Implementation of continuous-variable quantum key distribution with discrete modulation

We have developed a continuous-variable quantum key distribution (CV-QKD) system that employs discrete quadrature-amplitude modulation and homodyne detection of coherent states of light. We experimentally demonstrated automated secure key generation with a rate of 50 kbps when a quantum channel is a 10 km optical fibre. The CV-QKD system utilises a four-state and post-selection protocol and generates a secure key against the entangling cloner attack. We used a pulsed light source of 1550 nm wavelength with a repetition rate of 10 MHz. A commercially available balanced receiver is used to realise shot-noise-limited pulsed homodyne detection. We used a non-binary LDPC code for error correction (reverse reconciliation) and the Toeplitz matrix multiplication for privacy amplification. A graphical processing unit card is used to accelerate the software-based post-processing.


Introduction
Quantum key distribution (QKD) offers secure communication based on the fundamental laws of quantum physics [1]. In contrast to public key cryptography that is currently in wide-spread use and whose security relies on the computational difficulty of solving a mathematical problem [2], the security of QKD can be guaranteed even if an eavesdropper has an infinite computational power [3]. QKD enables two parties, usually called Alice and Bob, to share a secret key that is unknown to third parties by sending quantum states from Alice to Bob [4].
Continuous-variable (CV) QKD is different from the standard QKD system in the method for detecting weak optical signals [5][6][7][8][9][10][11]. This feature gives an advantage to CV-QKD in terms of practical implementation. In the standard QKD system, weak light is detected by a single photon detector that measures the particle nature of light: the measured observable has a discrete spectrum [4]. The detector is usually custom built for QKD, requires cooling, and expensive, and it is sensitive to stray light. On the other hand, in the CV-QKD weak light is detected by a homodyne detector that measures wave nature of light: the measured observable has continuous spectrum. A homodyne receiver is commercially available, works at room temperature, is low cost and small and insensitive to stray light because the local oscillator (LO) itself works as a spectral, temporal and spatial mode filter. Since both CV-QKD and coherent optical communication exploit devices which operate on the same principle, we may be able to realise a secure and safe communication infrastructure that can offer diverse functions ranging from unconditionally secure communications to high-speed and high-security data transmission in a unified way, and seamlessly integrate them into coherent optical communication systems [12].
However, in terms of security analysis, the security proof of CV-QKD is relatively difficult compared with the discrete variable (DV) QKD that uses a single photon detector. In the case of DV-QKD, one can intuitively understand its safety as follows: if Alice sends only a single photon and Bob detects the photon, an eavesdropper 2. Four-state CV-QKD protocol The protocol we are going to analyse consists of the following eight steps: (i) Alice sends Bob a quantum state Sñ | , which is randomly chosen out of four coherent states i , a a  ñ  ñ | | of a given mode. Here, 0 a > . (ii) Bob performs a measurement on the received state with x-basis or p-basis randomly chosen. Here, we defined the quadratures x a a p a a i 2 , 2 , 1 = + = -( ) † † through the annihilation operator a of the mode A. (iii) Alice and Bob repeat processes (i) and (ii) sufficiently many times. (iv) Alice reveals which basis she used in each process through a classical channel. She also randomly chooses a part of the processes and reveals the state she sent. (v) Bob estimates the parameters of the quantum channel using the data of the processes that Alice revealed her states. Then he selects the data to be used for key generation in accordance with his measurement and the estimated channel parameters. He uses only the processes for which he made a correct choice of the measurement basis. Here, the correct basis refers to the x-basis for a  ñ | , whereas the p-basis for ia  ñ | . Bob informs Alice which process was selected. In the theoretical analysis, we assume that Bob reveals also the absolute value m | |of his outcome m. (vi) Bob makes a bit string by assigning 0 for the negative m, while 1 for the positive m of selected measurement, respectively. (vii) Alice makes a bit string by assigning 0 for Alice and Bob share a secure key by applying error correction and privacy amplification to the bit strings obtained. The efficiency of the postprocessing could be substantially different whether one chooses DR or RR.
