Coherent State Quantum Key Distribution with Multi Letter Phase-Shift Keying

We present a protocol for quantum key distribution using discrete modulation of coherent states of light. Information is encoded in the variable phase of coherent states which can be chosen from a regular discrete set ranging from binary to continuous modulation, similar to phase-shift-keying in classical communication. Information is decoded by simultaneous homodyne measurement of both quadratures and requires no active choice of basis. The protocol utilizes either direct or reverse reconciliation, both with and without postselection. We analyze the security of the protocol and show how to enhance it by the optimal choice of all variable parameters of the quantum signal.


Introduction
Quantum key distribution (QKD) is a procedure of information exchange between two parties, the sender Alice and the receiver Bob, which allows to distribute absolutely secure data between them (Gisin et al. 2002, Dušek et al. 2006, Scarani et al. 2009). The distinctive part of QKD with respect to classical communication is the use of a quantum information channel, where the signal is protected from unauthorized duplication (Wooters & Zurek 1982, Dieks 1982, Bennett & Brassard 1984, Ekert 1991. Mathematically, the information signal can be described by discrete variables (DV) or by continuous variables (CV) (Cerf et al. 2007), although physically the signal can be of various kinds: single photons (Bennett & Brassard 1984), weak coherent pulses (Bennett 1992), squeezed states (Ralph 1999, Hillery 2000 and other systems where a signal possesses essentially quantum properties. A universal characteristic that can be compared for different QKD protocols (apart from their experimental realizations) is the secret key generation rate (shortly, key rate) -i.e. the average amount of secure information per elementary transmission (e.g. per light pulse). In order to transmit higher total amount of secure data one can increase the pulse repetition rate or increase the key rate. The first way is limited mainly by experimental techniques, while the second one is defined by mathematical properties of the given QKD protocol.
In the case of DV QKD, it has been shown that extensions of the standard four-letter BB84 protocol (Bennett & Brassard 1984) to higher number of letters in the alphabet can improve performance in terms of higher critical error rate or longer communication lines (Bruß 1998, Bechmann-Pasquinucci & Gisin 1999, Sych et al. 2004, Sych et al. 2005.
In the case of CV QKD, the first protocols were based on Gaussian alphabets consisting of either coherent or squeezed states. The common weak point of these protocols is high sensitivity to losses in the quantum communication channel, which initially was believed to lead to the so-called "3 dB loss limit": the key rate is equal to zero when channel losses are higher than 50%. After the invention of postselection (Silberhorn et al. 2002) and reverse reconciliation (Grosshans et al. 2003), this limit was overcome, and the key rate was substantially improved. Another interesting option for improving the key rate is to consider discrete alphabets (Namiki & Hirano 2003, Heid & Lütkenhaus 2006 instead of Gaussian ones. Protocols with Gaussian alphabets have an advantage of simpler security analysis, whilst the protocols based on discrete modulation are easier to realize in practice. In this work we address the question how one can further increase the key rate of CV QKD with discrete modulation by varying the geometry of the quantum alphabet. Having in mind the idea of improving the properties of DV QKD by use of more symmetric alphabets with higher number of letters (Sych et al. 2005), we present a new CV QKD protocol which generalizes previous ones with discrete modulation (Namiki & Hirano 2003, Lorenz et al. 2004, Heid & Lütkenhaus 2006. Namely, the protocol employs an alphabet with N coherent states |α k = ae i 2π N k which have relative phases 2π N k and a fixed amplitude a. In classical communication, this type of encoding is known as phase-shift-keying (PSK). We perform a security analysis of the proposed protocol for lossy but noiseless quantum channels, providing full optimization of all parameters of the protocol, and show how the number of letters affects the key rate.

