number resolving detector. Thus, a photon-number resolving detector appears to be not very useful for triggering PDC QKD.
We emphasize that one advantage of passive decoy state method is that by passively choosing decoy and signal states, the possibility that Eve can distinguish decoy and signal states is reduced. On the other hand, in active (regular) decoy state experiments, it is more difficult to verify the assumption that Eve cannot distinguish decoy and signal states.
We note that the passive decoy state idea can be combined to the active decoy state idea.
In Ref. [37], the authors gave a special case of combining passive and active decoy state ideas. Note that for coherent state QKD, one can only use active decoy state methods.
Although our analysis is focussed on the QKD with PDC source, we emphasize that it can also be applied to QKD setups with other triggered single photon sources.
In Section II, we will review the experiment setup of the triggering PDC QKD. In Section III, we give a model for the triggering PDC QKD. In Section IV, we will study various post-processing schemes for the triggering PDC QKD. In Section V, we will compare various schemes of the triggering PDC QKD: non-decoy+threshold detectors, infinite de-coy+threshold detectors, AYKI and the case with a perfect photon-number resolving detector, by simulating a real PDC experiment. In Appendix A, we consider the optimal PDC source intensities for the triggering PDC QKD.
where h.c. means Hermitian conjugate and χ is a coupling constant which depends on the crystal nonlinearity and the amplitude of the pump beam. The operators a † , b † and a, b are the creation and annihilation operators of two modes with different polarizations.
Here we assume the state is single-mode. The expected photon pair number is given by µ = sinh 2 χ. The probability to get an n-photon-pair is Here we assume that the PDC source always sends out photon pairs. That is, the photon number of mode a and b are always the same.
There is a nonzero probability for the PDC source to emit more than one photon pairs in one pulse. Thus, Alice may send out multi photon states after she encodes basis and key information by her polarization controller (PC). This is the reason why the triggering PDC QKD suffers from PNS attacks.
Let us compare triggering PDC QKD and entanglement PDC QKD implementations.
For the setup of entanglement PDC QKD, one can refer to Ref. [33]. In the triggering PDC QKD Alice actively encodes the key information, while in the entanglement PDC QKD Alice measures the polarization of one mode of PDC source directly. The advantage of the triggering PDC QKD here is that it does not rely on the polarization correlations between two modes of the PDC source. It only requires photon-pair generation of the source, which means entanglement between photon pairs are not important for triggering PDC QKD.
However, in entanglement PDC QKD implementation, the entanglement between two modes has to be well maintained for QKD transmission. We notice that maintaining entanglement in real experiments is a highly non-trivial task [50].

III. MODEL
Lütkenhaus has already studied the model of triggering PDC QKD [8] with threshold detectors. His model is similar to the one of the coherent state QKD, except for a different photon number distribution. For the model of the coherent state QKD, one can refer to Ref. [8,20]. For the model of entanglement PDC QKD, one can refer to Ref. [33].

A. Photon number channel model
Here we will use the photon number channel model [19]: Alice and Bob have infinite number of channels. For channel i, Alice uses i-photon states (Fock states) to carry the qubit information, with i = 0, 1, 2 · · · . The ith channel corresponds to the case when Alice's photon source emits an i-photon state. Thus, the probability for Alice to use the ith channel is determined by the photon source. For example, in coherent state QKD, the probability for Alice using the different channels follows a Poisson distribution. For the details of the photon number channel model, one can refer to Ref. [20].
We define the yield Y i to be the probability for Bob to get a detection event conditioned on Alice using the ith channel. As discussed in Section II, we assume that Bob uses a threshold detector. The yield is given by where Y 0B is the background count rate of Bob's detection system, and η is the overall detection probability for Bob, which takes into account the channel transmission efficiency, the coupling efficiency, the detector efficiency and the other losses in Bob's box.
The error rate when Alice uses ith channel is given by where e 0 = 1/2 is the error rate of background counts, e d is the intrinsic detector error rate on Bob's side (e.g., due to misalignment) and Y i is given by Eq. (4). Here, we neglect the case where both background counts and true signal click since η and Y 0B are small. We remark that Eqs. (4) and (5) are true for both triggered and non-triggered cases.

