200km Decoy-state quantum key distribution with photon polarization

We demonstrate the decoy-state quantum key distribution over 200 km with photon polarization through optical fiber, by using super-conducting single photon detector with a repetition rate of 320 Mega Hz and a dark count rate of lower than 1 Hz. Since we have used the polarization coding, the synchronization pulses can be run in a low frequency. The final key rate is 14.1 Hz. The experiment lasts for 3089 seconds with 43555 total final bits.


Introduction
Compared with the existing classical private communication methods, quantum key distribution (QKD) is believed to have the special advantage of unconditional security. Since Bennett and Brasard [1] proposed their protocol (the so called BB84 protocol) QKD has now been extensively studied both theoretically [1][2][3][4][5][6][7][8][9][10][11][12][13][14] and experimentally. The central issue of QKD in practice is its unconditional security. The real set-up can actually be different from the assumed ideal case in many aspects. For example, the existing real set-ups use an imperfect singlephoton source with a lossy channel, which is different from the assumed ideal protocol where one can use a perfect single-photon source. Therefore, the security is undermined by the photonnumber-splitting attack [9,10]. Fortunately, there are a a number of methods [4,5,[11][12][13][14][15][16][17][18][19][20][21][22][23][24] can be used to overcome the issue in practical QKD where we only use the imperfect source. The ILM-GLLP proof [5,6] has shown that if we know the upper bound of fraction of the multiphoton counts (or equivalently, the lower bound of single-photon counts) among all raw bits, we still have a way to distill the secure final key. Verifying such a bound is strongly non-trivial. One can faithfully estimate such bounds with the decoy-state method [4,[11][12][13][14] Different realizations of BB84 protocol may have different technical advantages and disadvantages. For example, polarization coding has its advantage in passively switching the measurement basis, while optical fiber based QKD can be directly developed for a network secure private quantum key distribution [34]. However, photon polarization may change significantly over long distance transmission through an optical fiber. Robust polarization transmission in optical fiber has been achieved by optical compensation [26,39].
Here we report our new experimental result with photon polarization transmitted by optical fiber, over a distance of 200km. Our result here has kept the advantages of polarization coding and optical-fiber based photon transmission as our earlier result [26], but has reached a longer secure distance by using superconducting detectors. Also, as shown below, together with a superconducting detector, the polarization coding can have one more advantage in the synchronization. In principle, the synchronization pulses are not necessary in our system if one has a very precise local clock at the detection side.

Polarization coding, superconducting detector, and synchronization
In a BB84 protocol [1], there is a sender, Alice and a receiver, Bob. Besides sending Bob the weak coding pulses of BB84 states, Alice also sends Bob synchronization pulses as a clock, so that Bob can know the position of each of his detected results. In principle, the synchronization pulses do not have to be run in the same frequency with the weak coding pulses. For example, if Bob has a very precise clock, they don't need the high frequency synchronization pulses in the whole protocol. However, in all existing real set-ups, even we have such an expensive clock, the high frequency synchronization is still necessary because they are needed in measurement, if we use phase coding or if we use the gated mode for the single photon detector.
Consider a system using phasing coding first. There, the signal detection at Bob's side is done actively. Immediately before the detecting each individual signals, an active phase shift is taken to the signal pulse, which works as the random selection of measurement basis. In such a system, each individual signal pulse must be accompanied by a synchronization pulse as a clock so that the phase shift can be done at the right time. Second, consider a system with normal single-photon detectors, using either phase coding or polarization coding. In this case, normally the detector is run in a frequency of a few Mega Hertz. The detector has to be run in a gated mode, otherwise there will be too many dark counts and no final key can be distilled out. Such a gated mode also requires each coding signal be accompanied by a synchronization pulse so that the detector is gated at the right time window in detecting each coding signal.
The situation is different if one uses polarization coding with a superconducting detector. First, the detector's repetition rate is so high that it can be run in the always-on mode rather than the gated mode. Second, unlike the case of phase coding, photon polarization detection is done passively. There is no active operation on each signal. Therefore, in principle, in such a case, the synchronization pulses are not necessary in the system, if one has a very precise local clock. A very precise local clock is technically difficult and expensive. However, the existing economic local clock technology can run rather precisely in a short period. This allows one to make the synchronization block by block, given such a simple local clock at Bob's side. Say, one needs only one synchronization pulse for a block of (many) signals.

Our set-up
Our set-up is shown schematically in Figure 1. Two sides, Alice and Bob are linked by 200 km optical fiber. Decoy pulses of BB84 polarization states are sent to Bob through the optical fiber. They are detected at Bob's side by superconducting single-photon detectors.

Source
We use the weak coherent light as our source. The main idea of the decoy-state method is to change intensities randomly among different values in sending out each pulses. Here we change the intensity of each pulses among 3 different values: 0, 0.2, 0.6, which are called vacuum pulse, decoy-pulse, and signal pulse, respectively. Alice's probabilities of sending a vacuum pulse, a decoy pulse and a signal pulse are 1:1:2 . The experiment lasts for 3089 seconds.
As shown in Fig.1, the coherent light pulses in our experiment are produced by 8 diodes which are controlled by 4-bit random numbers random numbers. The first two bits of a random number determines whether to produce a vacuum pulse, a decoy pulse, or a signal pulse. In particular, if they are 00, none of the diode sends out any pulse, i.e., a vacuum pulse is produced; if they are 01, one of the 4 decoy diodes in the figure produces a decoy pulse; if they are 10 or 11, one of the 4 signal diodes in the figure produces a signal pulse. The last 2 bits of the 4-bit random number decides which of the 4 diodes is chosen to produce the pulse (If the first two bits are not 00 ). The light intensities are controlled by an attenuator after each diodes, 0.2 for the decoy pulse and 0.6 for the signal pulse. Each diodes will produce only one polarization from the 4 BB84 states, i.e., the horizontal, vertical, π/4, 3π/4. Polarization maintaining beam splitters (PMBS) are used to guide pulses from the decoy diode and the signal diode in the same polarization block into one PMBS. Two polarization maintaining polarization beam splitters are used to guide pulses from all diodes to one optical fiber. The fidelity of our polarization states is larger than 99.9%. The Pulses produced by the laser diodes first passes through a polarization maintaining beam-splitter (BS), then a polarization beam splitter (PBS) and then combined by