Description of the protocol
An elementary information transmission in the multi letter PSK protocol is as follows: • The sender (Alice) chooses a random equiprobable number k = 1 . . . N and sends the respective coherent state |α k = ae i 2π N k . • The receiver (Bob) measures the state by splitting the signal at a 50/50 beam splitter and measuring two conjugate quadraturesx andp at the output ports by homodyning each signal -such a scheme is called heterodyne measurement (Lorenz et al. 2004, Weedbrook et al. 2004, where the two conjugate measurements can be separated in time or space. The results of the measurements are β x and β p , which we write as a pure coherent state |β = |β x + iβ p .
• Bob assigns a classical number l to the measured state |β by finding a state |α l which is the closest alphabet's state to the state |β : | α l | β | 2 = max n | α n | β | 2 . Generally speaking, this classical value l decoded by Bob can be different from the initial value k sent by Alice because of intrinsic quantum uncertainty even in the absence of eavesdropping or any channel noise.
The elementary information transmission from Alice to Bob can be schematically shown as a "k → l" channel: As long as the considered quantum alphabet has a regular 2π/N phase-shift symmetry, and all states have an equal probability to be sent, all channel inputs and outputs (1) are equiprobable. We note, that there is no active choice of measurement basis in our protocol, therefore there is no basis reconciliation needed. All transmissions contribute to the total secure key, and nothing is discarded unlike in previous protocols with discrete modulation and homodyne detection (Namiki & Hirano 2006).
After the measurement, Bob can (but not necessarily has to) use the postselection idea (Silberhorn et al. 2002), when he decides whether to keep the transmission depending on the value β. The elementary transmission (1), possibly followed by postselection, is repeated until Alice and Bob collect enough data to perform classical error correction and privacy amplification procedures (Gisin et al. 2002). The resulting data is a secret key.
The amplitude a and the number of letters N can be flexibly adjusted for a given information channel. The exact optimization for a given channel transmittance will be discussed later. These parameters are supposed to be publicly known, particularly by the potential eavesdropper. We note that the number of states can be arbitrary large. In the limit of infinity N → ∞ we have a continuous phase modulation. Thus our protocol can be viewed as a smooth transition between discrete (Namiki & Hirano 2003, Lorenz et al. 2004, Heid & Lütkenhaus 2006 and continuous (Silberhorn et al. 2002, Grosshans & Grangier 2002, Weedbrook et al. 2004) modulation of CV.

Security analysis
We investigate the security of our protocol assuming there is no excess noise in the quantum channel. In this case the best possible attack is the beam splitting attack (Heid & Lütkenhaus 2006). We allow Eve to have unlimited access to all the losses, as she could replace the real lossy information channel with an ideal lossless one.
The beam splitting transformation is |α k A → |β k B ⊗ |ǫ k E , where Alice's initial state |α k is split to Bob's state |β k and Eve's state |ǫ k : and η is the channel transmittance.
In this beam splitting scenario, Eve does not introduce any excess noise on Bob's side, whereas in any other better eavesdropping strategy Eve necessarily does. For example, if Eve would make an intercept-resend attack, then she adds at least one unit of shot noise. Afterwards, she can attenuate the signal, and the excess noise will be proportionally reduced. As a remark on the side, we see in this way, that the maximum tolerable excess noise cannot exceed that of the intercept-resend strategy, i.e. cannot be higher then channel transmittance η.
In real communication lines, such as optical fibres or free space, excess noise (typically, about 1% of shot noise (Lorenz et al. 2004, Lorenz et al. 2006, Elser et al. 2008) is introduced mainly by imperfections of the experimental setup, and there is almost no measurable excess noise due to the channel itself. If the absence of channel excess noise is experimentally verified, then the eavesdropping strategy based on beam splitting is the best possible attack, at least for the values of the channel transmittance η ≫ 0.01.

Information between Alice and Bob
The amount of classical mutual Shannon information I AB transmitted from Alice to Bob via the channel (1) is equal to the difference of a priori (before measurement) and a posteriori (after measurement) entropies (Shannon 1948). Before any measurement, all channel outcomes are equiprobable for Bob, so his a priori entropy H prior Bob is the unconditional "pure guess" entropy equal to log 2 N bit per transmission.
The conditional probability density to measure the state |β when a state |α k has been sent is p(β|k) ∼ | β k | β | 2 ∼ e −|β−β k | 2 . The total unconditional probability density to measure a state |β is p(β) = 1 N N k=1 p(β|k). Its normalization p(β)dβ = 1 also yields the normalization of p(β|k) = 1 π e −|β−β k | 2 . After the measurement of |β , the probability p l (β) that the state |α l was initially sent is As we discussed above, the measured state |β is decoded by Bob to a classical value l such that the state |α l is the closest alphabet's state to the measured state |β . Corresponding regions in the phase space are shown by different shades of grey in Fig. 1.
In the case when l = k the value (3) is the probability of decoding the correct result, otherwise (3) is the error probability of decoding a wrong result l = k. Bob's a posteriori entropy H post Bob is the Shannon entropy of the total probability distribution P (β) = {p 1 (β), p 2 (β), . . . , p N (β)} conditioned on the measured state |β : Finally, the amount of classical information transmitted from Alice to Bob via the channel (1): where I AB (β) = log 2 N + N k=1 p k (β) log 2 p k (β).