The role of the quadrature x, p is clearly symmetric in this protocol. Without loss of generality, therefore, we may restrict ourselves only to the case of the correct measurements that Alice sends the coherent states S a =  and Bob performs the x-basis measurements. Note that the probabilities that S a =  is given by , respectively. Let us assume that quantum channel is not ideal, but characterised by excess noise ξ and transmission η. The probability density to obtain m conditioned by S is given by [30] when the vacuum noise variance is 1/4. Note that It immediately follows from equation (3) that given the absolute value m | |, the protocol can be seen as a binary symmetric channel [31]. To show this, let us define the probability ò that Aliceʼs 0 goes to Bobʼs 1. We then find P m P m P m P m P m P m e 1 , 4 which proves the claim, since from the second equality ò now reads the probability that Aliceʼs 1 goes to Bobʼs 0. Thus, we may use the Shannon formula and find the mutual information I AB between Alice and Bob as ) is the binary entropy. An advantage of this four-state CV-QKD protocol is its implementation simplicity. In step (i), Alice performs one of four kinds of phase modulations and in step (ii), Bob performs one of two kinds of phase modulations. Therefore, only a phase modulator for each station is necessary as an experimental device for modulation, and the required random number is 2 bits for Alice and 1 bit for Bob. In the Gaussian-modulated coherent states CV-QKD protocol [6][7][8][9], Alice needs also an amplitude modulator and two random real numbers, which are not computable in principle and experimentally she needs random bit strings longer than at least the resolution of the digital-to-analogue converters.

Entangling cloner attack
We shall consider the key rate of our protocol against collective attacks assuming that the quantum channel is Gaussian. When the quantum channel is symmetric and Gaussian, all collective attacks are unitarily equivalent [22]. Therefore, in the following we calculate the secret fraction against the entangling cloner attack [21]. Prior to this, we present the details of the entangling cloner attack and evaluate the information accessible by an eavesdropper, say Eve, in this section.
For the entangling cloner attack, Eve prepares an Einstein-Podolsky-Rosen (EPR) state represents the eigenstate of a quadrature operator x of the mode E i with eigenvalue x. The parameter V 1  is chosen in such a way that so as to emulate the noisy quantum channel introduced in the previous section. Eve next replaces the noisy quantum channel with a lossless and noiseless quantum channel followed by a beam splitter of transmission η (see figure 1). She then makes interference between the mode A and E 2 by using the beam splitter. After Alice and Bob make a sufficiently long bit sequence, Eve obtains the information of the sequence by performing a collective measurement on the states coming from E 1 and E 2 modes kept in her quantum memory. Let us describe the attack in detail. Since the coherent state Sñ | can be written as and the beam splitter of transmission η leads to a transformation the state after the interference takes the form of To obtain this, we have changed the variable x in equation ) has the following normalisation: For later convenience, we introduce where i, j=0, 1 and  is a normalisation factor which implicitly depends on i j , . Now, suppose that Bob performs the x-basis measurement to the mode A and find an outcome m. On this situation, Eve has the following two strategies to attack, depending on the reconciliation Alice and Bob adopted: (a) For DR, Eve attacks Alice to estimate her bit. This estimation results in distinguishing In both cases, it is known that the information accessible to Eve is bounded from above by the Holevo quantity χ, which is given by ) denotes the von Neumann entropy. To compute the Holevo quantity χ, we will determine the eigenvalues of all the density matrices appearing in equation (17). Despite all these are infinite dimensional Hermite operators written as a convex combination of projectors not necessarily orthogonal to one another, it is straightforward to find their non-zero eigenvalues by using scaled Gramian matrices, which is defined below.
Given a density matrix p We then find the following proposition.
Proposition 1. All the non-zero eigenvalues of s are identical to all those of the associated Gramian matrix G.
