Gaussian Entanglement for Quantum Key Distribution from a Single-Mode Squeezing Source

We report the suitability of an Einstein-Podolsky-Rosen (EPR) entanglement source for gaussian continuous-variable quantum key distribution at 1550 nm. Our source is based on a single continuous-wave squeezed vacuum mode combined with a vacuum mode at a balanced beam splitter. Extending a recent security proof, we characterize the source by quantifying the extractable length of a composable secure key from a finite number of samples under the assumption of collective attacks. We show that distances in the order of 10 km are achievable with this source for a reasonable sample size despite the fact that the entanglement was generated including a vacuum mode. Our security analysis applies to all states having an asymmetry in the field quadrature variances, including those generated by superposition of two squeezed modes with different squeezing strengths.


Introduction
Quantum key distribution (QKD) enables two remote parties to generate a shared key which is guaranteed to be unknown to any potential eavesdropper. Discrete variable systems implementing, for example, the famous BB84 protocol [1] are well established [2] and commercial systems exist. Recently, also first commercial continuous variable (CV) systems have been launched in which the field quadratures of laser light are measured by homodyne detection. Compared to discrete variable systems, they have the advantage that for homodyne detection PIN photo diodes can be used which are well developed and widely used telecommunication components. They offer high bandwidth, low dark noise and high quantum efficiencies. Most of todays CV QKD systems use prepare-and-measure schemes employing coherent states with Gaussian or discrete modulation [3][4][5][6][7]. Prepare-and-measure schemes with squeezed states have been considered in [8,9]. The less common entanglement-based schemes do not need signal modulation [10], and instead exploit directly the correlations in the field quadratures of an Einstein-Podolsky-Rosen (EPR) entangled state. EPR entangled states are usually generated by interfering two squeezed beams at a beam splitter [11][12][13][14][15][16][17][18][19][20][21][22].
An implementation of a suitable source for a CV entanglement-based scheme was shown in [23] and a demonstration of a fully implemented table-top QKD system was given in [24]. In both cases the security analysis assumed an infinite number of measured samples which is experimentally unfeasible. Security proofs for CV systems including the effect of a finite number of samples were only recently published [25,26]. In [27] an experiment including finite-size effects was performed using Gaussian modulation and coherent states with a security analysis under the assumption of collective attacks. The first quantitative security analysis against coherent attacks, which also includes finite-size effects, was shown for a protocol using EPR entangled states [26].
In this paper, we characterize EPR entangled states generated by superimposing a squeezed vacuum mode with a vacuum mode at a balanced beam splitter in terms of extractable key length. Using only one squeezed mode instead of two minimizes the necessary resources and reduces the complexity of the setup. Our source is implemented at the telecommunication wavelength of 1550 nm to, in principle, allow for efficient coupling to existing telecommunication fiber networks. We calculate the extractable key rate as a function of measured samples for various communication distances through an optical fiber. We assume that the source is located in the lab of an honest party such that only one part of the beam is affected by transmission losses. The key rate is computed by applying the security proof for composable security under the assumption of collective attacks including finite-size effects given in [26] to states with asymmetric field quadrature variances. As asymmetries in the field quadrature variances are experimentally unavoidable even for entanglement generated by two squeezed modes, our analysis can also be applied to such states.
The paper is organized as follows, In section 2 we describe the protocol, give the security definitions and extend the proof given in [26] to asymmetric states. Section 3 is devoted to the details of the experimental setup. The main results are presented in section 4. The paper ends with the conclusions in section 5.

Security analysis
In this section we extend the security proof for composable security against collective Gaussian attacks including finite-size effects given in [26] toward two-mode squeezed states with an asymmetry of the noise distributions of the field quadratures. By superimposing a squeezed mode with a vacuum mode at a balanced beam splitter, the two output modes are still squeezed in one quadrature which we assume to be the amplitude quadrature X , and anti-squeezed in the orthogonal quadrature, the phase quadrature P.