Eve's information
To calculate Eve's potential information we consider two strategies of classical communication between Alice and Bob during the post processing step: direct reconciliation and reverse reconciliation. In the first strategy Alice sends correcting information to Bob, and in the second one Bob sends it to Alice. We also assume, that after the beam splitting Eve is not restricted to any practical way of information extraction from this state, thus her potential knowledge is bounded by the Holevo information (Holevo 1973). In the general case, the Holevo information χ sets the upper bound on the information which can be transmitted by a state randomly chosen from a set of N statesρ k with a respective probability p k : where S(ρ) is the von Neumann entropy S(ρ) = −Trρ log 2ρ .

Direct reconciliation
In the direct reconciliation case, Eve has a state (2) conditioned only on Alice's sent state |α k . Eve's conditional state is pure, thus her information is equal to the von Neumann entropy I AE = S(ρ E ) of her unconditional k . To calculate S(ρ E ) we need to find the eigenvalues ofρ E . The rotational symmetry of the phase-shift alphabet allows us to write Eve's conditional states in an orthogonal basis {|m } as (Chefles & Barnett 1998): In the basis {|m } Eve's unconditional state takes the diagonal form: so Eve's information is equal to is the Shannon entropy (4) of the probability distribution C = {|c 1 | 2 , |c 2 | 2 , . . . , |c N | 2 }. The coefficients |c m | 2 are derived from a system of N linear equations enumerated by an index k = 1 . . . N: It has a formal analytical solution where the coefficients c m depend on the signal amplitude a and the channel transmittance η.

Reverse reconciliation
In the case of reverse reconciliation Eve has a state (2) conditioned on Bob's measured state |β . After classical communication Eve can possibly find out the amount of information (5) between Alice and Bob in each transmission, so we assume this value is publicly open. Additionally we assume that Bob announces the amplitude of the measured state, so Eve knows the measured state |β up to a cyclic phase shift 2π/N. We denote these possible states as β (l) . On her side, Eve has to distinguish between the statesρ After averaging, Eve's state is 1 N lρ (l) E =ρ E , so the left entropy term in (6) is the same as we calculated before for the case of direct reconciliation. Due to the 2π/N phase-shift symmetry of the alphabet, the averaging in the right entropy term in (6) is just equal to the entropy of any of the statesρ (l) E , let it be the first oneρ (1) E . Again, we can rewrite Eve's states |ǫ k in the orthogonal basis (7). Unfortunately, the stateρ (1) E in this basis takes a non-diagonal formρ We analytically calculate eigenvalues of this state for a given N, but the result is too large to be presented here. Finally, Eve's information is

Postselection
The key rate G, i.e. the amount of secret information per transmission (1), is equal to the difference between Bob's and Eve's informations (Devetak & Winter 2005, Renner 2007: where I AE and I BE refer to direct and reverse reconciliation respectively. In the case of direct reconciliation, Eve has to guess what was sent by Alice. If the channel transmittance is lower than 50%, Eve can potentially have a better signal than Bob, thus Eve's information can be higher than Bob's information and no secure communication is possible. To overcome this "3 dB limit" we use the postselection idea (Silberhorn et al. 2002), so that Bob has an information advantage over Eve (I AB > I AE ), i.e. we select only that part of transmissions which give us positive terms G(β).
The postselection procedure in the direct reconciliation scenario can be qualitatively described as follows: Eve's information I AE does not depend on Bob's measured state β, so the key rate can be increased if Bob accepts only those transmissions where β is such that he has higher information than Eve (I AB (β) > I AE ). Instead of integration over the whole phase space (11) we have integration over the postselected area (PSA): To find this PSA we numerically solve an equation I AB (β) > I AE . As an example in Fig. 1 we show the borders of the PSA for 5 letter protocol as the dashed lines. Different dashed lines correspond to different values of transmittance η = 0.4, 0.45, 0.5, . . . , 0.95, and the amplitude is fixed a = 1.4. The PSA is the phase space except the central region bounded by a dashed line. If the measured state |β lies inside the region the transmission should be omitted, otherwise it is accepted. The higher the transmittance, the smaller the omitted region, the bigger the PSA, and the higher the key rate (12).
To find the key rate G P S as a function of transmittance η we optimize the amplitude a such as to maximize the key rate G P S (η) = max a G P S (η, a). In the case of reverse reconciliation, Eve has to guess Bob's measurement result, thus her information cannot be higher than Bob's information: I AB ≥ I BE . Therefore, G(β) is always nonnegative, and the postselection procedure does not have to be applied.