B. On Alice's side
In the triggering PDC QKD, Alice may use either a threshold detector or a photonnumber resolving detector. Define an N-photon-resolving detector to be a detector that can tell 0, 1, · · · , N photons of incoming signal. For a threshold detector, we have N = 1, which can only tell there are photons presenting or not. Given an incoming i-photon state, the probability for Alice's detector to indicate a j-photon state is η j|i , with j=N j=0 η j|i = 1 for all i = 0, 1, · · · . In general, η j|i 's are real numbers in [0,1]. We define a j-photon trigger for the case that Alice's detector indicates a j-photon state.
For a triggered PDC photon source, as given in Eq. (2), the probability for Alice's detector to indicate a j-photon detection is With the assumption that the PDC source always emits photon pairs, the probability (gain) for Alice getting a j-photon detection and Bob getting a detection is where the yield Y i is given in Eq. (4). The quantum bit error rate (QBER) conditioned on Alice's j-photon detection, similar to Eq. (7), is given by where the error rate e i is given in Eq. (5).
One observation is that in the triggering PDC QKD setup, shown in FIG. 1, the quantities Y i and e i are independent of Alice's measurement outcome j. This is based on the singlemode PDC source assumption described in Eq. (1) in Section II. Therefore, in Section IV, we can apply the decoy state idea.

C. Threshold detector
Here we will discuss a special case that Alice uses a threshold detector. That is, where Y 0A and η A are the background count rate and the detector efficiency on Alice's side.
The approximation is due to the fact that normally we have η A ≫ Y 0A . That is, we neglect the background contributions on Alice's side.
According to Eqs. (7) and (8), without Eve's interference, the gains and QBER's of triggered (j = 1) and non-triggered (j = 0) detections are given by Without Eve's interference, the gains and error rates of the single photon state in two detections are given by where Y 1 and e 1 are given in Eq. (4) and (5), respectively.

D. Perfect photon-number resolving detector
Here we will discuss the case that Alice uses a perfect photon-number resolving detector, which can faithfully tell the number of photons in the incoming signal. That is, η j|i = δ ij .
Thus the gains and QBER's are given by, from Eqs. (7) and (8), from where one can directly infer the gains and error rates of i-photon state,

IV. POST-PROCESSING
In the following discussion, we will focus on BB84 protocol [1]. Due to PNS attacks [9,14,15], only vacuum states and single photon states are secure for BB84 protocol, which may not be true for other protocols, such as SARG04 [40].
Similar to the coherent state QKD, we can apply GLLP [12] security analysis to the triggering PDC QKD. First, Alice and Bob perform error correction, after which they will share an identical key. Then, they perform privacy amplification to different types of qubits separately. Since here we assume only vacuum states and single photon states are secure for BB84 protocol, the key generation rate is given by [19,41,42] R where q is the basis reconciliation factor (1/2 for the BB84 protocol due to the fact that half of the time Alice and Bob disagree with the bases, and if one uses the efficient BB84 protocol [43], q ≈ 1), the subscript µ denotes for the expected photon pair number, Q µ and E µ are the overall gain and QBER, Q 1 and e 1 are the gain and error rate of single photon states, Q 0 is the gain of vacuum states, f (x) is the bi-direction error correction efficiency (see, for example, [44]) as a function of the error rate (normally f (x) ≥ 1 with the Shannon is the binary entropy function.
All the classical data measured can be grouped according to Alice's detection events, j = 0, 1, · · · , N. Then we can apply the GLLP idea [12,45] to each group. The final key generation rate will be given by summing over contributions from all groups, In each case j, one can apply Eq. (23), where Q 0,j and Q 1,j are the first and second terms in the right hand side of Eq. (7). Here the error rate of single photon state e 1 is independent of j, see the observation in the end of Section III B. We note that the key generation rate from all j-photon trigger detections should be non-negative. If any of them contributes a negative key generation rate, we should assign 0 to it. In this case, Alice and Bob can just discard that type of detections. Based on this observation, we can further simplify Eq. (14). Given Alice detects more than one photons, the probability of emitting single photon state in Bob's arm is small [51]. As we mentioned in the beginning of this section, only single photon state can contribute positively to the final key rate. Thus we can focus on the case j = 0, 1.
where R 0 and R 1 are given in Eq. (15). Again, both R 0 and R 1 should be non-negative, otherwise should be assigned 0.
In Eq. (15), the gain Q µ,j and the QBER E µ,j , given in Eqs. (7) and (8), can be measured or tested from QKD experiments directly. In this section, we will discuss various ways to estimate Q 0,j , Q 1,j , and e 1 . We assume that the PDC photon source and detector characteristics are fixed and known to Alice. That is, µ, the photon number distribution in Eq. (3) and η A are fixed and known.