Protocol
The protocol we use goes as follows: (i) Preparation and measurement. Alice prepares an entangled state with her EPR source, keeps one subsystem and sends the other to Bob. Both parties perform homodyne measurements in either the X or P quadrature which is individually chosen at random. An outcome of such a synchronous measurement is called a sample. This process is repeated until 2N samples were recorded, forming two strings x A and x B of length 2N . (ii) Sifting. In the second step Alice and Bob perform sifting, i.e. they communicate which quadrature they measured. Samples measured with a different choice of quadrature are discarded from x A and x B leaving Alice and Bob with strings x A and x B of length N in average. The discarded data are used for parameter estimation. (iii) Parameter estimation. In the third step Alice and Bob chose randomly a common subset of length k from x A and x B which they reveal. From these data and the data discarded by the sifting procedure, they reconstruct the covariance matrix. In particular, they estimate a confidence set C pe with the property that with probability 1 − pe the real covariance matrix lies within C pe . (iv) (Optional) Discarding X or P quadrature measurements. As the X and P quadrature measurements of Alice and Bob are correlated with different strengths due to the asymmetric nature of the bipartite entangled state, it might be beneficial to discard the measurements performed in the P quadrature from the raw key. To take into account all three possibilities, i.e. discarding X measurements, discarding P measurements and discarding nothing at all, we introduce a parameter p X which describes the probability of a sample being measured in the X quadrature. For taking both X and P quadrature measurements to generate a raw key p X ≈ 0.5 depending on the actual run. By discarding all X measurements p X = 0 and 1 for dicarding all P quadrature measurements. The number of samples left after this step is denoted by n. Each bin is assigned a unique bit combination so that after the conversion Alice and Bob both have a bit string representing their raw key. In practice, we always choose α such that for no sample the quadrature measurement exceeded α. In that sense, only δ is a free parameter in the protocol. (vi) Classical postprocessing. In the last step Alice and Bob perform error correction and privacy amplification to extract secure bits. We assume that they execute a reverse information reconciliation protocol (error correction) in which Bob only sends information to Alice and denote the number of bits revealed by Bob by EC . In the final privacy amplification step both parties apply two-universal hash functions to reduce the key length to bits, where is computed according to equation (3).

Security definitions
It is important to ensure that the key is secure in any further cryptographic sub-protocol like, for instance, the one-time pad to securely transmit messages between Alice and Bob. To guarantee this we use the composable security definitions from [28,29]. In the following, we denote by S A and S B the random variables associated with the final key of Alice and Bob at the very end of the protocol.

Robustness.
We call a protocol robust if it does not abort when no eavesdropper is present. This ensures that the protocol is not trivial.

Correctness. A protocol is c -correct if
c . If c 1, this implies that Alice's and Bob's key agree with high probability.

Secrecy.
Let ω S B E denote the classical-quantum state of Bob's final key S B and a possible eavesdropper E. Such a state can always be written as where p(s B ) is the probability distribution of the key. We then call a protocol s -secret if for any Here, · 1 is the trace norm, τ S B is the uniform distribution over S B , ω E is the reduced state of ω S B E and 1 − p pass is the probability that the protocol aborts.

Security.
A protocol is -secure if it is c -correct and s -secret with c + s . For a detailed discussion of the above security conditions we refer to [30].

Secure key rates
Let us consider the stage of the protocol before applying error correction and privacy amplification. We call the remaining n samples at this stage the raw keys and denote the corresponding random variables on Alice's and Bob's side by X n A and X n B . One can assume that X n A and X n B are obtained by performing n times a quadrature measurement where amplitude X is chosen with probability p X and phase P with p P = 1 − p X . Note that for the following security discussion p X can be arbitrarily chosen. Let in the following E n be the eavesdropper system which can be infinite dimensional and ω X n A X n B E n the corresponding classical-quantum state conditioned on the event that the protocol passes. It was shown in [31] that an c -correct and s -secret key of length [29] and generalized to infinite-dimensional systems in [31,32]. Hence, it remains to obtain a lower bound on H min (X n B |E n ) ω for any possible eavesdropping strategy.
Under the assumption of collective attacks, we can assume that the state ω X n A X n B E n has tensor product structure, i.e. ω X n The smooth min-entropy of a product state can then be approximated by the conditional von Neumann entropy H (X B |E) ω of ω X B E via the asymptotic equipartition property [32] where n has to be sufficiently large and In the next step, we use that the state ω X B E is of form are the states obtained when the honest parties are measuring amplitude or phase, respectively. The system denoted by θ is a classical register which is assigned to the eavesdropper and keeps track which measurements were performed by the honest parties. Using elementary properties of the von Neumann entropy, we can Combining this estimation of the smooth min-entropy with the assumption of Gaussian attacks, we can use the confidence set C pe to obtain a lower bound on the key length given by Here, the infimum is taken over all states compatible with covariance matrices γ within the confident set. For simplicity, we have chosen 1 = s /2 which can be justified by the fact that for large enough n the term in the logarithm can be neglected. Note further that due to the definition of C pe , the key length from equation (3) is now -secure with = pe + s + c .
The von Neumann entropy for both quadratures θ = X, P can now be computed under the non-restricting assumption that the eavesdropper holds the purification of Alice's and Bob's state, that is, we assume that ω γ AB E is the purification of the Gaussian state ω γ AB with covariance matrix γ . It then follows by applying the definition of the conditional von Neumann entropy As shown in [26,33,34] P}=0) is the post-measurement state at the eavesdropper's side when Bob measured X = 0 or P = 0. The bipartite covariance matrix is written in block form, i.e.
and M X = diag(1, 0) and M P = diag(0, 1) are the projectors to the X and P quadrature, respectively. MP denotes the Moore-Penrose inverse.
To compute , we have to estimate H max (X B ) which can be approximated by [32] H where ω X X B and ω P X B are the probability distributions of Bob's X and P quadrature measurements, respectively.
While in a practical experiment the number of bits EC can be directly measured for each run, we need to estimate the leakage term here. We assume the term to be [35] where β ∈ (0, 1) is the error correction efficiency and I (A, B) is the mutual information. In this paper we will assume an error correction efficiency of β = 0.9 [36]. With these results the secure key rate r = /n can be calculated by In the theoretical asymptotic limit for an infinite number of samples n → ∞ and perfect security → 0, the key rate r tends to Note that in the asymptotic limit the error correction protocol achieves the Shannen rate, and thus, one could set β = 1. However, since we only use the asymptotic limit to compare the key rate to the finite-size effects which are not connected to the efficiency of the error correction protocol, we treat β as a constant over all sample sizes.