Results
The calculated secret key rate G P S (η) and the optimal amplitude a 0 (η) for several alphabets are shown in Fig. 2 ‡. We can see, that for the channel transmittance η < 0.9 all the curves of the key rate are almost the same when the number of letters is more than 4.
In the case of reverse reconciliation we have an interesting result: the higher the number of letters, the higher the key rate. We don't have an analytical expression for the ∞-letter alphabet, but its approximation by a high number of letter confirms that this is the best choice for all values of η. The key rate is higher than for the 2-letter alphabet of almost an order of magnitude.
In the case of direct reconciliation, we can see that lines G(η) for various numbers of letters are intersecting in different points, which are presented in Table 1. This means that for different values of transmittance η there are different optimal numbers of letters. The higher the transmittance, the higher the optimal number of states.  (N, η) intersects with a curve G P S (N + 1, η). N 2 3 4 5 6 7 8 η 0.493 0.705 0.797 0.797 0.753 0.725 0.696 ‡ Discontinuity of the curve a 0 (η) for the 5-letter alphabet is not a mistake. Due to the fact that the function G(a) at a fixed value η can have two slightly different global maxima, the exact optimization for variable η may cause a "jump" from one maximum to another. Again, we don't have have an analytical expression for the curve G(N = ∞, η), but we found that left side of the curves quickly saturates (there is no essential difference between G(N = 5, η) and G(N = 64, η) for η < 0.9). So we can conjecture, that the optimal alphabets can consist of 2, 3, 4, or ∞ letters. A curve G(N = ∞, η) intersects with G(N = 4, η) at the value η ≃ 0.795, so the most significant advantage of the multi letter protocol over the two letter protocol one can get in the case of high transmittance. The intuitive explanation is as follows: In the case of high losses, Eve has a stronger signal than Bob. Thus the amplitude of the signal a 0 must be small, and Bob relies basically on the postselection. In postselection it is harder for Bob to distinguish between many letters than between two. Thus with an increasing number of letters his information essentially decreases. In this case the alphabet with two letters outperforms the multi letter alphabet.
In the opposite case of low losses Eve has a weaker signal, and Alice can increase the amplitude of the signal and number of letters. With higher amplitude of the signal Bob can better distinguish between many letters and increase his information. In the limit η → 1 Alice can use signals with high amplitude and Bob can get almost log 2 N bit per transmission. Therefore, the more letters in the alphabet are, the higher Bob's information is. In principle, one can use an arbitrary high number of letters, and in the limit N → ∞ (continuous phase modulation) Bob's information seems to be infinite. However, there are limiting factors from both experimental and theoretical viewpoints. First, as one can see in Fig. 2 the curves G(η) and a 0 (η) start to essentially increase from the values η > 0.99. In any real experimental setup there are imperfections (inaccuracy, losses, etc.), so the case η > 0.99 can hardly be achieved. Second, any real signal has certain energy limit, which sets maximum amplitude. Also taking into account excess noise in the channel might somewhat change the situation.

Conclusions
To summarize, we have presented a new CV QKD protocol with coherent states. The protocol employs multi letter phase-shift-keying and heterodyne measurement. Security analysis of the proposed protocol is performed for the case of lossy but noiseless quantum channels. We have shown that for each given channel transmittance one can find a certain optimal number of letters (2, 3, 4, or ∞), optimal amplitude of the signal (typically, 1 to 4 photons per pulse), and optimal postselection threshold, which increase the secret key rate about one order of magnitude comparing to the protocol with binary modulation.