A. Non-decoy states with threshold detectors
Here we assume that Alice uses a threshold detector. Thus, Alice only has two measurement outcomes, j = 0, 1. One simple way to estimate Q 0,j , Q 1,j , and e 1 is by assuming that all losses and errors come from the single photon states. This is because Eve can in principle perform PNS attacks on the multi-photon states. The gain and error rate of the single photon states in triggered (j = 1) and non-triggered (j = 0) detections can be bounded by where η A is the efficiency of Alice's detector. The gain Q µ and the QBER E µ , given in Eqs. (7) and (8), can be measured or tested from QKD experiments directly. In the following simulations, we will use Eqs. (10). Since we assume all errors come from the single photon states, one should take the lower bound of the vacuum contribution to be Q 0,j = 0.

B. Infinite active decoy state with threshold detectors
To do privacy amplification, Alice and Bob need to bound Q 0,j , Q 1,j , and e 1 for Eq. (15).
From Eq. (7), we know that to bound Q 0,j and Q 1,j , Alice and Bob need to estimate Y 1 .
Decoy state method provide a good way to estimate Y 1 and e 1 [16,19]. The essential idea is that instead of considering each linear equation of Y 1 and e 1 in the form of Eqs. (7) and (8) separately, Alice and Bob consider all the linear equations simultaneously.
Let us imagine that Alice and Bob obtain an infinite number of linear equations in the form of Eqs. (7) and (8), e.g., they use an infinite number of intensities µ. In principle, Alice and Bob can solve the equations to get Y 1 and e 1 accurately. Mathematically, the problem is solvable. The intuition is that the contributions from higher order terms of Y i and e i decrease exponentially in Eqs. (7) and (8). For the case coherent state QKD, one or two decoy states are proven to be sufficient [20]. Shortly, we will see that one decoy state is sufficient for triggering PDC QKD.
We remark that the key underlying assumption of the decoy state method is [19] Y i (decoy) = Y i (signal) e i (decoy) = e i (signal).
In another word, Eve sets the same values of Y i and e i for decoy and signal states. This can be guaranteed by the assumption that Eve cannot distinguish decoy and signal states.
In Appendix A, we will show that the optimal µ for the infinite decoy state case is in the order of 1, µ = O(1), which yields final key rate R = O(η). On the other hand, the optimal µ for non-decoy case is µ = O(η), which yields final key rate R = O(η 2 ). Therefore, we expect the decoy state QKD to become a standard technique not only in the coherent state QKD, but also in QKD with triggering PDC sources.  (7) and (8) to estimate Y 1 and e 1 accurately. So they can calculate each Q 0,j , Q 1,j , and e 1 accurately. In the simulation, we will use Eqs. (10) and (11) directly.

C. Weak active decoy state with threshold detectors
Here we assume that Alice and Bob use threshold detectors and focus on triggered detection events. Alice uses another intensity ν, say by attenuating pumping laser, for the weak decoy state. Wang, Wang and Guo have proposed a practical decoy method for triggering PDC QKD [36], which is essentially applying vacuum+weak decoy state method [20].
Note that for triggered detection events, the vacuum contribution can be negligible since Bounds of Y 1 and e 1 are given by µ 2 (1 + ν) 3 × Q ν,1 − ν 2 (1 + µ) 3 × Q µ,1 in Eq. (7) and Eq. (8) where ν is the expected photon pair number of the weak decoy state and η A is the efficiency of Alice's threshold detector.
It is not hard to show that when ν → 0, Eq. (19) approaches the infinite case, Eqs. (10) and (11) 1. Alice uses a PDC source as her triggered photon source. She detects one of the modes from her PDC source as trigger and encode key information into another mode. Due to the detector Alice uses, she will get different trigger events: j = 0, 1, · · · . When she uses a threshold detector, she will only get j = 0, 1.

As usual BB84 protocol, Bob measures signals in two different bases. Alice and Bob
perform basis reconciliation.
3. Alice announces her trigger detection results for each pulse: j. Bob group his detection events by the information j. For each j, they calculate the gain Q µ,j and test the QBER E µ,j .
Mathematically, they will obtain a set of linear equations in the form of Eqs. (7) and (8). Notice that the setup parameters, µ and η j|i 's, are known to Alice and Bob. Thus, they can estimate Y 1 and e 1 by considering Eqs. (7) and (8).