Parameter estimation
To calculate the secure key rate we need to construct the confidence set C pe which is defined such that the covariance matrix describing the real state lies within C pe with probability 1 − pe . As our states are two-mode squeezed vacuum states, the first moment vanishes and the state is fully described by its covariance matrix. It is reconstructed during the parameter estimation step from the discarded samples and the revealed common subset of length k using a maximum likelihood estimator. The sample covariance matrix is then estimated bỹ where x µ i and x ν i are the samples measured simultaneously by Alice and Bob in µ and ν quadrature, respectively. n µν is the number of samples used for the covariance estimation which might in our case be different for different entries. The distribution of the sample covariance matrixγ is given by [37] nγ ∼ W 4 (γ , n − 1), where W 4 (γ , n − 1) is the Wishart distribution. Hence, the standard deviation for a single entry of the covariance matrix takes the form For a large enough number of samples the confidence set is then constructed by C pe = γ |γ µν − z pe σ µν γ µν γ µν + z pe σ µν , where z pe is chosen such that 1 − erf z pe √ 2 pe is fulfilled. Here, erf is the error function which is defined by

Experiment
A schematic view of the experiment is shown in figure 1. The EPR entanglement source was driven by a commercial 1 W 1550 nm fiber laser. Most of its power was frequency doubled in a quasi-phase-matched periodically poled potassium titanyl phosphate (PPKTP) crystal [38] and served as a pump for the squeezed-light source which consisted of a 1 × 2 × 9.3 mm 3 PPKTP crystal. One of the end faces of the squeezed-light source's crystal was curved with a radius of curvature of 12 mm and coated with a high-reflective coating for both the pump and the fundamental beam at 775 and 1550 nm, respectively. The other end face was flat and anti-reflective coated for both wavelengths. Together with a coupling mirror with a radius of curvature of 25 mm a hemilithic cavity was formed. The coupling mirror had a reflectivity of 90% for 1550 nm and a reflectivity of 20% for 775 nm. With a 23 mm air gap between The beam of a 1550 nm fiber laser (red) was frequency doubled (yellow) and used as a pump for the squeezedlight source. The squeezed beam was overlapped with a vacuum mode at a 50 : 50 beam splitter to produce a pair of EPR entangled beams. The field quadratures of both beams were measured by balanced homodyne detection to characterize the EPR source and to provide data points that can be used to extract a secret quantum key from simultaneous measurements of the amplitude or phase quadrature. AOM: acousto-optical modulator; PD: photo diode. the crystal and the coupling mirror the cavity had a finesse of 60 at 1550 nm, a free spectral range of 3.8 GHz and a full-width half-maximum linewidth of 63 MHz. The temperature of the PPKTP crystal was tuned to about 50 • C to achieve quasi-phase matching. A sub-milliwatt control beam that was coupled into the cavity through the high-reflective mirror was used to lock both the length of the cavity and the phase of the pump. The output of the squeezedlight source was split from the pump by a dichroic beam splitter and superimposed with a vacuum mode at a balanced beam splitter to produce a pair of EPR entangled beams. The field quadratures of these beams were measured by homodyne detection. For this each beam was overlapped with a strong local oscillator of about 10 mW at a balanced beam splitter with a visibility of about 99.5% and detected by a pair of custom-made PIN photo diodes with high quantum efficiency. By changing the relative phase between the local oscillator and the quantum field, the measured field quadrature could be chosen. Whereas for QKD Alice and Bob only have to randomly measure the amplitude and phase quadrature, also a linear combination of these is needed to reconstruct the full covariance matrix. Therefore, we implemented a single sideband technique to be able to lock both homodyne detectors independently to any quadrature angle. An 80 MHz frequency shifted beam, produced by an acousto-optical modulator, was coupled into the squeezing path through the dichroic beam splitter and was phase locked to the control beam leaking through it. The single sideband was detected by the homodyne detectors and demodulated at 80 MHz. By choosing the phase of the electronic oscillator used for the demodulation the homodyne detector could be set to measure any field quadrature angle.
The outputs of both homodyne detectors were recorded simultaneously by a data acquisition system for which they were demodulated with a double-balanced mixer at 8.3 MHz and lowpass filtered with an anti-aliasing filter with a passband of 40 kHz. The data were sampled with 14 bit resolution at a sampling rate of 500 kHz.