Proof. See [32]. + This proposition reduces the calculation of the Holevo quantity to much milder problems: the eigenvalue problems of the Gramian matrices associated with , Note that, independent of α and η, it holds r , the Gramian matrix is also independent of i and takes the form of where t e e e e e . 2 5 00 10 11 01 2 Note also that, independent of m, it holds The eigenvalues of G in equation (27) can be written as Plugging equations (22) and (26) into equation (17)

Secret fractions
Now we come to the point to evaluate the secret fraction r of the protocol under the entangling cloner attack. Here, the secret fraction r is given by the average of the information difference: Here, the integral is taken over the region where I 0  D . This means that we perform a post-selection to the parameter region where the accessible information of Alice and Bob exceeds that of Eve. This corresponds to the selection in step (v). Note that the joint probability density P m S , ( )satisfies P m S P m S P S P m S , . We also note that  Figure 2 shows the optimised secret fractions in the cases of DR and RR, respectively. In the short distance less than 10 km, these two schemes make not so much difference in the secret fraction. In contrast to this, in a longer-distance, RR clearly yields the better secret fraction than DR, as shown in a CV-QKD with Gaussian modulations [22]. Unlike the secret fraction, however, the associated average photon number in DR shows the similar behaviour to that in RR (see figure 3).
The information difference I D at the optimal case is of interest, since it determines how many measurement outcomes should be chosen by the post-selections. From figure 4, we observe the followings. First, there is at most one non-zero zero point such that I 0 D = in both the schemes. Thus, it turns out that the post-selection should be performed over the outcomes whose absolute values are larger than this zero point. Note that this post-selection scheme is exactly the same as that in [5] introduced so as to reduce the bit error rate of sifted keys. Second, RR requires almost no post-selection in the short distance less than about 20 km for the excess noise 0.02 x = when the error correction is ideal, whereas DR requires post-selection for the several distances we examined. Third, the zero point for DR is in general larger than that for RR. This implies that the former yields the smaller secret fraction, consistent with the direct evaluation of r.  Optimal key rate r for the DR (left) and RR (right). We evaluated the key rate for every 5 km and interpolated them. The key rates shown here have the excess noise 0.005, 0.01, 0.02 x = and decrease as ξ increases. In this section, fibre loss is assumed to be 0.2 dB/km.  In the post-selection process, the quadratures for I 0 D < are discarded. The amplitude α is optimised so as to maximise the secret fraction r. Excess noise is assumed to be 0.02 x = .
After the post-selection, average bit error rate reads q p dm P m dm P m 1 , , , Figure 6 shows clear contrast of the behaviour of q depending on the reconciliation scheme: DR has q 10 2  = -( )at most, whereas RR has q 10 1  = -( ). Thus, we find that to attain the optimal key rate in RR, it is essential to employ an error correction code which works under considerably high bit error rate.