Apply post-processing according to Eq. (16).
We remark that the scheme is called passive because Alice does not actively select decoy states. Instead, she determines the decoy states by measuring the trigger mode. Later, we will show that this is one advantage of using triggering PDC source for QKD. Actually, in this case, there is no strict definitions of decoy states and signal states. In the original decoy state method [20], decoy states are only used to estimate Y 1 and e 1 and the key is always generated from signal states [52]. In triggering PDC QKD case, both the triggered j = 0 and non-triggered j = 1 detection events may have positive contribution to the final key generation.

E. Passive decoy state with threshold detectors
Here we will review the decoy protocol proposed by Adachi, Yamamoto, Koashi and Imoto [35] as a special case of the passive decoy state protocol. The AYKI protocol is interesting in practice since it doesn't involve any hardware change to implement decoy state.
Both Alice and Bob use threshold detectors, thus they have two types of detection events, triggered (j = 1) and non-triggered (j = 0). Secure keys can be generated from both types of detection events. Following the passive decoy state method procedure described in the previous subsection, Alice and Bob can estimate Y 1 and e 1 by considering the statistics of triggered and non-triggered detection events together. This is conceptually similar to one decoy state idea [20].
By solving two linear equations of Eq. (7) with j = 0, 1, where Q 0,0 is the vacuum state contribution in non-triggered detection events. One need to minimize the key rate of Eq. (16) for Q 0,0 with the constraint of Eq. (8). We note that this result is essentially the Eq. (14) given in Ref. [35]. We can see that when η A is close to 1 or µ is small, after neglecting Q µ,0 (background counts), the lower bound Y L 1 is tight (approaches the real value of Y 1 , see Eq. (4)), By neglecting the vacuum state contribution for triggered detection events, Q 0,1 = 0, e 1 can be simply estimated by To get the lower bound of Y 1 in Eq. (20), one has to estimate the background contribution Q 0,0 as well. One simple bound of Q 0,0 is 0 ≤ Q 0,0 e 0 ≤ E µ,0 Q µ,0 from Eq. (8), where e 0 = 1/2.
We note that the key rate calculated by substituting Eqs. (20) and (22) into Eq. (16) is not optimal. To get a tighter key rate bound, one can numerically lower bound Eq. (16) directly given the measurement results, Eq. (11).

F. With a perfect photon-number resolving detector
Here we discuss a special case that Alice uses a perfect photon-number resolving detector, discussed in Section III D. Now that Alice knows the exact photon number of the source, Alice and Bob only need to focus the post-processing on the single photon state detection events. In this case, the BB84 protocol is implemented by single photon states only. Thus, they can directly apply Shor and Preskill's formula [5,33] Later from the simulation, shown in Fig. 2, we can see that a perfect photon-number resolving detector does not improve the QKD performance dramatically comparing to the threshold detector case.

G. A few remarks
From the analysis of optimal µ in Appendix A, one can see that the key rate for the case without decoy states quadratically depends on the channel loss, R = O(η 2 ), while for the case with decoy states, R = O(η). This result is consistent with prior work in comparing the cases of coherent state QKD with and without decoy states [19].
In the decoy state security proof [19], the key assumption is that the decoy state and signal state should satisfy Eq. (18). This is guaranteed by the assumption that Eve cannot distinguish decoy and signal states. However, in the active decoy state method, Alice may introduce side information that can distinguish decoy and signal states when she actively prepares decoy and signal states. For example, an attenuator on Alice's side, used to prepare different intensities for signal and decoy states, may introduce different frequency shifts for signal and decoy states [24]. In general, it is hard to verify the assumption that Eve cannot distinguish decoy and signal states in real active decoy state experiments.
In the passive decoy state scheme, decoy and signal states are passively determined by Alice's measurement outcome. Alice does not use an extra component (like in active decoy state method) to prepare decoy states. This reduces the possibility of side information leakage. By passively choosing decoy states, Alice prepares same states on Bob's arm [53].
In fact, Alice can measure trigger signals after Bob finishes his measurements. Thus, to Eve's point of view, the states transmitted through the channel is independent of Alice's measurement results (j). Therefore, in principle, Eve cannot distinguish the decoy and signal states in the passive decoy state QKD.
This is the main advantage to use passive decoy state methods. Note that for coherent state QKD, one can only use active decoy state idea.