Experimental results
To characterize our EPR source we fully reconstructed the covariance matrix of the bipartite state. The full reconstruction of the covariance matrix followed a protocol described in [23], where the complete covariance matrix of a Gaussian state was measured for the first time. The protocol goes as follows: In our case we chose the 45 • angle for both parties.
Following the protocol above we recorded 5 × 10 6 samples for each quadrature combination using a pump power of 235 mW for the squeezed-light source which allowed the observation of 11.1 dB squeezing and 16.6 dB anti-squeezing. From these data, we reconstructed the covariance matrix which reads One can directly see certain properties of the state from the entries in the matrix. The values on the principal diagonal are the variances for the amplitude and phase quadrature measurements at Alice's and Bob's detector. The diagonal entries of the two blocks in the upper right and lower left give the strengths of the correlations in the amplitude quadrature and the anti-correlations in the phase quadrature, respectively, between both detectors. In a perfect orthogonal measurement, the remaining entries should turn out to be zero since they give the covariance between amplitude and phase quadratures. The small deviations from zero show that the measurements were not perfectly orthogonal but close. To verify that our source is indeed an EPR source we calculated the EPR-Reid covariance product [39] min g Var( which was 0.31 < 1 for our states setting a new benchmark with entanglement generated by a squeezed mode superimposed with a vacuum mode. In comparison with [20] this was achieved by reducing the optical loss and thus, by producing more squeezing. Furthermore, the excess noise which was present in [20] was reduced. Using the recorded data we analyzed the feasibility to use our state for QKD. For all calculations, we assumed the covariance matrix of equation (6) to be the reconstructed covariance matrix in the parameter estimation phase of the QKD protocol, regardless for how many samples the key rate was calculated. We then constructed the confidence set assuming k samples were used to estimate the correlation terms between Alice and Bob in the covariance matrix. All diagonal terms were assumed to be estimated by using the total of N samples measured in one quadrature by each party. For all of the following simulations, the number of samples k used for parameter estimation was optimized to yield a maximal secure key length. Figure 2(a) shows the calculated key rate for our state versus the total number of measured samples when omitting all samples measured in the P quadrature (anti-squeezed quadrature), i.e. p X = 1. The key rate is given in secure bits per measured sample, i.e. the total number of samples before sifting. The parameters used for the calculation were pe = c = s = 10 −16 and β = 0.9 for the efficiency of the error correction. α was chosen eight times the standard deviation of the quadrature given by the covariance matrix of equation (6). Each curve in the figure was calculated for a different number of bins which was taken as 2 n bits by choosing an appropriate δ. For n bits 6 the asymptotic maximum of the key rate is reached. For 10 9 samples, which is experimentally challenging but achievable [27], the key rate is already close to the maximum value of about 0.18 bits per sample and even for 10 8 samples it is not much lower. Figure 2(b) shows the same as figure 2(a) but with the samples from the X quadrature omitted, i.e. p X = 0. To reach the asymptotic value for the key rate n bits 8 is needed. In comparison to the key rate for only the X quadrature samples the asymptotic key rate is lower with about 0.08 bits per sample. Here, also about 10 9 samples are necessary to reach a value close to the maximum and also for 10 8 samples the key rate is with about 0.06 bits per sample not much lower.
In figure 2(c) samples from both X and P quadrature measurements were used to compute the secure key rate, i.e. p X = 0.5. For the calculation we used n bits = 6 for the X quadrature and n bits = 8 for the P quadrature. The key rate reaches 0.25 bits per sample for a large number of measured samples which is similar to but not quite the sum of the key rates achieved when omitting samples from one of the quadratures. This is due to the larger confidence set since less samples were used for its construction.
When sending Bob's part of the entangled state through an optical fiber the key rate versus the distance is shown in figure 3. We assumed a coupling efficiency of 95% into the optical fiber [40] and an optical loss of 0.2 dB km −1 . To maximize the achievable distance we omitted the samples from the P quadrature. Considering only samples from the P quadrature would yield a maximal distance of only about 2 km and considering both X and P quadrature measurements would yield about 8 km for an infinite number of samples. The parameters used for the calculation were chosen as for figure 2, in particular n bits = 6 and pe = 10 −16 . From the figure we read that the absolute maximal distance for our state is about 37.5 km. Taking a realistic number of samples [27] the reachable distance shrinks to about 9 km for 10 8 samples and about 18 km for 10 9 samples. These values are limited by the parameter estimation. Curves with a relaxed parameter estimation security parameter of pe = 10 −12 and 10 −10 are shown for 10 8 samples in the figure. For pe = 10 −10 [25] the distance increases to about 10.5 km. For the calculation we assumed that no excess noise is introduced by the fiber as stated in [41]. Excess noise introduced by the electronic dark noise of the homodyne detectors is instead already included in the reconstructed covariance matrix. As the error correction efficiency depends Includes both X and P quadrature measurements, i.e. p X = 0.5. n bits = 6 for the X quadrature and n bits = 8 for the P quadrature. The key rate is given as the number of secure bits per measured samples, i.e. before sifting. We assumed a coupling efficiency of 95% into the optical fiber and an optical loss of 0.2 dB km −1 . The curves are plotted for different numbers of measured samples 2N . The parameter estimation security was chosen pe = 10 −16 except for the dashed lines. Samples from the P quadrature were omitted since otherwise only short distances would be possible (see text).
on the given signal-to-noise ratio, the actually maximal achievable distance depends on the availability of efficient error correcting codes [27].

