Proof-of-principle experimental realization of a qubit-like qudit-based quantum key distribution scheme

In comparison to qubit-based protocols, qudit-based quantum key distribution (QKD) ones gen- erally allow two cooperative parties to share unconditionally secure keys under a higher channel noise. However, it is very hard to prepare and measure the required quantum states in qudit-based protocols in general. One exception is the recently proposed highly error tolerant qudit-based proto- col known as the Chau15 [1]. Remarkably, the state preparation and measurement in this protocol can be done relatively easily since the required states are phase encoded almost like the diagonal basis states of a qubit. Here we report the first proof-of-principle demonstration of the Chau15 protocol. One highlight of our experiment is that its post-processing is based on practical one-way manner, while the original proposal in Ref. [1] relies on complicated two-way post-processing, which is a great challenge in experiment. In addition, by manipulating time-bin qudit and measurement with a variable delay interferometer, our realization is extensible to qudit with high-dimensionality and confirms the experimental feasibility of the Chau15 protocol.


Introduction.
Quantum key distribution (QKD) allows two distant peers Alice and Bob to share secret key bits through a quantum channel which is accessed by a malicious eavesdropper Eve [2,3]. In a typical QKD protocol, Alice encodes random classical bits into quantum states, and sends them to Bob, who measures the incoming quantum states to decode Alice's classical bits. Then by classical communications and random sampling, Alice and Bob can obtain raw key bits, whose error rate can be also estimated. Finally, by classical post-processing, Alice and Bob can generate secret key bits. The most commonly used QKD protocol is the Bennett-Brassard 1984 (BB84) protocol [2] combined with the decoy states method [4][5][6]. In the past decade, tremendous progresses in experimental decoy states BB84 have been achieved [7][8][9][10][11][12][13]. Lately, several novel QKD protocols have been proposed [1,[14][15][16]. Among these protocols, measurement-device-independent (MDI)-QKD [14] is immune to all detector-side-channel attacks and have been proven to be a feasible QKD scheme [17][18][19][20][21]. And the round-Robin-differentialphase-shift (RRDPS) protocol features that monitoring signal disturbance can be bypassed [16], thus becomes another hot topic. In the RRDPS protocol, Alice has to prepare trains of pulses each consisting of L pulses. In the simple case that each train contains only one photon, the secret key rate R of the RRDPS protocol in the one-way classical communication setting equals where e bit is the bit error rate of the raw key [16]. In other words, the RRDPS protocol can tolerate much higher bit error rate of the raw key than the BB84 protocol when L is sufficiently large. However, implementing the RRDPS protocol for large L posts a great experimental challenge. In spite of the experimental difficulty, several experimental demonstrations of RRDPS protocol have been reported [22][23][24][25].
Inspired by the RRDPS protocol, Chau recently proposed a novel QKD protocol [1], called the Chau15 protocol, which can tolerate very high error rate and has a simpler implementation than the RRDPS protocol. In the Chau15 protocol, for each trial Alice randomly picks two distinct numbers i, j from the set {1, . . . , L} and a raw key bit k ∈ {0 ≡ +, 1 ≡ −}, then prepares a quantum state ψ ± ij = (|i ± |j )/ √ 2 according to the value of k used. That is to say, Alice encodes each raw bit in the phase between the two time bins |i and |j . Alice sends ψ k ij to Bob, who then randomly picks two distinct numbers m, n in {1, . . . , L} and measures the incoming photon along {|ψ ± mn }. Bob records his raw key bit as 0 or 1 according to the measurement result should the detector clicks. Repeating above steps for sufficient times, Alice and Bob an-nounce their i, j and m, n for each trial and only retain the raw key bits correspond to the cases that {i, j} = {m, n} as their sifted key bits. In Ref. [1], Chau proved that secret key bits can be generated when the error rate of sifted key bits is very high. It is remarkable that this scheme can tolerate up to 50% error rate provided that L = 2 p for some integer p 2.
It is instructive to realize the Chau15 protocol experimentally. One challenge is that one must prepare and measure certain high-dimensional quantum states, namely, qudits, in the Chau15 protocol although preparing and measuring these special qudit states are less complicated that those for a general qudit state. Another challenge is that the two-way classical communication post-processing method reported in Ref. [1] is both rather complicated and of low yield. Here, we first present a new security proof of the Chau15 protocol based on standard one-way communication plus a simple secret key rate formula for any integer L 4 rather than only for L in the form 2 p . Then, we report a proof-of-principle experimental demonstration of the Chau15 protocol. In this experiment, we encode the qudit based on quantum superposition of time-bin and measurement is performed with the help of a variable delay interferometer [24]. As far as we know, this is the first experiment of the Chau15 protocol.
