Decoy-state quantum key distribution with both source errors and statistical fluctuations

We show how to calculate the fraction of single photon counts of the 3-intensity decoy-state quantum cryptography faithfully with both statistical fluctuations and source errors. Our results only rely on the bound values of a few parameters of the states of pulses.


INTRODUCTION
Quantum key distribution (QKD)[1, 2, 3,4,5,6,7] has now been extensively studied both theoretically and experimentally. In practice, if one uses an imperfect single-photon source with a lossy channel, the security is undermined by the photon-number-splitting attack [8,9]. Fortunately, this can be managed by a number of methods [4,10,11,12,13,14,15,16,17,18,19,20]. In particular, the so called ILM-GLLP proof [4,5] has shown that if we know the upper bound of fraction of the multi-photon counts (or equivalently, the lower bound of single-photon counts) among all raw bits, we still have a way to distill the secure final key. Verifying such a bound is strongly non-trivial. The so called decoy-state method [10,11,12,13,14] is to find out such bounds, say, among all those clicks at Bob's side, at least how many of them are due to the single-photon pulses from Alice.
The main idea of the decoy-state method is to change intensities randomly among different values in sending out each pulses. Equivalently, we can regard pulses of different intensities as pulses from different sources. For example, in a 3-intensity protocol [12], Alice has three sources, source Y 0 (vacuum source) which is supposed to produce vacuum only, source Y (decoy source) which is supposed to only produce state ρ = J k=0 a k |k k| (1) only, and source Y ′ (signal source) which is supposed to only produce state where |k is the k−photon Fock state and a k ≥ 0, a ′ k ≥ 0 for all k, a k = a ′ k = 1. Here J can be either finite or infinite. Given a coherent-state source or a heralded single-photon source from the parametric down conversion, J = ∞.
The fundamental formula in the decoy-state method as first proposed by Hwang [11] is that the counting rates (yields) of pulses of the same photon-number states must be equal to each other even they are from different source, i.e.
where s k and s ′ k are counting rate of k−photon pulses from the decoy source and counting rate of k−photon pulses from the signal source, respectively. This is because of the obvious fact that those k−photon pulses from different sources are actually randomly mixed therefore they are random samples of each other, if sources Y 0 , Y, Y ′ are perfectly stable, i.e., they always produce a state precisely as the assumed one. Given Eq.(3), one can list simultaneous equations [12] for s k based Eqs.(1,2) and then find out the lower bound of s 1 (s ′ 1 ) which indicates the lower bound of single photon counts of the decoy source and signal source.
Given this, one can calculate the final key rate of each source, by the well known result of ILM-GLLP [4,5]. For example, the asymptotic final key rate for the signal source can be calculated by where t 1 , t are the QBER for single-photon counts of the signal source and the QBER for all counts of the signal pulses from the signal source. ∆ ′ 1 is the lower bound of the fraction of counts due to single photon pulses from the signal source. Moreover, the non-asymptotic unconditional secure key rate in a finite-size QKD is extensively studied recently, first in Ref. [4], and then further studied in [6,7].
Recently, a number of QKD experiments using the decoy-state method have been done [21,22,23,24,25]. However, the story is not completed here because the existing decoystate theory does not entirely cover the real experimental conditions in practice. No source in real-life can be perfectly stable. One important problem is the effect of source errors.
Suppose in a protocol Alice sends out M pulses one by one. The actually produced state at any time i can differ from the assumed state that she wants. We call this discrepancy source error. Say, at any time i, Alice wants to prepare a state for Bob, but the source actually prepares a slightly different statẽ in the Fock space. We shall call such f ki − f k source error, or state error, or parameter fluctuation. Most generally, the error, f ki − f k is not random for different i. In practice, one of the major cause of the source error is the intensity fluctuation. Therefore we often use the term intensity fluctuation for the source errors. But our result here is not limited to the intensity fluctuation only. Here we consider a more general case that the parameters in the state fluctuate. Therefore we shall still use the term source error in stead of intensity fluctuation.