V. SIMULATION
In this section, we will compare the passive decoy state with a perfect number resolving detector and four QKD implementations with threshold detectors: non-decoy, infinite decoy, weak active decoy and AYKI (passive decoy state).
We deduce experimental parameters from a recent PDC experiment [38], which are listed in TABLE I. In the following simulations, we will use q = 1/2 and f (E µ ) = 1.22 in Eq. (15).
We notice that with the slightly modified experiment setup, a coherent state QKD with decoy states has been implemented [38]. Thus, it is reasonable to use this experiment setup to simulate the five QKD implementations.
In the simulation, for fair comparison, we always assume Bob uses the same detection setup (with threshold detectors).

A. Without statistical fluctuations
In the first simulation, we consider the case that Alice and Bob performs an infinitely long QKD (no statistical fluctuations). In this case the weak active decoy state protocol 249MHz 710 nm 14.5% 14.5% 1.5% 6.024 × 10 −6  [38]. Here η A and η Bob are the detection efficiencies in Alice and Bob's detection system, not including the optical channel loss. e d is the intrinsic detector error rate. Y 0B is the background count rate of Bob's detection system (for example, if Bob has two detectors, then Y 0B will be the sum of two detectors' background count rates). The transmission efficiency η in Eq. (4) is given by η Bob plus the channel loss.
will approach the infinite decoy case [20]. We assume that Alice is able to adjust µ   Table I. From FIG. 2, we have the following remarks.
1. In Appendix A, instead of numerically optimizing µ as done for Fig. (2), we qualitatively investigate the optimal µ for triggering PDC QKD with and without decoy states. The simulation result is consistent with the qualitative conclusion R = O(η) for the case with decoy state and R = O(η 2 ) for the case without decoy state.
2. The space between the solid line and dashed line in FIG. 2 indicates the room left for improvement by other decoy protocols with threshold detectors after AYKI protocol is implemented. We can see that, in a large optical link loss regime, the performances of AYKI and the infinite decoy are close. For instance, the AYKI protocol yields around 50% of the key rate of the infinite decoy state protocol when the channel loss is within 20dB.
3. By comparing AYKI and the case with a perfect photon-number resolving detector, we can see that even with a perfect photon-number resolving detector on Alice's side, the key rate is not improved dramatically in a large optical loss regime.
4. The non-decoy protocol is better than AYKI in the regime close to maximal secure distances. This is because we use the bounds of Eqs. (20) and (22) for AYKI curve.
In reality, Alice and Bob can use the bound of Eq. (17) directly in this regime.
5. There is a bump in each curve. This is due to the fact that in the key generation rate formula Eq. (16), the non-triggered detection events have no contribution to the final secure key after the bump. 7. At the point of loss=0 dB, the numerical results for optimal µ for four cases (from top to bottom) are: 1, 0.52, 0.194, 0.0589. The optimal µ for the case with a perfect threshold detector is always 1, which is reasonable since µ = 1 maximizes the single photon state probability. In Appendix A, we show that the optimal µ's for the infinite decoy and AYKI case are relatively stable in a large optical loss regime. The optimal µ for the no decoy state case decreases with channel loss. 8. We remark that the real µ used in the experiment [38] is µ = 0.0265. In general, it is experimentally hard to increase the brightness (µ) of a PDC source. 9. All of the four cases can tolerate similar optical losses.

B. With statistical fluctuations
In a real experiment, the key length is always finite. Alice and Bob should consider statistical fluctuations. As pointed in Ref. [20], statistical fluctuation analysis is a complicated problem in decoy state QKD.
Similar to the analysis in Ref. [20], we assume a few conditions: 1. Alice knows the exact value of average photon pair number µ, which is a fixed number during key transmission.

Assume the QKD transmission is part of an infinite length experiment.
Here we focus on the three cases with threshold detectors: infinite decoy, weak decoy and AYKI. We assume that the data size is 6 ×  Simulation parameters are listed in Table I. The data size is 6 × 10 9 pumping laser pulses on Alice's side.
In Section IV G, we pointed out that from a practical security point of view, the passive decoy state method has an advantage over active decoy state methods. Also, AYKI method does not require any additional hardware change to implement decoy state, while in the weak decoy state case, Alice needs to add an attenuator to create decoy states. Now, from the simulation result, we can see that AYKI and weak active decoy state method yields similar QKD performance. Thus, our conclusion is that one should just use AYKI method instead of the weak decoy state method.