Security proof of the Chau15 protocol for arbitrary L 4 with one-way communication. We first consider the case of an ideal single photon sourceand ideal detectors. Since the protocol is permutationally symmetric, quantum de Finetti theorem [26] implies that we only need to consider the security under Eve's general collective attack in the form where |E ij is the quantum state of Eve's ancilla, {|E ij } is a set of basis for Eve's ancilla, E ij |E il = δ jl . Without loss of generality, we assume c ij 0 and N j=0 c 2 ij = 1. Denote the probability that Bob obtains |ψ ± mn conditioned on the facts that Alice prepares her state as ψ ± ij and Bob tried to project the state along |ψ ± mn by p(m, n|i, j). In other words, p(m, n|i, j) is the chance that a quantum state in Hilbert space spanned by {|i , |j } is transformed into a space spanned by {|m , |n }.
In the Supplemental Material, we show that Eve's information on all sifted key bits is given by ). (2) For easy use by experimentalists, we define the mean Finally, the secret key rate per sifted key bit is given by where E is the bit error rate of the sifted key bit. We remark that our asymptotic bound of I AE holds even when (i, j) is biased distributed. As long as the probability for Bob to measure any one of the (i, j) pairs is non-zero, we could then estimate p(m, n|i, j) to arbitrarily good precision given a sufficiently long key [27]. With the help of decoy states [4][5][6], this security proof can be adepted in real-life implementations with weak coherent sources. And in the Supplementary Material, we extend our analysis to the case of finite key length with decoy states. Experimental setup and results. We performed the experiment using the setup in Fig. 1. Alice consists of a continuous wave (CW) laser at 1550.12 nm, three intensity modulators (IM) and two phase modulators (PM). IM 1 modulates the CW light into a coherent pulse train with a temporal width of 96 ps and a repetition rate of 1 GHz. IM 2 chops this pulse train into packets of 5 time slots (5 ns), in which only two random pulses indexed by i and j (i, j ∈ {1, 2, 3, 4, 5} and i < j) are allowed to pass. IM 3 is employed to implement the decoy states method [4][5][6], in which each packet is randomly modulated into signal, de-coy1, or decoy2 states. PM 1 encodes key bits by modulating phase {− π 2 , π 2 } on pulses for each packet, and PM 2 adds random global phase on each packet. Finally, the variable attenuator (VA) attenuates the average photon numbers per packet to the single photon level. The output quantum state prepared by Alice can be expressed as |ψ ij = (|i + e iφ |j )/ √ 2, where φ ∈ {0, π} is the phase difference between the ith and jth pulses.
Bob mainly consists of a 1 GHz, 1 − 4 bit variabledelay Faraday-Michelson interferometer (FMI) and a double-channel single-photon detector (SPD). By setting the delay to r, the variable-delay FMI makes the ith pulse interfere with the jth pulse if j = i + r. Two channels of the SPD are connected to each of the output ports of the FMI, and which channel records a detection event depends on the phase difference φ. Through recording a click event in the interference slot, Bob fulfills the quantum projection into ψ ± ij . To realize the variable-delay interferometer, the same structure as in Ref. [24] is employed here. Each of the two arms of this interferometer has two fiber delays, and the delay is chosen by a bidirectional NanoSpeed 1 × 2 optical switch (OS). The arm with the {0, 1} delays is named the short arm, and the arm with the {2, 4} delays is named the long arm. The chosen delays of the long and short arms are denoted as x ∈ {2, 4} and y ∈ {0, 1} respectively. Then, the delay of the interferometer is r = x−y. In total, the variable-delay FMI can achieve fast switch among 1−4 ns delay values. The piezoelectric transducer (PZT) cylinder wrapped with 2 m fiber was used to obtain high precision of each delay, and also to compensate the phase shift of the interferometer. The insertion loss (IL) of the interferometer (including the IL of the circulator) is about 2.0 dB, and the values of each delay are almost the same. This variable-delay interferometer is polarization insensitive owning to Faraday mirrors and features an average extinction ratio of 23 dB.
Photons from the variable-delay FMI were detected by the double-channel SPD, and finally recorded by a time-to-digital converter (TDC). Both channels of SPD are based on InGaAs/InP avalanche photodiodes and employ the sine-wave filtering method [28]. The first channel features a detection efficiency of 22.1% (down to 20.8% if including 2 → 3 IL of CIR), a dark count rate of 1.5 × 10 −6 per gate, and after-pulse probability of 0.8%. The second channel features a detection efficiency of 20.9%, a dark count rate of 1.1×10 −6 per gate, and after-pulse probability of 1.1%. The TDC not only recorded signals but also set measurement time window. The value of the time window was set to 800 ps during the experiment, and this setting reduced the average effective detection efficiency of two channels of the SPD to 20.4%, while the total dark count was just a little less than 2.6 × 10 −6 per gate.