If the source error is random, we can simply assume a perfectly stable source always emitting the averaged-state [14,26] of all pulses from a certain source. As shown in Ref. [26], we have to take a feed-forward control to each individual pulses in order to guarantee the randomness of source errors. If we use coherent light only, and if we have a stable two-value attenuator, we can use the method in Ref. [27] to manage any intensity fluctuations.
If we don't assume any conditions above, the issue need to be studied more carefully.
A very tricky point here is that the elementary assumption of Eq.(3) for the decoy-state method with stable sources is in general incorrect, if the state errors are not random. As we have shown explicitly [10,28], there are cases that Eve. may know the source errors and she can violate Eq.(3) by producing an instantaneous transmittance channel dependent on the errors. Therefore, we must seek a solution to the new problem.
Very recently [28], a general asymptotic theory for decoy-state QKD with source errors is presented. By the method [28], we don't have to change anything in the existing setup. The only thing we need is the bound values of a few parameters in the states from each source. However, that work has only presented the asymptotic result i.e., the effect of classical statistical fluctuation is not considered. Besides Ref. [28], the problem is also studied studied [29] asymptotically from another viewpoint for the Plug-and-Play protocol.
There [29], Alice receives a pulse, attenuates it and sends it out for Bob. Eve controls both the incident pulse and the outcome pulse. Alice's transmittance γ in doing attenuation can be either γ D or γ S , depending on whether she wants to prepare a decoy pulse or a signal pulse. Similar to Ref. [27], Ref. [29] also assumes that Alice can do the two-value attenuation exactly. The fundamental formula assumed there [29]is where Y D m,n (Y S m,n ) is the counting rate of a decoy(signal) pulse which contains m photons when flying into Alice lab and contains n photons when flying away from Alice's lab, after Alice's attenuation. As was pointed out by the authors of Ref. [29], the effects of the internal fluctuation of Alice's lab was not considered there and also the validity of elementary equation Y D m,n = Y S m,n is not studied [30]. Actually, as shown in the appendix of this work, the elementary equation does not always hold if there are fluctuations to Alice's attenuation.
Here in this paper, we study the effects of both source errors and classical statistical fluctuations. The existing works [28,29] have not included the effect of statistical fluctuations in calculating the final key rate, though the effect can be included in principle. Our earlier work assumes zero error for vacuum source Y 0 , here we shall assume errors in this source, besides errors in source Y and source Y ′ . Similar to the results in [28], the results presented here only need the bound values of a few parameters in the states of different sources.
In particular, in deriving the fraction of single-photon counts we don't use any unproven assumption and we don't need worry about the internal fluctuation of any Alice's device, since our method only needs the bound values of a few parameters in the source state. We don't need to presume any specific distribution for our states. In our study in this work, classical statistical fluctuation is considered by estimating the observed values from the asymptotic values with a fixed standard deviation. We shall start with a protocol with one-way quantum communication only. But as we point out in the end of this paper, our method obviously also applies to a Plug-and-Play protocol.
This paper is arranged as the following. After the introduction above, we present our method with some important mathematical relations section II. We then present our main results in section III: the asymptotic and non-asymptotic formula for the fraction of single photon counts of the 3-intensity protocol with errors in states of all 3 sources. Some remarks on the source errors are addressed in section IV. The paper is ended with a concluding remark.

II. OUR METHOD
We assume that Alice sends M pulses to Bob one by one in the protocol. Each pulse sent out by Alice is randomly chosen from one of the 3 sources Y 0 , Y, Y ′ with constant probability p 0 , p, p ′ , respectively. Each source has errors. Clearly, pM, p ′ M and p 0 M are just the number of the decoy pulses, the number of the signal pulses, and the number of pulses from the vacuum source, respectively. We assume we know the bounds of parameters in the states of each sources.
Our goal is to find out the lower bound of the fraction of counts caused by those singlephoton pulses for both the signal source and the decoy source. The following quantities are directly observed in the protocol therefore we regard them as known parameters: N d , the number of counts caused by the decoy source, N s , the number of counts caused by the signal source, and N 0 , the number of counts caused by the vacuum source, Y 0 . For our goal, we only need to formulate the number of counts caused by those single-photon pulses from each sources in terms of the known quantities N 0 , N d , N s and p 0 , p, p ′ and the bound values of those parameters of states in each sources.