VI. CONCLUSION
By investigating the optimal photon source intensity, we find that the triggering PDC QKD setup with decoy states is able to achieve a key rate that linearly depends on the channel transmittance, comparing to the quadratic dependence for the case without decoy states. Therefore, we expect the decoy state QKD to become a standard technique not only in the coherent state QKD, but also in QKD with triggering PDC sources.
On the practical side, we generalize the passive decoy state idea. The generalized passive decoy state idea can be applied to cases where either threshold detectors or photon number resolving detectors are used. The decoy protocol proposed by Adachi, Yamamoto, Koashi and Imoto (AYKI) can be treated as a special case of the generalized passive decoy state method. Comparing to the active (regular) decoy state methods, the passive one opens less possibility for Eve to distinguish decoy and signal states, which is a key underlying assumption in the security proof of decoy state QKD. From this sense, the passive decoy state method is more secure than the active decoy state methods in practice.
By simulating a recent PDC experiment, we compare various practical decoy state protocols with the infinite decoy protocol. We also compare the cases using threshold detectors and photon-number resolving detectors. Our simulation result shows that with the AYKI protocol, one can achieve a key generation rate that is close to the theoretical limit of infinite decoy protocol. Furthermore, our simulation result suggests that a photon-number resolving detector has little room to improve the QKD performance, comparing to the case using threshold detectors.
We also consider the statistical fluctuations. We compare infinite decoy protocol, weak active decoy state method and AYKI protocol. The simulation result shows that the weak active decoy state method and AYKI protocol yield very close QKD performance. In a large optical loss regime, the AYKI protocol can achieve a performance that is close to the infinite decoy case. Since the AYKI protocol requires no hardware changes for triggering PDC QKD, we conclude that AYKI method is a good protocol for triggering PDC QKD experiments.
Although our analysis is focused on the QKD with PDC sources, we emphasize that it can also be applied to other QKD setups with triggered single photon sources. The optimal µ for the coherent state QKD with and without decoy states has already been studied [20]. Here instead of numerically optimizing µ as done for Fig. (2), we qualitatively investigate the optimal µ for the triggering PDC QKD with and without decoy states. Here we are interested in the case that Alice uses a threshold detector.

Without decoy states
Let us begin with the optimal µ of the case without decoy states. Here we will apply GLLP [12] security analysis. As shown in Ref. [46], GLLP and Lütkenhaus's [8] security analyses achieve similar performances for the coherent state QKD. Intuitively, we should get a similar optimal µ as given in Ref. [8], µ ≈ η/2. From Eq. (10), we can see that the gain Q µ,j (j = 0, 1) is in the order of µη. To keep Q 1,0 or Q 1,1 in Eq. (17) positive, µ should be in the order of η. By assuming µ, η and Y 0B are small, we can simplify Eq. (10) where Q L 1,0 + Q L 1,1 is the lower bound of Q 1,0 + Q 1,1 and e U 1 is the upper bound of e 1 from Eq. (17). Since the error rates from triggered (j = 1) and non-triggered (j = 0) detection events are the same, the key generation rate given by Eq. (23) can be simplified to By taking derivative of R, the optimal µ ≡ xη satisfies Here if set e d = 0, then we get x = 1/2 which is compatible with Lükenthaus' result [8]. We note that x = 1/2 essentially maximize the probability of single photon source Q L 1,0 + Q L From FIG. 4, we can see that the optimal µ for triggering PDC+non-decoy is µ = O(η), which will lead the final key generation rate R = O(η 2 ).

With decoy states
With decoy states, Alice and Bob can estimate Q 1 and e 1 better. Here we consider the infinite decoy state case with threshold detectors. Under the assumption that η and Y 0B are small, we can simplify Eqs. (10) and (11), With these approximations, the key generation rate given in Eq.   [20], one can see that the optimal µ is independent of channel loss η for the infinite decoy state case with threshold detectors, i.e., µ = O(1), which will lead the final key generation rate R = O(η).

Numerical checking
Now we would like to numerically compare the optimal µ with and without decoy states by simulating a recent PDC experiment [38], with parameters listed in Table I. In the simulation, we numerically optimize µ for the key rate given by Eq. (16) for the non-decoy and infinite decoy methods. For this particular setup, the optimal µ is shown in Figure 6.  Table I.
From the figure we can see that the optimal µ for the non-decoy case is in the order of η, while the optimal µ for the infinite-decoy case is in the order of 1. This is consistent with