Conclusion
We have presented an analysis of a Gaussian entanglement source involving a squeezed mode and a vacuum mode regarding entanglement-based QKD under the assumption of collective attacks including finite-size effects. While in the present experiment the entanglement has been distributed on an optical table, coupling one part of the bipartite state into a standard optical telecommunication fiber and building Bob's detector remotely would allow for QKD in localarea networks. The local oscillator for Bob's homodyne detector could be served e.g. from an auxiliary laser at Bob's site which could be phase locked to the control beam accompanying the entangled state. This scheme also ensures that phase noise introduced by the fiber is not crucial below the unity-gain frequency of the phase-locked loop. Our analysis revealed that a distance of more than 10 km is possible with a reasonable but challenging number of measured samples of 10 9 even though a vacuum mode was included in the generation of the states.
The effective sampling rate without introducing any correlations between samples, was 25 kHz for the implemented data acquisition. Thus, measuring 10 8 samples would take about 66 min. Improving the data acquisition an effective measurement rate of about 1 MHz should be feasible with the setup, reducing the measurement time to about 2 min. The stability of our setup exceeded 15 min and was only limited by large drifts caused by thermal fluctuations of the environment which could not be compensated by the phase actuators. Hence, to be able to measure 10 9 samples, actuators with larger ranges might be necessary. As for achieving a large distance, only samples measured in the squeezed quadrature are used, a probability larger than 50% for measuring the squeezed quadrature compared to the anti-squeezed quadrature would decrease the necessary measurement time. Since a squeezing bandwidth of more than 100 MHz was already demonstrated [42], a QKD system involving a single squeezed-light source could achieve significant overall key rates.
Although the restriction to a single squeezed input mode, as presented here, reduces the complexity of the source, a full scheme with two squeezed fields superimposed at a balanced beam splitter will achieve higher key rates. For the full scheme the achievable distance for 10 9 samples would be about 28 km in comparison to about 17 km for a single squeezed-light source. While these values were calculated for an entangled state generated by two identical squeezed modes, our security analysis provided here also allows the use of states generated by squeezed modes with different squeezing strengths. Furthermore, the full scheme with two squeezed vacuum modes is a promising candidate for the first implementation ever of a CV QKD system which provides security under coherent attacks [26].