A. Virtual protocol
For clarity, we first consider a virtual protocol; Suppose Alice will send M pulses to Bob in the whole protocol. At any time i (i ∈ [1, M]), each source produces a pulse. The states of the pulses from sources Y 0 , Y , Y ′ are a ki |k k| ; and (8) Here b 0i is a bit smaller than 1, and we assume b L 0 , lower bound of all b 0i is known in the protocol; ρ i and ρ ′ i are a bit different from ρ and ρ ′ of Eq.(1, 2), which are the assumed states in the perfect protocol where there is no source error. At any time i, only one pulse is selected and sent out for Bob. The probability of selecting the ith pulse source Y 0 , Y or Y ′ is constantly p 0 , p, and p ′ for any i. The un-selected two pulses at each time will be discarded. After Bob has completed all measurements to the incident pulses, Alice checks the record about which pulse is selected at each time, i.e., which time has used which source.
Obviously, Alice can decide which source to be used at each time in the very beginning. This is just then the real protocol of the decoy-state method.
As shown below, based on this virtual protocol, we can formulate the number of counts from each source and therefore find the lower bound of the number of single-photon counts.
The result also holds for the real protocol where Alice decides to use which sources at the ith time in the very beginning.
Definition 1. In the protocol, Alice sends Bob M pulses, one by one. In response to Alice, Bob observes his detector for M times. As Bob's ith observed result, Bob's detector can either click or not click. If the detector clicks in Bob's ith observation, then we say that "the ith pulse from Alice has caused a count". We disregard how the ith pulse may change after it is sent out. When we say that Alice's ith pulse has caused a count we only need Bob's detector clicks in Bob's ith observation.
Given the source state in Eqs. (8,9), any ith pulse sent out by Alice must be in a photonnumber state. To anyone outside Alice's lab, it looks as if that Alice only sends a photon number state at each single-shot: sometimes it's vacuum, sometimes it's a single-photon pulse, sometimes it is a k−photon pulse, and so on. We shall make use of this fact that any individual pulse is in one Fock state.
Definition 2. Set C and c k : Set C contains any pulse that has caused a count; set c k contains any k−photon pulse that has caused a count. Mathematically speaking, the sufficient and necessary condition for i ∈ C is that the ith pulse has caused a count. The sufficient and necessary condition for i ∈ c k is that the ith pulse contains k photons and it has caused a count. For instance, if the photon number states of the first 10 pulses from Alice are |0 , |0 , |1 , |2 , |0 , |1 , |3 , |2 , |1 , |0 , and the pulses of i = 2, 3, 5, 6, 9, 10 each has caused a count at Bob's side, then we have C = {i|i = 2, 3, 5, 6, 9, 10, · · ·}; c 0 = {i|i = 2, 5, 10, · · ·}; c 1 = {i|i = 3, 6, 9, · · ·}. (10) Clearly, C = c 0 ∪ c 1 ∪ c 2 · · ·, every pulse in set C has caused a count. Definition 3. We use superscripts U, L for the upper bound and lower bound of a certain parameter. In particular, given any k ≥ 0 in Eqs. (7,8,9), we denote x L k , x U k for the minimum value and maximum value of {x ki | i ∈ c k }; and x = b, a, a ′ . We assume these bound values are known in the protocol.