Based on the experimental parameters listed above, the performance of Chau15 system was estimated and all parameters were optimized by maximizing the secret key rate. Setting the intensity and probability of one signal (µ) and two decoy states (ν 1 and ν 2 ) close to the optimal ones, we measured the mean yield Q and Q ′ , and error rate of the signal state E µ at four fiber lengths: 50, 100, 130 and 150 km. When Alice prepares laser pulse at time slots i and j, Bob gets the mean yield Q = i<j p(i, j|i, j)/ 5 2 if he also gets interference output between these two time slots, and Bob gets the mean yield Q ′ = i<j,m<n p(m, n|i, j)/ ( 5   2   3 2 ) if he obtains interference output between time slots m and n (m, n = i, j). The experimental results are listed in Table I. The last set of data over 50 km length fiber is obtained in high error rate case, which may happen in the ultrahigh speed case or harsher environment. In the experiment, we intentionally distorted the modulating signal on P M 1 to get error rate over 20%.
Secret keys can still be extracted at a transmission distance of 150 km in the asymptotic case (R inf when Alice sends infinite packets), which is comparable with the commonly used BB84 protocol. The secret key rate per packet is at 10 −3 level over 50 km length fiber, which is lower than BB84 protocol, but if the biased-basis method was employed in Chau15 protocol, its secret key rate is also comparable with BB84 in the asymptotic case. When the error rate exceeds 20%, Chau15 protocol can still get secret key rate at 10 −5 level over 50 km length fiber. Therefore, Chau15 protocol can outperform BB84, especially in the high error rate case. And, Chau15 protocol can also outperform RRDPS. The maximum transmission distance of the L = 5 RRDPS experiment system is less than 50 km using superconducting SPDs [23], while in our L = 5 Chau15 system, the transmission distance could reach 150 km with InGaAs/InP SPD. The tolerant error rate of the L = 65 RRDPS experiment system with the weak coherent source is less than 17% [24], while TABLE I. Experimental results. The length of fiber (l), intensity (Int.) and probability (P ) of one signal (µ) and two decoy states (ν1 and ν2), the mean yield (Q and Q ′ ), error rate of the signal state (Eµ), and the secret key rate per packet(R inf for infinite packet number and R f for finite packet number). The last set of data over 50 km fiber is obtained in high error rate case. The total number of packets sent from Alice is N = 3 × 10 11 , the failure probability is set to be 10 −10 , and parameters are optimized. the value can exceed 20% in Chau15 system even L = 5. These results verified that Chau15 protocol has good comprehensive performances on maximum transmission distance, secret key rate and tolerant error rate with small L.
Nevertheless, the secret key rate per second of our proof-of-principle experimental realization is limited by the optical switch, whose switching speed in the setup is about 100 ns. This limitation can be overcame by employing the passive scheme based on 1 × (L − 1) BS (just like [23]), or slow basis choice method [29], or the development of optical switch techniques in the near future.
Another difficulty to overcome is to obtain relatively small yield Q ′ , which plays an important role to estimate Eve's information (see Eq. (3)). The smaller Q ′ Bob measures, the more key rate Alice and Bob can share. Under ideal conditions, the yield Q ′ should be equal to the dark count of the SPD. However, the experimental results show that the yield Q ′ is larger than the dark count rate of the SPD, especially at short transmission distance. To offer an intuitive impression, we define the count ratio C m as the count at time slot i to the count at time slot m = i, j for the output packets from Alice. Q ′ can be evaluated by the mean value of C m . The sources contributing to relatively large Q ′ mainly include the limited extinction ratio of IM 2 , the dark count, after pulses and time jitter of the SPD. Therefore, Bob's SPD (without interferometer) is employed to directly measure the outputs of Alice. Four kinds of typical outputs with i = 1 (12, 13, 14, and 15) are shown in Fig. 2, the time window of TDC is not set for this measurement. The worst case corresponds to the outputs of j = i + 2. Taking 13 output of Alice for example, the count ratio C 2 is only 280.
Conclusion. In summary, we developed a security proof for the Chau15 protocol with one-way postprocessing, which facilitates the secret key generation in real-life situation. In our experiment, the qubit-like qudits are prepared by manipulating timebin of photon and measured by a variable delay interferometer. Our demonstration exhibits the fine feasibility and high error-rate tolerance of the novel Chau15 protocol and sheds light on QKD experiments with high-dimensionality.