Secure key generation rate N secure is expressed using the secret fraction r by the following equation:

Experimental implementation
In figure 2, we observe that even though RR offers higher secret fraction, when the distance is longer than 30 km, the secret fraction is sensitive to the value of excess noise. However when the distance of a quantum channel is shorter than 20 km, the secret fraction is insensitive to excess noise. This insensitivity relaxes the requirements for the experimental system and makes stable key generation easier. The target of the present implementation is this relatively short-distance operation [33]. Figure 7 shows the schematic of our optical setup. The optical system includes Alice's and Bob's apparatus, and quantum channel. All of components in the optical system including a homodyne receiver are off-the-shelf fibre components and commercially available. We use a DFB laser of 1550 nm wavelength as a light source. Repetition frequency of the light pulse is 10 MHz and the pulse duration is 5 nsec. The optical configuration is a  polarisation and time division multiplexed interferometer. In order to stabilise the relative phase between the signal and LO pulse, we packaged the interferometer part of Alice's and Bob's components with thermal insulation materials. Light pulse from the laser is split by a beam splitter of 1:99 ratio. Weaker light is used as the signal light and stronger light is as the LO. The signal light is randomly phase modulated into one of four states by a phase modulator (PM), then attenuated to an appropriate intensity by a variable optical attenuator (VOA). The signal and LO light enter an optical fibre with orthogonal linear polarisations and also with a time delay of about 50 nsec with each other. Since the polarisation is not maintained in the quantum channel, a polarisation controller (PL) is placed at the entrance of Bob's apparatus. Then, the LO and the signal are split by a polarising beam splitter (PBS). The LO light is randomly phase modulated by a PM: Bob randomly selects xor pmeasurement. Finally, the signal and LO are combined at a half beam splitter, and two outputs incident to two optical paths and reach balanced photo detectors and the quadrature amplitude of the signal light is measured by homodyne detection. Two VOAs in front of photo detectors are used to balance the light intensity of two outputs. Figure 8 shows the schematics of our CV-QKD system. Each station consists of three blocks; the optical system block, a control block, and a personal computer. From the optical block of Alice, quantum signals are sent to Bob, and they are received by the optical block of Bob. The components such as VOAs in optical blocks can be controlled by applying voltages from control blocks. The control blocks contain commercially available FPGA boards with daughter boards that perform Analogue-to-Digital conversion (ADC) and Digital-to-Analogue conversion (DAC) and are used to control the optical components in optical blocks. The FPGA boards operate with a master clock of 100 MHz which is generated by an oscillator. This clock is sent from Alice's block to Bob's block by 1310 nm light using Small Form-factor Pluggable (SFP) modules. The quantum signal and the clock light are transmitted over the same path by wavelength-division multiplexing (WDM). The control blocks are also equipped with ICs for generating random numbers. The random number generator ICs can generate physical random numbers at 1 Mbps. Pseudo-random numbers can be generated by FPGAs for 10 MHz operation. Personal computers (PC) and the FPGA boards are connected by USB cables. The output of the homodyne receiver is recorded by an ADC board connected to a PCI-express bus of the PC. PCs are also equipped with GPU cards to accelerate the software-based post-processing. We use non-binary LDPC code [34]   for error correction (RR) and a fast privacy amplification algorithm using the Toeplitz matrix multiplication [35] (see appendix). Alice's station and Bob's station are enclosed in two 19-inch rack mounts as shown in figure 9. Figure 10 shows the noise characteristics of the commercially available balanced receiver (General photonics, BPD-001-50) used for homodyne detection. In the figure on the left, the variance of the output voltage when the photo detectors are irradiated only by the LO is shown as a function of the average power of the LO light. As the average power of the LO increases, the variance of output voltage increases linearly. This linear dependence indicates that shot-noise-limited homodyne detection is possible using the commercial receiver. When the average power of the LO is 0.1 mW, the shot noise level is about 10 times larger than the dark noise of the receiver.
In the time domain, correlation between measured values of the N-th pulse and the (N + 1)-st pulse was investigated in order to know whether adjacent pulses could be measured independently. In the right of figure 10 we observe an isotropic distribution and the correlation coefficient of the data is less than 0.01, indicating that each pulse light can be independently measured.
In figure 11, typical distributions of the voltage output of the homodyne receiver for four kinds of relative phase between the signal and LO are shown in a semi-log scale. We can see that these distributions are well represented by Gaussian distribution. The average values of the amplitude m for 90 and 270 degrees data are almost zero, and those for 0 and 180 degrees data are plus and minus values, respectively.

Automated operation of CV-QKD system
In the key generation operation, Alice sends 10 6 pulses at a time and a half of them is used for the parameter estimation: In the parameter estimation, the mean values and variances of the measurement results for four  kinds of relative phases are calculated. From these values, excess noise and transmissivity of the quantum channel can be evaluated. In addition, the relative phase offset between the signal and the LO is obtained and this offset value is used to stabilise the phase offset. At present, this procedure can be repeated every 0.3 seconds; the repetition time is limited by the transfer time of random numbers from Alice's FPGA board to Alice's PC through a USB cable. By improving the transfer rate, three times faster operation will be possible.