C. Some important relations and facts
If the ith pulse is an element of c k , the probability that it is from Y 0 , Y or Y ′ is We want to formulate the numbers of k-photon counts caused by each sources. Given the definition of the set c k , this is equivalent to ask how many of pules in set c k come from each sources. If the ith pulse contain k photons, it can come from any of the 3 sources, Y 0 , Y or Y ′ . According to Eqs. (7,8,9), if the ith pulse contains k-photons, the probability that it comes from source Y 0 is Or, equivalently, Given a finite number of pulses and counts, this equation should be replaced by the expectation-value equation as This is the expected number of counts caused by source Y 0 , since every pulse in {c k } has caused a count. Therefore we can formulate the expected value of the number of counts caused by source Y 0 by Here N 0 is the number of counts due to pulses from source Y 0 , N * 0 = p 0 i∈c 0 b 0i d 0i is the number of counts due to those vacuum pulses from source Y 0 . Similarly, if the ith pulse contains k photons, it has a probability P di|k = pa ki p 0 b ki +pa ki +p ′ a ′ ki to be from the decoy source, and a to be from the signal source. Therefore we have for the expected number of counts caused by those k-photon pulses from the decoy source, and for the expected number of counts caused by those k-photon pulses from the signal source.
Therefore, besides Eq.(13) we also have the following 2 equations for N d and N s as the expected values of the number of counts due to the decoy pulses and signal pulses: Here we have used Eqs. (15,16).
For simplicity, we define Recall Eqs. (16,15), n ′ 0s , n 0d are the expected number of pulses from the decoy source and signal source in set c 0 .
Based on the formulas and definitions above, we find the following important facts: Fact 1: This is directly deduced from Eqs. (15,16).
Proof: Obviously, On the other hand, since any b 0i ≤ 1, To lower bound D 0 , we only need upper bound p 0 which is equivalent to say We assume This condition can obviously hold if each pulses of source Y 0 is in an extremely weak coherent state. These conditions mean Therefore, based on Eq.(23,25) we have Combining fact 1 with Eq. (28), we obtain the following important formula This completes the proof of fact 2.
Fact 3: Proof: The startpoint of our proof is Eqs. (17,18) which can be rewritten into and According to the definition of Λ and Λ ′ , we also have and Further, we assume the important condition The first inequality above leads to as one may easily prove. With Eq.(34), Eq. (32) is converted to Given the Eqs.(31, 38), we can formulate D 1 : Since ξ 1 , ξ 2 , and ξ 3 are all non-negative, and a U 1 a ′L 2 − a ′L 1 a U 2 ≥ 0 by the second inequality of Eq.(36), we now have Here we have used Fact 1 for the bound values of n 0d , n ′ 0s . To minimize D 1 , we have replaced n 0d by its upper bound and n ′ 0s by its lower bound as given in Fact 1. This completes the proof of fact 3.

A. Asymptotic result
Given Fact 3, the minimum value of the number of counts caused by single-photon pulses from the signal-source (or the decoy-source) is simply Therefore, we can now bound the fraction of single photon counts among all counts caused by the signal source Here the range of D 0 is given by fact 2 in the earlier subsection. We don't have to replace D 0 by its largest possible value to obtain the smallest possible ∆ ′ 1 at this moment. Instead, we shall do numerical calculation by Eq.(4) with all possible values of D 0 in the range given by fact 2 and find the worst case result directly to the key rate. Define S ′ = Ns p ′ M as the counting rate of the signal source, S = N d pM as the counting rate of the decoy source, S 0 = N 0 p 0 M as the counting rate of source Y 0 , and M is the total number of pulses as defined earlier, we can write the right-hand-side of the inequality in term of counting rates: Similarly, we also have for the minimum value of fraction of single-photon counts for the decoy source. First, n ′ 1s L = p ′ a ′L 1 D 1 ≥ p ′ a ′L 1 D L 1 in the formulas is the lower bound of the expected number of single photon counts of the signal source, but we actually need the lower bound of n ′ 1s , the (deduced) observed value (i.e., the true value) of the number single photon counts of the signal source in a certain experiment. Of course, given the expectation value, n ′ 1s L , one can deduce the lower bound n ′L 1s of the experimental value n ′ 1s by classical statistics: To be sure that this bound is correct with a probability exponential close to 1, we need set δ 1 considerably large, e.g., Here 10 standard deviation is chosen simply for convenience rather than a exact cut off point.
As shown in Ref. [12], the probability that the statistical fluctuation exceeds this range is exponentially close to 0.