Detection
The circuit at Bob's side is is a standard design of BB84 detection. Four super-conducting single-photon detectors are used to detect signals. These detectors are made by Scontel company in Russia. We have set the environmental temperature lower than 2.4k. The dark count rate of each detectors is smaller than 1 Hz and the detection efficiency of 3 of them is larger than 4%, one of them is larger than 3%.

Clock
The 40k Hz synchronization pulses are originated from the 320M Hz clock which drives a laser diode to produce synchronization pulses. In order to observe the detect the synchronization pulses at Bob's side which is linked to Alice by 200 km optical fiber, a semiconductor optical amplifier is inserted at the point of 100 km, amplifying the intensity of optical pulses by 100 before transmission over the second half of the optical fiber. At Bob's side, a photon-electrical detector is used to recover the synchronization pulses. Both the synchronization pulses and the electrical signal from the superconductor detector are sent to a time-to-digit convertor (TDC) which works as an "economic local clock".

Calculation of the final key
The secure final keys can be distilled with an imperfect source given the separate theoretical results from Ref. [5]. We regard the upper bound of the fraction of tagged bits as those raw bits generated by multiphoton pulses from Alice, or equivalently, the lower bound of the fraction of untagged bits as those raw bits generated by single-photon pulses from Alice. In Wang's 3-intensity decoy-state protocol [12], Alice can randomly use 3 different intensities (average photon numbers) of each pulses (0, µ, µ ′ )as the vacuum pulses, decoy pulses and signal pulses. Alice produce the states by different intensities in Eq.1. Here µ n n! |n n|,ρ d is a density operator, and d > 0(here we use the same notation in Ref. [12]. In the protocol, Bob records all the states which he observed his detector click. After Alice sent out all the pulses, Bob announced his record. Then they known the number of the counts C 0 , C µ , C µ ′ which came from different intensities 0, µ, µ ′ . N 0 , N µ , N µ ′ are the pulse numbers of intensity 0, µ, µ ′ which Alice sent out. The counting rates (the counting probability of Bobs detector whenever Alice sends out a state) of pulses of each intensities can be calculate S 0 = C 0 /N 0 , S µ = C µ /N µ and S µ ′ = C µ ′ /N µ ′ , respectively. We denote s 0 (s ′ 0 ), s 1 (s ′ 1 ) and s c (s ′ c ) for the counting rates of those vacuum pulses, singlephoton pulses, and ρ c pulses from ρ µ (ρ µ ′ ). Asymptotically, the values of primed symbols here should be equal to those values of unprimed symbols. However, in an experiment the number of samples is finite; therefore they could be a bit different. The bound values of s 1 , s ′ 1 can be determined by the following joint constraints equations: to obtain the worst-case results [12]. Given these, one can calculate s 1 , s ′ 1 , s c numerically. In the experiment, Alice totally transmits about N pulses to Bob. After the transmission, Bob announces the pulse sequence numbers and basis information of received states. Then Alice broadcasts to Bob the actual state class information and basis information of the corresponding pulses. Alice and Bob can calculate the experimentally observed quantum bit error rate (QBER) values E µ , E µ ′ of decoy states and signal states according to all the decoy bits and a small fraction of the signal bits, respectively. Since we exploit E µ and E µ ′ from finite test bit, the statistical fluctuation should be consider to evaluate the error rate of the remaining bit.
L p µ ′ (µ) is the proportion of the test bits for the phase-flip test in single states (decoy state). Then we can numerically calculate a tight lower bound of the counting rate of single-photon s ′ 1 using Eq. (2). The next step is to estimate the fraction of single-photon ∆ 1 and the QBER upper bound of single-photon E 1 . We use to conservatively calculate ∆ 1 of signal states and decoy states, respectively [12]. And E 1 of signal states and decoy states can be estimated by the following formula: Here we consider the statistical fluctuations of the vacuum states to obtain the worst-case results. Lastly, we can calculate the final key rates of signal states using the following formula [12]: In the experiment, the pulse numbers ratio of the 3 intensities 0, µ and µ ′ is 1:1:2 and the intensities of signal states and decoy states are fixed at µ ′ = 0.6 and µ = 0.2, respectively. The numbers of the counts from 0, µ anf µ ′ are 3263, 77157 and 449467. We calculate the experimentally observed QBER values E µ , E µ ′ of decoy states and signal states are 4.0426%, 1.964%. The experiment lasts for T = 3089 seconds. We use L p µ ′ = L p µ = 10% for phase-flip test, and L b µ ′ = L b µ = 5% for bit-flip test. The experimental parameters and their corresponding values are listed in Table 1. After calculation, we obtain a final key rate of 11.8 bits/s for the signal states (intensity µ ′ = 0.6) and a final key rate of 2.9 bits/s for the decoy states (intensity µ = 0.2).

Concluding remarks
In summary, with a superconducting detector, we have demonstrated a decoy-state QKD over 200km distance in polarization coding and optical fiber. In our experiment, the synchroniza-tion system is significantly simplified. In principle, the frequent synchronization pulses are not necessary in our set-up if one has a very precise local clock.