Optical phase tracking
The optical system shown in figure 7 is basically a Mach-Zehnder interferometer. The relative phase between the signal and LO should be kept stable with higher accuracy than the wavelength of the light. Especially in the case of CV-QKD, the relative phase variation must be made very small in order to keep excess noise small.
The relative phase offset between the signal and LO can be estimated relatively easily in four-state CV-QKD. In figure 12, the effect of phase offset is schematically shown. Let be the average value of the measured voltage for the relative phase ) . This phase offset value is fed to the voltage of the phase modulator in Bob's optical box. Typical phase fluctuation after stabilisation is 0.05 radian. Excess noise can be kept less that 0.02 for most of the time. When the phase offset is suddenly increased, such data are discarded.

Real-time key generation
In a real operation, it is necessary to take account the efficiency of the error correction in the secret fraction. When the error correction efficiency f is not unity, the mutual information between Alice and Bob is given as Then the secret fraction is modified to r dm P m I , where I I AB c D ¢ = ¢and the integral is taken . The compression factor of the classical post-processing, r comp , is defined as the Figure 11. Histogram of homodyne detected signal amplitude for four kinds of relative phase between the signal and the LO.  Table 1 shows numerical examples of the post-selection rate and the compression factor. In this numerical calculation, the channel loss is 0.2 dB/km, the error correction efficiency is f=1.3, and the signal photon number 2 a | | is optimised. Figure 13 shows an example of key generation results. This is the data when the CV-QKD system was installed in the NICT facility and connected to the Tokyo QKD network [36,37]. The quantum channel is a 10 km optical fibre. Sift key rate is about 300 kbps and secure key rate is about 50 kbps.
We performed RR using non-binary LDPC code [34]. The error correction efficiency parameter was set to be 1.3 although the code can operate stably even when the f parameter is 1.08 and error rate is 0.15. The speed of error correction is about 300 kbps per thread using a GPU (GTX 680). Privacy amplification was performed by Toeplitz matrix multiplication [35]. Its calculation complexity can be reduced to O n n log ( )for an input length n by exploiting the FFT algorithm.
In an automated operation, the compression factor is calculated by using a linear approximation function for numerical calculation shown in table 1, that gives the compression factor as functions of transmissivity and excess noise. Here we assume that Eve cannot control Bob's receiver which has optical loss and excess noise. We also assume that Eve's knowledge about the sift key when Bob has an ideal receiver is smaller than her knowledge about the sift key when Bob uses a lossy and noisy receiver because in the RR Eve has to infer lossy and noisy signal in the latter situation. Under these assumptions, the Holevo quantity in the former situation, χ, should be larger than that in the latter situation, c¢: In addition, we assume that the mutual information between Alice and Bob in the latter situation, H AB ¢ , is larger than that in the former situation, H AB : This assumption on mutual information can be satisfied when the error rate in the latter case (actual experiment) is set be smaller than that in the former case (ideal calculation) by increasing the threshold of post-selection. When equations (39) and (40) are satisfied, the following equation holds;  Figure 13. Automatic key generation by our CV-QKD system that employs the four-state CV-QKD protocol and reverse reconciliation. The CV-QKD system was installed in the NICT and connected to the Tokyo QKD network. The quantum channel is a 10 km optical fibre. As explained in appendix C of [35], a multiplication of a square Toeplitz matrix and a vector can be performed by three calculations, i. e., two discrete Fourier transforms (DFT), a convolution and an inverse Fourier transform.
Since the complexity of a DFT is O n n log ( )using the FFT algorithm and the complexity of convolution is O(n), the total complexity of the multiplication is O n n log ( ). Figure 14. Schematics of reverse reconciliation by asymmetric coding.