Second, in the right hand side of Eq. (30), there are many parameters of expectation values such as N d , N s , n 0d , n ′ 0s , which are not observed values in one specific experiment. We need to replace these parameters by the experimentally observed quantities to make the formula useful. Again, this can be done by using classical statistics. This is to say, we need consider the largest possible difference between the expectation values and the observed values due to the statistic fluctuations.
For clarity, we shall use ζ for the statistical expectation value of observableζ, and ζ for the true value or the observed value in the experiment. For example, we shall use n 1d for the expectation value of the number of counts at Bob's side due to the single-photon pulses from the decoy source at Alice's side. We shall also use the superscript U or L to indicate the maximum value or minimum value of certain variable. With the following condition, for any k, we can now start to derive our non-asymptotic result. By classical statistics we know that there exists a real number δ d satisfying with a probability exponentially close to 1 if we set This indicates that with a probability exponentially close to 1 that δ d is in the range given by Eq. (49). Also, there exists a real number δ 0 satisfying and |δ 0 | ≤ 10 √ N 0 .
In our problem, due to the constraint given in Eq.(47), the fluctuations of each variables are not independent. This can help us not to overestimate the effects of the fluctuations too much. Eq.(47) immediately leads to the following identity: This is to say, the total population in set C is fixed, but there could be fluctuation in the population distribution over sources Y 0 , Y, Y ′ . Eq.(52), together with Eq.(50) and Eq. (51) leads to We use This is the inequality for the experimental lower bound of the number of single-photon counts from decoy pulses, where However, we don't have use the largest possible value of D 0 , because we only need the worst-case result of the final key rate, rather than the worst-case result in each steps.
According to these we can lower bound the fraction of single-photon counts of the raw bits caused by signal pulses through equation: whereñ ′ 1s is defined in Eq.(54) and the ranges of related variables in Eq.(54) can be calculated by Eq. (55,50,51,53) and Fact 2, if conditions of Eq.(26,36) hold.
For coherent states, if the intensity is bounded by [µ L , µ U ] for the decoy pulses and [µ ′L , µ ′U ] for the signal pulses then with X = L, U and k = 1, 2 and Note that our result is not limited to a coherent state source. To calculate the unconditionally secure final key rate, one has to combine our result (eq.(56)) with the existing theory of finite-size QKD [4,6,7]. Here we make a loose treatment to show the effects of our Eq. final key is distilled from the remaining bits of signal pulses. The number of the remaining bits is not less thanñ ′ 1s /4 . We use t = t 0 (µ ′ ) for the bit-flip rate, and andñ ′ 1s is given by Eq.(54), t ′ 1 is We then put all possible values of D 0 into Eq.(4) according to Fact 2 and Eq.(51) for the worst-case result of key rate over D 0 .
The detailed experimental parameters can be founded in Ref. [22]. For completeness, we list the main parameters here in table II:

IV. SOME REMARKS ON THE SOURCE ERRORS
By the existing technology, one can indeed use whatever stabilizer to reduce the source errors considerably. Even with this fact, our theoretical results are still necessary: First, no technology can guarantee a perfectly stable source. It is also questionable whether any existing device has been proven to be able to reduce the source errors to a low level which  Ns whereÑ s is the number of raw bits of signal pulses after error test, n f is the number of final bits distilled from theseÑ s raw bits. R is the asymptotic key rate, R 1 , R 2 , R 3 are the non-asymptotic key rates with the intensity of each pulses in Y 0 being bounded by 0, 0.5%, 1%, respectively. The intensity fluctuations of any   From the results listed in table I, we find that the effects of source errors to the key rate is not significant (provided that the source error is not too large.) For example, in the asymptotic case (results in the first row), if the largest intensity fluctuation is controlled to be less than 0.5%, the key rate is decreased 17.28 Hz(the data in the last column of the first row ) to 16.26 Hz only(the data in the second column from the right of the first row). However, the statistical fluctuation decrease the key rate significantly, given the existing experiment [22]. If we strictly considered the finite-size effect [4,6,7], the key rate would be further decreased. To reduce the effects, one can increase the number of pulses in the set-up.
5.222 × 10 9 3.580% 9.098% 1.262 × 10 −4 4.611 × 10 −5 6.711 × 10 −6 0.5 0.4 0.1 is exponentially close to 0. If unconditional security is our goal in practice, we must show quantitatively the effects of any polynomially imperfections. For example, even we can control the intensity fluctuation to be less than 0.5%, we had better still consider the effects of intensity fluctuation quantitatively rather than simply trust that the effects are negligible by intuition. Otherwise, one may ask why the cut off point is 0.5% rather than 0.0001% or 25% ? The security is then standardless. If we disregard the effect of source errors, possibly we shall encounter the following ridiculous story: Set-up A produces a key rate of 1k/s with source errors of less than 0.5%, set-up B produces a key rate of 20k/s with source errors of 25% over the same distance. Do we have to believe that set-up B is better ? With our theoretical results, such type of issue is immediately resolved because we can calculate the net final key rate after considering the effects of source errors. Second, with our theoretical results, we don't have to blindly take too much costs in improving the source quality. For example, with our results we now know with strict proof that source intensity fluctuation less than 0.0001% is not so necessary, since it only improves the key rate negligibly, if we can already control the errors less than 0.5%. Finally, there are cases Eve. can indeed know the intensity errors [28]. As explicitly shown in [10,28], in such cases Eve. can then violates assume zero internal fluctuation of of Alice's attenuation as assumed by earlier works [27,29].
Obviously, our result here directly applies to the so called Plug-and-Play protocol first proposed by Gisin et al.. As pointed out in Ref [31,32], the so called Plug-and-Play protocol can be made secure if the attenuation factors can be accurately set [29,33]

VI. APPENDIX
Here we show that the elementary assumption Y D m,n = Y S m,n used in Ref. [29]is incorrect if the actively controlled attenuation factor is not stable. (Ref. [29] assumes a stable attenuation controlled actively.) For simplicity, we consider those pulses containing 10 photons when flying into Alice's lab and after Alice's attenuation, containing 1 photon when flying away from Alice's lab to Bob. Alice decides to randomly use her transmittance λ = λ D = 0.01 to produce a decoy pulse and λ = λ S = 0.05 to produce a signal pulse. However, due to whatever un-controlled cause, there are internal fluctuations of λ value at different times.
Consider the following specific case: to some blocks of pulses (we call these blocks strong blocks), to all decoy pulses and signal pulses, the real transmittance is a bit larger than λ, the value that Alice wants, while in some other blocks (we call weak blocks) the real transmittance is a bit smaller than λ. Suppose the number of pulses in the strong blocks and that in the weak blocks are equal. In the strong blocks, Alice's real transmittance for a decoy pulse or a signal pulse is λ D+ = 1.01λ D or λ S+ = 1.01λ D while in the weak blocks, Alice's real transmittance for a decoy pulse or a signal pulse is λ D− = 0.99λ D or λ S− = 0.99λ S . Suppose every block contains millions of pulses therefore Eve can know whether a block is a strong block or a weak block by observe the averaged intensity of pulses in the block. This is to say, Eve can treat different blocks differently. Eve produces a channel transmittance of η + to each pulses in the strong blocks and another transmittance η − to each pulses in weak pulses. Note that here Eve does not know which pulses are decoy pulses and which pulses are signal pulses. She treats all pulses in one block fixed way. Now we can directly calculate Y D 10,1 and Y S 10,1 : This counter example shows that in general the assumption Y D m,n = Y S m,n is incorrect if Alice's transmittance is not exactly controlled. We have demonstrated this fact with a pulse containing 10 photons, one can also consider a pulse containing 10 7 photons and shall find very similar result: Eve. can make Y D 10 7 ,1 significantly different from Y S 10 7 ,1 . This has clearly broken the elementary assumption used in [29]. Obviously, such a case is equivalent to say that the pulse intensity from Alice is inexact, this is just the case we have studied in [28].
As was clearly shown there and also in [10], Eve can produce different transmittance for the single-photon state from the decoy source and the signal source. If Alice can control the attenuation exactly, i.e., λ D , λ S , there exists more efficient way to manage the issue in the protocol of one-way quantum communication [27].